Google Managed SSL Certificate use SSL v3 - google-cloud-platform

Question

I would like to use Google Managed Certificate on GKE.
I have a GKE cluster (1.22) with the external-dns helm chart configured against a CloudDNS zone, then I tried:
$ gcloud compute ssl-certificates create managed-cert \
--description "managed-cert" \
--domains "<hostname>" \
--global
$ kubectl create ns test
$ cat <<EOF | kubectl apply -f -
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-mc-deployment
namespace: test
spec:
selector:
matchLabels:
app: products
department: sales
replicas: 2
template:
metadata:
labels:
app: products
department: sales
spec:
containers:
- name: hello
image: "gcr.io/google-samples/hello-app:2.0"
env:
- name: "PORT"
value: "50001"
---
apiVersion: v1
kind: Service
metadata:
name: my-mc-service
namespace: test
spec:
type: NodePort
selector:
app: products
department: sales
ports:
- name: my-first-port
protocol: TCP
port: 60001
targetPort: 50001
---
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
name: managed-cert
namespace: test
spec:
domains:
- <hostname>
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-psc-ingress
namespace: test
annotations:
networking.gke.io/managed-certificates: "managed-cert"
ingress.gcp.kubernetes.io/pre-shared-cert: "managed-cert"
kubernetes.io/ingress.class: "gce"
spec:
rules:
- host: "<hostname>"
http:
paths:
- path: "/"
pathType: "ImplementationSpecific"
backend:
service:
name: "my-mc-service"
port:
number: 60001
EOF
The DNS zone is correctly updated and I am able to browse http://<hostname>.
Instead if I:
$ curl -v https://<hostname>
* Trying 34.120.218.42:443...
* Connected to <hostname> (34.120.218.42) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
* CApath: none
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (IN), TLS header, Unknown (21):
* TLSv1.3 (IN), TLS alert, handshake failure (552):
* error:0A000410:SSL routines::sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:0A000410:SSL routines::sslv3 alert handshake failure
$ gcloud compute ssl-certificates list
NAME TYPE CREATION_TIMESTAMP EXPIRE_TIME MANAGED_STATUS
managed-cert MANAGED 2022-06-30T00:27:25.708-07:00 PROVISIONING
<hostname>: PROVISIONING
mcrt-fe44e023-3234-42cc-b009-67f57dcdc5ef MANAGED 2022-06-30T00:27:52.707-07:00 PROVISIONING
<hostname>: PROVISIONING
I do not understand why it is creating a new managed certificate (mcrt-fe44e023-3234-42cc-b009-67f57dcdc5ef) even if I am specifing it.
Any ideas?
Thanks

Answer 1

After a bit of experimentation I understand what is going on.
The code above works, it takes around 20 minutes for the certificate to be created and propagated.
Regarding the double certificates: it is not required to create a ssl-certificates object as the ManagedCertificate custom resource will create it for you (mcrt-*).
To recap a example:
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-mc-deployment
namespace: test
spec:
selector:
matchLabels:
app: products
department: sales
replicas: 2
template:
metadata:
labels:
app: products
department: sales
spec:
containers:
- name: hello
image: "gcr.io/google-samples/hello-app:2.0"
env:
- name: "PORT"
value: "50001"
---
apiVersion: v1
kind: Service
metadata:
name: my-mc-service
namespace: test
spec:
type: NodePort
selector:
app: products
department: sales
ports:
- name: my-first-port
protocol: TCP
port: 60001
targetPort: 50001
---
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
name: managed-cert
namespace: test
spec:
domains:
- <hostname>
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-psc-ingress
namespace: test
annotations:
networking.gke.io/managed-certificates: "managed-cert"
kubernetes.io/ingress.class: "gce"
spec:
rules:
- host: "<hostname>"
http:
paths:
- path: "/"
pathType: "ImplementationSpecific"
backend:
service:
name: "my-mc-service"
port:
number: 60001