Alibaba Cloud Service Mesh FAQ (5): ASM Gateway Supports Creating HTTPS Listeners on the SLB Side

By Xining Wang

ASM gateways support HTTPS security and dynamically load certificates to improve the security of ASM gateways. In addition to binding certificates on the ASM gateway, you can manage certificates on the SLB side.

This article describes how to support ASM gateway service to bind certificates on the SLB side and create an HTTPS listener.

Prerequisites

An ASM instance is created. Please see Create an ASM Instance for more information.
An ACK cluster is created. Please see Create a Managed Kubernetes Cluster for more information.
Add a cluster to the ASM instance. Please see Add a Cluster to the ASM Instance for more information.

Background

How to Create an HTTPS Listener for a Kubernetes Service

Create a certificate in the Alibaba Cloud console and record the cert-id. Then, use the following annotation to create an HTTPS-type SLB.

Description: HTTPS requests are decrypted at the SLB layer and then sent as HTTP requests to backend pods.

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "https:443"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "${YOUR_CERT_ID}"
  name: sample
  namespace: default
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 80
  selector:
    app: sample
  type: LoadBalancer

Specific Reference Document: https://www.alibabacloud.com/help/en/container-service-for-kubernetes/latest/use-annotations-to-configure-load-balancing-1

Step 1: Prepare the Certificates Required by SLB

In this example, a certificate and private key are generated for aliyun.com.

If you already have a certificate and private key available for aliyun.com, you need to name the key aliyun.com.key and the certificate aliyun.com.crt. If not, you can generate the certificate and key by performing the following steps through OpenSSL.

1. Run the following command to create a root certificate and a private key:

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt

2. Run the following command to generate a certificate and private key for the aliyun.com server:

openssl req -out aliyun.com.csr -newkey rsa:2048 -nodes -keyout aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"
openssl x509 -req -days 365 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in aliyun.com.csr -out aliyun.com.crt

3. Create a certificate in the SLB console:

In order to configure an HTTPS listener, you can directly use the certificate in the SSL Certificates Service or upload the required server certificate and CA certificate issued by a third party to the traditional SLB.

Specific Reference Document: https://www.alibabacloud.com/help/en/server-load-balancer/latest/use-a-certificate-from-alibaba-cloud-ssl-certificates-service

Step 2: Create an HTTPS Listener

ASM allows you to customize ingress gateway services. You can configure specific function parameters in YAML.

Specific Reference Document:

https://www.alibabacloud.com/help/en/alibaba-cloud-service-mesh/latest/define-a-custom-ingress-gateway-service

In the following configuration, an HTTPS SLB will be created through serviceAnnotation. HTTPS requests with port 443 will be decrypted at the SLB layer and then sent to port 80 of the backend Pod in the form of HTTP requests.

apiVersion: istio.alibabacloud.com/v1beta1
kind: IstioGateway
metadata:
  name: ingressgateway
  namespace: istio-system
spec:
 ....
  ports:
    - name: http-0
      port: 80
      protocol: HTTP
      targetPort: 80
    - name: https-1
      port: 443
      protocol: HTTPS
      targetPort: 80
  ....
  serviceAnnotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "${YOUR_CERT_ID}"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: 'https:443'
    ....
  serviceType: LoadBalancer

Execution Result

Log on to the ASM console. Select the target service mesh instance in the console. Click ASM Gateways on the left-side navigation pane. View the information on the right side of the page.

Run the following command to access the httpbin service over HTTPS:

curl -k https://{replace with real ingress gateway IP address}:443/headers
{
  "headers": {
    "Accept": "*/*",
    "Host": "xxxx",
    "Remoteip": "xxxx",
    "User-Agent": "curl/7.79.1",
    "X-Envoy-Attempt-Count": "1",
    "X-Envoy-External-Address": "xxxx",
    "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/httpbin;Hash=9dd4266bc514d03aae50e174ace52eff7e577d79a14795b532be876139e8922f;Subject=\"\";URI=spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"
  }
}

Community

Alibaba Cloud Service Mesh FAQ (5): ASM Gateway Supports Creating HTTPS Listeners on the SLB Side

Prerequisites

Background

How to Create an HTTPS Listener for a Kubernetes Service

Step 1: Prepare the Certificates Required by SLB

Step 2: Create an HTTPS Listener

Execution Result

Read previous post:

Read next post:

Xi Ning Wang(王夕宁)

You may also like

Comments

Xi Ning Wang(王夕宁)

Related Products

Server Load Balancer

HTTPDNS

Container Service for Kubernetes

EMAS HTTPDNS