0

I set up a simple 1-node GKE deployment with the default (beta) ingress, created via the GCP console. I would like to set up a Google-managed SSL certificate and HTTPS proxy to the a single GKE node & service hosting HTTP & WebSockets.

There are older methods mentioned out there of using NGINX and Ingress Controller as a load balancer and/or reverse proxy to allow WebSockets and HTTPS, but those options do not integrate with GCP's Load Balancers, which means no Cloud CDN, Cloud NAT or Google-managed SSL certificates. From the documentation, it seems they sorted out the old problems of websockets and https load balancers, but GKE has no information I can find on how to do this.

Is there a way to configure this manually?

The relevant service configuration is:

spec:
  clusterIP: 10.27.247.83
  externalTrafficPolicy: Cluster
  ports:
  - nodePort: 30621
    port: 80
    protocol: TCP
    targetPort: 3456
  selector:
    app: angmar-wsproxy-test
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: 35.245.111.75

The load balancer appears on the GCP Console as a TCP proxy, too, which leaves no option for session affinity, HTTP features like websockets, or Google managed SSL certificates.

  • Have you tried running a socket.io app as configured like this doc and this? Those creates a service with sessionAffinity: ClientIP , and Ingress as the load balancer. There was an issue with the integration in the links, however that seems to be resolved. – mehdi sharifi Jan 9 at 23:43
0

not sure if this is still relevant, but yes - it can be done.

# this will only provision if you the A record test.example.com will point to the address of the https load balancer

# create a managed cert
apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: example-certificate
spec:
  domains:
    - test.example.com

---
# create an http(s) LB
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  namespace: riscale-test
  name: riscale-ingress
  labels:
    name: riscale-ingress
  annotations:

    kubernetes.io/ingress.global-static-ip-name: <static-ip-name> 
    # only relevant if you reserved an address:
    # gcloud compute addresses create <address-name> --description "<some description>" --global
    networking.gke.io/managed-certificates: example-certificate # need to match the ManagedCertificate name
    kubernetes.io/ingress.allow-http: "false" # disable http - only listen on HTTPS
spec:
  rules:
  - http:
      paths:
      - path: /m/*
        backend:
          serviceName: mgmt
          servicePort: 8080
      - path: /* # default backend
        backend:
          serviceName: ui
          servicePort: 4200

---
# not mandatory - only relevant when you wish to configure the backend 
# this example increases the timeout from 30 sec default to 12 hours (for WS)
apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
  name: mgmt-service-backend
spec:
  timeoutSec: 43200

---
# another example of backend config to allow for BackendConfig
apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
  name: ui-backend
spec:
  cdn:
    enabled: true
    cachePolicy:
      includeHost: false
      includeProtocol: true
      includeQueryString: false
---
apiVersion: v1
kind: Service
metadata:
  name: mgmt
  annotations:
    beta.cloud.google.com/backend-config: '{"ports": {"8080":"mgmt-service-backend"}}'
spec:
  selector:
    app: mgmt
  type: NodePort
  ports:
    - name: mgmt-service-port
      port: 8080
      targetPort: 8080
      protocol: TCP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.