Set up HTTPS for GKE

Modern Cloud Platforms

This content applies only to CloudBees CI on modern cloud platforms.

HTTPS ensures encrypted communication between clients and the CloudBees CI UI on Google Kubernetes Engine (GKE). With Gateway API, TLS termination is configured on the Gateway resource. The Gateway listener references a TLS certificate, decrypts incoming traffic, and forwards plaintext to backend pods.

For instructions on creating a TLS certificate Secret and configuring the Gateway listener, refer to Gateway TLS termination in the GKE reference architecture.

For the complete list of Gateway API prerequisites, including TLS verification, refer to Verify Kubernetes Gateway API prerequisites.

Google-managed certificates

As an alternative to self-managed certificate Secrets, the GKE Gateway controller supports automatic certificate provisioning and renewal through Google Certificate Manager.

Create a DNS authorization and a managed certificate:

gcloud certificate-manager dns-authorizations create cloudbees-dns-auth \
  --domain="*.cloudbees.example.com"

gcloud certificate-manager certificates create cloudbees-cert \
  --domains="*.cloudbees.example.com" \
  --dns-authorizations=cloudbees-dns-auth▼

Create a certificate map and map entry:

gcloud certificate-manager maps create cloudbees-cert-map

gcloud certificate-manager maps entries create cloudbees-cert-entry \
  --map=cloudbees-cert-map \
  --certificates=cloudbees-cert \
  --hostname="*.cloudbees.example.com"▼

Reference the certificate map in the Gateway resource:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: cloudbees-gateway
  namespace: <gateway-namespace>
  annotations:
    networking.gke.io/certmap: cloudbees-cert-map
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
  - name: https
    protocol: HTTPS
    port: 443
    hostname: "*.cloudbees.example.com"
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            cloudbees.com/gateway-routes: enabled▼

When using a certificate map, the tls block on the listener is not required. Google Certificate Manager handles certificate provisioning and renewal automatically.

If you use a manually created TLS secret (via kubectl create secret tls) instead of a certificate map, add a tls block to the listener with mode: Terminate and a certificateRefs entry pointing to your secret. Refer to Gateway TLS termination for details.

For more information, refer to the GKE documentation on securing Gateways with Certificate Manager.

Redirect HTTP to HTTPS

To redirect all HTTP traffic to HTTPS, add an HTTP listener to the Gateway and create an HTTPRoute with a redirect filter.

Add an HTTP listener to the Gateway resource alongside the existing HTTPS listener:

  listeners:
  # ...existing HTTPS listener...
  - name: http-redirect
    protocol: HTTP
    port: 80
    hostname: "*.cloudbees.example.com"
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            cloudbees.com/gateway-routes: enabled▼

Create an HTTPRoute to redirect HTTP requests to HTTPS:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http-to-https-redirect
  namespace: <cbci-namespace>
spec:
  parentRefs:
  - name: cloudbees-gateway
    namespace: <gateway-namespace>
    sectionName: http-redirect
  rules:
  - filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https
        statusCode: 301▼

TLS policy

To enforce a minimum TLS version and restrict cipher suites on the Gateway, create a Google Cloud SSL policy.

gcloud compute ssl-policies create cloudbees-tls-policy \
  --profile=MODERN \
  --min-tls-version=1.2▼

For instructions on applying SSL policies to Gateway resources, refer to the GKE documentation on configuring TLS.