Container Service for Kubernetes:Configure HTTPS certificates for encrypted communication

Compatibility of certificates configured by using different methods

The following table describes the compatibility of different certificate configuration methods.

(Optional) Step 1: Create a self-signed certificate

You can run the following OpenSSL commands to create a self-signed certificate:

openssl genrsa -out albtop-key.pem 4096
openssl req -subj "/CN=demo.alb.ingress.top" -sha256  -new -key albtop-key.pem -out albtop.csr  # demo.alb.ingress.top can be replaced with your domain name
echo subjectAltName = DNS:demo.alb.ingress.top > extfile.cnf  # demo.alb.ingress.top can be replaced with your domain name
openssl x509 -req -days 3650 -sha256 -in albtop.csr -signkey albtop-key.pem -out albtop-cert.pem -extfile extfile.cnf

Step 2: Create required resources

ALB Ingresses require Deployments, Services, IngressClasses, and Ingresses to work as expected. Create these four resources using the following YAML template.

1. Create a file named https-quickstart.yaml, copy the following content to the file, and save it.

   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: https-ingressclass
   spec:
     controller: ingress.k8s.alibabacloud/alb
     parameters:
       apiGroup: alibabacloud.com
       kind: AlbConfig
       name: alb # Change to the name of the AlbConfig resource
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: https-ingress
   spec:
     ingressClassName: https-ingressclass
     rules:
     - host: demo.alb.ingress.top # Replace demo.alb.ingress.top with the domain name associated with the certificate
       http:
         paths:
         - backend:
             service:
               name: https-svc
               port:
                 number: 443
           path: /
           pathType: Prefix
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: https-deploy
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: https-deploy
     template:
       metadata:
         labels:
           app: https-deploy
       spec:
         containers:
           - image: registry.cn-hangzhou.aliyuncs.com/acs-sample/old-nginx:latest
             imagePullPolicy: IfNotPresent
             name: https-deploy
             ports:
               - containerPort: 80
                 protocol: TCP
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: https-svc
   spec:
     ports:
       - name: port1
         port: 443
         protocol: TCP
         targetPort: 80
     selector:
       app: https-deploy
     sessionAffinity: None
     type: ClusterIP

2. (Optional) If both HTTP and HTTPS listeners are configured in the AlbConfig, add the annotations field to the Ingress to ensure that the Ingress is associated with multiple listeners. The following code shows the configurations:

   Add annotations when you use multiple listeners

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: https-ingress
     annotations:
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]' # Add annotations when you use multiple listeners for ALB Ingress to work properly 
   spec:
     #...

3. Run the following command to create resources:

   kubectl apply -f https-quickstart.yaml

Step 3: Configure certificates

Step 4: Verify the result

You can access a service over HTTPS to check whether the certificate is configured.

1. Run the following command to view Ingress information.

   kubectl get ingress

   Expected output:

   NAME            CLASS                HOSTS                  ADDRESS                         PORTS     AGE
   https-ingress   https-ingressclass   demo.alb.ingress.top   alb-********.alb.aliyuncs.com   80, 443   83m

   Copy the values under HOSTS and ADDRESS for later use.

2. Run the following command to access the backend service using HTTPS through the ALB Ingress. Replace demo.alb.ingress.top and alb-********.alb.aliyuncs.com with the values obtained in the previous step.

   curl -H HOST:demo.alb.ingress.top -k https://alb-********.alb.aliyuncs.com

   If the following output is returned, the certificate is configured:

   old

References

• For more information about how to enable client access using HTTP/3, see Configure a QUIC listener by using an AlbConfig.

• For more information about how to configure mutual authentication on an HTTPS listener, see Use HTTPS mutual authentication to enhance service security.