Bind a certificate and create an HTTPS listener for an ingress gateway CLB - Alibaba Cloud Service Mesh

Service Mesh (ASM) improves ingress gateway security by supporting HTTPS and dynamic certificate loading. You can bind a certificate to the Classic Load Balancer (CLB) instance associated with your ingress gateway and create an HTTPS listener. This configuration offloads TLS termination to the CLB instance, which decrypts incoming HTTPS requests and forwards them as HTTP requests to the backend gateway pod. This topic shows you how to bind a certificate and create an HTTPS listener for the CLB instance of an ASM ingress gateway.

Prerequisites

Step 1: Prepare a CLB certificate

Use an existing certificate and private key

If you have a valid certificate and private key for aliyun.com, name the private key aliyun.com.key and the certificate aliyun.com.crt.

Generate a new certificate and private key

If you do not have a certificate and private key, you can use OpenSSL to generate a self-signed certificate and private key for aliyun.com.

Run the following command to create a root certificate and private key.

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt

Create an SSL certificate.
1. On the Classic Load Balancer (CLB) console, choose Classic Load Balancer (CLB) > Certificate Management in the left-side navigation pane.
2. On the Certificates page, click Add Certificate.
3. In the Add Certificate panel, select Alibaba Cloud Certificates, and then click Create SSL Certificate at the bottom of the certificate list.
4. On the Certificate Management Service page, choose Certificate Management > SSL Certificate Management in the left-side navigation pane.
5. On the Uploaded tab, click Uploaded Certificates. Set Certificate Name to aliyun.com. Upload the generated root certificate to Certificate File and the private key to Certificate Key. Click OK and ignore the prompt about the certificate chain.
For more information about creating a certificate on the Classic Load Balancer (CLB) console, see Select Alibaba Cloud Issued Certificate.

Step 2: Create an HTTPS listener

ASM allows you to customize the ingress gateway service by defining parameters in a YAML configuration file. For more information, see Manage an ingress gateway by using KubeAPI.

Add the following content to your ingressgateway.yaml file.

spec:
 ....
  ports:
    - name: http-0
      port: 80
      protocol: HTTP
      targetPort: 80
    - name: https-1
      port: 443
      protocol: HTTPS
      targetPort: 80
  ....
  serviceAnnotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "${YOUR_CERT_ID}"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: 'https:443'
    ....
  serviceType: LoadBalancer

The serviceAnnotations field configures a CLB instance with an HTTPS listener. HTTPS requests sent to port 443 are terminated at the CLB instance, which decrypts the requests and forwards them as HTTP requests to port 80 of the backend gateway pod. In the YAML file, replace ${YOUR_CERT_ID} with the certificate ID from Step 1.

Run the following command to deploy the ingress gateway.
```
kubectl apply -f ingressgateway.yaml
```

Step 3: Verify HTTPS access

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
On the Ingress Gateway page, find the Service address of the target gateway.

The Service address is the IP address of the gateway.
Run the following command to access the productpage service over HTTPS.

Replace ${INGRESS_GATEWAY_IP} with the gateway IP address from the previous step.
```
curl -k -H Host:a.aliyun.com --resolve a.aliyun.com:443:${INGRESS_GATEWAY_IP}  https://a.aliyun.com/productpage -I
```
Example output:
```
HTTP/2 200
date: Fri, 13 Jan 2023 07:11:45 GMT
content-type: text/html; charset=utf-8
content-length: 5294
vary: Accept-Encoding
x-envoy-upstream-service-time: 23
```
The output shows that the CLB instance successfully decrypted the encrypted traffic and forwarded it to the cluster. This confirms that the HTTPS listener is correctly configured.