Container Service for Kubernetes:Configure certificates for encrypted communication over HTTPS

Use the ACK console

After you upload the self-signed certificate to Certificate Management Service, you can specify the domain name bound to the certificate for the tls field in the Ingress configurations. This way, the ALB Ingress can automatically discover and use the uploaded certificate.

1. Upload the self-signed certificate to the Certificate Management Service console. For more information, see Upload and share an SSL certificate.

2. Log on to the ACK console. In the navigation pane on the left, click Clusters.

3. On the Clusters page, find the cluster you want and click its name. In the left-side pane, choose Network > Ingresses.

4. On the Ingress page, find the Ingress that you want to update and click Update in the Actions column. In the Modify Ingress panel, configure the parameters. The following table describes the parameters.

   Parameter	Description	Example
   TLS Settings	Specifies whether to enable TLS authentication. You can enable TLS authentication for the Ingress. Domain Name: Enter a custom domain name. Secret: Select the Secret that you want to use. Note If you leave this parameter empty, automatic certificate discovery is used. To create a Secret, perform the following steps: Click Create to the right of the Secret field. In the Create Secret dialog box, configure the Name, Cert, and Key parameters. Then, click OK. Select the Secret that you created from the Secret drop-down list. You can click + Add to add more TLS certificates.	Domain Name: demo.alb.ingress.top Secret: Leave this parameter empty.
   (Optional) Annotations	You can: Define custom annotation names and values Select or filter existing annotations by name for configuration For more information about Ingress annotations, see Supported annotations for Ingress. Click +Add Annotation to add an annotation. ACK does not limit the number of Ingress annotations you can add.	No configuration is required. Note If you want to listen for both HTTP and HTTPS requests, add the following annotations: Name: alb.ingress.kubernetes.io/listen-ports Value: [{"HTTP": 80},{"HTTPS": 443}]

   

Use kubectl

After you upload the self-signed certificate to Certificate Management Service, you can specify the domain name bound to the certificate for the tls field in the Ingress configurations. This way, the ALB Ingress can automatically discover and use the uploaded certificate.

1. Upload the self-signed certificate to the Certificate Management Service console. For more information, see Upload and share an SSL certificate.

2. Run the following command to modify the Ingress:

   kubectl edit ingress https-ingress

3. Add the tls field and specify the domain name bound to the certificate.

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
   #  annotations:
   #    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'  # Add this annotation if you want to listen for both HTTP and HTTPS requests. 
     name: https-ingress
   spec:
     ingressClassName: https-ingressclass
     rules:
     - host: demo.alb.ingress.top # Replace demo.alb.ingress.top with the domain name that you want to use.
       http:
         paths:
         - backend:
             service:
               name: https-svc
               port:
                 number: 443
           path: /
           pathType: Prefix
     tls:                     # New field.    
     -hosts:                  # New field. 
       - demo.alb.ingress.top # New field. Set the value to the domain name bound to the certificate. The domain name must be the same as the domain name specified in the "rules: host" field.

Use the ACK console

1. Log on to the ACK console. In the navigation pane on the left, click Clusters.

2. On the Clusters page, find the cluster you want and click its name. In the left-side pane, choose Network > Ingresses.

3. On the Ingress page, find the Ingress that you want to update and click Update in the Actions column. In the Modify Ingress panel, configure the parameters. The following table describes the parameters.

   Parameter	Description	Example
   TLS Settings	Specifies whether to enable TLS authentication. You can enable TLS authentication for the Ingress. Domain Name: Enter a custom domain name. Secret: Select the Secret that you want to use. Note If you leave this parameter empty, automatic certificate discovery is used. To create a Secret, perform the following steps: Click Create to the right of the Secret field. In the Create Secret dialog box, configure the Name, Cert, and Key parameters. Then, click OK. Select the Secret that you created from the Secret drop-down list. You can click + Add to add more TLS certificates.	Domain Name: demo.alb.ingress.top Secret: https-secret Secret name: https-secret Cert: The self-signed certificates that are not encoded in Base64. Key: The self-signed private keys that are not encoded in Base64.
   (Optional) Annotations	You can: Define custom annotation names and values Select or filter existing annotations by name for configuration For more information about Ingress annotations, see Supported annotations for Ingress. Click +Add Annotation to add an annotation. ACK does not limit the number of Ingress annotations you can add.	No configuration is required. Note If you want to listen for both HTTP and HTTPS requests, add the following annotations: Name: alb.ingress.kubernetes.io/listen-ports Value: [{"HTTP": 80},{"HTTPS": 443}]

   

Use kubectl

Use the ACK console

1. Obtain the CertIdentifier of the self-signed certificate.

   After you upload the self-signed certificate to Certificate Management Service, you can specify the certificate ID in the CertificateId field in the listener configurations of an AlbConfig. This way, the certificate is associated with the listener.

   Note

   If a listener is associated with a certificate, the Ingress no longer uses the automatic certificate discovery feature.

   1. Upload the self-signed certificate to the Certificate Management Service console. For more information, see Upload and share an SSL certificate.

   2. Obtain the certificate ID.

      1. Log on to the Certificate Management Service console.

      2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

      3. On the SSL Certificate Management page, click the Manage Uploaded Certificates tab. Select the certificate you uploaded and click More in the Actions column.

         In the Certificate Details panel, you can view the certificate ID in the CertIdentifier field.

2. Specify the certificate in an AlbConfig.

   1. Log on to the ACK console. In the navigation pane on the left, click Clusters.

   2. On the Clusters page, find the cluster you want and click its name. In the left-side pane, choose Workloads > Custom Resources.

   3. On the Resource Objects tab, enter AlbConfig in the search box and click the displayed AlbConfig.

   4. In the AlbConfig panel, find the resource whose name is alb by default and click Edit YAML in the Actions column.

   5. In the View in YAML panel, add the following fields. In the dialog box that appears, change the instance name and click Confirm.

      Field	Description	Example
      certificates	The certificate information.	-
      CertificateId	The CertIdentifier of the certificate, which can be obtained in Step 1.	756****-cn-hangzhou
      IsDefault	Specifies whether to set the certificate as the default certificate.	true

      

3. Modify the Ingress.

   1. Log on to the ACK console. In the navigation pane on the left, click Clusters.

   2. On the Clusters page, find the cluster you want and click its name. In the left-side pane, choose Network > Ingresses.

   3. On the Ingress page, find the Ingress that you want to update and click Update in the Actions column. In the Modify Ingress panel, configure the parameters. The following table describes the parameters.

      Parameter	Description	Example
      Annotations	You can: Define custom annotation names and values Select or filter existing annotations by name for configuration For more information about Ingress annotations, see Supported annotations for Ingress. Click +Add Annotation to add an annotation. ACK does not limit the number of Ingress annotations you can add.	Name: alb.ingress.kubernetes.io/listen-ports Value: [{"HTTPS": 443}] Note If you need to listen for both HTTP and HTTPS requests, replace this value with [{"HTTP": 80},{"HTTPS": 443}]

      

Use kubectl