Alibaba Cloud Service Mesh:Use SSL certificates provided by Certificate Management Service in an ASM gateway

Prerequisites

• An SSL certificate is available in the Certificate Management Service console. You can purchase a certificate or upload an existing one.

• The httpbin application is deployed in your ASM-managed cluster.

Step 1: Grant Certificate Management Service access to the ACK cluster

Certificate Management Service uses the AliyunCASDefaultRole Resource Access Management (RAM) role to access and manage ACK clusters. Grant this role the required permissions before deploying certificates.

1. Log on to the ACK console. In the left-side navigation pane, click Authorizations.

2. Click the RAM Roles tab, enter AliyunCASDefaultRole in the search box, and then click Manage Permissions.

   Note: If the message AliyunCASDefaultRole Does Not Exist appears, create the RAM role for Certificate Management Service and grant permissions first.

3. In the Permission Management dialog box, click + Add Permissions and configure the following fields:

   Field	Value
   Cluster	Select the target cluster from the drop-down list.
   Namespace	Select istio-system.
   Permission Management	Select Restricted User.

4. Click Submit Authorization.

Step 2: Deploy the certificate to the ACK cluster

After deployment, Certificate Management Service creates a Kubernetes Secret of type kubernetes.io/tls in the istio-system namespace. The ingress gateway reads this Secret for TLS termination.

Note: This topic uses the domain name test.com as an example. Replace it with your actual domain.

kubectl -n istio-system get secret -l alibabacloud.com/ssl-certificate-identifier=${CertIdentifier of the SSL certificate}

NAME                TYPE                DATA   AGE
cas-cert-305xxx76   kubernetes.io/tls   2      10m

Step 3: Configure the Gateway resource for HTTPS

Update the Istio Gateway resource that was created when you deployed the httpbin application. Add an HTTPS server block that references the Secret from the previous step.

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: httpbin
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
        - '*'
      port:
        name: test
        number: 80
        protocol: HTTP
    - hosts:
        - 'test.com'
      port:
        name: https
        number: 443
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: cas-cert-305xxx76  # Replace with your Secret name from Step 2
EOF

Key fields in the HTTPS server block:

Step 4: Verify HTTPS access

1. Get the ingress gateway IP address:

   export GATEWAY_IP=$(kubectl get service istio-ingressgateway -n istio-system -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

2. Send a test request over HTTPS:

   curl -vk --resolve test.com:443:${GATEWAY_IP} https://test.com/status/418

   Expected output (abbreviated):

   * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
   * ALPN, server accepted to use h2
   * Server certificate:
   *  subject: CN=test.com; O=myexample organization
   ...
   > GET /status/418 HTTP/2
   > Host: test.com
   ...
   < HTTP/2 418
   < server: istio-envoy
   ...
   
       -=[ teapot ]=-
   
          _...._
        .'  _ _ `.
       | ."` ^ `". _,
       \_;`"---"`|//
         |       ;/
         \_     _/
           `"""`

   A successful response includes both TLS handshake details (TLSv1.3, server certificate for test.com) and an HTTP/2 418 status code from the httpbin application.