Using "Let's Encrypt" TLS with a Google Load Balancer? (Kubernetes/GKE)
So, it turns out that you can just add TLS directly on the load balancer now, and it'll issue a Let's Encrypt certificate automatically. This is doable via Cloud Console:
No clue why this isn't more well-known.