Skip to content

Commit f64974c

Browse files
chance-colemanchance-coleman
authored
feat: root domain templating (defenseunicorns#1343)
## Description New feature to add root domain configuration to the istio package. This allows for applications to sit on the root domain and be configured with a virtual service to be accessed. Templating includes options for TLS mode, TLSversion, cert, key, and cacert. Also a credential override if not using the templated tls secret. ## Related Issue Fixes defenseunicorns#1301 ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Steps to Validate This is a bit complicated to test but here are some steps: - Configure the values.yaml (certs for `uds.dev` and `uds.admin.dev`): ```yaml enableRootDomain: true rootDomainTLS: mode: SIMPLE # e.g., SIMPLE, MUTUAL, etc. default SIMPLE credentialName: "" # If set to a non-empty value, the chart will assume this secret already exists and will not auto-generate it using the provided cert data. supportTLSV1_2: true # Set to false to enforce TLSV1_3 only cert: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM5akNDQWQ2Z0F3SUJBZ0lVS2xZTlg5TG9CcSt4QytOWEF4eHg0R3VDZ0RZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0VqRVFNQTRHQTFVRUF3d0hkV1J6TG1SbGRqQWVGdzB5TlRBek1EWXhORFUwTlRsYUZ3MHlOakF6TURZeApORFUwTlRsYU1CSXhFREFPQmdOVkJBTU1CM1ZrY3k1a1pYWXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRQ3hMTHJ2ZWFHNDQ0NDFsbk8xaEVTSXUvM2UvOTRFVkxMZE5NSnpTNHJxOHl1Qi8wZGUKeVdaRFpISUJpb0RnbGFhaENUUUtUNFlFWTlkenBmNVFiWW9PUkZON1BoWEJUSTBacjlNUjRBQk9SeEpLbUREawpxelBWOGZPZW41a0dKaEFtWmllS0NuWk44a0FUZ29zQVVNUlh0Mk9laXE3Rmh0VUFQU0JaaGRueXJSOWZobGtsCnl0dGRxYXAxcFJZNmtzbStuWjVsbTdxc2RqMXdoQnVvN1lZcmtoYWlqUEF6WWFISkJCZ0VjWnVyMVN0a05BcjEKU2FmM1V5SmwxSkVMTG1ta2hiV0FBSDI2eVZKcGsyZTRkUVRrM3U3eWw3c1A2ZkhPSUoyeTdDbWZTM2xzV3hWMApBK0VUVC9DUVpBVHVXMHVYenowWFVjaDduL3EybnlyVHArREpBZ01CQUFHalJEQkNNQ0VHQTFVZEVRUWFNQmlDCkIzVmtjeTVrWlhhQ0RXRmtiV2x1TG5Wa2N5NWtaWFl3SFFZRFZSME9CQllFRk03dGdpdlovNC9LNzlwTzBUcnYKd2hvZUJaUm5NQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUFYd1p5MkdTaksreVJ2SGpBd0J5UlRUUW9hZ1RKeQpIUG1zK2kxY0xRMEJJaWE1b2hsMmE2U1d2eHpVdzcxczNCK0kyaHo5aTQ3TFlaQ1hCYWpsUzZLeEZ6bXRneXNaCitBa0VWOWFNZk9kb1dLMVA3UHVEQWZtYXFSY21pQU1SYWd2NDZCRnYyL2ozNU9FUTZUQTNGZGNIYitrN0tQWjMKUmJwcFVTWk84RHJpN0dLMnJXeVZBMHBLK0FUdzBtYWJzS1FNYVVmNFZ1cEhxNWRON21VS2U1S2cxZmluS2ltZAppZEhBYWxuREw4c3c0UTYzbTBpWTd0T1h1eGIvRlFmM0c4Smx5RXF0SUZyTWFndkZ6UzhoVExxTlRpRVdSbTJpClkvYitZMGZyazRyQTR2RUowWGlMVEpnSzJlOTVCZU1IMWJlUWV1ZG9DY3JyRmNuYnpMTmJBalpSCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" key: "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ3hMTHJ2ZWFHNDQ0NDEKbG5PMWhFU0l1LzNlLzk0RVZMTGROTUp6UzRycTh5dUIvMGRleVdaRFpISUJpb0RnbGFhaENUUUtUNFlFWTlkegpwZjVRYllvT1JGTjdQaFhCVEkwWnI5TVI0QUJPUnhKS21ERGtxelBWOGZPZW41a0dKaEFtWmllS0NuWk44a0FUCmdvc0FVTVJYdDJPZWlxN0ZodFVBUFNCWmhkbnlyUjlmaGxrbHl0dGRxYXAxcFJZNmtzbStuWjVsbTdxc2RqMXcKaEJ1bzdZWXJraGFpalBBellhSEpCQmdFY1p1cjFTdGtOQXIxU2FmM1V5SmwxSkVMTG1ta2hiV0FBSDI2eVZKcAprMmU0ZFFUazN1N3lsN3NQNmZIT0lKMnk3Q21mUzNsc1d4VjBBK0VUVC9DUVpBVHVXMHVYenowWFVjaDduL3EyCm55clRwK0RKQWdNQkFBRUNnZ0VBTlk5MEk1ajlqc3NiM285UkEzcXN6VGtua2haL280ZUhXdC9zT0xhSmxHVlcKcmNIaWJZRXM3UXFjZkdMR2V4NUNkVVEyK3piM0tMU1dHVndBK1lkanlOUlcrRmJZZE1zVGpNUmVablQxSXJUUgpqc05iWklWczhpeG1uWGxaNVVYMGMrZEY1TEVzK250VmE1QjNQTzB0cmVhK3N0cng0cnpULzNKN0tSVVJ3ZzZhCnM5c1R2T3dNU2RGUkxvWHU5bUE1RXlrWndTcjFuaVNkblp4OUlvNlJ1OFdRNEY5eXBuVVplQUd3VDBlWWd5QjcKcnczNmlzR3kzZC92SlJuNnZIcklDMk5rc2dqQURJYkpLUzdNNG5yc0s0WkRqYm5SZHlOVnBYYkc2UFdyMTJsTQp0bC9ZNndKeXhmaG5kSURYWERlYkVJL3Nxa2hjTTlqYitoaXV3aDd6MFFLQmdRRHBWbzMxZThRTDhvbGNBZ1loCnUvV0xDWlh3cjVFc2xXWkduWXhlSllYQjMwNE82T0M0SnlPTXd3dHJDOUlhMk9kK1IrMTc2VC8xb3Z4RFoxNHAKaWZNdFJnWEpQNTlQQXhVMGNpQUhoQUsrbWNUUXk1Q0JETXNUbmlXdUZIUDBab3g1WHpYRXN3U0JUck9DWExyTQpPSGVzZ25DVElCWlpYUFJ3WGlWWlozdE5id0tCZ1FEQ1ljdVZPeHlONkl3SVhpR0x4bXFabEM1dVhkc2ZoUkthCmJzWDdwdXJXbmJ0UUQzZVFUWGtvOWJPRUV6NFQvWFA0cmw2NkpMMllGQnY4MnVOY05KMEV4MkNtM3VHbGh1QWgKc0Rwa0t3ckQ2UGlJclZlT2p0RXNpR2pEZTVMNGgwczQ2UFZjTVBVUXlXQjAyNGhuSEZnRytFaWhRUWE3N0J1TAp3UzdQazh1SlJ3S0JnRFp2VzlUT0Y5RlZ0cGZCWFI3WGs1UHBHNUszMHAxZENTd21LdzMzb1BtMmw2WkF5OVFLClJXL2NQTGl2WEVlcEhIQklaVzNIMzRUMWpmWkhraDhNc0s5NkszVmtvMHl5Z21ybXlQUVg1dkFDUFhrY1ZFelcKNkRWZWFwbnU2WkkxcmtYT1lXUFBBNWtLL0RQSVlFZXVVTFR0QlVnOWJ4bFA1ektqdEFEa2RFNS9Bb0dBZktTSgpEdUFncHo1K3pMN1BjL2wvVVl1Yldsb0VzR2w4VEZyTHlWcDNLN2RvN1NWOTNhSlFGdHUyaVBKdDFCT3AwY1MrCktVNTE1SmJBZTV0QVAxZmRkN3NCVnYrRVljZmk0TGRJT2dML25EQS9iaVQ1Q0FpOFNIb1A4NG5CN0d1VTZLRTQKOUN6UWVEc3BCc1hlNlg5YlV0elNkZFJrcFF2NWZkd2FVREROU3ZFQ2dZRUEzT0hhV2k3eDF0c1ZLSWpjMEtGZwpxbmtjOTZBQlQ5dTR3V0t0bG9ZNXZFNDNWN2M1ZGM4QnZ0UGp1QUNucjZ2Q253YzZ3MjlhT3RzVUJPdVJNZ2QrCmlFRlpGcTN4bjVGK2I5MURLUzZDN2FLTjcvRzY3OUl6OFpZaGdVZGhuL1I4SjRPNkdXbGJEL2gvQThGQUJDOHIKZzlMTW9KUUxlc1VNQXVma1I5V25udGc9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K" cacert: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM5akNDQWQ2Z0F3SUJBZ0lVS2xZTlg5TG9CcSt4QytOWEF4eHg0R3VDZ0RZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0VqRVFNQTRHQTFVRUF3d0hkV1J6TG1SbGRqQWVGdzB5TlRBek1EWXhORFUwTlRsYUZ3MHlOakF6TURZeApORFUwTlRsYU1CSXhFREFPQmdOVkJBTU1CM1ZrY3k1a1pYWXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRQ3hMTHJ2ZWFHNDQ0NDFsbk8xaEVTSXUvM2UvOTRFVkxMZE5NSnpTNHJxOHl1Qi8wZGUKeVdaRFpISUJpb0RnbGFhaENUUUtUNFlFWTlkenBmNVFiWW9PUkZON1BoWEJUSTBacjlNUjRBQk9SeEpLbUREawpxelBWOGZPZW41a0dKaEFtWmllS0NuWk44a0FUZ29zQVVNUlh0Mk9laXE3Rmh0VUFQU0JaaGRueXJSOWZobGtsCnl0dGRxYXAxcFJZNmtzbStuWjVsbTdxc2RqMXdoQnVvN1lZcmtoYWlqUEF6WWFISkJCZ0VjWnVyMVN0a05BcjEKU2FmM1V5SmwxSkVMTG1ta2hiV0FBSDI2eVZKcGsyZTRkUVRrM3U3eWw3c1A2ZkhPSUoyeTdDbWZTM2xzV3hWMApBK0VUVC9DUVpBVHVXMHVYenowWFVjaDduL3EybnlyVHArREpBZ01CQUFHalJEQkNNQ0VHQTFVZEVRUWFNQmlDCkIzVmtjeTVrWlhhQ0RXRmtiV2x1TG5Wa2N5NWtaWFl3SFFZRFZSME9CQllFRk03dGdpdlovNC9LNzlwTzBUcnYKd2hvZUJaUm5NQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUFYd1p5MkdTaksreVJ2SGpBd0J5UlRUUW9hZ1RKeQpIUG1zK2kxY0xRMEJJaWE1b2hsMmE2U1d2eHpVdzcxczNCK0kyaHo5aTQ3TFlaQ1hCYWpsUzZLeEZ6bXRneXNaCitBa0VWOWFNZk9kb1dLMVA3UHVEQWZtYXFSY21pQU1SYWd2NDZCRnYyL2ozNU9FUTZUQTNGZGNIYitrN0tQWjMKUmJwcFVTWk84RHJpN0dLMnJXeVZBMHBLK0FUdzBtYWJzS1FNYVVmNFZ1cEhxNWRON21VS2U1S2cxZmluS2ltZAppZEhBYWxuREw4c3c0UTYzbTBpWTd0T1h1eGIvRlFmM0c4Smx5RXF0SUZyTWFndkZ6UzhoVExxTlRpRVdSbTJpClkvYitZMGZyazRyQTR2RUowWGlMVEpnSzJlOTVCZU1IMWJlUWV1ZG9DY3JyRmNuYnpMTmJBalpSCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" ``` - modify /etc/hosts file to include the ingress-gateway external ip `<external-ip> uds.dev` - deploy slim-dev `uds run slim-dev` - add virtual service to app-tenant manifest ```yaml apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: test-tenant-app namespace: test-tenant-app spec: hosts: - uds.dev gateways: - istio-tenant-gateway/tenant-gateway http: - match: - uri: prefix: /port8080 name: route-8080 rewrite: uri: / route: - destination: host: test-tenant-app port: number: 8080 - match: - uri: prefix: /port8081 name: route-8081 rewrite: uri: / route: - destination: host: test-tenant-app port: number: 8081 ``` - build and deploy test apps `uds zarf package create src/test --confirm --no-progress --skip-sbom && uds zarf package deploy build/zarf-package-uds-core-test-apps-*.zst --confirm --no-progress` - curl the uds.dev url: `curl -vk https://uds.dev/port8080` and should receive a `Hello from port 8080` ## Checklist before merging - [x] Test, docs, adr added or updated as needed - [x] [Contributor Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md) followed
1 parent 5e9c119 commit f64974c

5 files changed

