title: Terraform AWS NLB TLS Passthrough
body: <p>Using terraform I'm provisioning infra in AWS for my K3S cluster. I have provisioned an NLB with two listeners on port 80 and 443, with appropriate self-signed certs. This works. I can access HTTP services in my cluster via the nlb.</p>
  <pre><code>resource &quot;tls_private_key&quot; &quot;agents&quot; {
    algorithm = &quot;RSA&quot;
  }
  
  resource &quot;tls_self_signed_cert&quot; &quot;agents&quot; {
    key_algorithm         = &quot;RSA&quot;
    private_key_pem       = tls_private_key.agents.private_key_pem
    validity_period_hours = 24
  
    subject {
      common_name  = &quot;my hostname&quot;
      organization = &quot;My org&quot;
    }
  
    allowed_uses = [
      &quot;key_encipherment&quot;,
      &quot;digital_signature&quot;,
      &quot;server_auth&quot;
    ]
  }
  
  resource &quot;aws_acm_certificate&quot; &quot;agents&quot; {
    private_key      = tls_private_key.agents.private_key_pem
    certificate_body = tls_self_signed_cert.agents.cert_pem
  }
  
  
  resource &quot;aws_lb&quot; &quot;agents&quot; {
    name               = &quot;basic-load-balancer&quot;
    load_balancer_type = &quot;network&quot;
  
    subnet_mapping {
      subnet_id     = aws_subnet.agents.id
      allocation_id = aws_eip.agents.id
    }
  }
  
  resource &quot;aws_lb_listener&quot; &quot;agents_80&quot; {
    load_balancer_arn = aws_lb.agents.arn
    protocol = &quot;TCP&quot;
    port     = 80
  
    default_action {
      type             = &quot;forward&quot;
      target_group_arn = aws_lb_target_group.agents_80.arn
    }
  }
  
  resource &quot;aws_lb_listener&quot; &quot;agents_443&quot; {
    load_balancer_arn = aws_lb.agents.arn
    protocol = &quot;TLS&quot;
    port     = 443
    certificate_arn = aws_acm_certificate.agents.arn
  
    default_action {
      type             = &quot;forward&quot;
      target_group_arn = aws_lb_target_group.agents_443.arn
    }
  }
  
  resource &quot;aws_lb_target_group&quot; &quot;agents_80&quot; {
    port     = 30000
    protocol = &quot;TCP&quot;
    vpc_id   = var.vpc.id
  
    depends_on = [
      aws_lb.agents
    ]
  }
  resource &quot;aws_lb_target_group&quot; &quot;agents_443&quot; {
    port     = 30001
    protocol = &quot;TCP&quot;
    vpc_id   = var.vpc.id
  
    depends_on = [
      aws_lb.agents
    ]
  }
  
  resource &quot;aws_autoscaling_attachment&quot; &quot;agents_80&quot; {
    autoscaling_group_name = aws_autoscaling_group.agents.name
    alb_target_group_arn   = aws_lb_target_group.agents_80.arn
  }
  
  resource &quot;aws_autoscaling_attachment&quot; &quot;agents_443&quot; {
    autoscaling_group_name = aws_autoscaling_group.agents.name
    alb_target_group_arn   = aws_lb_target_group.agents_443.arn
  }
  
  </code></pre>
  <p>That's a cutdown version of my code.</p>
  <p>I have configured my ingress controller to listen for HTTP and HTTPS on NodePorts 30000 and 30001 respectively. This works too.</p>
  <p>The thing that doesn't work is that the NLB is terminating TLS, but I need it to passthrough. I'm doing this so that I can access Kubernetes Dashboard (among other apps), but the dashboard requires https to sign-in, something I can't provide if tls is terminated at the nlb.</p>
  <p>I need help configuring the nlb for passthrough. I have searched and searched and can't find any examples. If anyone knows how to configure this it would be good to get some tf code, or even just an idea of the appropriate way of achieving it in AWS so that I can implement it myself in tf.</p>