Description of ASMCredential fields-Alibaba Cloud Service Mesh-阿里云帮助中心

ASMCredential is a CustomResourceDefinition (CRD) that defines the Transport Layer Security (TLS) certificates and private keys used by Service Mesh (ASM) gateways. Use ASMCredential with Istio gateways to implement TLS termination.

After you create an ASMCredential, reference it in the CredentialName field of an Istio gateway to bind the certificate to a specific listener.

Important

When you create an ASMCredential, ASM automatically creates secrets in both the control plane and data plane clusters. Make sure that no existing secrets share the same name as the ASMCredential resource. Otherwise, the existing secrets may be overwritten.

Configuration example

The following ASMCredential enables TLS termination on a gateway:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMCredential
metadata:
  name: aliyun.com
  namespace: istio-system
spec:
  cert: |-
    -----BEGIN CERTIFICATE-----
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    -----END CERTIFICATE-----
  key: |-
    -----BEGIN PRIVATE KEY-----
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    -----END PRIVATE KEY-----
  type: tls

Spec fields

Field	Type	Required	Description
`type`	string	Yes	Certificate mode. Set to `tls` for standard TLS termination, or `mtls` for mutual TLS where the gateway also verifies client certificates.
`cert`	string	Yes	Public key certificate in PEM format.
`key`	string	Yes	Private key in PEM format.
`caCert`	string	Conditional	CA certificate in PEM format used to verify client identity during mTLS. Required when `type` is set to `mtls`.

Note

Starting from ASM version 1.19, the cert, key, and caCert fields also accept Base64-encoded PEM values.

ASMCredential field reference

Configuration example

Spec fields

See also