Lines changed: 128 additions & 5 deletions

File tree

‎docs/reference/UDS Core/dns.md‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,11 @@ Each Gateway requires a wildcard DNS entry corresponding with the chosen `DOMAIN
1212
- `*.admin.<DOMAIN>` / Admin Gateway if NOT setting `ADMIN_DOMAIN`
1313

1414
:::note
15-
The default value for `DOMAIN` is `uds.dev`, which is intended for development purposes only. For non-development purposes, you should override this value by specifying a value for `domain` in your `uds-config.yaml`. You can find instructions on how to do so [here](https://uds.defenseunicorns.com/reference/configuration/ingress/#configure-domain-name-and-tls-for-istio-gateways).
15+
Wildcard records do not cover the root (apex) domain itself. If you need to serve applications directly on the root (for example, `uds.dev`), see [Istio Ingress docs](https://uds.defenseunicorns.com/reference/configuration/ingress/).
16+
:::
17+
18+
:::note
19+
The default value for `DOMAIN` is `uds.dev`, which is intended for development purposes only. For non-development purposes, you should override this value by specifying a value for `domain` in your `uds-config.yaml`. You can find instructions on how to do so [here](https://uds.defenseunicorns.com/reference/configuration/ingress/#configure-domain-name-and-tls-for-istio-gateways).
1620
:::
1721

1822
### Bundle Configuration
@@ -28,7 +32,7 @@ metadata:
2832
name: core-with-lb-config
2933
description: A UDS example bundle for deploying UDS Core with external Load Balancer configuration
3034
version: "0.0.1"
31-
35+
3236
packages:
3337
- name: core
3438
repository: oci://ghcr.io/defenseunicorns/packages/uds/core
@@ -52,7 +56,7 @@ overrides:
5256
- path: service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-scheme
5357
value: "internet-facing"
5458
- path: service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-attributes
55-
value: "load_balancing.cross_zone.enabled=true"
59+
value: "load_balancing.cross_zone.enabled=true"
5660
```
5761
5862
### Istio Gateways
@@ -72,4 +76,4 @@ istio-admin-gateway admin-ingressgateway Loa
7276
istio-tenant-gateway tenant-ingressgateway LoadBalancer 10.43.47.182 k8s-istioten-tenant...elb.us-east-1.amazonaws.com 15021:31222/TCP,80:30456/TCP,443:32508/TCP 1h
7377
```
7478

75-
From here, you can register your domain and/or create DNS records for your environment that point to the appropriate Gateways/Load Balancers. Refer to your DNS provider's documentation.
