This is a cache of https://docs.openshift.com/container-platform/4.17/networking/networking_operators/aws_load_balancer_operator/add-tls-termination.html. It is a snapshot of the page at 2024-11-30T06:40:30.291+0000.
Adding TLS termination - Networking Operators | Networking | OpenShift Container Platform 4.17
    OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history bug_report picture_as_pdf
×

Adding TLS termination

You can add TLS termination on the AWS Load Balancer.

Adding TLS termination on the AWS Load Balancer

You can route the traffic for the domain to pods of a service and add TLS termination on the AWS Load Balancer.

Prerequisites

  • You have an access to the OpenShift CLI (oc).

Procedure

  1. Create a YAML file that defines the AWSLoadBalancerController resource:

    Example add-tls-termination-albc.yaml file
    apiVersion: networking.olm.openshift.io/v1
kind: AWSLoadBalancerController
metadata:
  name: cluster
spec:
  subnetTagging: Auto
  ingressClass: tls-termination (1)
    1 Defines the ingress class name. If the ingress class is not present in your cluster the AWS Load Balancer Controller creates one. The AWS Load Balancer Controller reconciles the additional ingress class values if spec.controller is set to ingress.k8s.aws/alb.

  2. Create a YAML file that defines the Ingress resource:

    Example add-tls-termination-ingress.yaml file
    apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: <example> (1)
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing (2)
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:xxxxx (3)
spec:
  ingressClassName: tls-termination (4)
  rules:
  - host: <example.com> (5)
    http:
        paths:
          - path: /
            pathType: Exact
            backend:
              service:
                name: <example-service> (6)
                port:
                  number: 80
    1 Specifies the ingress name.
    2 The controller provisions the load balancer for ingress in a public subnet to access the load balancer over the internet.
    3 The Amazon Resource Name (ARN) of the certificate that you attach to the load balancer.
    4 Defines the ingress class name.
    5 Defines the domain for traffic routing.
    6 Defines the service for traffic routing.