Configuring SNI for a LoadBalancer Ingress

Prerequisites

• An available workload has been deployed in the cluster for external access. If no workload is available, deploy a workload by referring to Creating a Deployment, Creating a StatefulSet, or Creating a DaemonSet.
• A Service for external access has been configured for the workload. Services Supported by LoadBalancer Ingresses lists the Service types supported by LoadBalancer ingresses.
• You can obtain a trusted certificate from a certificate provider.

Using the CCE Console to Configure an SNI Certificate

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Choose Services & Ingresses in the navigation pane, click the Ingresses tab, and click Create Ingress in the upper right corner.
3. Configure ingress parameters.
   Note

   This example explains only key parameters for configuring SNI certificates. You can configure other parameters as required. For details, see Creating a LoadBalancer Ingress on the Console.

   Table 1 Key parameters

   Parameter	Description	Example
   Name	Enter an ingress name.	ingress-test
   Load Balancer	Select a load balancer to be associated with the ingress or automatically create a load balancer.	Shared
   Listener	External Protocol: Select HTTPS when configuring a certificate for an ingress. External Port: specifies the port of the load balancer listener. The default HTTPS port is 443. Certificate Source: Select TLS secret. Server Certificate: kubernetes.io/tls and IngressTLS are supported. If no certificate is available, you can create a TLS certificate. For details about the configuration parameters, see Creating a Secret. SNI: Enter a domain name and select a certificate. The SNI certificate must contain the domain name information. SNI certificates support two TLS secret types: kubernetes.io/tls and IngressTLS.	External Protocol: HTTPS External Port: 443 Certificate Source: TLS secret Server Certificate: test SNI: Domain Name: example.com Certificate: example-test
   Forwarding Policy	Domain Name: Enter an actual domain name to be accessed. If it is left blank, the ingress can be accessed through the IP address. Ensure that the domain name has been registered and licensed. Once a forwarding policy is configured with a domain name specified, you must use the domain name for access. Path Matching Rule: Select Prefix match, Exact match, or RegEx match. Path: Enter the path provided by a backend application for external access. The path added must be valid in the backend application, or the forwarding cannot take effect. Destination Service: Select an existing Service. Only Services that meet the requirements are automatically displayed in the Service list. Destination Service Port: Select the access port of the destination Service.	Domain Name: example.com Path Matching Rule: Prefix match Path: / Destination Service: nginx Destination Service Port: 80

4. Click OK.

Using kubectl to Configure an SNI Certificate

1. Use kubectl to access the cluster. For details, see Accessing a Cluster Using kubectl.
2. Create a YAML file named ingress-test.yaml. The file name can be customized.

   vi ingress-test.yaml
   
   

   An example YAML file of an ingress associated with an automatically created load balancer is as follows:

   For clusters of v1.21 or earlier:

   apiVersion: networking.k8s.io/v1beta1
   kind: Ingress 
   metadata: 
     name: ingress-test
     annotations: 
       kubernetes.io/elb.class: performance
       kubernetes.io/ingress.class: cce
       kubernetes.io/elb.port: '443'
       kubernetes.io/elb.autocreate: 
         '{
             "type": "public",
             "bandwidth_name": "cce-bandwidth-******",
             "bandwidth_chargemode": "bandwidth",
             "bandwidth_size": 5,
             "bandwidth_sharetype": "PER",
             "eip_type": "5_bgp",
             "available_zone": [
                 "ru-moscow-1a"
             ],
             "elb_virsubnet_ids":["b4bf8152-6c36-4c3b-9f74-2229f8e640c9"],
             "l7_flavor_name": "L7_flavor.elb.s1.small"
          }'
       kubernetes.io/elb.tls-ciphers-policy: tls-1-2
   spec:
     tls: 
     - secretName: ingress-test-secret # A server certificate must be specified.
     - hosts:
         - example.com  # Domain name specified when an SNI certificate is issued
       secretName: sni-test-secret   #SNI certificate
     rules: 
     - host: example.com   #The domain name must be the same as the value of hosts in the tls field.
       http: 
         paths: 
         - path: '/'
           backend: 
             serviceName: <your_service_name>  # Replace it with the name of your target Service.
             servicePort: 80
           property:
             ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
   
   

   For clusters of v1.23 or later:

   apiVersion: networking.k8s.io/v1
   kind: Ingress 
   metadata: 
     name: ingress-test
     annotations: 
       kubernetes.io/elb.class: performance
       kubernetes.io/elb.port: '443'
       kubernetes.io/elb.autocreate: 
         '{
             "type": "public",
             "bandwidth_name": "cce-bandwidth-******",
             "bandwidth_chargemode": "bandwidth",
             "bandwidth_size": 5,
             "bandwidth_sharetype": "PER",
             "eip_type": "5_bgp",
             "available_zone": [
                 "ru-moscow-1a"
             ],
             "elb_virsubnet_ids":["b4bf8152-6c36-4c3b-9f74-2229f8e640c9"],
             "l7_flavor_name": "L7_flavor.elb.s1.small"
          }'
       kubernetes.io/elb.tls-ciphers-policy: tls-1-2
   spec:
     tls: 
     - secretName: ingress-test-secret  # A server certificate must be specified.
     - hosts:
         - example.com  # Domain name specified when an SNI certificate is issued
       secretName: sni-test-secret # SNI certificate
     rules: 
     - host: example.com   # The domain name must be the same as the value of hosts in the tls field.
       http: 
         paths: 
         - path: '/'
           backend: 
             service:
               name: <your_service_name>  # Replace it with the name of your target Service.
               port: 
                 number: 80             # Replace 80 with the port number of your target Service.
           property:
             ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
           pathType: ImplementationSpecific
     ingressClassName: cce 
   
   

3. Create an ingress.

   kubectl create -f ingress-test.yaml
   
   

   If information similar to the following is displayed, the ingress has been created:

   ingress/ingress-test created
   
   

4. Check the created ingress.

   kubectl get ingress
   
   

   If information similar to the following is displayed, the ingress has been created:

   NAME           CLASS  HOSTS          ADDRESS          PORTS   AGE
   ingress-test   cce    example.com    121.**.**.**     80,443  10s
   
   

5. Use HTTPS to access the ingress. ${ELB_IP} specifies the IP address accessed by the target ingress.

   curl -H "Host:example.com" -k https://${ELB_IP}:443 
   
   

   If the ingress can be accessed, the certificate is configured.

