Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menunjukkan cara menonaktifkan dan mengaktifkan kembali fitur sertifikat TLS terkelola
yang secara otomatis menyediakan dan memperpanjang sertifikat TLS untuk mendukung
koneksi HTTPS pada penayangan Knative.
Jika Anda ingin menggunakan HTTPS,
Penampung Anda akan terus memproses $PORT
Anda harus memilih cara menyediakan sertifikat TLS:
Gunakan sertifikat TLS terkelola, dengan sertifikat TLS otomatis
dibuat sesuai kebutuhan, dan diperpanjang secara otomatis. Halaman ini menjelaskan fitur ini, yang tersedia di versi Google Kubernetes Engine yang didukung.
Gunakan sertifikat Anda sendiri, dengan Anda
bertanggung jawab untuk mendapatkan dan memperpanjang sertifikat. Dalam beberapa situasi,
yang dijelaskan di bagian Batasan, Anda harus menggunakan sertifikat Anda sendiri.
Jika menggunakan sertifikat terkelola, Anda juga harus memetakan domain kustom untuk menggunakan fitur sertifikat terkelola.
Menggunakan HTTPS dan HTTP
Secara default, jika Anda menggunakan sertifikat terkelola, cluster atau layanan penayangan
Knative dengan sertifikat terkelola akan diekspos ke traffic HTTP dan HTTPS.
Jika hanya menginginkan traffic HTTPS, Anda dapat mengaktifkan pengalihan HTTPS untuk
memaksa semua traffic agar hanya menggunakan HTTPS.
Fitur sertifikat terkelola hanya berfungsi dengan Cloud Service Mesh. Add-on Istio atau konfigurasi Istio lainnya tidak didukung.
Fitur ini menggunakan Let's Encrypt, yang memiliki batas kuota awal 50 sertifikat TLS per minggu per domain terdaftar. Anda dapat meminta penambahan kuota dengan mengikuti dokumentasi Let's Encrypt.
Saat menjalankan cluster penayangan Knative di platform lain, seperti
on-prem atau AWS, fitur ini dinonaktifkan. Untuk menggunakan fitur ini, Anda harus memastikan
cluster dapat mengakses
Let's Encrypt, dan layanan masuk Cloud Service Mesh
Anda diekspos ke internet publik.
Sebelum memulai
Petunjuk di halaman ini mengasumsikan hal berikut:
Tunggu beberapa menit setelah perintah berhasil, lalu pastikan
fitur sertifikat berfungsi:
kubectlgetkcert
Jika sertifikat sudah siap, Anda akan melihat pesan seperti ini:
NAMEREADYREASON
your-domain.comTrue
Mungkin perlu waktu 20 detik hingga 2 menit agar Kcert siap. Jika
Anda mengalami masalah, lihat
petunjuk pemecahan masalah untuk fitur
ini.
Memverifikasi keberhasilan
Pastikan data DNS telah diterapkan dengan menjalankan perintah:
gcloudrundomain-mappingsdescribe--domainDOMAIN
Ganti DOMAIN dengan nama domain Anda sendiri, misalnya:
your-domain.com
Periksa kolom url: dalam hasil dari perintah di atas: URL harus
memiliki https, bukan http.
Periksa alamat IP dari perintah di atas, yang tercantum di bagian
resourceRecords:rrdata, dan bandingkan dengan nilai yang Anda lihat saat menjalankan
perintah host DOMAIN. Keduanya harus sama.
Mengaktifkan pengalihan HTTPS untuk penayangan Knative
Jika Anda menggunakan fitur sertifikat TLS terkelola, secara default cluster akan
ditampilkan ke traffic HTTP dan HTTPS karena alasan kompatibilitas mundur. Jika ingin memaksa semua traffic hanya menggunakan HTTPS, Anda dapat mengaktifkan pengalihan HTTPS untuk pemetaan domain yang ada dengan memanggil perintah
Memecahkan masalah TLS terkelola untuk mengetahui detail tentang cara memeriksa pemetaan domain, kuota sertifikat, status pesanan, dan waktu tunggu pesanan, serta kegagalan otorisasi.
