How to use custom certificate with knative

[StarpTech]

Hi, I use Knative with Kong ingress controller and it works great but I can't find out how to use a custom wildcard certificate with my Knative services. I'm looking for a way to configure the ingress with Kong CRD's.

Therefore I can't find any documentation on how TLS is configured at all.

[StarpTech]

I think this is related https://discuss.konghq.com/t/tcpingress-how-can-i-use-it/5908

[StarpTech]

I could fix it by using TCPIngress

apiVersion: configuration.konghq.com/v1beta1
kind: TCPIngress
metadata:
  name: kong
spec:
  tls:
    - hosts:
      - "*.default.yourdomain.com"
      secretName: my-tls-domain

I'm still interested in how to display the complete ingress with kubectl.

[hbagdi]

You can use regular Ingress to populate TLS in Kong. Or TCPIngress, which is what you did. Or you can use Knative's Ingress resource's TLS section as well. All should work.

[StarpTech]

You can use regular Ingress to populate TLS in Kong

How to do it with Knative? I didn't create one.

Or you can use Knative's Ingress resource's TLS section as well.

Could you give me an example? As far I can see there is no knative ingress resource.

Additionally, is there any example how to redirect HTTP to HTTP2 when using knative?

Thanks!

[hbagdi]

Could you give me an example? As far I can see there is no knative ingress resource.

There is:

kubectl get ingresses.networking.internal.knative.dev -n <namespace>

Could you give me an example? As far I can see there is no knative ingress resource.

This is something for knative folks to answer. Please open a Github issue at github.com/knative/serving.

Additionally, is there any example how to redirect HTTP to HTTP2 when using knative?

Is that even technically possible? As far as I know, the client decides which protocol to use, the server can advertise that it supports h1 and h2. I'm not very confident here and I could very well be wrong here.

[StarpTech]

@hbagdi thanks. I tried to patch it with

kubectl patch ingresses.networking.internal.knative.dev helloworld-go --type merge --patch '{"metadata":{"annotations":{"konghq.com/override":"https-only"}}}'

and use

kind: KongIngress
apiVersion: configuration.konghq.com/v1
metadata:
  name: https-only
route:
  protocols:
  - https
  https_redirect_status_code: 302

but it has no effect.

Is that even technically possible? As far as I know, the client decides which protocol to use, the server can advertise that it supports h1 and h2. I'm not very confident here and I could very well be wrong here.

Sry for the confusion, I mean how can I create a redirect with Kong when using Knative?

[StarpTech]

@hbagdi Besides that, patching the ingress resource is not supported because services are immutable https://knative.dev/docs/serving/services/creating-services/

kn service update helloworld-go -a konghq.com/override=https-only

after that, I could see the annotations but it still has no effect on Kong :(

What I am doing wrong?

[hbagdi]

You are running into two separate issues and let's keep the two issues separate.
Let's track the TLS certificate issue in this issue and use #742 to track the override issue.

For TLS certificate, you need to ensure two things:

• use 0.9.1 version of the control, that contains a fix for the TLS section of Knative Ingress resource
• Specify TLS certificate in the Knative Ingress resource. @mattmoor Can you point us to a document on how to use TLS section of Knative Ingress resource? I tried looking for it myself but couldn't find any.

[mattmoor]

@ZhiminXiang is our TLS guru

[ZhiminXiang]

Knative Ingress is not manually configurable as it will be reconciled by Knative Route controller (i.e. your manual configuration will be reverted by Knative controller).

If you want to manually configure TLS, you have to directly configure KongIngress (if KongIngress allows the manual configuration).

Alternatively, you can also try Knative auto-tls feature which automatically provision your certificates and configure the Knative Ingress to terminate the TLS connection.

[StarpTech]

Specify TLS certificate in the Knative Ingress resource. @mattmoor Can you point us to a document on how to use TLS section of Knative Ingress resource? I tried looking for it myself but couldn't find any.

Knative Ingress is not manually configurable as it will be reconciled by Knative Route controller (i.e. your manual configuration will be reverted by Knative controller).

@hbagdi this is contrary.

Alternatively, you can also try Knative auto-tls feature which automatically provision your certificates and configure the Knative Ingress to terminate the TLS connection.

The proposed solution doesn't support my DNS provider.

Besides that, I have an issue with extending the knative route with Kong's CRD. No CRD is applied. For example, the https redirect has no effect.

[StarpTech]

I can't see any tests that verify the Knative integration as promised in https://konghq.com/blog/kong-for-kubernetes-0-8-released/

[ZhiminXiang]

Alternatively, you can also try Knative auto-tls feature which automatically provision your certificates and configure the Knative Ingress to terminate the TLS connection.

The proposed solution doesn't support my DNS provider.

@StarpTech you can choose HTTP01 challenge which only requires you to manually configure your custom domain to map to the IP of ingress.

[StarpTech]

@StarpTech you can choose HTTP01 challenge which only requires you to manually configure your custom domain to map to the IP of ingress.

HTTP01 doesn't support wildcard certs.

[hbagdi]

Alright. In that case, please use the regular Kubernetes Ingress resource for TLS certificates.
Certificates configured via regular Ingress are shared with the traffic that is being routed for Knative.
Here is the guide for cert-manager: https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/guides/cert-manager.md.

You can use DNS challenge as well for wildcard certs.

[StarpTech]

@hbagdi the whole point of this issue is to use Kong CRD 😄 How can you provide full knative support when SSL isn't even supported? Did you test it?

[hbagdi]

@hbagdi the whole point of this issue is to use Kong CRD smile How can you provide full knative support when SSL isn't even supported? Did you test it?

I'm losing you. I can't understand what you are trying to get at.
Here are the ways to solve your problem:

• use Knative Ingress resource to configure TLS. As @ZhiminXiang noted above, that doesn't seem to be possible. This is a limitation on Knative's part and Kong can't do anything about it. We do support it, and here is the fix for it.
• You can use k8s Ingress or TCPIngress resource to configure TLS and that applies the custom certificate to Knative traffic.

So, to track back, what is it that you want to do and does not work as your expectation?

[hbagdi]

Closing this due to lack of activity. Please re-open if needed.