if I am deploying kolide, can I terminate TLS with an ALB, or does kolide need to be able to access the certs where it's running?

You can run Fleet without TLS and have it terminated. by a LB https://github.com/kolide/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md#server_tls