Baca artikel Membawa sertifikat TLS Anda sendiri untuk mengetahui petunjuk tentang cara menggunakan sertifikat TLS Anda sendiri, bukan sertifikat TLS terkelola.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-04 UTC."],[],[],null,["# Using managed TLS certificates and HTTPS\n\nThis page shows how to turn off and re-enable the managed TLS certificates feature that automatically provides and renews TLS certificates to support HTTPS connections on Knative serving.\n\n\u003cbr /\u003e\n\nIf you want to use HTTPS,\n\n- Your container should continue listening on `$PORT`\n- You must choose how you are supplying TLS certificates:\n\n - Use managed TLS certificates, where TLS certificates are automatically created as needed, and are automatically renewed. This page describes this feature, which is available in the [supported Google Kubernetes Engine versions](/kubernetes-engine/enterprise/knative-serving/docs/cluster-versions).\n - [Use your own certificates](/kubernetes-engine/enterprise/knative-serving/docs/bring-your-own-cert), where you are responsible for obtaining and renewing certificates. In some situations, described under [Limitations](#limitations), you must use your own certificates.\n- If you are using managed certificates, you must also\n [map your custom domain](/kubernetes-engine/enterprise/knative-serving/docs/mapping-custom-domains) in order to use the\n managed certificates feature.\n\nUsing HTTPS and HTTP\n--------------------\n\nBy default, if you use managed certificates, clusters or Knative serving\nservices with managed certificates are exposed to both HTTP and HTTPS traffic.\nIf you want only HTTPS traffic, you can [enable HTTPS redirects](#redirects) to\nforce all traffic to use HTTPS only.\n\nTroubleshooting\n---------------\n\nIf you experience issues when using managed TLS certificates, refer to the\n[managed TLS troubleshooting](/kubernetes-engine/enterprise/knative-serving/docs/troubleshooting#managed-tls) page.\n\nLimitations\n-----------\n\nThe following considerations apply to the use of the managed TLS certificates\nfeature:\n\n- Managed TLS certificates are disabled and not supported for Knative serving private clusters on Google Cloud.\n- To use the managed certificates feature, your service must be [exposed externally](/kubernetes-engine/enterprise/knative-serving/docs/managing/services#connectivity): it cannot be a cluster-local service or a service exposed by [Virtual Private Cloud](/vpc).\n- The managed certificates feature works only with Cloud Service Mesh. The Istio addon or other Istio configurations are not supported.\n- This feature uses [Let's Encrypt](https://letsencrypt.org/), which has an initial quota limit of 50 TLS certificates per week per registered domain. You can ask for a quota increase by following the [Let's Encrypt documentation](https://letsencrypt.org/docs/rate-limits/).\n- When running a Knative serving cluster on other platforms, such as on-prem or AWS, this feature is disabled. To use this feature, you must make sure your cluster is able to access [Let's Encrypt](https://acme-v02.api.letsencrypt.org/directory), and your Cloud Service Mesh ingress service is exposed to the public internet.\n\nBefore you begin\n----------------\n\nThe instructions on this page assume the following:\n\n- You have [deployed your Knative serving service](/kubernetes-engine/enterprise/knative-serving/docs/deploying) to the cluster.\n- You own a domain. If you don't have a domain, you can obtain one from [Google](https://domains.google/) or from another domain vendor.\n- You created a domain mapping for your service and updated your DNS record accordingly following the instructions at the [domains mapping page](/kubernetes-engine/enterprise/knative-serving/docs/mapping-custom-domains).\n- Use [Cloud DNS](/dns/docs/set-up-dns-records-domain-name), or a DNS server of your choice.\n\n| **Note:** By default, `gke-system-gateway` supports HTTP requests that have the Host header. However, if you have customized this gateway, make sure it still accepts the HTTP requests that contain the Host header.