Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

site: update ingress.md for tls-cert-namespace annotation #4283

Merged
merged 1 commit into from
Jan 20, 2022
Merged

site: update ingress.md for tls-cert-namespace annotation #4283

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions site/content/docs/main/config/ingress.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,9 +61,12 @@ See upstream [documentation][7] on TLS configuration.
A secret specified in an Ingress TLS element will only be applied to Ingress rules with `Host` configuration that exactly matches an element of the TLS `Hosts` field.
Any secrets that do not match an Ingress rule `Host` will be ignored.

Ingress v1 does not allow the `secretName` field to contain a string with a full `namespace/name` identifier.
This is a major change from Ingress v1beta1 and causes secrets referenced by v1 resources to be in the same namespace as the Ingress resource.
This also disables Contour's [TLS secret delegation][8] behavior across namespaces in Ingress v1.
In Ingress v1beta1, the `secretName` field could contain a string with a full `namespace/name` identifier.
When used with Contour's [TLS certificate delegation][8], this allowed Ingresses to use a TLS certificate from a different namespace.
However, Ingress v1 does not allow the `secretName` field to contain a string with a full `namespace/name` identifier, because the field validation disallows the `/` character.
Instead, Ingress v1 resources can now use the `projectcontour.io/tls-cert-namespace` annotation, to define the namespace that contains the TLS certificate (if different than the Ingress's namespace).
This enables the TLS certificate delegation functionality to continue working for Ingress v1.
For more information and an example, see the [TLS certificate delegation documentation][8].

## Status

Expand Down