- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
- User Guide
- Best Practices
-
Developer Guide
- Overview
- Using Native kubectl (Recommended)
- Namespace and Network
- Pod
- Label
- Deployment
- EIPPool
- EIP
- Pod Resource Monitoring Metric
- Collecting Pod Logs
- Managing Network Access Through Service and Ingress
- Using PersistentVolumeClaim to Apply for Persistent Storage
- ConfigMap and Secret
- Creating a Workload Using Job and Cron Job
- YAML Syntax
-
API Reference
- Before You Start
- Calling APIs
- Getting Started
- Proprietary APIs
-
Kubernetes APIs
- ConfigMap
- Pod
- StorageClass
- Service
-
Deployment
- Querying All Deployments
- Deleting All Deployments in a Namespace
- Querying Deployments in a Namespace
- Creating a Deployment
- Deleting a Deployment
- Querying a Deployment
- Updating a Deployment
- Replacing a Deployment
- Querying the Scaling Operation of a Specified Deployment
- Updating the Scaling Operation of a Specified Deployment
- Replacing the Scaling Operation of a Specified Deployment
- Querying the Status of a Deployment
- Ingress
- OpenAPIv2
- VolcanoJob
- Namespace
- ClusterRole
- Secret
- Endpoint
- ResourceQuota
- CronJob
-
API groups
- Querying API Versions
- Querying All APIs of v1
- Querying an APIGroupList
- Querying APIGroup (/apis/apps)
- Querying APIs of apps/v1
- Querying an APIGroup (/apis/batch)
- Querying an APIGroup (/apis/batch.volcano.sh)
- Querying All APIs of batch.volcano.sh/v1alpha1
- Querying All APIs of batch/v1
- Querying All APIs of batch/v1beta1
- Querying an APIGroup (/apis/crd.yangtse.cni)
- Querying All APIs of crd.yangtse.cni/v1
- Querying an APIGroup (/apis/extensions)
- Querying All APIs of extensions/v1beta1
- Querying an APIGroup (/apis/metrics.k8s.io)
- Querying All APIs of metrics.k8s.io/v1beta1
- Querying an APIGroup (/apis/networking.cci.io)
- Querying All APIs of networking.cci.io/v1beta1
- Querying an APIGroup (/apis/rbac.authorization.k8s.io)
- Querying All APIs of rbac.authorization.k8s.io/v1
- Event
- PersistentVolumeClaim
- RoleBinding
- StatefulSet
- Job
- ReplicaSet
- Data Structure
- Permissions Policies and Supported Actions
- Appendix
- Out-of-Date APIs
- Change History
-
FAQs
- Product Consulting
-
Basic Concept FAQs
- What Is CCI?
- What Are the Differences Between Cloud Container Instance and Cloud Container Engine?
- What Is an Environment Variable?
- What Is a Service?
- What Is Mcore?
- What Are the Relationships Between Images, Containers, and Workloads?
- What Are Kata Containers?
- Can kubectl Be Used to Manage Container Instances?
- What Are Core-Hours in CCI Resource Packages?
- Workload Abnormalities
-
Container Workload FAQs
- Why Service Performance Does Not Meet the Expectation?
- How Do I Set the Quantity of Instances (Pods)?
- How Do I Check My Resource Quotas?
- How Do I Set Probes for a Workload?
- How Do I Configure an Auto Scaling Policy?
- What Do I Do If the Workload Created from the sample Image Fails to Run?
- How Do I View Pods After I Call the API to Delete a Deployment?
- Why an Error Is Reported When a GPU-Related Operation Is Performed on the Container Entered by Using exec?
- Can I Start a Container in Privileged Mode When Running the systemctl Command in a Container in a CCI Cluster?
- Why Does the Intel oneAPI Toolkit Fail to Run VASP Tasks Occasionally?
- Why Are Pods Evicted?
- Why Is the Workload Web-Terminal Not Displayed on the Console?
- Why Are Fees Continuously Deducted After I Delete a Workload?
-
Image Repository FAQs
- Can I Export Public Images?
