Enable secure HTTPS access in Kubernetes-Container Service for Kubernetes(ACK)-阿里云帮助中心

Container Service for Kubernetes (ACK) clusters support multiple ways to access applications, such as by using an <SLB-Instance-IP>:<Port> address, a <NodeIP>:<NodePort> address, or a domain name. By default, HTTPS access is not supported. Container Service for Kubernetes (ACK) and Server Load Balancer (SLB) let you secure your applications with HTTPS. This topic demonstrates how to configure your own certificates in an ACK cluster to enable secure HTTPS access.

Prerequisites

Create an ACK managed cluster.

Create a server certificate for the cluster, including a public key certificate and a private key.

You can run the following command to quickly create a self-signed server certificate. Fill in the certificate information when prompted.

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt

Output:

Generating a 2048 bit RSA private key
.......+++
.......+++
writing new private key to 'tls.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:CN
State or Province Name (full name) []:zhejiang
Locality Name (eg, city) []:hangzhou
Organization Name (eg, company) []:alibaba
Organizational Unit Name (eg, section) []:test
Common Name (eg, fully qualified host name) []:foo.bar.com # Note: You must configure a valid domain name.
Email Address []:te**@alibaba.com

The generated certificate file tls.crt and private key file tls.key are saved in the current directory.

Alternatively, you can purchase a certificate issued by Alibaba Cloud. For more information, see Create a certificate.

Background information

You can configure certificates in one of two ways, depending on how you expose access to your application:

Configure the certificate on the frontend Server Load Balancer (SLB) instance.
Configure the certificate in an Ingress.

Configure an HTTPS certificate on an SLB

This method has the following characteristics:

Pros: The certificate is configured on the SLB instance, which acts as the entry point for external traffic. Communication within the cluster continues over HTTP.
Cons: You need to maintain more mappings between domain names and IP addresses.
Use cases: Your application is exposed through a Service of type LoadBalancer instead of an Ingress.

Preparations:

You have created an Nginx application in your ACK cluster. The application is exposed by a Service of type LoadBalancer. For more information, see Create a stateless Deployment.

Procedure:

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Network > Services.
Select the namespace of the Service and find the Service in the list. View its External IP. You can access the application by using <SLB IP>:<Port>.

After accessing the application, the default Welcome to nginx! page appears. This confirms that the application is deployed and accessible.
Log on to the SLB console.
Configure the SSL certificate.
- If you created the server certificate by running the openssl command, you must upload the public key certificate and private key as a non-Alibaba Cloud certificate. For more information, see Create a certificate.
- If you purchased a certificate from Alibaba Cloud, skip this step. For more information about how to create an Alibaba Cloud-issued certificate, see Create a certificate.
In the certificate list, find your certificate and note its ID.
In the list of services in the ACK console, find the service that you created and click Update in the Actions column.

In the Update Service dialog box, add the following two annotations to the Annotations section.

Note: Do not reuse the Server Load Balancer (SLB) for the cluster's API server. This can cause cluster access issues.

Annotation	Name	Value
Annotation 1	service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port	https:443
Annotation 2	service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id	${YOUR_CERT_ID}

Note

Replace ${YOUR_CERT_ID} with the certificate ID generated in Step 7. Configure an SSL certificate.

Alternatively, add the annotations using YAML. The following is a complete YAML example:

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "https:443"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "${YOUR_CERT_ID}"
  name: nginx
  namespace: default
spec:
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 80
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
  type: LoadBalancer

Note

Set the targetPort for HTTPS port 443 to 80, which is the port for HTTP.

To access the Nginx application over HTTPS, enter https://<slb-instance-ip> in your browser.

The page displays the Welcome to nginx! default welcome page. This confirms a successful HTTPS connection to the Nginx application through the SLB instance.

Configure a certificate on an Ingress

This method has the following features:

Benefit: You do not need to change the Server Load Balancer (SLB) configuration. Each application can manage its own certificate through an Ingress without affecting other applications.
Scenarios: This method is suitable when each application requires a separate certificate for access, or when some applications in the cluster require certificates for access.

Prerequisites

You have created a Tomcat application in the Kubernetes cluster, and its Service is exposed by using the ClusterIP type. This example uses an Ingress to provide external HTTPS access. For more information, see Create a Deployment.

Example

Run the following command to create a Secret using the certificate prepared in the prerequisites.
Note
Correctly configure the domain name. Otherwise, you will encounter issues when you access the application over HTTPS.
```
kubectl create secret tls secret-https --key tls.key --cert tls.crt      
```
Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Network > Ingresses.
On the Ingresses page, click Create Ingress.
In the Create Ingress dialog box, configure an Ingress for HTTPS access, and then click OK.
For more information about how to configure an Ingress, see Create an Ingress. This example uses the following configurations.
- Name: Enter a name for the Ingress.
- Domain Name: The domain name that you configured. This must be the same as the domain name in the SSL certificate.
- Service: Select the Service that corresponds to the Tomcat application. The port is 8080.
- TLS Settings: Enable TLS and select the created Secrets.
You can also create an Ingress by using a YAML file. The following code provides a sample YAML file for this example.
```
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
   name: tomcat-https
spec:
  tls:
  - hosts:
    - foo.bar.com
    secretName: secret-https
  rules:
  - host: foo.bar.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: tomcat-svc
            port:
              number: 8080
```
Return to the Ingress list and view the created Ingress. In this example, the domain name is foo.bar.com. View the endpoint and domain name. You can also go to the Ingress details page to view them.
Note
This example uses foo.bar.com as the test domain name. You need to add a record to the hosts file.
```
47.110.119.203  foo.bar.com                   # The IP address is the endpoint of the Ingress.
```
In a browser, visit https://foo.bar.com.

Note
Because a TLS certificate is used for access, you must use HTTPS to access the domain name. For this application, this example uses foo.bar.com and resolves it locally. In a real-world scenario, use a domain name that has an ICP filing.

Visit https://foo.bar.com in a browser. The default welcome page of Apache Tomcat/8.5.34 appears. The page displays the message: If you're seeing this, you've successfully installed Tomcat. Congratulations! This indicates that the application is successfully accessed through the domain name.