Docs

Volcengine Kubernetes Engine

Nginx Ingress

Configure HTTPS for Nginx Ingress

To ensure secure communication in a public network environment, when services are exposed to the public network using Ingress, they typically use the HTTPS protocol for communication. This article describes how to configure HTTPS for Nginx Ingress.

Prerequisites

The cluster has been connected. For more details, refer to Connecting to a cluster.

The ingress-nginx add-on has already been installed in the cluster. For more details, refer to the ingress-nginx add-on.

You have already purchased or used SSL certificates and keys in SSL Certificate Service or created them using OpenSSL.

Procedure

Step 1: Configure Secret

The SSL certificate and key have been obtained; this document uses tls.key and tls.crt as examples.

Run the following command to create a Secret named ingress-secret with the type kubernetes.io/tls.

Step 2: Deploy applications and services

Create the YAML file of the workload. The code of the sample file deployment-demo.yaml is as follows:

Run the following command to create the workload.

Create a YAML file for the Service. Here is an example file named service-demo.yaml :

warning

When the cluster's network model is Flannel, only Services of the NodePort and LoadBalancer types can be selected and associated.

When the network model of the cluster is VPC-CNI:

If Ingress has enabled LB-to-pod direct access mode, it supports associating with and selecting Service of type NodePort, LoadBalancer, or ClusterIP.

If Ingress does not enable LB-to-pod direct access mode, it only supports associating with and selecting NodePort or LoadBalancer type services.

Execute the following command to create a service.

Step 3: Configure Nginx Ingress

Create an Ingress YAML file. The code for the example file nginx-ingress.yaml is as follows:

tip

In a public network environment, you need to independently ensure the DNS resolution mapping between your custom domain and the EIP of the ingress LoadBalancer.

When the HTTPS protocol is selected, the system will open both port 80 and port 443 by default. To ensure data security, it is recommended to configure port 80 redirection, that is, redirect HTTP to HTTPS. For details, refer to Nginx Ingress redirect rule configuration.

Run the following command to create an Ingress.

Result validation

Viewing configuration

Run the following command to view the ingress configuration.

The expected response result is as follows, indicating that the Ingress was created successfully. Here, 180.xxx.xxx.xxx is the public or private IP address of the CLB associated with Nginx Ingress.

Testing the connections to services

Use the following commands to access the Service via domain name.

warning

When you use a self-signed certificate, you can use the -k or --insecure parameter to ignore certificate validation.

When using TLS certificates in a production environment, it is recommended that you use official trusted certificates. Using a self-signed certificate and ignoring certificate verification may expose you to man-in-the-middle attacks.

The expected output is as follows, indicating that the backend service can be accessed via the domain name.

Operation and maintenance configuration

How to replace an HTTPS certificate

When you need to replace the HTTPS certificate for Nginx Ingress, you must follow the procedure below:

On the cluster list page, click the target cluster name to enter the cluster management page.

In the left navigation bar, select Services and Ingresses > Ingress. In Ingress, select the Ingress rule for which you need to update the HTTPS certificate. In the Actions column, click Update.

In the Listener configuration section, click Create Secret to create a secret.

Create and upload new certificates and keys, and click Confirm to update the Ingress.

Click the Ingress name, and on the Ingress details page, click the Event tab to view the successful reconciliation events for the Ingress.

Last updated: 2026.07.24 14:51:36