Using the CCE Console to Configure an SNI Certificate Created on the ELB Console

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. Choose Services & Ingresses in the navigation pane, click the Ingresses tab, and click Create Ingress in the upper right corner.
3. Configure ingress parameters.
   Note

   This example explains only key parameters for configuring SNI certificates. You can configure other parameters as required. For details, see Creating a LoadBalancer Ingress on the Console.

   Table 2 Key parameters

   Parameter	Description	Example
   Name	Enter an ingress name.	ingress-test
   Load Balancer	Select a load balancer to be associated with the ingress or automatically create a load balancer.	Shared
   Listener	External Protocol: Select HTTPS. External Port: specifies the port of the load balancer listener. The default HTTPS port is 443. Certificate Source: Select ELB server certificate. Server Certificate: Use a certificate created on ELB. If no certificate is available, go to the ELB console and create one. SNI: Select the corresponding SNI certificate, which must contain the domain name information. If no certificate is available, go to the ELB console and create one.	External Protocol: HTTPS External Port: 443 Certificate Source: ELB server certificate Server Certificate: cert-test SNI: cert-example
   Forwarding Policy	Domain Name: Enter an actual domain name to be accessed. If it is left blank, the ingress can be accessed through the IP address. Ensure that the domain name has been registered and licensed. Once a forwarding policy is configured with a domain name specified, you must use the domain name for access. Path Matching Rule: Select Prefix match, Exact match, or RegEx match. Path: Enter the path provided by a backend application for external access. The path added must be valid in the backend application, or the forwarding cannot take effect. Destination Service: Select an existing Service. Only Services that meet the requirements are automatically displayed in the Service list. Destination Service Port: Select the access port of the destination Service.	Domain Name: You do not need to configure this parameter. Path Matching Rule: Prefix match Path: / Destination Service: nginx Destination Service Port: 80

4. Click OK.

Using kubectl to Configure an SNI Certificate Created on the ELB Console

1. Use kubectl to access the cluster. For details, see Accessing a Cluster Using kubectl.
2. Create a YAML file named ingress-test.yaml. The file name can be customized.

   vi ingress-test.yaml
   
   

   An example YAML file of an ingress associated with an existing load balancer is as follows:

   For clusters of v1.21 or earlier:

   apiVersion: networking.k8s.io/v1beta1
   kind: Ingress 
   metadata: 
     name: ingress-test
     annotations: 
       kubernetes.io/ingress.class: cce
       kubernetes.io/elb.port: '443'
       kubernetes.io/elb.id: 0b9a6c4d-bd8b-45cc-bfc8-ff0f9da54e95
       kubernetes.io/elb.class: union
       kubernetes.io/elb.tls-certificate-ids: 058cc023690d48a3867ad69dbe9cd6e5,b98382b1f01c473286653afd1ed9ab63
   spec:
     rules: 
     - host: ''
       http: 
         paths: 
         - path: '/'
           backend: 
             serviceName: <your_service_name>  # Replace it with the name of your target Service.
             servicePort: 80
           property:
             ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
   
   

   For clusters of v1.23 or later:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: ingress-test
     namespace: default
     annotations:
       kubernetes.io/elb.port: '443'
       kubernetes.io/elb.id: 0b9a6c4d-bd8b-45cc-bfc8-ff0f9da54e95
       kubernetes.io/elb.class: union
       kubernetes.io/elb.tls-certificate-ids: 058cc023690d48a3867ad69dbe9cd6e5,b98382b1f01c473286653afd1ed9ab63
   spec:
     rules:
       - host: ''
         http:
           paths:
             - path: '/'
               backend:
                 service:
               name: <your_service_name>  # Replace it with the name of your target Service.
                   port: 
                     number: 80             # Replace 80 with the port number of your target Service.
               property:
                 ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
               pathType: ImplementationSpecific
     ingressClassName: cce
   
   

   Table 3 Key parameters

   Parameter	Type	Description
   kubernetes.io/elb.tls-certificate-ids	String	ELB certificate IDs, which are separated by comma (,). The list length is greater than or equal to 1. The first ID in the list is the server certificate, and the other IDs are SNI certificates in which a domain name must be contained. If an SNI certificate cannot be found based on the domain name requested by the client, the server certificate will be returned by default. To obtain the certificate, log in to the CCE console, choose Service List > Networking > Elastic Load Balance, and click Certificates in the navigation pane. In the load balancer list, copy the ID under the target certificate name.

3. Create an ingress.

   kubectl create -f ingress-test.yaml
   
   

   If information similar to the following is displayed, the ingress has been created:

   ingress/ingress-test created
   
   

4. Check the created ingress.

   kubectl get ingress
   
   

   If information similar to the following is displayed, the ingress has been created:

   NAME          CLASS    HOSTS     ADDRESS          PORTS   AGE
   ingress-test  cce      *         121.**.**.**     80,443  10s
   
   

5. Use HTTPS to access the ingress. ${ELB_IP} specifies the IP address accessed by the target ingress.

   curl -H "Host:example.com" -k https://${ELB_IP}:443 
   
   

   If the ingress can be accessed, the certificate is configured.