Container Service for Kubernetes:Configure an HTTPS certificate for encrypted communication

ACK console

1. Upload your certificate to Certificate Management Service.

2. Log on to the ACK console. In the left-side navigation pane, click Clusters.

3. On the Clusters page, click the name of your cluster. In the left-side pane, choose Network > Ingresses.

4. Find https-ingress and click Update in the Actions column. Configure the following parameters:

   Parameter	Description	Example
   TLS settings > Domain name	The domain name bound to the certificate.	demo.alb.ingress.top
   TLS settings > Secret	Leave blank to use automatic certificate discovery. To use a Secret instead, click Create next to the Secret field and fill in the name, certificate, and private key.	Leave blank
   (Optional) Annotations	Add alb.ingress.kubernetes.io/listen-ports to make the Ingress listen on both HTTP and HTTPS.	Name: alb.ingress.kubernetes.io/listen-ports<br>Value: [{"HTTP": 80},{"HTTPS": 443}]

   

kubectl

1. Upload your certificate to Certificate Management Service.

2. Edit the Ingress:

   kubectl edit ingress https-ingress

3. Add the tls field with the domain name bound to the certificate:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
   #  annotations:
   #    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'  # Uncomment to listen on both HTTP and HTTPS.
     name: https-ingress
   spec:
     ingressClassName: https-ingressclass
     rules:
     - host: demo.alb.ingress.top # Replace with your domain name.
       http:
         paths:
         - backend:
             service:
               name: https-svc
               port:
                 number: 443
           path: /
           pathType: Prefix
     tls:                     # New field.
     - hosts:                 # New field.
       - demo.alb.ingress.top # New field. Must match the domain in rules[].host.

ACK console

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left-side pane, choose Network > Ingresses.

3. Find https-ingress and click Update in the Actions column. Configure the following parameters:

   Parameter	Description	Example
   TLS settings > Domain name	The domain name bound to the certificate.	demo.alb.ingress.top
   TLS settings > Secret	The Secret storing the certificate. Click Create next to this field to create a new one — provide the Name, Cert (raw PEM, not Base64-encoded), and Key (raw PEM, not Base64-encoded).	Name: https-secret<br>Cert: content of albtop-cert.pem<br>Key: content of albtop-key.pem
   (Optional) Annotations	Add alb.ingress.kubernetes.io/listen-ports to make the Ingress listen on both HTTP and HTTPS.	Name: alb.ingress.kubernetes.io/listen-ports<br>Value: [{"HTTP": 80},{"HTTPS": 443}]

   

kubectl

1. Create the Secret.

   1. Create a file named https-secret.yaml. Paste the Base64-encoded certificate and private key from Step 2:

      apiVersion: v1 kind: Secret metadata: name: https-secret type: kubernetes.io/tls data: tls.key: |  # Base64-encoded content of albtop-key.pem. {base64 albtop-key.pem} tls.crt: |  # Base64-encoded content of albtop-cert.pem. {base64 albtop-cert.pem} 

   2. Apply the manifest: ``bash kubectl apply -f https-secret.yaml ``

2. Update the Ingress to reference the Secret.

   1. Edit the Ingress: ``bash kubectl edit ingress https-ingress ``

   2. Add the tls field with both the domain name and the Secret name:

      apiVersion: networking.k8s.io/v1 kind: Ingress metadata: #  annotations: #    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'  # Uncomment to listen on both HTTP and HTTPS. name: https-ingress namespace: default spec: ingressClassName: alb rules: tls:                       # New field. 

      • hosts: secretName: https-secret # New field. The name of the Secret storing the certificate.

        • demo.alb.ingress.top # New field. Must match the domain in rules[].host.

Tip: If you use cert-manager to automate certificate issuance and renewal, annotate the Ingress with cert-manager.io/issuer or cert-manager.io/cluster-issuer. cert-manager monitors the Ingress and automatically creates and rotates the Secret. For details, see the cert-manager documentation.

ACK console

1. Get the CertIdentifier of your certificate.

   1. Upload your certificate to Certificate Management Service.

   2. Log on to the Certificate Management Service consoleCertificate Management Service console. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

   3. On the SSL Certificate Management page, click the Manage Uploaded Certificates tab. Find your certificate and click More in the Actions column.

   4. In the Certificate Details panel, note the value in the CertIdentifier field.

2. Add the certificate to the AlbConfig.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, click the name of your cluster. In the left-side pane, choose Workloads > Custom Resources.

   3. On the Resource Objects tab, search for AlbConfig and click the result.

   4. Find the AlbConfig resource and click Edit YAML in the Actions column.

   5. In the View in YAML panel, add the certificates field to the HTTPS listener:

      Field	Description	Example
      certificates	Certificate configuration for the listener.	—
      CertificateId	The CertIdentifier obtained in the previous step.	756****-cn-hangzhou
      IsDefault	Whether this is the default certificate for the listener.	true

      

3. Update the Ingress to listen on HTTPS.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, click the name of your cluster. In the left-side pane, choose Network > Ingresses.

   3. Find https-ingress and click Update in the Actions column. Add the following annotation:

      Parameter	Description	Example
      Annotations > Name	The annotation key.	alb.ingress.kubernetes.io/listen-ports
      Annotations > Value	The ports to listen on. To also accept HTTP traffic, use [{"HTTP": 80},{"HTTPS": 443}].	[{"HTTPS": 443}]

      

kubectl

1. Upload your certificate to Certificate Management Service.

2. Get the certificate ID.

   1. Log on to the Certificate Management Service consoleCertificate Management Service console. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

   2. On the SSL Certificate Management page, click the Manage Uploaded Certificates tab. Find your certificate and click More in the Actions column.

   3. In the Certificate Details panel, note the value in the CertIdentifier field.

3. Add the certificate to the AlbConfig:

   kubectl edit albconfig <ALBCONFIG_NAME>

   Add the certificates field under the HTTPS listener:

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: alb
   spec:
     config:
       addressType: Intranet
       name: xiaosha-alb-test
     listeners:
       - port: 80
         protocol: HTTP
       - certificates:
           - CertificateId: 756****-cn-hangzhou   # The CertIdentifier of the certificate.
             IsDefault: true                      # Set to true for the default certificate.
         port: 443
         protocol: HTTPS

4. Update the Ingress to use the HTTPS listener:

   kubectl edit ingress https-ingress

   Add the alb.ingress.kubernetes.io/listen-ports annotation:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}]'  # New field. To also accept HTTP traffic, use '[{"HTTP": 80},{"HTTPS": 443}]'.
     name: https-ingress
   spec:
     ingressClassName: https-ingressclass
     rules:
     - host: demo.alb.ingress.top # Replace with your domain name.
       http:
         paths:
         - backend:
             service:
               name: https-svc
               port:
                 number: 443
           path: /
           pathType: Prefix