Securely access a Knative service over HTTPS by using an ASM gateway - Alibaba Cloud Service Mesh

An ASM gateway supports the HTTPS protocol and dynamic certificate loading. To securely access and manage microservices built with Knative, you can use an ASM gateway to enable HTTPS access. This encrypts traffic to service endpoints, protecting communication between services and enhancing the security and reliability of your architecture.

Prerequisites

You have created a Knative service in Knative on ASM. For more information, see Deploy a serverless application on ASM with Knative.
You have used the custom domain name aliyun.com in Knative on ASM. For more information, see Use a custom domain name in Knative on ASM.

Create a certificate and a private key

Before you use a domain name, you must obtain an Internet Content Provider (ICP) filing for the domain name. This example uses the domain name aliyun.com to generate a certificate and a private key and saves them as a Secret.

Note

If you already have a valid certificate and private key for aliyun.com, name the certificate file aliyun.com.crt and the private key file aliyun.com.key.

If you do not have a certificate and private key for aliyun.com, you can use OpenSSL to generate them by following these steps.

Run the following command to create a root certificate and private key.

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt

Run the following commands to generate a certificate and private key for the aliyun.com server.

openssl req -out aliyun.com.csr -newkey rsa:2048 -nodes -keyout aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"
openssl x509 -req -days 365 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in aliyun.com.csr -out aliyun.com.crt

After the certificate and private key are ready, run the following command in the KubeConfig context of the cluster where the ingress gateway pod resides. This command creates a Secret that contains the certificate and private key in the istio-system Namespace. Make a note of the Secret name.

kubectl create -n istio-system secret tls myexample-credential --key=aliyun.com.key --cert=aliyun.com.crt

Enable HTTPS access

Save the following content as default.yaml.

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMKnativeConfig
metadata:
  name: default
spec:
  enabled: true
  useExisting: true
  tag: 1.4.0
  domainConfig:
    domainName: aliyun.com # Replace this with your domain name.
    credentialName: myexample-credential # Replace this with the name of your Secret.

Use kubectl to connect to Service Mesh and run the following command.
```
kubectl apply -f default.yaml
```

Access the service over HTTPS

Update the hosts file to add a mapping for the new domain name.

For example:

Note
Replace xx.xx.xxx.xx with your actual gateway IP address. For information about how to obtain the gateway IP address, see Obtain the IP address of the ingress gateway.
```
xx.xx.xxx.xx helloworld-go.default.aliyun.com
```
Access the service over HTTPS.
- Access from the command line
  
  Run the following command to access the service over HTTPS by using the certificate.
```
curl -k --cert aliyun.com.crt --key aliyun.com.key https://helloworld-go.default.aliyun.com

# Expected output
Hello Knative!
```
- Access from a browser
  
  Enter https://helloworld-go.default.aliyun.com in the address bar of your browser.
```
Hello Knative!
```
  Note
  Because a self-signed certificate is used, your browser may display a security warning when you access the service. You can safely proceed.

Related operations

Knative on ASM provides traffic-based canary release capabilities. When you create a Knative service, Knative automatically creates the first Revision for the service. Each time the service configuration changes, Knative creates a new Revision. You can implement a canary release by changing the percentage of traffic routed to different Revisions. For more information, see Perform a traffic-based canary release for a Knative service in Knative on ASM.
Knative Serving injects a queue-proxy container into each Pod. This container reports concurrency metrics for the application container to the Autoscaler. After receiving these metrics, the Autoscaler enables autoscaling by adjusting the number of Pods in the Deployment based on the number of concurrent requests and the scaling algorithm. For more information, see Autoscale a service based on the number of concurrent requests.