Terminate TLS connections in a Managed Kubernetes cluster for Envoy Gateway

Terminating a TLS connection for a Managed Kubernetes cluster is the process of decrypting HTTPS traffic and redirecting it to Kubernetes pods as HTTP traffic.

TLS connection termination can be used to:

• protect data transmission between a client and a service in a cluster;
• control access to services in a cluster and protect against unauthorized access;
• improve performance;
• simplify certificate management.

In a Managed Kubernetes cluster, TLS termination can be configured on a load balancer. TLS termination on a load balancer is available in clusters running Kubernetes version 1.25 and higher. You can upgrade the cluster version.

Certificates can be managed via the Certificates Manager — add your custom certificate or issue a Let’s Encrypt® certificate.

1. Add a custom certificate or issue one in the secrets manager.
2. Create a load balancer.
3. Edit the domain's A record.

1. Add or issue a certificate

In Certificates Manager, you can upload a certificate issued by a third-party certificate authority or issue a Let’s Encrypt® certificate.

Add a certificate

1. A custom certificate is valid only in the project where it was added. Make sure you are in the correct project. To do this, open the project menu (name of the current project) and select a project.

2. In the Control Panel, in the top menu, click Products and select Certificates Manager.

3. In the Certificates section, click Add certificate.

4. Select Custom certificate.

5. Enter the certificate name.

6. Paste the main certificate for the domain. It must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

7. Paste the private key. It must start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----.

8. Optional: to add an intermediate certificate:

   8.1. Select the Add intermediate certificate checkbox.

   8.2. In the Intermediate certificate field, paste the certificate. It must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

   If you need to add multiple intermediate certificates, make sure that all certificates (main certificate for the domain, intermediate, and root) form a complete chain. The Issuer value of the main certificate must match the Subject value of the first intermediate certificate, the Issuer value of the first intermediate certificate must match the Subject value of the second intermediate certificate, and so on.

   Intermediate certificates can be added to the Intermediate certificate field in any order. It is important to use the full chain.

9. Optional: to add a root certificate:

   9.1. Select the Add root certificate checkbox.

   9.2. In the Root certificate field, paste the certificate. It must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

10. Click Add.

11. Open the certificate page.

12. Copy the certificate UUID.

Issue a Let’s Encrypt® certificate

You can issue a Let’s Encrypt® certificate that will be valid:

• only for the primary domain or for the primary domain and all its subdomains (Wildcard certificate);
• only for a subdomain. The certificate will not be valid for the primary domain.

To issue a certificate:

For a primary domain and subdomains

1. Create a zone for the domain in DNS hosting.

2. Delegate the domain.

3. In the Control Panel, in the top menu, click Products and select Certificates Manager.

4. In the Certificates section, click Add certificate.

5. Select Let’s Encrypt® certificates.

6. Enter a certificate name.

7. Select the domain that you delegated to DNS hosting in step 2.

8. Optional: to add a subdomain to the certificate for the main domain, click Add additional domain.

   Enter the subdomain name. To issue a Wildcard certificate, enter a subdomain in the format *.example.com

9. Click Issue certificate.

10. Open the certificate page.

11. Copy the certificate UUID.

12. In the Certificate files block, select the certificate, intermediate certificate chain, root certificate, and private key.

13. Click Download.

14. Install the files on the side of your service.

For a subdomain only

1. Create a zone for the subdomain in DNS hosting.

2. Delegate the subdomain.

3. In the Control Panel, in the top menu, click Products and select Certificates Manager.

4. In the Certificates section, click Add certificate.

5. Select Let’s Encrypt® certificates.

6. Enter a certificate name.

7. Select the subdomain that you delegated to DNS hosting in step 2.

8. Click Issue certificate.

9. Open the certificate page.

10. Copy the certificate UUID.

11. In the Certificate files block, select the certificate, intermediate certificate chain, root certificate, and private key.

12. Click Download.

13. Install the files on the side of your service.

2. Create a load balancer

Use the Create load balancer subsection of the Create and configure a load balancer in a Managed Kubernetes cluster for Envoy Gateway instructions.

In the Gateway object manifest, add the annotation to the annotations block:

loadbalancer.openstack.org/default-tls-container-ref: "<certificate_uuid>"

Specify <certificate_uuid> — the universally unique identifier (UUID) of the certificate that you copied in the Add or issue a certificate instructions.

The created load balancer will appear in the Control Panel: in the top menu, click Products and select Cloud Servers → Load Balancers section → Load Balancers tab.

3. Change the A record for the domain

You can accelerate the propagation of resource record changes to caching servers. To do this, a few days before the planned change, reduce the record TTL to the minimum possible value. Then, at the scheduled time, change the resource record, and once the change has propagated to the caching servers, revert the TTL to its previous value.

1. In the Control Panel, in the top menu, click Products and select DNS Hosting.
2. In the Domain zones section, open the zone page.
3. In the menu of the A record group, select Edit.
4. Change the IP address to the address of the load balancer. You can view the load balancer IP address in the Control Panel: in the top menu, click Products and select Cloud Servers → Load Balancers → Load Balancers tab → load balancer card.
5. Click Save.
6. Wait for the resource record to update on the DNS servers. The update can take from the record group's TTL up to 72 hours. You can view the record group's TTL in the Control Panel: in the top menu, click Products → DNS Hosting → Domain zones → zone page → record row → TTL field.
7. Optional: check the resource record. If the resource record is not updated after 72 hours, submit a ticket.
8. Verify that requests are only reaching the load balancer and that there are no requests from users on the server.