If you already have an SSL/TLS certificate for your domain you can follow the steps below to configure Knative to use your certificate and enable HTTPS connections.
Before you begin, you will need to configure Knative to use your custom domain.
Note: due to limitations in Istio, Knative only supports a single certificate per cluster. If you will serve multiple domains in the same cluster, make sure the certificate is signed for all the domains.
Note, if you don't have a certificate, you can find instructions on obtaining an SSL/TLS certificate using LetsEncrypt at the bottom of this page.
Assuming you have two files, cert.pk
which contains your certificate private
key, and cert.pem
which contains the public certificate, you can use the
following command to create a secret that stores the certificate. Note the
name of the secret, istio-ingressgateway-certs
is required.
kubectl create --namespace istio-system secret tls istio-ingressgateway-certs \
--key cert.pk \
--cert cert.pem
Once you have created a secret that contains the certificate, you need to update the Gateway spec to use the HTTPS.
To edit the shared gateway, run:
kubectl edit gateway knative-shared-gateway --namespace knative-serving
Change the Gateway spec to include the tls:
section as shown below, then
save the changes.
# Please edit the object below. Lines beginning with a '#' will be ignored.
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
# ... skipped ...
spec:
selector:
knative: ingressgateway
servers:
- hosts:
- '*'
port:
name: http
number: 80
protocol: HTTP
- hosts:
- '*'
port:
name: https
number: 443
protocol: HTTPS
tls:
mode: SIMPLE
privateKey: /etc/istio/ingressgateway-certs/tls.key
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
Once the change has been made, you can now use the HTTPS protocol to access your deployed services.
If you don't have an existing SSL/TLS certificate, you can use LetsEncrypt to obtain a certificate manually.
-
Install the
certbot-auto
script from the Certbot website. -
Use the certbot to request a certificate, using DNS validation. The certbot tool will walk you through validating your domain ownership by creating TXT records in your domain.
./certbot-auto certonly --manual --preferred-challenges dns -d '*.default.yourdomain.com'
-
When certbot is complete, you will have two output files,
privkey.pem
andfullchain.pem
. These files map to thecert.pk
andcert.pem
files used above.
You can also use cert-manager to automate the steps required to generate a TLS certificate using LetsEncrypt.
To install cert-manager into your cluster, use kubectl to apply the cert-manager manifest:
kubectl apply --filename https://raw.githubusercontent.com/jetstack/cert-manager/release-0.5/contrib/manifests/cert-manager/with-rbac.yaml
or see the cert-manager docs for more ways to install and customize.
Once you have installed cert-manager, you'll need to configure it for your DNS hosting provider.
Knative currently only works with the DNS01
challenge type for LetsEncrypt, which
is only supported by a small number of DNS providers through cert-manager.
Instructions for configuring cert-manager are provided for the following DNS hosts:
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License.