Configure HTTPS access for a Knative Service-Container Service for Kubernetes(ACK)-阿里云帮助中心

If you use a custom domain for a Knative Service, configure an HTTPS certificate for it to secure data in transit. Knative supports HTTPS access, letting you securely map a Knative Service to a custom domain.

Prerequisites

Knative is deployed in your cluster. For more information, see Deploy Knative.

Step 1: Create a Knative Service

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your target cluster. In the left-side navigation pane, choose Applications > Knative.
On the Knative page, on the Services tab, set Namespace to default, and then click Create from Template. Use the sample template to create a Knative Service named helloworld-go. Follow the on-screen instructions.
After the service is created, the Services tab shows the helloworld-go service with a status of Successful. The default domain name is helloworld-go.default.example.com. Before accessing the service, configure the Host header to ensure that requests to the service's domain are routed by the access gateway.

Step 2: Configure HTTPS service

The HTTPS configuration method depends on your gateway type:

ALB gateway: An AlbConfig manages certificates. You enable TLS by adding an Annotation, eliminating the need for manual certificate handling.
Kourier gateway: You must manually create a certificate Secret and then use a DomainMapping to bind the Secret to the domain.

ALB

You can specify a certificate in the ALBConfig and enable TLS access in the Knative Service by using the Annotationknative.k8s.alibabacloud/tls: "true". The following is an example.

To enable HTTPS access, add a TLS Annotation to your Knative Service and configure a listener on port 443 in your AlbConfig.

Add the knative.k8s.alibabacloud/tls: "true" Annotation to the YAML file of your Knative Service.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld
  namespace: default
  annotations:
    knative.k8s.alibabacloud/tls: "true"
spec:
  template:
    spec:
      containers:
      - image: registry-vpc.cn-shenzhen.aliyuncs.com/knative-sample/helloworld-go:73fbdd56  # Replace with your region.
        env:
        - name: TARGET
          value: "Knative"

Add a listener on port 443 to your AlbConfig, such as knative-internet, to route HTTPS traffic to the cluster.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: knative-internet
spec:
  config:
  ...
  listeners:
    - port: 443
      # Options include HTTP, HTTPS, and QUIC
      protocol: HTTPS 
  ...

Verify that the service is accessible over HTTPS.

# Replace with your ALB gateway address.
curl -H "Host: helloworld.knative.top" https://alb-ppcate4ox6******.cn-beijing.alb.aliyuncs.com -k

Expected output:

Hello Knative!

Kourier

The Kourier gateway lacks built-in certificate management. You must store the TLS certificate as a Secret in the cluster and then use a DomainMapping to bind the certificate to the domain.

1. Create a certificate Secret

The following example uses an OpenSSL self-signed HTTPS certificate. If you already have a certificate file in .pem format, you can skip Step 1 and start from Step 2.

Self-signed certificates are for testing purposes only. In production environments, use a certificate issued by a Certificate Authority (CA).

Create a self-signed certificate by using OpenSSL.

openssl genrsa -out knativetop-key.pem 4096
openssl req -subj "/CN=helloworld.knative.top" -sha256  -new -key knativetop-key.pem -out knativetop.csr
echo subjectAltName = DNS:helloworld.knative.top > extfile.cnf
openssl x509 -req -days 3650 -sha256 -in knativetop.csr -signkey knativetop-key.pem -out knativetop-cert.pem -extfile extfile.cnf

Expected output:

Signature ok
subject=CN = helloworld.knative.top
Getting Private key

Optionally, get the Base64 encoding of the knativetop-key.pem and knativetop-cert.pem files from step 1. This is only required if you create the Secret manually from a YAML file, not for the kubectl command in the next step.
- Apply Base64 encoding to knativetop-key.pem.
```
cat knativetop-key.pem | base64
```
  Expected output:
```
a25hdGl2ZXRvcC1r******
```
- Apply Base64 encoding to knativetop-cert.pem.
```
cat knativetop-cert.pem | base64
```
  Expected output:
```
a25hdGl2ZXRvcC1jZ******==
```
Create the Secret.
You can use a Secret in the TLS configuration of a Knative Service to enable secure access to the domain helloworld.knative.top.
```
kubectl create secret tls secret-tls --key knativetop-key.pem --cert knativetop-cert.pem
```
Expected output:
```
secret/secret-tls created
```

2. Create a DomainMapping

In Knative, a DomainMapping is a resource that maps a domain to one or more Knative Services.

With the Secret created, use a DomainMapping to bind the custom domain to the Knative Service and enable TLS encryption by referencing the Secret.

Create a helloworld.knative.top.yaml file and write the following DomainMapping configuration.

apiVersion: serving.knative.dev/v1beta1
kind: DomainMapping
metadata:
  name: helloworld.knative.top
  namespace: default
spec:
  ref:
    name: helloworld-go
    kind: Service
    apiVersion: serving.knative.dev/v1
# tls block specifies the secret to be used
  tls:
    secretName: secret-tls

Apply the DomainMapping to the cluster.

kubectl apply -f helloworld.knative.top.yaml

Expected output:

domainmapping.serving.knative.dev/helloworld.knative.top created

Run the following command to verify that the DomainMapping is ready.

kubectl get domainmapping helloworld.knative.top

Expected output:

NAME                          URL                                      READY   REASON
helloworld.knative.top       https://helloworld.knative.top            True

Verify that the service is accessible through the custom domain.

# Replace with your Kourier gateway address.
curl -H "Host: helloworld.knative.top" https://8.141.XX.XX -k

Expected output:

>Hello Knative!

Prerequisites

Step 1: Create a Knative Service

Step 2: Configure HTTPS service

ALB

Kourier

1. Create a certificate Secret

2. Create a DomainMapping

Related documents