\n\nDisabling managed TLS certificates and HTTPS for a whole cluster\n----------------------------------------------------------------\n\nDisable managed TLS for a cluster by updating the ConfigMap\n`config-domainmapping`:\n\n\u003cbr /\u003e\n\n```bash\nkubectl patch cm config-domainmapping -n knative-serving -p '{\"data\":{\"autoTLS\":\"Disabled\"}}'\n```\n\n\u003cbr /\u003e\n\nDisabling managed TLS and HTTPS for a specific domain mapping\n-------------------------------------------------------------\n\nIf needed, you can turn off managed TLS for a specific domain mapping:\n\n1. Add the annotation `domains.cloudrun.com/disableAutoTLS: \"true\"`\\`:\n\n ```bash\n kubectl annotate domainmappings DOMAIN domains.cloudrun.com/disableAutoTLS=true\n ```\n2. Verify that HTTPS does not work:\n\n ```bash\n curl https://DOMAIN\n ```\n\n \u003cbr /\u003e\n\n3. Verify that HTTP is being used for the service:\n\n ```bash\n gcloud run domain-mappings describe --domain DOMAIN\n ```\n\n Replace \u003cvar translate=\"no\"\u003eDOMAIN\u003c/var\u003e with your own domain name, for example:\n `your-domain.com`\n\n Check the `url:` field in the return from the above command: the URL should\n have `http`, not `https`.\n\nRe-enabling managed TLS certificates and HTTPS\n----------------------------------------------\n\nTo re-enable managed TLS:\n\n1. If you haven't already done so, create a domain mapping for your service and\n update your DNS record accordingly following the instructions at the\n [domains mapping page](/kubernetes-engine/enterprise/knative-serving/docs/mapping-custom-domains).\n\n2. Turn on managed TLS certificates and HTTPS by updating the ConfigMap\n `config-domainmapping`:\n\n ```bash\n kubectl patch cm config-domainmapping -n knative-serving -p '{\"data\":{\"autoTLS\":\"Enabled\"}}'\n ```\n3. Wait for a few minutes after the command succeeds, then make sure the\n certificates feature is working:\n\n ```bash\n kubectl get kcert\n ```\n\n If the certificate is ready, you should see a message similar to this one: \n\n ```bash\n NAME READY REASON\n your-domain.com True\n ```\n\n It may take from 20 seconds to 2 minutes for the `Kcert` to become ready. If\n you experience any issues, see the\n [troubleshooting instructions](/kubernetes-engine/enterprise/knative-serving/docs/troubleshooting) for this\n feature.\n\n### Verifying success\n\n1. Verify that the DNS record has gone into effect by running the command:\n\n ```bash\n gcloud run domain-mappings describe --domain DOMAIN\n ```\n\n Replace \u003cvar translate=\"no\"\u003eDOMAIN\u003c/var\u003e with your own domain name, for example:\n `your-domain.com`\n2. Check the `url:` field in the return from the above command: the URL should\n have `https`, not `http`.\n\n3. Check the IP address from the above command, listed under\n `resourceRecords:rrdata`, and compare it to the value you see when you execute\n the command `host `\u003cvar translate=\"no\"\u003eDOMAIN\u003c/var\u003e. They should be the same.\n\nEnabling HTTPS redirects for Knative serving\n--------------------------------------------\n\n| **Important:** HTTPS redirect is available for cluster version `1.17.7-gke.8` and later.\n\nIf you use the managed TLS certificates feature, by default the cluster is\nexposed to both HTTP and HTTPS traffic for backwards compatibility reasons. If\nyou want to force all traffic to use HTTPS only, you can enable HTTPS redirects\nfor [an existing domain mapping](/kubernetes-engine/enterprise/knative-serving/docs/mapping-custom-domains) by invoking\nthe command \n\n kubectl annotate domainmappings \u003cvar translate=\"no\"\u003eDOMAIN\u003c/var\u003e domains.cloudrun.com/httpsRedirect=Enabled\n\nwhere \u003cvar translate=\"no\"\u003eDOMAIN\u003c/var\u003e is the name of the domain mapping.\n\nRelated topics\n--------------\n\n- [Troubleshooting managed TLS](/kubernetes-engine/enterprise/knative-serving/docs/troubleshooting#managed-tls) for details on checking domain mappings, certificate quotas, order status and order timeouts, and authorization failures.\n- [Bring your own TLS certificates](/kubernetes-engine/enterprise/knative-serving/docs/bring-your-own-cert) for instructions on using your own TLS certificates instead of the managed TLS certificates."]]
