Managed Certificates for AI APIs on GKE

Question

Pulumi · Accepted Answer

To set up managed certificates for AI APIs on Google Kubernetes Engine (GKE), you'll typically need a few things:

1. A Google Kubernetes Engine cluster to host your APIs.
2. A service exposed via an Ingress resource, with an associated domain name that you own.
3. Managed certificates provided by Google Certificate Manager or a similar service to enable TLS for your domain.
4. Proper DNS setup to point your domain to the IP of the Ingress controller.

In this Pulumi program, we will create an Ingress resource with a Google-managed certificate in a GKE cluster. You're expected to have your GKE cluster already running and have a domain name ready that you own.

Google's managed certificate service will automatically provision an SSL certificate and renew it on your behalf. Ensure that the domain name's DNS configuration is properly set up, pointing to your Ingress's IP address in GKE.

Here's how you can achieve this setup in Pulumi using Python:

```python
import pulumi
import pulumi_gcp as gcp

# Assume we have a GKE cluster created, and we're managing its kubeconfig through Pulumi.
# Therefore, we need the K8s provider configured with the GKE cluster's kubeconfig.
kubeconfig = ... # replace with your GKE cluster kubeconfig data

k8s_provider = pulumi_kubernetes.Provider("k8s-provider", kubeconfig=kubeconfig)

# Create a Kubernetes Ingress per your requirements.
# This example assumes you're running a simple NGINX deployment or similar.
api_ingress = pulumi_kubernetes.networking.v1.Ingress(
    "api-ingress",
    metadata={
        "annotations": {
            # The annotation below is necessary for utilizing GCP-managed SSL certificates
            "networking.gke.io/managed-certificates": "api-ssl-certificate",
        }
    },
    spec={
        "rules": [{
            "host": "api.example.com",  # Replace with your own domain
            "http": {
                "paths": [{
                    "path": "/",  # Your app's path
                    "backend": {
                        "service_name": "api-service",  # Assume there is a service named 'api-service'
                        "service_port": 80,
                    },
                }],
            },
        }],
    },
    opts=pulumi.ResourceOptions(provider=k8s_provider)
)

# Create a ManagedCertificate resource for the domain
managed_certificate = gcp.certificatemanager.Certificate(
    "api-ssl-certificate",
    managed={
        "domains": ["api.example.com"]  # Replace with your own domain
    }
)

# Export the Ingress IP to update your DNS settings manually
ingress_ip = api_ingress.status.load_balancer.ingress[0].ip
pulumi.export("ingress_ip", ingress_ip)
```

This program does the following:
- It creates a Kubernetes Ingress resource and specifies a managed certificate annotation using GCP's managed certificate service.
- It sets up a `Certificate` resource managed by GCP Certificate Manager for the domain name.
- The managed certificate resource indicates to GCP that you want to use Google's Certificate Manager to manage the SSL certificate for the specified domain.

**Important**: After creating the Ingress with the proper annotations, it typically takes some time for the Ingress controller to provision the IP address and for the SSL certificate to be ready. Additionally, you'll need to update your domain's DNS records with the IP address of the Ingress controller (exported as `ingress_ip` by the program) to complete the setup, and for certificate provisioning to succeed.

Make sure you replace `"api.example.com"`, which serves as a placeholder for your actual domain, and ensure your domain's DNS configuration points to `ingress_ip`. After doing this, Google will issue an SSL certificate for your domain, ensuring secure communication to your GKE-hosted API.

Keep in mind that this code assumes you have a service called `api-service` running in Kubernetes, and that you have the `kubeconfig` for your GKE cluster. You also need to replace the placeholders with actual values relevant to your setup.