gke - securing regional external gateway

We will create a certificate file quickly and then setup our external gateway. 

Please note: we can't use certificate manager here because it is not supported for regional gateway.

Run the following command to generate store example cert:

openssl genrsa -out private-key.pem 2048

openssl req -new -key private-key.pem \

    -out cert.pem \

    -config CONFIG_FILE

openssl x509 -req \

    -signkey private-key.pem \

    -in cert.pem  \

    -out cert-file.pem \

    -extfile CONFIG_FILE \

    -extensions extension_requirements \

    -days 350

kubectl create secret tls store-example-com \

    --cert=cert-file.pem \

    --key=private-key.pem

Then we will use the following config

cat <<EOF >CONFIG_FILE

[req]

default_bits              = 2048

req_extensions            = extension_requirements

distinguished_name        = dn_requirements

prompt                    = no

[extension_requirements]

basicConstraints          = CA:FALSE

keyUsage                  = nonRepudiation, digitalSignature, keyEncipherment

subjectAltName            = @sans_list

[dn_requirements]

0.organizationName        = example

commonName                = store.example.com

[sans_list]

DNS.1                     = store.example.com

EOF

Next we will apply the following yaml

kind: Gateway

apiVersion: gateway.networking.k8s.io/v1beta1

metadata:

  name: external-http

spec:

  gatewayClassName: gke-l7-global-external-managed

  listeners:

  - name: https

    protocol: HTTPS

    port: 443

    tls:

      mode: Terminate

      certificateRefs: # Directly reference the Kubernetes Secret containing the TLS certificate and private key.

      - name: store-example-com # The name of the TLS secret.

And the http route

kind: HTTPRoute

apiVersion: gateway.networking.k8s.io/v1beta1

metadata:

  name: store-external

  labels:

    gateway: external-http

spec:

  parentRefs:

  - name: external-http # Link this route to the 'external-http' Gateway.

  hostnames:

  - "store.example.com" # Match traffic for this hostname.

  rules:

  - backendRefs: # Define where to forward the traffic.

    - name: store-v1

      port: 8080

Get your ip address by running the following command

kubectl get gateways.gateway.networking.k8s.io external-http -o=jsonpath="{.status.addresses[0].value}"

Finally to test out the traffic, run this curl command

curl https://34.36.251.180 --resolve store.example.com:443:34.36.251.180 --cacert cert-file.pem -v

You will be able to see tls handshake happening but won't be able successfully establish a connection because of the TLS is self signed.