79+
From here, you can register your domain and/or create DNS records for your environment that point to the appropriate Gateways/Load Balancers. Refer to your DNS provider's documentation.

‎docs/reference/configuration/ingress.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,3 +132,69 @@ packages:
132132
- path: tls.credentialName
133133
value: tenant-gateway-tls-secret # Reference to the Kubernetes secret for the tenant gateway's TLS certificate
134134
```
135+
136+
### Root (Apex) Domain Configuration
137+
By default, the UDS Core Gateways are configured with wildcard hosts (for example, `*.uds.dev`), which match only subdomains (such as `demo.uds.dev` or `keycloak.admin.uds.dev`). The root domain (i.e. `uds.dev`) is not covered by a wildcard. This is important if you need an application to be accessible at the root of your domain.
138+
139+
To support this use case, UDS Core provides an optional configuration to enable a dedicated server block for the root domain. When enabled, two additional server blocks are added to your Istio Gateway:
140+
- **HTTP on port 80**: Redirects traffic to HTTPS.
141+
- **HTTPS on port 443**: Terminates TLS using settings from the rootDomain.tls section.
142+
143+
If you want your application to be reachable at `https://uds.dev`, enable root (apex) domain configuration via a bundle override in your UDS Bundle. For example:
144+
```yaml
145+
- name: core
146+
repository: oci://ghcr.io/defenseunicorns/packages/uds/core
147+
ref: 0.23.0-upstream
148+
overrides:
149+
istio-tenant-gateway:
150+
uds-istio-config:
151+
values:
152+
- path: rootDomain.enabled
153+
value: true
154+
- path: rootDomain.tls.mode
155+
value: SIMPLE
156+
- path: rootDomain.tls.credentialName
157+
value: "" # Leave blank to auto-create the secret using the provided cert data.
158+
- path: rootDomain.tls.supportTLSV1_2
159+
value: true
160+
variables:
161+
- path: rootDomain.tls.cert
162+
name: "ROOT_TLS_CERT"
163+
- path: rootDomain.tls.key
164+
name: "ROOT_TLS_KEY"
165+
- path: rootDomain.tls.cacert
166+
name: "ROOT_TLS_CACERT"
167+
```
168+
:::note
169+
- If you provide a non-empty value for credentialName, UDS Core assumes that you have pre-created the Kubernetes secret and will not auto-generate it using the certificate data.
170+
171+
- If you prefer to use an existing secret (such as when using a SAN certificate that covers both subdomains and the root) you may set the `rootDomain.tls.credentialName` field to the name of that secret (for example, `gateway-tls`). In that case, UDS Core assumes the secret exists and will not auto-create one using the certificate data.
172+
:::
173+
174+
#### Exposing a Service on the Root Domain with a VirtualService
175+
Once your root domain configuration is enabled and DNS is correctly set up (i.e. an A record for `uds.dev` points to your ingress gateway), you can expose services directly on the root domain. For example, to route traffic from `https://uds.dev/my-app` to a service in your cluster, create a VirtualService similar to the following:
176+
```yaml
177+
apiVersion: networking.istio.io/v1beta1
178+
kind: VirtualService
179+
metadata:
180+
name: my-app
181+
namespace: my-namespace
182+
spec:
183+
hosts:
184+
- uds.dev
185+
# If your gateway is deployed in a different namespace, fully qualify it:
186+
gateways:
187+
- istio-tenant-gateway/tenant-gateway
188+
http:
189+
- match:
190+
- uri:
191+
prefix: /my-app
192+
rewrite:
193+
uri: "/" # Optionally strip the /my-app prefix before forwarding
194+
route:
195+
- destination:
196+
host: my-app-service
197+
port:
198+
number: 80
199+
```
200+
This VirtualService matches requests to the root domain (`uds.dev`) with the path prefix `/my-app` and routes them to your service (`my-app-service` on port 80).

