AlinsRan commented on issue #1882:
URL:
https://github.com/apache/apisix-ingress-controller/issues/1882#issuecomment-5502718097
@wk-mls's comment above is the correct answer, and it is the recommended way
to do this.
No controller-level "default certificate" option is needed: in APISIX the
SSL object is
selected by SNI during the TLS handshake, independently of the routes and of
the
namespace the route lives in. A certificate declared once therefore applies
to Ingresses
in every namespace, and the Secret does not have to be copied around.
So, following @wk-mls: create a single `ApisixTls` with wildcard SNIs, and
leave the
`tls` section out of your `Ingress` objects. `spec.secret` takes a name
*and* a
namespace, so the Secret only has to exist once.
```yaml
apiVersion: apisix.apache.org/v2
kind: ApisixTls
metadata:
name: default-tls
namespace: apisix
spec:
ingressClassName: apisix
hosts:
- "*.bar.tld"
secret:
name: star-bar-tld-tls
namespace: apisix
```
If you are on Gateway API instead, the equivalent is to put the certificate
in the
Gateway's `listeners[].tls.certificateRefs` and let HTTPRoutes from other
namespaces
attach through `allowedRoutes`.
The one thing not covered is ingress-nginx's `--default-ssl-certificate`
acting as a
catch-all for SNIs that match nothing, which is a different feature from
what is
described here — `*.bar.tld` is fully covered by a wildcard SNI.
Closing as already resolved. Please reopen if the wildcard `ApisixTls` does
not work for
your setup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
