How to accept HTTPS and Websockets on a new Google Kubernetes Engine deployment?

Question

I set up a simple 1-node GKE deployment with the default (beta) ingress, created via the GCP console. I would like to set up a Google-managed SSL certificate and HTTPS proxy to the a single GKE node & service hosting HTTP & WebSockets.

There are older methods mentioned out there of using NGINX and Ingress Controller as a load balancer and/or reverse proxy to allow WebSockets and HTTPS, but those options do not integrate with GCP's Load Balancers, which means no Cloud CDN, Cloud NAT or Google-managed SSL certificates. From the documentation, it seems they sorted out the old problems of websockets and https load balancers, but GKE has no information I can find on how to do this.

Is there a way to configure this manually?

The relevant service configuration is:

spec:
  clusterIP: 10.27.247.83
  externalTrafficPolicy: Cluster
  ports:
  - nodePort: 30621
    port: 80
    protocol: TCP
    targetPort: 3456
  selector:
    app: angmar-wsproxy-test
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: 35.245.111.75

The load balancer appears on the GCP Console as a TCP proxy, too, which leaves no option for session affinity, HTTP features like websockets, or Google managed SSL certificates.

Gilad Sharaby · Answer

not sure if this is still relevant, but yes - it can be done.

# this will only provision if you the A record test.example.com will point to the address of the https load balancer

# create a managed cert
apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: example-certificate
spec:
  domains:
    - test.example.com

---
# create an http(s) LB
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  namespace: riscale-test
  name: riscale-ingress
  labels:
    name: riscale-ingress
  annotations:

    kubernetes.io/ingress.global-static-ip-name: <static-ip-name> 
    # only relevant if you reserved an address:
    # gcloud compute addresses create <address-name> --description "<some description>" --global
    networking.gke.io/managed-certificates: example-certificate # need to match the ManagedCertificate name
    kubernetes.io/ingress.allow-http: "false" # disable http - only listen on HTTPS
spec:
  rules:
  - http:
      paths:
      - path: /m/*
        backend:
          serviceName: mgmt
          servicePort: 8080
      - path: /* # default backend
        backend:
          serviceName: ui
          servicePort: 4200

---
# not mandatory - only relevant when you wish to configure the backend 
# this example increases the timeout from 30 sec default to 12 hours (for WS)
apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
  name: mgmt-service-backend
spec:
  timeoutSec: 43200

---
# another example of backend config to allow for BackendConfig
apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
  name: ui-backend
spec:
  cdn:
    enabled: true
    cachePolicy:
      includeHost: false
      includeProtocol: true
      includeQueryString: false
---
apiVersion: v1
kind: Service
metadata:
  name: mgmt
  annotations:
    beta.cloud.google.com/backend-config: '{"ports": {"8080":"mgmt-service-backend"}}'
spec:
  selector:
    app: mgmt
  type: NodePort
  ports:
    - name: mgmt-service-port
      port: 8080
      targetPort: 8080
      protocol: TCP

Answered by Gilad Sharaby on December 7, 2021

How to accept HTTPS and Websockets on a new Google Kubernetes Engine deployment?

One Answer

Add your own answers!

Ask a Question