How enable google managed certificate on Google Kubernetes?

user_2661479 0
Viewed 4485

I'm new to GKE now am trying to creating a new cluster for RASA. I'm trying to create an ingress with HTTPS to point to a loadbalancer in this cluster. But I'm unable to select the option Create Google-managed certificate from the list. It seems to be disabled in this cluster. How enable this?

The help shows:

To create Google-managed certificates, your cluster needs to have ManagedCertificate Custom Resource Definition present.

enter image description here

gke-networking google-kubernetes-engine google-cloud-platform certificate ssl-certificate
2 Answers

Posting this community wiki answer to give more visibility on recently fixed issue of grayed out option to create Create a Google-managed certificate.

Feel free to edit and expand.

You can find the corresponding Issue on the GCP Issuetracker:

Citing the part of the message from the thread:

As I can see, this issue was already fixed. You shouldn't encounter it anymore.

Example

As stated above, this issue shouldn't show up anymore. After reproduction with the following steps:

  • Create a GKE cluster and wait for it's provisioning.
  • Create a sample workload and expose it with:
    • $ kubectl create deployment nginx --image=nginx
    • $ kubectl expose deployment nginx --port=80 --type=NodePort
  • Go to:
    • Cloud Console -> Kubernetes Engine -> Services & Ingress -> Create Ingress (after choosing nginx Service) -> Frontend configuration -> HTTPS -> Create a new certificate

The following option can be seen as available:

GOOGLE-MANAGED-CERT

Additional resources:

user_122571340

As you didn't provide the steps you're following, I will demonstrate how to do it the right way.

First of all, if you check Setting up HTTP(S) Load Balancing with Ingress, you will find information thate GKE integrated support for two types of Cloud Load Balancing:

When you specify type:LoadBalancer in the resource manifest, GKE creates a Service of type LoadBalancer.

When you specify type:Ingress in the resource manifest, you instruct GKE to create an Ingress resource. By including annotations and supporting workloads and Services, you can create a custom Ingress controller. ... The load balancer's URL map's host rules and path matchers reference one or more backend services, where each backend service corresponds to a GKE Service of type NodePort, as referenced in the Ingress

In another part of the GKE Documentation, related to Using Google-managed SSL certificates, you can find two important notes:

This feature is only available with Ingress for External HTTP(S) Load Balancing.

Managed Certificates is a Beta feature available in all GKE versions. In clusters with masters running Kubernetes lower than 1.16.5-gke.1 Managed Certificates are available in version v1beta1, and they do not support multiple subject alternative names (SANs) per certificate.

In GKE 1.16.5-gke.1 and higher Managed Certificates are available in version v1beta2 and they support up to 100 SANs per certificate, version v1beta1 is also still available.

I have tested a few scenarios including LoadBalancer and NodePort as service type. In RASA-X chart, the service is of a LoadBalancer type. In all my tests when I wanted to Create Google Managed Certificate, it worked only with NodePort.

Did you try to edit this service and change it to NodePort?

A good example to check is to follow this tutorial.

If you still experience the same issue, please provide more information about your environment and steps to reproduce the problem.

user_111481390
Related