Manage gateway certificates with cert-manager - Alibaba Cloud Service Mesh

cert-manager is a certificate lifecycle management system that automates certificate requests and deployments. You can use cert-manager to issue certificates for an ASM gateway. This allows you to secure services accessed through the gateway with HTTPS, ensuring data is encrypted in transit. This topic describes how to use cert-manager to manage certificates for gateways.

Background information

cert-manager can issue self-signed certificates and DNS-validated certificates, which allow you to access services through an ASM gateway over HTTPS. The differences between these two types of certificates are as follows:

A self-signed certificate provides encryption but not identity verification. You can use it to access the ASM gateway over HTTPS from command-line tools. However, web browsers do not trust self-signed certificates and will display a security warning, which prevents access through a web browser.
A DNS-validated certificate is issued by a trusted certificate authority (CA) and provides both encryption and identity verification. It offers higher security than a self-signed certificate and is trusted by web browsers. You can use a DNS-validated certificate to access the ASM gateway over HTTPS from both command-line tools and web browsers.

Note

If you encounter an error while using cert-manager in an ASM data plane cluster, join the DingTalk group (ID: 30421250) for assistance.

Prerequisites

Install cert-manager

Install Helm on your local machine. For more information, see Helm.
Connect to your cluster using kubectl. For more information, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.
Run the following command to create the cert-manager namespace:
```
kubectl create namespace cert-manager
```
Run the following command to add the cert-manager chart repository:
```
helm repo add jetstack https://charts.jetstack.io
```
Run the following command to update the cert-manager chart repository:
```
helm repo update
```
Run the following command to install cert-manager.

Note
The cert-manager version must be compatible with your Kubernetes version. For information about version compatibility, see Supported Releases.
```
helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --version v1.14  \
  --set installCRDs=true
```

Issue a self-signed certificate

Step 1: Generate a self-signed certificate

Create a file named issuer.yaml with the following content.

Show issuer.yaml

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: istio-ingressgateway-certs
spec:
  isCA: true
  duration: 2160h # 90d
  secretName: istio-ingressgateway-certs
  commonName: istio-ingressgateway-certs
  subject:
    organizations:
    - cluster.local
    - cert-manager
  issuerRef:
    name: selfsigned
    kind: Issuer
    group: cert-manager.io

Run the following command to create a self-signed CA to issue workload certificates:
```
kubectl apply -f issuer.yaml -n istio-system
```

Run the following command to verify that the certificate Secret has been created:

kubectl get secret -n istio-system

Expected output:

NAME                                        TYPE                             DATA         AGE
istio-ingressgateway-certs                  kubernetes.io/tls                3            68m

Step 2: Verify access over HTTPS

Deploy the httpbin application. For more information, see Deploy the httpbin application.

Modify the Gateway for the httpbin application.

You can perform this modification from the command line using the kubeconfig file for your ASM instance, or on the ASM console by modifying the YAML on the Gateway page. For more information, see Manage Gateway rules.

The following YAML example adds an HTTPS listener on port 443 that uses the certificate created by cert-manager.

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: httpbin
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
        - '*'
      port:
        name: test
        number: 80
        protocol: HTTP
    - hosts:
        - '*'
      port:
        name: https
        number: 443
        protocol: HTTPS
      tls:
        credentialName: istio-ingressgateway-certs
        mode: SIMPLE

Run the following command to get the IP address of the ingress gateway:
```
kubectl get svc -n istio-system -l istio=ingressgateway
```
Run the following command to access the httpbin application over HTTPS:
```
curl -k --resolve istio-ingressgateway-certs:443:${ASM_GATEWAY_IP} https://istio-ingressgateway-certs/status/418 -I
```
If the request is successful, a 418 status code is returned. The domain for accessing the gateway is istio-ingressgateway-certs, which matches the commonName set in the Certificate resource.