Container Compute Service:Configure certificates for encrypted communication over HTTPS

Compatibility of certificates configured by using different methods

The following table describes the compatibility of different certificate configuration methods.

Procedure

Step 1: Create an HTTPS listener in an AlbConfig

1. Run the following command to edit the albconfig configuration file:

   kubectl edit albconfig <Albconfig_Name>

2. Modify the configurations based on your business requirements. You can configure the port and protocol parameters in the Albconfig to create a corresponding listener.

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: alb
   spec:
     config:
       addressAllocatedMode: Fixed
       addressType: Internet
       zoneMappings:
       - vSwitchId: vsw-bp19sXXXXXXX176iv
       - vSwitchId: vsw-bp1boXXXXXXXu74xz
     listeners:
     - port: 80
       protocol: HTTP
     - port: 443           # New content  
       protocol: HTTPS     # New content

(Optional) Step 2: Create a self-signed certificate

Run the following OpenSSL commands to create a self-signed certificate:

openssl genrsa -out albtop-key.pem 4096
openssl req -subj "/CN=demo.alb.ingress.top" -sha256  -new -key albtop-key.pem -out albtop.csr
echo subjectAltName = DNS:demo.alb.ingress.top > extfile.cnf
openssl x509 -req -days 3650 -sha256 -in albtop.csr -signkey albtop-key.pem -out albtop-cert.pem -extfile extfile.cnf

Expected results:

Certificate request self-signature ok
subject=CN=demo.alb.ingress.top

Step 3: Create sample resources

In addition to the AlbConfig you created, you need to create a Deployment, Service, IngressClass, and Ingress to make an ALB Ingress function as normal. You can use the following YAML template to create the preceding resources.

1. Create a file named https-quickstart.yaml and copy the following content to the file:

   Show the YAML file content

   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     name: https-ingressclass
   spec:
     controller: ingress.k8s.alibabacloud/alb
     parameters:
       apiGroup: alibabacloud.com
       kind: AlbConfig
       name: alb # Set the value to the name of the AlbConfig you created.
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: https-ingress
   spec:
     ingressClassName: https-ingressclass
     rules:
     - host: demo.alb.ingress.top # Replace demo.alb.ingress.top with the domain name that you want to use.
       http:
         paths:
         - backend:
             service:
               name: https-svc
               port:
                 number: 443
           path: /
           pathType: Prefix
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: https-deploy
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: https-deploy
     template:
       metadata:
         labels:
           app: https-deploy
       spec:
         containers:
           - image: registry.cn-hangzhou.aliyuncs.com/acs-sample/old-nginx:latest
             imagePullPolicy: IfNotPresent
             name: https-deploy
             ports:
               - containerPort: 80
                 protocol: TCP
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: https-svc
   spec:
     ports:
       - name: port1
         port: 443
         protocol: TCP
         targetPort: 80
     selector:
       app: https-deploy
     sessionAffinity: None
     type: ClusterIP

2. (Optional) If both HTTP listeners and HTTPS listeners are configured in the AlbConfig, add the annotations field to the Ingress configurations. Example:

   Add annotations if multiple listeners are used

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: https-ingress
     annotations:
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]' # Add this annotation if the ALB Ingress is associated with multiple listeners.
   spec:
     #...

3. Run the following command to create the preceding resources:

   kubectl apply -f https-quickstart.yaml

Step 4: Configure certificates

Step 5: Verify the result

Access the application over HTTPS to check whether the certificate is configured.

1. Run the following command to query the Ingress:

   kubectl get ingress

   Expected results:

   NAME            CLASS                HOSTS                  ADDRESS                         PORTS     AGE
   https-ingress   https-ingressclass   demo.alb.ingress.top   alb-********.alb.aliyuncs.com   80, 443   83m

   Record the values in the HOSTS and ADDRESS columns.

2. Run the following command to access the backend Service of the ALB Ingress: Replace demo.alb.ingress.top and alb-********.alb.aliyuncs.com with the values you obtained in the preceding step.

   curl -H HOST:demo.alb.ingress.top -k https://alb-********.alb.aliyuncs.com

   If the following output is returned, the certificate is configured:

   old

References

• If you want to receive requests from clients that use the HTTP/3 protocol, see Use QUIC listeners to support HTTP/3 and improve network performance

• If you want to use a listener to enable HTTPS mutual authentication, see Use HTTPS mutual authentication to enhance service security.