Alibaba Cloud Service Mesh:Add a certificate for a domain name

Procedure

1. Create the sample service myexampleapp.

   1. Create a file named myexample-nginx.conf that contains the following content.

      This sample service is based on NGINX. You must create a configuration file for the NGINX server. For the service with the domain name aliyun.com, the following configuration specifies that requests to the root path return the message Welcome to aliyun.com! and the status code 200.

      events {
      }
      http {
        log_format main '$remote_addr - $remote_user [$time_local]  $status '
        '"$request" $body_bytes_sent "$http_referer" '
        '"$http_user_agent" "$http_x_forwarded_for"';
        access_log /var/log/nginx/access.log main;
        error_log  /var/log/nginx/error.log;
        server {
          listen 80;
          location / {
              return 200 'Welcome to aliyun.com!';
              add_header Content-Type text/plain;
          }
        }
      }

   2. Run the following command to create a ConfigMap for the NGINX server:

      kubectl create configmap myexample-nginx-configmap --from-file=nginx.conf=./myexample-nginx.conf

   3. Create a file named myexampleapp.yaml that contains the following content.

      View myexampleapp.yaml

      apiVersion: v1
      kind: Service
      metadata:
        name: myexampleapp
        labels:
          app: myexampleapp
      spec:
        ports:
        - port: 80
          protocol: TCP
        selector:
          app: myexampleapp
      ---
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: myexampleapp
      spec:
        selector:
          matchLabels:
            app: myexampleapp
        replicas: 1
        template:
          metadata:
            labels:
              app: myexampleapp
          spec:
            containers:
            - name: nginx
              image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
              ports:
              - containerPort: 80
              volumeMounts:
              - name: nginx-config
                mountPath: /etc/nginx
                readOnly: true
            volumes:
            - name: nginx-config
              configMap:
                name: myexample-nginx-configmap

   4. Run the following command to create the internal service for the aliyun.com domain name:

      kubectl apply -f myexampleapp.yaml

2. Import the myexampleapp service into the ASM gateway.

   1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

   2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

   3. On the Ingress Gateway page, click the name of the target gateway.

   4. On the Gateway Details page, click Upstream Service in the navigation pane on the left.

   5. On the Upstream Service page, click Import service.

   6. On the Import service page, select a Namespaces, select the myexampleapp service, click the icon, and then click Submit.

3. Create a certificate and a private key.

   1. Run the following command in OpenSSL to create a root certificate and a private key:

      openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt

   2. Run the following commands to generate a certificate and a private key for the aliyun.com domain.

      • Run the following command to create the aliyun.com.crt certificate:

        openssl x509 -req -days 365 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in aliyun.com.csr -out aliyun.com.crt

      • Run the following command to create the private key aliyun.com.key.

        openssl req -out aliyun.com.csr -newkey rsa:2048 -nodes -keyout aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"

4. Add the certificate and private key to the ASM gateway.

   Note

   • Starting from V1.17, ASM instances support certificates from the Certificate Management page. We recommend that you migrate your certificates to Certificate Management. You can create a certificate with the same name on the Certificate Management page to automatically overwrite the existing certificate. You do not need to delete the old certificate. For more information about how to upgrade an instance, see Upgrade an ASM instance.

   • A certificate on the Certificate Management page automatically creates a Secret with the same name on the data plane. This action overwrites the content of any existing Secret with the same name.

   ASM instances before v1.17

   1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

   2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

   3. On the Ingress Gateway page, click the name of the target gateway. On the Gateway Details page, click Domain/Certificate in the navigation pane on the left.

   4. On the Domain/Certificate page, click the Certificate tab, and then click Create.

   5. On the New Certificate page, enter a Name, paste the content of aliyun.com.crt into the Certificate text box and the content of aliyun.com.key into the key text box, and then click Create.

   ASM v1.17 and later

   1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

   2. On the Mesh Management page, click the name of the target instance. In the navigation pane on the left, choose ASM Gateway > Certificate Management.

   3. On the Certificate Management page, click Create. In the Certificate Information panel, configure the parameters and click OK.

      Parameter	Description
      Name	Enter a name for the certificate. In this example, use myexample-credential.
      Public Key Certificate	The content of the aliyun.com.crt file from Step 3.
      Private Key	The content of the aliyun.com.key file from Step 3.

5. Bind the domain name to the certificate.

   1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

   2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

   3. On the Ingress Gateway page, click the name of the target gateway. On the Gateway Details page, click Domain/Certificate in the navigation pane on the left.

   4. On the Domain/Certificate page, click the Domain tab, and then click Create.

   5. On the Add domain page, set Domain Name to *.aliyun.com and Protocol to HTTPS. Enter a Port Name and a Port. Select a credential and select Secure connections with standard TLS semantics.. Then, click Create.

      Note

      If you select Secure connections with standard TLS semantics., only TLS-encrypted requests can access the domain name.

6. Run the following command to access aliyun.com over HTTPS and verify that the certificate is bound to the domain name:

   curl -k -H Host:www.aliyun.com --resolve www.aliyun.com:443:<IP address of the ASM gateway>  https://www.aliyun.com

   Expected output:

   Welcome to aliyun.com!

   If you successfully access aliyun.com by using the HTTPS protocol, it indicates that the domain name and the certificate are successfully bound.