I've been trying to test out Kubernetes on Google Cloud, but would need HTTPS/TLS (only) exposed on the deployed application. To start, I just followed this tutorial, which worked fine for plain HTTP over port 80: https://cloud.google.com/kubernetes-engine/docs/quickstart

To get TLS support working with Let's Encrypt, I've tried (without success):

... Does anyone have any suggestions on how to serve just HTTPS for the original tutorial? No need for plain HTTP unless it's a freebie, but I'm really scratching my head on this one since I haven't worked with Kubernetes before and I haven't been able to get Let's Encrypt working at all here.

  • have you considered using a tiny VM as a load balancer running Traefik? It supports Let's Encrypt renewal without any effort and costs a little less than Google's load balancer. A lot of good info here: estl.tech/…
    – sippybear
    Oct 10, 2018 at 21:03
  • @sippybear Nice article! One issue with using a VM is that it’s linked to the cluster’s ephemeral IP.
    – Ben Guild
    Oct 11, 2018 at 0:07

2 Answers 2


So, it turns out that you can just add TLS directly on the load balancer now, and it'll issue a Let's Encrypt certificate automatically. This is doable via Cloud Console:

Let's Encrypt issued on GCP LB

No clue why this isn't more well-known.

  • Nice, probably newly added functionality. You should accept your answer so people know you've found a good solution!
    – sippybear
    Oct 11, 2018 at 17:11

You can follow the instructions here to create a Kubernetes Ingress with a Google managed certificate. At a high level, this involves two stpes:

  1. Create a ManagedCertificate resource (this is a beta feature in GKE)
  2. Use the networking.gke.io/managed-certificates annotation in your Ingress manifest to point to the managed certificate created in step 1

Google will automatically create a certificate for you using one of two CAs. If you're adamant on using Let's Encrypt, you can add a CAA record to your DNS zone as follows:

your_domain. CAA 0 issue "letsencrypt.org"

Alternatively, if your app is already up and running in GKE and sitting behind an existing Global HTTP Load Balancer, you can follow the instructions here to add a Google managed certificate to your load balancer. The end result is essentially the same regardless of which method you use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.