- How Do I Create a Container Image?
- How Do I Upload Images?
- Does CCI Provide Base Container Images for Download?
- Does CCI Administrator Have the Permission to Upload Image Packages?
- What Permissions Are Required for Uploading Image Packages for CCI?
- What Do I Do If Authentication Is Required During Image Push?
-
Network Management FAQs
- How Do I View the VPC CIDR Block?
- Does CCI Support Load Balancing?
- How Do I Configure the DNS Service on CCI?
- Does CCI Support InfiniBand (IB) Networks?
- How Do I Access a Container from a Public Network?
- How Do I Access a Public Network from a Container?
- What Do I Do If Access to a Workload from a Public Network Fails?
- What Do I Do If Error 504 Is Reported When I Access a Workload?
- What Do I Do If the Connection Timed Out?
- Storage Management FAQs
- Log Collection
- Account
- SDK Reference
- Videos
- General Reference
Copied.
SSL Certificates
Secure Sockets Layer (SSL) is a security protocol designed to protect security and data integrity for Internet communications.
You can upload an SSL certificate to CCI. In HTTPS access, CCI will automatically install it to the Layer-7 load balancer for data transmission encryption.
- Secrets and SSL certificates share the same quota.
- You are advised to encrypt the uploaded SSL certificate.
SSL Certificate Introduction
An SSL certificate indicates compliance with the SSL protocol. An SSL certificate is issued to a server by a trusted digital certificate authority (CA) after the CA has verified the identity of the server. SSL certificates have the functions of server authentication and data transmission encryption. After you install an SSL certificate, a server can encrypt the data transmitted between clients and the server and prevent information leakage. In addition, the SSL certificate verifies whether the websites visited by the server are authentic and reliable.
SSL certificates are classified into authoritative and self-signed certificates. Authoritative certificates are issued by CAs. You can obtain authoritative certificates from third-party certificate agents. A client trusts websites that use authoritative certificates by default. Self-signed certificates are self-issued by users, typically using OpenSSL. By default, self-signed certificates are untrusted by the client. The browser will display an alarm message when you access a website that uses a self-signed certificate. You can continue to access the website by ignoring the alarm.
Application Scenarios
After you install an SSL certificate, a server can encrypt the data transmitted between clients and the server and prevent information leakage. To enable secure public network access for a web application in CCI, set the workload access mode to Internet access and the ELB protocol to HTTPS, and then select the certificate for Internet access during workload creation.
Adding a Certificate
- Log in to the CCI console. In the navigation pane on the left, choose Configuration Center > SSL Certificates. On the page displayed, select a namespace and click Add Certificate.
- Specify the name and description information of the SSL certificate.
Certificate name: Enter 1 to 253 characters starting and ending with a letter or digit. Only lowercase letters, digits, hyphens (-), and periods (.) are allowed. Do not enter two consecutive periods or a period adjacent to a hyphen.
- Upload the certificate file and private key file.
- .crt and .cer certificate files are supported, and the file size cannot exceed 1 MB. Ensure that the file content complies with the corresponding CRT or CER protocol.
- .key and .pem private key files are supported, and the file size cannot exceed 1 MB. You cannot encrypt private keys.
Figure 1 Uploading SSL certificate files - Click Add.
Using an SSL Certificate
When the service has public network access, you can use the SSL certificate and set the ELB protocol to the HTTPS protocol.
During workload creation, set the workload access mode to Internet access and the ELB protocol to HTTP/HTTPS, and select the SSL certificate. The SSL certificate will be automatically installed on the ELB to encrypt data before it is transmitted.

After you create the workload, CCI will create a certificate for the load balancer and name the certificate after the workload. If a certificate with a name starting with beethoveen-cci-ingress is created on CCI, do not delete or update it. Otherwise, an access exception may occur.
Updating and Deleting an SSL Certificate
- You can update a certificate before it expires. The workload that uses the certificate will also update it at the same time.
- Do not delete a certificate that is being used by a workload. Otherwise, the workload may become inaccessible.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot