All Products
Search

This Product

    Alibaba Cloud Service Mesh:ASMCredential field reference

    Document Center

    Alibaba Cloud Service Mesh:ASMCredential field reference

    Last Updated:Sep 21, 2026

    ASM gateways require Transport Layer Security (TLS) certificates and private keys to terminate encrypted traffic. ASMCredential is a CustomResourceDefinition (CRD) that defines these credentials. To configure TLS termination on an ASM gateway, create an ASMCredential and reference its name in the credentialName field of an Istio gateway.

    Secret generation behavior

    When you create an ASMCredential, ASM automatically generates Kubernetes secrets on both the control plane and data plane clusters.

    Important

    Before you create an ASMCredential, verify that no existing secret in the target clusters shares the same name. A naming conflict causes the existing secret to be overwritten.

    Spec fields

    Field

    Type

    Required

    Description

    type

    string

    Yes

    Certificate mode. Set to tls for one-way TLS (the gateway presents its certificate to clients, but does not request a client certificate). Set to mtls for mutual TLS (mTLS), where both the gateway and the client present certificates for two-way authentication.

    cert

    string

    Yes

    Public key certificate in PEM format.

    key

    string

    Yes

    Private key in PEM format.

    caCert

    string

    No

    CA certificate in PEM format, used to verify client identity during mTLS. Required when type is set to mtls.

    Note

    As of ASM version 1.19, the cert, key, and caCert fields also accept Base64-encoded PEM certificates and private keys.

    Configuration examples

    TLS termination

    The following YAML creates an ASMCredential for one-way TLS termination:

    apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMCredential
metadata:
  name: aliyun.com
  namespace: istio-system
spec:
  cert: |-
    -----BEGIN CERTIFICATE-----
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    -----END CERTIFICATE-----
  key: |-
    -----BEGIN PRIVATE KEY-----
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    -----END PRIVATE KEY-----
  type: tls

    Reference an ASMCredential in an Istio gateway

    After you apply the ASMCredential, set the credentialName field of your Istio gateway to the ASMCredential metadata.name value:

    apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: my-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: aliyun.com  # Must match the ASMCredential metadata.name
    hosts:
    - "*.example.com"

    References