Certificate Discovery

TLS certificates for ALB Listeners can be automatically discovered with hostnames from Ingress resources if the alb.ingress.kubernetes.io/certificate-arn annotation is not specified.

The controller will attempt to discover TLS certificates from the tls field in Ingress and host field in Ingress rules.

You need to explicitly specify to use HTTPS listener with listen-ports annotation.

Discover via Ingress tls

Example

• attaches certs for www.example.com to the ALB

  apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
  namespace: default
  name: ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
  spec:
    tls:
    - hosts:
      - www.example.com
    rules:
    - http:
        paths:
        - path: /users/*
          backend:
            serviceName: user-service
            servicePort: 80
  

Discover via Ingress rule host.

Example

• attaches a cert for dev.example.com or *.example.com to the ALB

  apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
  namespace: default
  name: ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
  spec:
  rules:
  - host: dev.example.com
    http:
      paths:
      - path: /users/*
      backend:
        serviceName: user-service
        servicePort: 80