Container Service for Kubernetes:Create and use an NGINX Ingress

Console

kubectl

1. Obtain the KubeConfig for your cluster and use kubectl to connect to the cluster.

2. Create a file named test-deployment-service.yaml with the following content.

   Sample YAML file

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: coffee
     namespace: default
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: coffee
     template:
       metadata:
         labels:
           app: coffee
       spec:
         containers:
         - name: coffee
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: coffee-svc
     namespace: default
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: coffee
     type: ClusterIP
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: tea
     namespace: default
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: tea
     template:
       metadata:
         labels:
           app: tea
       spec:
         containers:
         - name: tea
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: tea-svc
     namespace: default
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: tea
     type: ClusterIP

3. Apply the configuration to create the Deployment and Service.

   kubectl apply -f test-deployment-service.yaml

4. Verify the status of the coffee and tea Deployments.

   kubectl get deployment coffee tea

   Expected output:

   NAME     READY   UP-TO-DATE   AVAILABLE   AGE
   coffee   2/2     2            2           14m
   tea      2/2     2            2           14m

5. Verify the status of the coffee-svc and tea-svc Services.

   kubectl get service coffee-svc tea-svc

   Expected output:

   NAME         TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)   AGE
   coffee-svc   ClusterIP   192.168.xxx.xxx   <none>        80/TCP    15m
   tea-svc      ClusterIP   192.168.xxx.xxx   <none>        80/TCP    15m

Console

Kubectl

1. Log on to the Certificate Management Service console. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

2. On the Commercial Certificates tab, select the certificate you want to download, and click Download in the bottom-left corner of the certificate list.

3. In the dialog box that appears, select Nginx as the server type, download the certificate package, and decompress it.

4. Use the downloaded certificate file (.pem) and private key file (.key) to create a Secret.

   kubectl create secret tls nginx-ingress-tls --cert test-nginx-ingress.com.pem --key test-nginx-ingress.com.key -n default

5. Add a TLS configuration to the test-nginx-ingress Ingress. Replace test-nginx-ingress.com in the command with your actual registered domain name.

   kubectl patch ingress test-nginx-ingress -p '{"spec":{"tls":[{"hosts":["test-nginx-ingress.com"],"secretName":"nginx-ingress-tls"}]}}'

6. Verify encrypted HTTPS access to the service path by running the following command with your actual Elastic IP Address.

   curl -v -k https://8.xxx.xxx.117/coffee -H "Host: test-nginx-ingress.com"

   • Parameters:

     • -v: Displays verbose output, including the TLS handshake.

     • -k (or --insecure): Skips certificate verification. Use this option if you are using a self-signed certificate.

   • Expected output:

     ...
     *   Trying 8.xxx.xxx.117:443...
     * Connected to 8.xxx.xxx.117 (8.xxx.xxx.117) port 443
     * ALPN: curl offers h2,http/1.1
     * (304) (OUT), TLS handshake, Client hello (1):
     * (304) (IN), TLS handshake, Server hello (2):
     * (304) (IN), TLS handshake, Unknown (8):
     * (304) (IN), TLS handshake, Certificate (11):
     * (304) (IN), TLS handshake, CERT verify (15):
     * (304) (IN), TLS handshake, Finished (20):
     * (304) (OUT), TLS handshake, Finished (20):
     ...
     <title>Hello World</title>
     ...
     <p><span>Server&nbsp;address:</span> <span>10.xxx.xxx.159:80</span></p>
     <p><span>Server&nbsp;name:</span> <span>coffee-96d4bc87-6cstv</span></p>
     <p class="smaller"><span>Date:</span> <span>14/Aug/2025:09:27:42 +0000</span></p>
     <p class="smaller"><span>URI:</span> <span>/coffee</span></p>
     ...
         <div id="footer">
             <div id="center" align="center">
                 Request ID: fee5fe107106748a35d99a2dbbbc6652<br/>
                 &copy; NGINX, Inc. 2018
             </div>
         </div>
     ...