Skip to content

gcp managed cert config

Jump to bottom
Hleb Kanonik edited this page Mar 6, 2026 · 1 revision

Use Google-managed SSL certificates

You can use Google-managed SSL certificates to secure your custom domain with HTTPS. Google-managed SSL certificates are provisioned, renewed, and managed for your domain by Google. You can use Google-managed SSL certificates with Google Kubernetes Engine (GKE) and Google Cloud Load Balancing.

Comprehensive documentation is available at Google-managed SSL certificates.

Limitations

  • Don't support wildcard domains.
  • The domain name must be no longer than 63 characters.
  • Your ingressClassName must be "gce".
  • You must apply Ingress and ManagedCertificate resources in the same project and namespace.

Before you begin

Add a Google-managed SSL via Helm chart

To add a Google-managed SSL certificate to your ReportPortal deployment, you need to set the following parameters:

helm install \
...
  --set ingress.tls.certificate.gcpManaged=true
  --set ingress.hosts[0]="example.com"
...

Helm creates a ManagedCertificate resource and an Ingress resource that references the ManagedCertificate resource.

GKE automatically provisions the certificate and configures the load balancer to use it.

Manual adding a Google-managed SSL certificate

Setting up a Google-managed certificate

Create a ManagedCertificate resource

Create a ManagedCertificate resource in gcp-managed-cert.yaml to request a Google-managed SSL certificate for your domain.

# gcp-managed-cert.yaml
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: gcp-managed-certificate
spec:
  domains:
    - FQDN_1
    - FQDN_2

FQDN_1, FQDN_2: Fully-qualified domain names that you own. For example, example.com.

Apply the configuration:

kubectl apply -f gcp-managed-cert.yaml

Update the Ingress resource

Note: Replace {APP_NAME} with your application name.

If you have tls section in your Ingress resource, remove it.

kubectl edit ingress ${APP_NAME}-gateway-ingress

Update the Ingress resource to reference the ManagedCertificate resource:

kubectl annotate ingress ${APP_NAME}-gateway-ingress networking.gke.io/managed-certificates=gcp-managed-certificate

Check the status of the certificate

Using kubectl

To check the status of the certificate, run the following command:

kubectl describe managedcertificate

In the output, look for the Status. The status contains Certificate Status. Certificate Name is the GCP managed certificate name.

Using the Google Cloud CLI

To check all GCP managed certificates, run the following command:

gcloud compute ssl-certificates list --global

You need to find the certificate by the Google generated name and check the MANAGED_STATUS column.

You can get Google generated name from the Certificate Name using kubectl.

Disable HTTP Load Balancing

If you want to disable HTTP Load Balancing, you can do it after the certificate is attached to the Ingress resource:

kubectl annotate ingress ${APP_NAME}-gateway-ingress kubernetes.io/ingress.allow-http=false

Clean up

To delete the ManagedCertificate resource:

kubectl delete managedcertificate gcp-managed-certificate

Remove the ManagedCertificate reference from the Ingress resource:

kubectl annotate ingress managed-cert-ingress networking.gke.io/gcp-managed-certificate-

Also, check that the certificate is removed from the Google Cloud Console

gcloud compute ssl-certificates list --global

If the certificate is still present, delete it:

gcloud compute ssl-certificates delete ${CERTIFICATE_NAME} --global

Clone this wiki locally