Amazon EKS — SSL/TLS Termination

less than 1 minute read

SSL/TLS Termination

Production applications need HTTPS. EKS integrates with AWS Certificate Manager (ACM) for free, auto-renewing SSL/TLS certificates.

HTTPS with ALB + ACM

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: secure-app
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:123456789012:certificate/abc-123
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-redirect: "443"
spec:
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80

How It Works

SSL/TLS Termination
┌─────────────────────────────────────────────────┐
│                                                 │
│  User ──HTTPS──▶ ALB ──HTTP──▶ Pod             │
│  (encrypted)      │ (decrypts) (unencrypted)   │
│                   │                             │
│                   ├── ACM certificate           │
│                   ├── Auto-renewal              │
│                   └── Free!                     │
│                                                 │
└─────────────────────────────────────────────────┘

Request ACM Certificate

$ aws acm request-certificate \
    --domain-name "*.example.com" \
    --validation-method DNS \
    --subject-alternative-names "example.com"

HTTP → HTTPS Redirect

Add this annotation to automatically redirect HTTP to HTTPS:

alb.ingress.kubernetes.io/ssl-redirect: "443"
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'

Common Mistakes

Mistake Impact
ACM cert in wrong region ALB can’t find certificate
Not validating ACM certificate Stays in PENDING_VALIDATION forever
Missing HTTP redirect Users access insecure HTTP
Certificate for wrong domain Browser shows security warning

What’s Next?

Advanced routing patterns: Advanced Routing.

You may also enjoy