问通过HTTPS访问istio/k8s服务

EN

kubectl create secret generic clouddns --namespace=cert-manager --from-literal=GCP_PROJECT=<PROJECT> --from-file=/etc/keys/<KEY>.json

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: messaging-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "<HOST>"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "<HOST>"
    tls:
      credentialName: messaging-certificate
      mode: SIMPLE
      privateKey: sds
      serverCertificate: sds

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: messaging
spec:
  hosts:
  - "<HOST>"
  gateways:
  - messaging-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: messaging
        port:
          number: 8082

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: messaging-cluster-issuer
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: <EMAIL>
    privateKeySecretRef:
      name: messaging-letsencrypt
    solvers:
    - dns01:
        clouddns:
          serviceAccountSecretRef:
            name: clouddns
            key: <KEY>.json
          project: <PROJECT>

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: messaging-certificate
spec:
  secretName: messaging-certificate
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  organization:
  - RELE.AI
  commonName: <HOST>
  isCA: false
  keySize: 2048
  keyAlgorithm: rsa
  keyEncoding: pkcs1
  usages:
    - server auth
    - client auth
  dnsNames:
  - <HOST>
  issuerRef:
    name: messaging-cluster-issuer
    kind: ClusterIssuer