Re: [I] feat: As a user, I want to be able to specify a default SSL cert for ingress controller, so that k8s secret only needs to be created once [apisix-ingress-controller]

["AlinsRan (via GitHub)" <gi...@apache.org>]

AlinsRan commented on issue #1882:
URL: https://github.com/apache/apisix-ingress-controller/issues/1882#issuecomment-5502718097

   @wk-mls's comment above is the correct answer, and it is the recommended way to do this.
   
   No controller-level "default certificate" option is needed: in APISIX the SSL object is
   selected by SNI during the TLS handshake, independently of the routes and of the
   namespace the route lives in. A certificate declared once therefore applies to Ingresses
   in every namespace, and the Secret does not have to be copied around.
   
   So, following @wk-mls: create a single `ApisixTls` with wildcard SNIs, and leave the
   `tls` section out of your `Ingress` objects. `spec.secret` takes a name *and* a
   namespace, so the Secret only has to exist once.
   
   ```yaml
   apiVersion: apisix.apache.org/v2
   kind: ApisixTls
   metadata:
     name: default-tls
     namespace: apisix
   spec:
     ingressClassName: apisix
     hosts:
       - "*.bar.tld"
     secret:
       name: star-bar-tld-tls
       namespace: apisix
   ```
   
   If you are on Gateway API instead, the equivalent is to put the certificate in the
   Gateway's `listeners[].tls.certificateRefs` and let HTTPRoutes from other namespaces
   attach through `allowedRoutes`.
   
   The one thing not covered is ingress-nginx's `--default-ssl-certificate` acting as a
   catch-all for SNIs that match nothing, which is a different feature from what is
   described here — `*.bar.tld` is fully covered by a wildcard SNI.
   
   Closing as already resolved. Please reopen if the wildcard `ApisixTls` does not work for
   your setup.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org