Terminate API TLS with an ELB

[ProTip]

It would be great if we could allow the API's TLS to be terminated by an ELB. This would allow us to reuse certificates we have and avoid distributing the certs/keys around to the nodes. It's likely we would want to be going through an ELB when everything is deployed into private subnets as well.

[justinsb]

I'm pretty sure we use client certificates and ELB doesn't support them. But I'll check!

[ProTip]

It wouldn't. I guess I was just not aware of how authentication and encryption were handled.

If token or basic auth were used would we need TLS termination?

[lattwood]

Could do it in TCP mode instead of actually terminating things.

[zytek]

Does this relate to #834 ?

[justinsb]

We now have ELB support for the API (and some refinements in #1268).

Moving this particular issue (TLS offload / custom certs) to 1.5.1 though.

[blakebarnett]

Is this actually needed? We do this by simply creating a separate "External" service record with a cert via the annotation in TCP mode and let dns-controller create the DNS for it.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close