Concourse on AWS Kubernetes Deployment with HTTPS endpoint

configmap.yml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: concourse-keys
data:
  authorized_worker_keys: |+
    ssh-rsa {{public_key_text}} worker-key
  session_signing_key: |+
    -----BEGIN RSA PRIVATE KEY-----
    {{private_key_text}}
    -----END RSA PRIVATE KEY-----
  tsa_host_key: |+
    -----BEGIN RSA PRIVATE KEY-----
    {{public_key_text}}
    -----END RSA PRIVATE KEY-----
  tsa_host_key.pub: |
    ssh-rsa {{public_key_text}}
  worker_key: |+
    -----BEGIN RSA PRIVATE KEY-----
    {{public_key_text}}
    -----END RSA PRIVATE KEY-----

services.yml

---
kind: Service
apiVersion: v1
metadata:
  name: concourse-ingress
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "{{certificate_arn}}"
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
spec:
  type: LoadBalancer
  selector:
    app: concourse-web
  ports:
  - name: https
    port: 443
    targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: concourse-web
spec:
  selector:
    app: concourse-web
  ports:
  - port: 8080
    name: atc
  - port: 2222
    name: tsa

web-deployment.yml

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: concourse-web
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: concourse-web
    spec:
      containers:
      - name: web
        image: concourse/concourse:{{concourse_version}}
        args:
        - web
        - '--basic_auth_username'
        - '{{concourse_username}}'
        - '--basic_auth_password'
        - '{{concourse_password}}'
        - '--external_url'
        - 'https://{{concourse_server}}'
        - '--postgres_data_source'
        - '{{postgres_uri}}'
        ports:
        - containerPort: 8080
          name: atc
        - containerPort: 2222
          name: tsa
        volumeMounts:
        - name: concourse-keys
          mountPath: /concourse-keys
          readOnly: true
      volumes:
      - name: concourse-keys
        configMap:
          name: concourse-keys

worker-deployment.yml

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: concourse-worker
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: concourse-worker
    spec:
      containers:
      - name: concourse-worker
        image: concourse/concourse:{{concourse_version}}
        args:
        - worker
        - --work-dir
        - /concourse-work-dir
        env:
        - name: CONCOURSE_TSA_HOST
          value: concourse-web
        - name: CONCOURSE_GARDEN_NETWORK
        ports: []
        securityContext: {privileged: true}
        volumeMounts:
        - name: concourse-keys
          mountPath: /concourse-keys
          readOnly: true
        - name: concourse-work-dir
          mountPath: /concourse-work-dir
      volumes:
      - name: concourse-keys
        configMap:
          name: concourse-keys
      - name: concourse-work-dir
        emptyDir: {}

Once the concourse-ingress service is created you can run kubectl get svc concourse-ingress -o yaml and look for the loadbalancer address. Map your external_url DNS name to this loadbalancer and you'll have a complete endpoint!