Configuring HTTPS with cert-manager and Google Cloud DNS

You can use cert-manager with Knative to automatically provision TLS certificates from Let’s Encrypt and use Google Cloud DNS to handle HTTPS requests and validate DNS challenges.

The following guide demonstrates how you can setup Knative to handle secure HTTPS requests on Google Cloud Platform, specifically using cert-manager for TLS certificates and Google Cloud DNS as the DNS provider.

Learn more about using TLS certificates in Knative:

Before you begin

You must meet the following prerequisites to configure Knative with cert-manager and Cloud DNS:

Creating a service account and using a Kubernetes secret

To allow cert-manager to access and update the DNS record, you must create a service account in GCP, add the key in a Kubernetes secret, and then add that secret to your Knative cluster.

Note that several example names are used in the following commands, for example secret or file names, which can all be changed to your liking.

  1. Create a service account in GCP with dns.admin project role by running the following commands, where <your-project-id> is the ID of your GCP project:
   # Set this to your GCP project ID
   export PROJECT_ID=<your-project-id>

   # Name of the service account you want to create.
   export CLOUD_DNS_SA=cert-manager-cloud-dns-admin
   gcloud --project $PROJECT_ID iam service-accounts \
     create $CLOUD_DNS_SA \


   # the ACME DNS01 challenge.
   gcloud projects add-iam-policy-binding $PROJECT_ID \
     --member serviceAccount:$CLOUD_DNS_SA \
     --role roles/dns.admin
  1. Download the service account key by running the following commands:
   # Make a temporary directory to store key
   KEY_DIRECTORY=`mktemp -d`

   # Download the secret key file for your service account.
  1. Create a Kubernetes secret and then add that secret to your Knative cluster by running the following commands:
   # Upload that as a secret in your Kubernetes cluster.

   # Delete the local secret
   rm -rf $KEY_DIRECTORY

Adding your service account to cert-manager

Create a ClusterIssuer configuration file to define how cert-manager obtains TLS certificates and how the requests are validated with Cloud DNS.

  1. Run the following command to create the ClusterIssuer configuration. The following creates the letsencrypt-issuer ClusterIssuer, that includes your Let’s Encrypt account info, DNS-01 challenge type, and Cloud DNS provider info, including your cert-manager-cloud-dns-admin service account.
   kubectl apply --filename - <<EOF
   kind: ClusterIssuer
     name: letsencrypt-issuer
     namespace: cert-manager
       # This will register an issuer with LetsEncrypt.  Replace
       # with your admin email address.
         # Set privateKeySecretRef to any unused secret name.
         name: letsencrypt-issuer
         - name: cloud-dns-provider
             # Set this to your GCP project-id
             project: $PROJECT_ID
             # in the previous step.
               name: cloud-dns-key
               key: key.json
  1. Ensure that letsencrypt-issuer is created successfully by running the following command:
   kubectl get clusterissuer --namespace cert-manager letsencrypt-issuer --output yaml

Result: The Status.Conditions should include Ready=True. For example:

       - lastTransitionTime: 2018-08-23T01:44:54Z
         message: The ACME account was registered with the ACME server
         reason: ACMEAccountRegistered
         status: "True"
         type: Ready

Add letsencrypt-issuer to your ingress secret to configure your certificate

To configure how Knative uses your TLS certificates, you create a Certificate to add letsencrypt-issuer to the istio-ingressgateway-certs secret.

Note that istio-ingressgateway-certs will be overridden if the secret already exists.

  1. Run the following commands to create the my-certificate Certificate, where <> is your domain:
   # Change this value to the domain you want to use.
   export DOMAIN=<>

   kubectl apply --filename - <<EOF
   kind: Certificate
     name: my-certificate
     # Istio certs secret lives in the istio-system namespace, and
     # a cert-manager Certificate is namespace-scoped.
     namespace: istio-system
     # Reference to the Istio default cert secret.
     secretName: istio-ingressgateway-certs
       # Each certificate could rely on different ACME challenge
       # solver.  In this example we are using one provider for all
       # the domains.
       - dns01:
           provider: cloud-dns-provider
         # Since certificate wildcards only allow one level, we will
         # need to one for every namespace that Knative is used in.
         # We don't need to use wildcard here, fully-qualified domains
         # will work fine too.
         - "*.default.$DOMAIN"
         - "*.other-namespace.$DOMAIN"
     # The certificate common name, use one from your domains.
     commonName: "*.default.$DOMAIN"
     # Provide same list as `domains` section.
     - "*.default.$DOMAIN"
     - "*.other-namespace.$DOMAIN"
     # Reference to the ClusterIssuer we created in the previous step.
       kind: ClusterIssuer
       name: letsencrypt-issuer
  1. Ensure that my-certificate is created successfully by running the following command:
   kubectl get certificate --namespace istio-system my-certificate --output yaml


       - lastTransitionTime: 2018-08-23T02:28:44Z
         message: Certificate issued successfully
         reason: CertIssued
         status: "True"
         type: Ready

Note: If Status.Conditions is Ready=False, that indicates a failure to obtain a certificate, which should be explained in the accompanying error message.

Configuring the Knative ingress gateway

To configure the knative-ingress-gateway to use the TLS certificate that you created, append the tls: section to the end of your HTTPS port configuration.

Run the following commands to configure Knative to use HTTPS connections and send a 301 redirect response for all HTTP requests:

kubectl apply --filename - <<EOF
kind: Gateway
  name: knative-ingress-gateway
  namespace: knative-serving
    istio: ingressgateway
  - port:
      number: 80
      name: http
      protocol: HTTP
    - "*"
      # Sends 301 redirect for all http requests.
      # Omit to allow http and https.
      httpsRedirect: true
  - port:
      number: 443
      name: https
      protocol: HTTPS
    - "*"
      mode: SIMPLE
      privateKey: /etc/istio/ingressgateway-certs/tls.key
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt

Congratulations, you can now access your Knative services with secure HTTPS connections. Your Knative cluster is configured to use cert-manager to manually obtain TLS certificates but see the following section about automating that process.

Configure Knative for automatic certificate provisioning

You can update your Knative configuration to automatically obtain and renew TLS certificates before they expire. To learn more about automatic certificates, see Enabling automatic TLS certificate provisioning.