code: func buildListener(port v1.ServicePort, annotations map[string]string, sslPorts *portSets) (*elb.Listener, error) {
  	loadBalancerPort := int64(port.Port)
  	portName := strings.ToLower(port.Name)
  	instancePort := int64(port.NodePort)
  	protocol := strings.ToLower(string(port.Protocol))
  	instanceProtocol := protocol
  
  	listener := &elb.Listener{}
  	listener.InstancePort = &instancePort
  	listener.LoadBalancerPort = &loadBalancerPort
  	certID := annotations[ServiceAnnotationLoadBalancerCertificate]
  	if certID != "" && (sslPorts == nil || sslPorts.numbers.Has(loadBalancerPort) || sslPorts.names.Has(portName)) {
  		instanceProtocol = annotations[ServiceAnnotationLoadBalancerBEProtocol]
  		if instanceProtocol == "" {
  			protocol = "ssl"
  			instanceProtocol = "tcp"
  		} else {
  			protocol = backendProtocolMapping[instanceProtocol]
  			if protocol == "" {
  				return nil, fmt.Errorf("Invalid backend protocol %s for %s in %s", instanceProtocol, certID, ServiceAnnotationLoadBalancerBEProtocol)
  			}
  		}
  		listener.SSLCertificateId = &certID
  	} else if annotationProtocol := annotations[ServiceAnnotationLoadBalancerBEProtocol]; annotationProtocol == "http" {
  		instanceProtocol = annotationProtocol
  		protocol = "http"
  	}
  
  	listener.Protocol = &protocol
  	listener.InstanceProtocol = &instanceProtocol
  
  	return listener, nil
  }
docs: // buildListener creates a new listener from the given port, adding an SSL certificate
  // if indicated by the appropriate annotations.