Cipher mismatch error while trying to access an app deployed in GKE as HTTPS Ingress

user_5653189 0
Viewed 212

I am trying to deploy a springboot application running on 8080 port. My target is to have https protocol for custom subdomain with google managed-certificates. here are my yamls.

  1. deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-deployment
  namespace: my-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-deployment
      namespace: my-namespace
  template:
    metadata:
      labels:
        app: my-deployment
        namespace: my-namespace
    spec:
      containers:
        - name: app
          image: gcr.io/PROJECT_ID/IMAGE:TAG
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
          resources:
            requests:
              memory: "256Mi"
              ephemeral-storage: "256Mi"
              cpu: "250m"
            limits:
              memory: "512Mi"
              ephemeral-storage: "512Mi"
              cpu: "250m"

2.service.yaml

apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: my-namespace
  annotations:
    cloud.google.com/backend-config: '{"default": "my-http-health-check"}'
spec:
  selector:
    app: my-deployment
    namespace: my-namespace
  type: NodePort
  ports:
    - port: 80
      name: http
      targetPort: http
      protocol: TCP
  1. ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  namespace: my-name-space
  annotations:
    kubernetes.io/ingress.global-static-ip-name: my-ip
    networking.gke.io/managed-certificates: my-cert
    kubernetes.io/ingress.class: "gce"
  labels:
    app: my-ingress
spec:
  rules:
    - host: my-domain.com
      http:
        paths:
          - pathType: ImplementationSpecific
            backend:
              service:
                name: my-service
                port:
                  name: http

I followed various documentation, most of them could help to make http work but, couldn't make https work and ends with error ERR_SSL_VERSION_OR_CIPHER_MISMATCH. Looks like there is issue with "Global forwarding rule". Ports shows 443-443. What is the correct way to terminate the HTTPS traffic at loadbalancer and route it to backend app with http?

google-kubernetes-engine kubernetes-ingress spring-boot
1 Answers

From the information provided, I can see that the "ManagedCertificate" object is missing, you need to create a yaml file with the following structure:

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: my-cert
spec:
  domains:
    - <your-domain-name1>
    - <your-domain-name2>

And then apply it with the command: kubectl apply -f file-name.yaml

Provisioning of the Google-managed certificate can take up to 60 minutes; you can check the status of the certificate using the following command: kubectl describe managedcertificate my-cert, wait for the status to be as "Active".

A few prerequisites you need to be aware, though:

  • You must own the domain name. The domain name must be no longer than 63 characters. You can use Google Domains or another registrar.
  • The cluster must have the HttpLoadBalancing add-on enabled.
  • Your "kubernetes.io/ingress.class" must be "gce".
  • You must apply Ingress and ManagedCertificate resources in the same project and namespace.
  • Create a reserved (static) external IP address. Reserving a static IP address guarantees that it remains yours, even if you delete the Ingress. If you do not reserve an IP address, it might change, requiring you to reconfigure your domain's DNS records.

Finally, you can take a look at the complete Google's guide on Creating an Ingress with a Google-managed certificate.

user_169223430
Related