EKS service SSL endpoint

When creating a service using EKS, it is exposed using http through a AWS load balancer.

kubectl apply -f service.yaml - Will create a load balancer that's managed by EKS, and can not be modified. any modification, valid or not will be overriden by AWS at some point.

I'm going down the rabbit hole of trying to expose the service as HTTPS.

Modifying the aws load balancer to listen on 443 in https with and acm certificate, will provide a temporary solution, which will be reset when EKS will refresh the load balancer back to 'factory settings'.

Best approach seems to be to create an ingress load balancer that can support HTTPS. following these articles:

https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html

https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html

listen-ports and certificate-arn were added to the ingress yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: game-2048
  name: ingress-2048
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]' # Added by me
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:411686525067:certificate/8adf7812-a1af-4eae-af1b-ea425a238a67

spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: service-2048
              port:
                number: 80

EKS will create an ALB with a host name such as: k8s--------d4ees4dc9b-1296497080.eu-central-1.elb.amazonaws.com which is under the amazonaws.com.

When adding to the yaml config, certificate-arn the ALB will be created with a port 443 listener, and will be attached the ACM certificate that was specified.

But, since the ALB host is under the amazonaws.com domain, the certificate mismatches and I'm back to square one.

How can I make EKS create an https ALB?

On a higher level, I manage DNS on cloudflare and will create a CNAME proxy record for api.mydomain.com to the ALB host k8s--------d4ees4dc9b-1296497080.eu-central-1.elb.amazonaws.com

For the DNS proxy to work well, both 'sides' must support https.