How to use NSX-T https Ingress Controller for Kubernetes in VMware Enterprise PKS
book
Article ID: 316779
calendar_today
Updated On:
Products
VMware
Issue/Introduction
This article contains detailed steps on how to use https ingress in VMware Enterprise PKS environment.
Environment
VMware PKS 1.x
Resolution
In order to create an HTTPS ingress:
Create a server certificate and key by using openssl or any third party CA.
Create a TLS secret by using the above cert and key.
Create the Ingress resource by using the TLS secret.
Create a server certificate and key by using openssl :
Generate CA private key by running the command: openssl genrsa -aes256 -out ca.key 4096
Example: root@PKS-client-vm# openssl genrsa -aes256 -out ca.key 4096 Generating RSA private key, 4096 bit long modulus ..........................................++ ...............................................................................................................................++e is 65537 (0x10001) Enter pass phrase for ca.key: <Enter passphrase> Verifying - Enter pass phrase for ca.key: <Enter passphrase>
Generate the CA certificate by running the command: openssl req -key ca.key -new -x509 -days 365 -sha256 -extensions v3_ca -out ca.crt
Example: root@PKS-client-vm# openssl req -key ca.key -new -x509 -days 365 -sha256 -extensions v3_ca -out ca.crt Enter pass phrase for ca.key: <Enter the passphrase> You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []: Email Address []:
Generate server certificate request and private key: openssl req -out server.csr -new -newkey rsa:2048 -nodes -keyout server.key
Example: root@PKS-client-vm# openssl req -out server.csr -new -newkey rsa:2048 -nodes -keyout server.key Generating a 2048 bit RSA private key ..................................................................+++.........+++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []: Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: [optional] An optional company name []: [optional]
Sign the CSR with CA certificate: openssl x509 -req -days 360 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -sha256
Example: root@PKS-client-vm# openssl x509 -req -days 360 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -sha256 Signature ok subject=/C=XX/ST=XX/L=XXX XXX/O=XXXX/OU=XXXX Getting CA Private Key Enter pass phrase for ca.key: <Enter the pass phrase!>
Create a TLS secret by using cert and key:
You need to create the TLS secret by using the cert and key generated by openssl or custom CA. kubectl create secret tls cafe-secret --key server.key --cert server.crt
Verify that ingress resource has been created: root@PKS-client-vm# kubectl get ingress NAME HOSTS ADDRESS PORTS AGE cafe-ingress cafe.example.com 10.40.14.96,100.64.112.35 80, 443 1m
Navigate to NSX-T Manager > PKS Cluster Load Balancer > HTTPS ingress controller > LB Profiles and verify that you see the certificate under Client Side SSL section.