Container Service for Kubernetes:Configure an HTTPS certificate for encrypted communication

ACK console

1. Upload the certificate to the Certificate Management Service console. See Upload and share an SSL certificate.

2. Log on to the ACK console and navigate to your cluster. In the left-side navigation pane, choose Network > Ingresses.

3. Find https-ingress and click Update in the Actions column.

4. In the Modify Ingress panel, set these parameters:

   Parameter	Description	Example
   TLS Settings > Domain Name	The domain name bound to the certificate. Must match rules.host.	demo.alb.ingress.top
   TLS Settings > Secret	Leave blank to use automatic certificate discovery.	(blank)
   Annotations (optional)	Add alb.ingress.kubernetes.io/listen-ports if you need to listen on both HTTP and HTTPS.	Name: alb.ingress.kubernetes.io/listen-ports; Value: [{"HTTP": 80},{"HTTPS": 443}]

   

kubectl

1. Upload the certificate to the Certificate Management Service console. See Upload and share an SSL certificate.

2. Edit the Ingress:

   kubectl edit ingress https-ingress

3. Add the tls field. Set hosts to the domain name bound to the certificate — it must match rules[].host.

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
   #  annotations:
   #    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'  # Uncomment to listen on both HTTP and HTTPS.
     name: https-ingress
   spec:
     ingressClassName: https-ingressclass
     rules:
     - host: demo.alb.ingress.top # Replace with your domain name.
       http:
         paths:
         - backend:
             service:
               name: https-svc
               port:
                 number: 443
           path: /
           pathType: Prefix
     tls:
     - hosts:
       - demo.alb.ingress.top # Must match rules[].host — the controller uses this domain to look up the certificate.

ACK console

1. Log on to the ACK console and navigate to your cluster. In the left-side navigation pane, choose Network > Ingresses.

2. Find https-ingress and click Update in the Actions column.

3. In the Modify Ingress panel, set these parameters:

   Parameter	Description	Example
   TLS Settings > Domain Name	The domain name bound to the certificate.	demo.alb.ingress.top
   TLS Settings > Secret	The Secret storing the certificate. To create one, click Create next to the field. In the Create Secret dialog box, set Name, Cert (not Base64-encoded), and Key (not Base64-encoded), then click OK.	Secret name: https-secret
   Annotations (optional)	Add alb.ingress.kubernetes.io/listen-ports to listen on both HTTP and HTTPS.	Name: alb.ingress.kubernetes.io/listen-ports; Value: [{"HTTP": 80},{"HTTPS": 443}]

   

kubectl

1. Create the Secret. Create a file named https-secret.yaml. Replace placeholders with Base64-encoded certificate and key content. For encoding, see Step 2.

   apiVersion: v1
   kind: Secret
   metadata:
     name: https-secret
   type: kubernetes.io/tls
   data:
     tls.key: |  # Base64-encoded content of albtop-key.pem.
       {base64 albtop-key.pem}
     tls.crt: |  # Base64-encoded content of albtop-cert.pem.
       {base64 albtop-cert.pem}

   Apply the Secret:

   kubectl apply -f https-secret.yaml

2. Edit the Ingress.

   kubectl edit ingress https-ingress

   Add the tls field with both hosts and secretName:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
   #  annotations:
   #    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'  # Uncomment to listen on both HTTP and HTTPS.
     name: https-ingress
     namespace: default
   spec:
     ingressClassName: alb
     rules:
     - host: demo.alb.ingress.top # Replace with your domain name.
       http:
         paths:
         - backend:
             service:
               name: https-svc
               port:
                 number: 443
           path: /
           pathType: Prefix
     tls:
     - hosts:
       - demo.alb.ingress.top   # Must match rules[].host — the controller uses this domain to look up the certificate.
       secretName: https-secret # The Secret that stores the certificate.

ACK console

1. Get the certificate ID. Upload the certificate to Certificate Management Service if you haven't already. See Upload and share an SSL certificate. To find the certificate ID:

   1. Log on to the Certificate Management Service console.

   2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

   3. On the Manage Uploaded Certificates tab, find the certificate and click More in the Actions column.

   4. In the Certificate Details panel, copy the CertIdentifier value.

2. Add the certificate to the AlbConfig.

   1. Log on to the ACK console and navigate to your cluster. Choose Workloads > Custom Resources.

   2. Search for AlbConfig, find the resource named alb, and click Edit YAML in the Actions column.

   3. In the View in YAML panel, add these fields to the HTTPS listener:

      Field	Description	Example
      certificates	Certificate configuration block	—
      CertificateId	The CertIdentifier value from Certificate Management Service	756****-cn-hangzhou
      IsDefault	Whether this is the default certificate for the listener	true

      

3. Update the Ingress to route traffic to the HTTPS listener.

   1. In the left-side navigation pane, choose Network > Ingresses.

   2. Find https-ingress and click Update in the Actions column.

   3. Add the alb.ingress.kubernetes.io/listen-ports annotation:

      Parameter	Value
      Name	alb.ingress.kubernetes.io/listen-ports
      Value	[{"HTTPS": 443}] — change to [{"HTTP": 80},{"HTTPS": 443}] to also listen on HTTP

      

kubectl

Specifying a certificate in AlbConfig disables automatic discovery for that listener.

1. Upload the certificate to Certificate Management Service. See Upload and share an SSL certificate.

2. Get the certificate ID.

   1. Log on to the Certificate Management Service console.

   2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

   3. On the Manage Uploaded Certificates tab, find the certificate and click More in the Actions column.

   4. In the Certificate Details panel, copy the CertIdentifier value.

3. Edit the AlbConfig:

   kubectl edit albconfig <ALBCONFIG_NAME>

   Add the certificates field to the HTTPS listener:

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: alb
   spec:
     config:
       addressType: Intranet
       name: xiaosha-alb-test
     listeners:
       - port: 80
         protocol: HTTP
       - certificates:
           - CertificateId: 756****-cn-hangzhou   # The CertIdentifier from Certificate Management Service.
             IsDefault: true                       # Set to true to use as the default certificate.
         port: 443
         protocol: HTTPS

4. Edit the Ingress:

   kubectl edit ingress https-ingress

   Add the alb.ingress.kubernetes.io/listen-ports annotation:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}]'  # Change to '[{"HTTP": 80},{"HTTPS": 443}]' to also listen on HTTP.
     name: https-ingress
   spec:
     ingressClassName: https-ingressclass
     rules:
     - host: demo.alb.ingress.top # Replace with your domain name.
       http:
         paths:
         - backend:
             service:
               name: https-svc
               port:
                 number: 443
           path: /
           pathType: Prefix