title: Deploy Kong API Gateway in GKE via Helm and use Google managed certificates
body: <p>We're currently trying to deploy Kong in a GKE cluster and the goal is to delegate the certificate management to Google's Load Balancer (the SSL termination should be made here).</p>
  <p>The problem we faced is that all Google's documentation is focus on deploying some service and use their exclusive Load Balancer that connects directly to the Ingress declared.</p>
  <p>The configuration which currently works (without Kong) is the following:</p>
  <pre><code># values.yml (from Service X inside GKE, using Helm)
  ...
  ingress:
    enabled: true
    hostname: example.com
    annotations:
      kubernetes.io/ingress.class: gce
      kubernetes.io/ingress.allow-http: &quot;false&quot;
      kubernetes.io/ingress.global-static-ip-name: example-static-ip
      ingress.gcp.kubernetes.io/pre-shared-cert: example-cert
  ...
  </code></pre>
  <p>However, when we change <code>gce</code> for <code>kong</code> as the ingress.class, all other annotations don't continue to work. This is expected, as now Kong's proxy is the one being the <em>Load Balancer</em> and should be the one that tells Google's LB how to generate itself.</p>
  <p>According to this <a href="https://v1-18.docs.kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws" rel="nofollow noreferrer">documentation</a>, it should be fairly simple to add those annotations to Kong proxy service.</p>
  <p>Based on this chain of events:</p>
  <ul>
  <li>K8s Ingress creates Kong proxy service</li>
  <li>Kong proxy service generates Google's LB</li>
  </ul>
  <p>The configuration to customize the LB should be made inside Kong's service (as I understand):</p>
  <pre><code># values.yml (Kong, using Helm)
  ...
  proxy:
    type: LoadBalancer
    annotations: {} &lt;-- Here
    http:
      ...
    tls:
      ...
  ...
  </code></pre>
  <p>However, for GCP there are only a few according to the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/load-balance-ingress#summary_of_external_ingress_annotations" rel="nofollow noreferrer">docs</a>, and none of them have the desire effect (cannot set certificate to use, define which type of LB to create, etc.)</p>
  <p>All things into account, is there any way to achieve our main goal which would be:</p>
  <p><em>&quot;Deploy Kong API Gateway through Helm inside GKE and delegate SSL termination to custom Google's LB.&quot;</em></p>