Certificate Discovery¶
TLS certificates for ALB Listeners can be automatically discovered with hostnames from Ingress resources if the alb.ingress.kubernetes.io/certificate-arn
annotation is not specified.
The controller will attemp to discovery TLS certificates from the tls
field in Ingress and host
field in Ingress rules.
You need to explicitly specify to use HTTPS listener with listen-ports annotation.
Discover via Ingress tls¶
Example
- attaches certs for
www.example.com
to the ALBapiVersion: extensions/v1beta1 kind: Ingress metadata: namespace: default name: ingress annotations: kubernetes.io/ingress.class: alb alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' spec: tls: - hosts: - www.example.com rules: - http: paths: - path: /users/* backend: serviceName: user-service servicePort: 80
Discover via Ingress rule host.¶
Example
- attaches a cert for
dev.example.com
or*.example.com
to the ALBapiVersion: extensions/v1beta1 kind: Ingress metadata: namespace: default name: ingress annotations: kubernetes.io/ingress.class: alb alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' spec: rules: - host: dev.example.com http: paths: - path: /users/* backend: serviceName: user-service servicePort: 80