‎src/istio/chart/templates/gateway.yaml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
33

44
{{- $domain := tpl .Values.domain . }}
5+
{{- $rootTLS := .Values.rootDomain.tls | default dict -}}
6+
{{- $rootMode := $rootTLS.mode | default ($.Values.tls.mode | default "SIMPLE") -}}
7+
{{- $rootSupportTLS := $rootTLS.supportTLSV1_2 | default ($.Values.tls.supportTLSV1_2 | default false) -}}
58
{{- if .Values.tls }}
69
apiVersion: networking.istio.io/v1beta1
710
kind: Gateway
@@ -35,8 +38,29 @@ spec:
3538
mode: {{ $server.mode }}
3639
{{- if ne $server.mode "PASSTHROUGH" }}
3740
credentialName: {{ $.Values.tls.credentialName | default "gateway-tls" | quote }}
38-
# if supportTLSV1_2 is both defined and true, use TLSV1_2, otherwise use TLSV1_3
3941
minProtocolVersion: {{ if $.Values.tls.supportTLSV1_2 }}TLSV1_2{{ else }}TLSV1_3{{ end }}
4042
{{- end }}
4143
{{ end }}
44+
{{- if .Values.rootDomain.enabled }}
45+
- hosts:
46+
- "{{ $domain }}"
47+
port:
48+
name: "http-root-domain"
49+
number: 80
50+
protocol: HTTP
51+
tls:
52+
httpsRedirect: true
53+
- hosts:
54+
- "{{ $domain }}"
55+
port:
56+
name: "https-root-domain"
57+
number: 443
58+
protocol: HTTPS
59+
tls:
60+
mode: {{ $rootMode | quote }}
61+
{{- if ne $rootMode "PASSTHROUGH" }}
62+
credentialName: {{ $rootTLS.credentialName | default "root-domain-tls" | quote }}
63+
minProtocolVersion: {{ if $rootSupportTLS }}TLSV1_2{{ else }}TLSV1_3{{ end }}
64+
{{- end }}
65+
{{- end }}
4266
{{ end }}

‎src/istio/chart/templates/root-tls-cert.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Copyright 2024 Defense Unicorns
2+
# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
3+
4+
{{- $rootTls := .Values.rootDomain.tls }}
5+
{{ if and $rootTls.cert (not $rootTls.credentialName) }}
6+
apiVersion: v1
7+
kind: Secret
8+
metadata:
9+
name: root-domain-tls
10+
namespace: {{ .Release.Namespace }}
11+
data:
12+
tls.crt: {{ $rootTls.cert }}
13+
tls.key: {{ $rootTls.key }}
14+
cacert: {{ $rootTls.cacert }}
15+
type: kubernetes.io/tls
16+
---
17+
{{ end }}

‎src/istio/chart/values.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,15 @@ domain: "###ZARF_VAR_DOMAIN###"
3232
# - "*"
3333
# # Whether to support TLS 1.2 (if false, only TLS 1.3 will be supported)
3434
# supportTLSV1_2: true
35+
36+
# Enable root (apex) domain configuration. When true, the Gateway creates dedicated server blocks
37+
# for the root domain (e.g. uds.dev). This is required because wildcard hosts (e.g. *.uds.dev) do not match the root.
38+
rootDomain:
39+
enabled: false
40+
tls: {}
41+
# mode: SIMPLE # TLS mode (e.g., SIMPLE, MUTUAL). Default is SIMPLE.
42+
# credentialName: "" # Specify a TLS secret name if pre-created. Set to "" to auto-create using the cert data.
43+
# supportTLSV1_2: true # Set to true to support TLS 1.2, or false to enforce TLS 1.3 only.
44+
# cert: "BASE64_ENCODED_CERTIFICATE" # Base64-encoded certificate data. For self-signed certs, cert and cacert are typically the same.
45+
# key: "BASE64_ENCODED_PRIVATE_KEY" # Base64-encoded private key.
46+
# cacert: "BASE64_ENCODED_CERTIFICATE" # Base64-encoded CA certificate (use the same as cert for self-signed).

0 commit comments

Comments
 (0)