To ensure communication security in public networks, HTTPS is typically used for communication when services are exposed to public networks through Ingresses. This topic describes how to configure HTTPS for an APIG Ingress.

Prerequisites

A cluster has been connected. For more details, see Connecting to clusters.

The apig-controller add-on has been installed. For details, see Installing add-ons.

You have already purchased a Secure Sockets Layer (SSL) certificate and key in Volcano Engine SSL Certificate Service or created an SSL certificate and key by using OpenSSL.

Procedure

Step 1: Configure a Secret

The SSL certificate and key have been obtained. This topic takes tls.key and tls.crt as an example.

Run the following command to create a Secret named ingress-secret of type kubernetes.io/tls.

kubectl create secret tls ingress-secret --key tls.key --cert tls.crt

Step 2: Deploy an application and service

Create the YAML file of a workload. The code of the sample file deployment-demo.yaml is as follows:

apiVersion: apps/v1
kind: Deployment
metadata:
name: deployment-demo # The Deployment name.
namespace: default # The namespace where the Deployment resides.
spec:
replicas: 1 # Number of replicas for the Deployment
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx # The container name.
image: doc-cn-beijing.cr.volces.com/vke/nginx-demo:v1.0 # The container image address and tag.
ports:
- containerPort: 80 # Exposed container port number

Run the following command to create the workload.

kubectl apply -f deployment-demo.yaml

Create a YAML file for the Service. The following code is the content of a sample YAML file named service-demo.yaml.

apiVersion: v1
kind: Service
metadata:
name: service-demo # Service name
spec:
selector:
app: nginx # Bind the service to backend pods via a label selector.
ports:
- name: rule # Port mapping rule name
protocol: TCP # Service protocol, can be TCP or UDP
port: 80 # The service port.
nodePort: 30000 # NodePort, which can be an integer from 30000 to 32767.
targetPort: 80 # Container port, a port number or port name through which a workload provides service, e.g., the default port number for Nginx is 80
type: NodePort # Service type.

Execute the following command to create a service.

kubectl apply -f service-demo.yaml

Step 3: Configure the APIG Ingress

Creating through the console

Creating through kubectl

Log in to the VKE console.

In the left navigation bar, click Cluster. Click the name of the target cluster to go to the cluster management page.

In the left navigation bar, click Services and Ingresses > Ingress, and click Create Ingress.

Select Automatically create or Use existing for the Gateway specifications parameter. This topic uses an existing APIG instance as an example.

Select HTTPS for the Protocol parameter and select the configured Secret for the Certificate parameter.

In the Forwarding rules section, specify the domain name, path, and back-end service related to forwarding.

Click Confirm.

tip

For more configuration methods and descriptions of APIG Ingresses, see Creating APIG Ingresses in the console.

Validating results

Viewing configuration

Run the following command to view the APIG Ingress configurations.

kubectl get ingress

If the response is similar to the following one, the APIG Ingress has been created. The address 180.xxx.xxx.xxx is the IP address of the APIG Ingress access endpoint.

NAME CLASS HOSTS ADDRESS PORTS AGE
apig-ingress apig example.com 180.xxx.xxx.xxx 443 74s

Testing the connections to services

Run the following command to access the service by using the domain name.

If the response is similar to the following one, the back-end service is accessible through the domain name.

Operation and maintenance configuration

Using OpenSSL to create a self-signed certificate

Download OpenSSL from the OpenSSL website to your local environment and install it.

Execute the following command to generate a 4096-bit RSA private key.

openssl genrsa -out tls.key 4096

The expected result is as follows:

Generating RSA private key, 4096 bit long modulus
........+++++
...+++++
e is 65537 (0x10001)

Execute the following command to use the RSA private key to create a certificate.

openssl req -new -key tls.key -out tls.csr

The expected response is that you need to provide information such as the country, region, organization name, domain, and email address.

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:CN # A two-letter country code, for example, CN.
State or Province Name (full name) []:Shanghai # Region name, for example, Shanghai.
Locality Name (eg, city) []:Shanghai # City name, for example, Shanghai.
Organization Name (eg, company) []:vke # Organization name.
Organizational Unit Name (eg, section) []:vke # Organizational unit name.
Common Name (eg, fully qualified host name) []:example.com # Domain name of the certificate.
Email Address []:user@example.com # Email address.

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:mypassword # Password (optional).

Execute the following command to use the private key to sign the certificate and set the validity period to 365 days.

openssl x509 -req -in tls.csr -out tls.crt -signkey tls.key -days 365

At this point, the private key tls.key and certificate tls.crt required for HTTPS encryption have been created.

Replacing an HTTPS certificate

You need to perform the following steps to replace the HTTPS certificate for the APIG Ingress.

Log in to the VKE console.

In the left navigation bar, click Cluster. On the page that appears, click the name of the target cluster to go to the management page of the cluster.

In the left navigation bar, click Configurations > Secret. On the Secret page, click Create Secret to create a Secret and upload a new certificate and key.

In the left navigation bar, click Services and Ingresses > Ingress. In the Ingress list, find the Ingress for which you need to update the HTTPS certificate and click Update in the Actions column.

In the Listener configuration section, select the new Secret.

Click Confirm. The certificate update is complete. After the update is complete, click the Event tab on the Ingress details page to view the successful reconciliation events for the Ingress.

Log in to the APIG console to view certificate information.

In the left navigation bar, click Instance management. In the instance list, find the target APIG instance, and click its name to view its details.

In the left navigation bar, click Service list (Domain name). Click the name of the target service to go to the service overview page.

Click the Domain name management tab. You can view the certificate information that corresponds to the domain name in the Custom domain name section.

Volcengine Kubernetes Engine