Add default TLS cert

[BobyMCbobs]

use an existing secret for TLS termination.

similar to knative-extensions/net-contour#193

/assign

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[BobyMCbobs]

/remove-lifecycle stale

[nak3]

Hi @BobyMCbobs

net-istio has two TLS setup
a) Manually adding a TLS certificate
b) Enabling auto-TLS certs

I assume that you want to add the default TLS cert for b) but then I guess it is a little bit difficult for net-istio.

Unlike Contour, Istio's Gateway does not support cross namespace secret[1][2]. Thereforce, we need to deploy secrets in every single namespace where net-istio generated the Gateway.

Contour can deploy the default secret in "some-admin-namespace", though.

Sorry if you have any other good solution but I just leave my comment here.

[1] istio/istio#14598 (comment)
[2] https://istio.io/latest/docs/reference/config/networking/gateway/#ServerTLSSettings (Only credentialName is available)

[BobyMCbobs]

Hi @BobyMCbobs

net-istio has two TLS setup a) Manually adding a TLS certificate b) Enabling auto-TLS certs

I assume that you want to add the default TLS cert for b) but then I guess it is a little bit difficult for net-istio.

@nak3, thank you for your reply.
Yeah this is correct.
Ideally make it so that it uses a given TLS cert by default for a hostname wildcard and for anything else it uses net-certmanager.
I think I may need to write something custom for that functionality though.
Perhaps even a MutatingWebhookConfiguration could do it 🤔

Unlike Contour, Istio's Gateway does not support cross namespace secret[1][2]. Thereforce, we need to deploy secrets in every single namespace where net-istio generated the Gateway.

Contour can deploy the default secret in "some-admin-namespace", though.

When I used Contour, this was something I also implemented

Sorry if you have any other good solution but I just leave my comment here.

[1] istio/istio#14598 (comment) [2] https://istio.io/latest/docs/reference/config/networking/gateway/#ServerTLSSettings (Only credentialName is available)

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[dprotaso]

/unassign @BobyMCbobs