Configuring HTTPS for a LoadBalancer Service

Configuring an HTTPS Service

You can create a Service for a workload after it is created. Creating a Service has no impact on the workload. Once created, the Service can be used by the workload for network access immediately.

1. Log in to the ELB console and click Create Certificate.
2. Log in to the CCI 2.0 console.
3. In the navigation pane, choose Services. On the right of the page, click Create from YAML.
4. Import or add a YAML file.

   The following is an example YAML file.

   • Resource description in the service.yaml file:

     apiVersion: cci/v2
     kind: Service
     metadata:
       name: kubectl-test
       namespace: kubectl
       annotations:
         kubernetes.io/elb.class: elb
         kubernetes.io/elb.id: 1234567890 # Load balancer ID. Only dedicated load balancers are supported.
         kubernetes.io/elb.protocol-port: "http:443"  # HTTP and port number, which must be the same as that in spec.ports.
         kubernetes.io/elb.cert-id: "17e3b4f4bc40471c86741dc3aa211379"  # Certificate ID of the LoadBalancer Service
     spec:
       selector:
         app: kubectl-test # Label of the associated workload
       ports:
         - name: service-0
           targetPort: 80   # Container port
           port: 443      # Access port (load balancer's port for accessing the workload)
           protocol: TCP    # Set the protocol to TCP.
       type: LoadBalancer

   • Resource description in the service.json file:

     {
     	"apiVersion": "cci/v2",
     	"kind": "Service",
     	"metadata": {
     		"name": "kubectl-test",
     		"namespace": "kubectl",
     		"annotations": {
                             "kubernetes.io/elb.class": "elb",
     			"kubernetes.io/elb.id": "1234567890"  # Load balancer ID. Only dedicated load balancers are supported.
                             "kubernetes.io/elb.protocol-port": "https:443"  # HTTPS and port number, which must be the same as that in spec.ports.
                             "kubernetes.io/elb.cert-id": "17e3b4f4bc40471c86741dc3aa211379" # Certificate ID of the LoadBalancer Service
     		}
     	},
     	"spec": {
     		"selector": {
     			"app": "kubectl-test" # Label of the associated workload
     		},
     		"ports": [
     			{
     				"name": "service-0",
     				"targetPort": 80,     # Container port
     				"port": 443,          # Access port of the Service
     				"protocol": "TCP",    # Set the protocol to TCP.
     				"type": "LoadBalancer"
     			}
     		]
     	}
     }

5. Click OK. Access the workload through the load balancer's IP address and port in the format of <IP-address>:<port>.

Updating a Service

After you add a Service, you can update the access port of the Service.

1. Log in to the CCI 2.0 console.
2. In the navigation pane, choose Services. On the Services page, select the target namespace, locate the Service, and click Edit YAML in the Operation column.
3. Only the access port can be modified.

   spec.ports[i].port: indicates the access port. The port number ranges from 1 to 65535. You need to change the value of kubernetes.io/elb.protocol-port accordingly.

4. Click OK. The Service will be updated for the workload.

Parameters for an HTTPS Service

You can refer to the following table to add the annotations to configure a listener for an HTTPS Service.