Create an HTTPS listener on the CLB instance for an ingress gateway - Alibaba Cloud Service Mesh

By default, traffic reaches an Alibaba Cloud Service Mesh (ASM) ingress gateway pod as unencrypted HTTP. To add HTTPS support and dynamic certificate loading, bind a TLS certificate to the Classic Load Balancer (CLB) instance of the ingress gateway. The CLB instance then terminates TLS on port 443, decrypts requests, and forwards them as HTTP to port 80 on the gateway pod.

How it works

After you configure an HTTPS listener, requests flow through the following path:

A client sends an HTTPS request to port 443 of the CLB instance.
The CLB instance decrypts the request using the bound certificate.
The CLB instance forwards the decrypted HTTP request to port 80 on the ingress gateway pod.
The ingress gateway pod routes the request to the target service in the cluster.

Encrypted traffic is decrypted into plaintext at the CLB layer, before it enters the cluster.

Prerequisites

Before you begin, make sure that you have:

Step 1: Prepare the certificate

Bind a TLS certificate to the CLB instance. If you already have a certificate and private key for your domain, name them aliyun.com.crt and aliyun.com.key, then skip to Upload the certificate to Alibaba Cloud. Otherwise, generate them first.

Generate a root certificate and private key

If you do not have a certificate, use openssl to generate one.

Run the following command to generate a root certificate and private key: This creates two files:
- aliyun.root.key -- the root private key
- aliyun.root.crt -- the root certificate, valid for 365 days
```
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 \
  -subj '/O=myexample Inc./CN=aliyun.com' \
  -keyout aliyun.root.key \
  -out aliyun.root.crt
```

Upload the certificate to Alibaba Cloud

Upload the generated or existing certificate to Alibaba Cloud. The CLB instance references this certificate to terminate TLS.

Log on to the Server Load Balancer CLB console.
In the left-side navigation pane, choose Server Load Balancer CLB > Certificate Management.
On the Certificate Management page, click Create Certificate.
In the Create Certificate panel, select Alibaba Cloud Issued Certificate, then click Create SSL Certificate at the bottom of the certificate list.
The Digital Certificate Management Service page opens. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.
On the Upload Certificate tab, click Upload Certificate. Set Certificate Name to aliyun.com, paste the certificate content into Certificate File, and paste the private key into Certificate Private Key. Click OK.
Ignore the certificate chain prompt.
Return to the Server Load Balancer CLB console and create a certificate that references the uploaded SSL certificate. For details, see Select Alibaba Cloud Issued Certificate.
Record the certificate ID. You need it in the next step.

Step 2: Create the HTTPS listener

Configure the ingress gateway to create an HTTPS listener on the CLB instance. For background on managing ingress gateways with YAML, see Use KubeAPI to manage ingress gateways.

Add the following port and annotation configuration to your ingressgateway.yaml file: Replace the following placeholder with your actual value: Key configuration details:

Placeholder	Description	Example
`<your-cert-id>`	The certificate ID from Step 1	`72365xxx-cn-hangzhou`

Field	Purpose
`https-1` port entry	Listens on port 443 with HTTPS but forwards to `targetPort: 80` on the gateway pod
`alibaba-cloud-loadbalancer-cert-id` annotation	Binds the certificate to the CLB instance
`alibaba-cloud-loadbalancer-protocol-port` annotation	Specifies that port 443 uses HTTPS

spec:
  # ... other configuration ...
  ports:
    - name: http-0
      port: 80
      protocol: HTTP
      targetPort: 80
    - name: https-1
      port: 443
      protocol: HTTPS
      targetPort: 80
  # ... other configuration ...
  serviceAnnotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "<your-cert-id>"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "https:443"
  # ... other configuration ...
  serviceType: LoadBalancer

Deploy the ingress gateway:
```
kubectl apply -f ingressgateway.yaml
```

Step 3: Verify the HTTPS listener

After deployment, confirm that the HTTPS listener is working.

Get the ingress gateway endpoint:
1. Log on to the ASM console.
2. In the left-side navigation pane, choose Service Mesh > Mesh Management.
3. On the Mesh Management page, click the name of the target ASM instance.
4. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
5. On the Ingress Gateway page, find the Endpoint of the target gateway. This is the IP address of the target gateway.
Send an HTTPS request to verify connectivity. Replace <ingress-gateway-ip> with the endpoint IP address from the previous step:
```
curl -k -H Host:a.aliyun.com \
  --resolve a.aliyun.com:443:<ingress-gateway-ip> \
  https://a.aliyun.com/productpage -I
```
Check the output. A successful response looks like this: An HTTP/2 200 status confirms that the CLB instance is decrypting HTTPS traffic and forwarding it to the ingress gateway pod.
```
HTTP/2 200
date: Fri, 13 Jan 2023 07:11:45 GMT
content-type: text/html; charset=utf-8
content-length: 5294
vary: Accept-Encoding
x-envoy-upstream-service-time: 23
```

Troubleshooting

If the HTTPS listener does not work as expected, check the following:

Issue	Possible cause	Action
Connection refused on port 443	The HTTPS port is not configured	Verify that the `https-1` port entry exists in your `ingressgateway.yaml` and redeploy the service
Certificate error in browser or curl	Wrong certificate ID	Confirm that the `alibaba-cloud-loadbalancer-cert-id` annotation matches the certificate ID from the CLB console
`HTTP 503` or `HTTP 502` response	Ingress gateway pod is not ready, or the target service is unavailable	Check the pod status with `kubectl get pods` and verify that the target application is running
TLS handshake failure	Certificate and domain name mismatch	Make sure the certificate covers the domain used in the request (for example, `a.aliyun.com`)