I'm Running a Kubernetes cluster on AWS using Kops for the first time and I need some help in exposing the services to the public with an AWS managed domain name and an SSL certificate.

The cluster is running in a private VPC and I can access it through a bastion instance.

Right now I'm exposing the services to the public using LoadBalancer service type as follow:

apiVersion: v1
kind: Service
metadata:
  name: my-gateway-service
  namespace: {{ .Values.nameSpace }}
  labels:
    app: gateway
    tier: backend
  annotations:
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: 'http'
      service.beta.kubernetes.io/aws-load-balancer-ssl-port: '{{ .Values.services.sslPort }}'
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: '{{ .Values.services.sslCert }}'
spec:
  type: LoadBalancer
  selector:
    app: gateway
    tier: backend
  ports:
  - name: http
    port: 80
    targetPort: {{ .Values.applications.nodeAppPort }}
  - name: https
    port: 443
    targetPort: {{ .Values.applications.nodeAppPort }}

as you can see I'm passing the SSL certificate using annotations then I will just point the domain name to loadBalancer public ingress and done.

The Problem: This Project is a micro-services project and requires a lot of services to be exposed to the public in different environments which means a lot of AWS LoadBalancers and a lot of Money $$.

I've tried NodePort and ExternalName services but none of them worked because of the private VPC.

Any suggestions to overcome this problem?