Skip to content

Cluster issuer for HTTP-01 gatewayHTTPRoute should not require a gateway parentRef #7890

@brandonp42

Description

@brandonp42

Is your feature request related to a problem? Please describe.
I want to be able to create multiple gateways (with different host names) for separate applications & application environments but use a common cluster issuer. The problem is that cluster issuers require the spec.acme.solvers.http01.gatewayHTTPRoute.parentRefs[0].name field to be filled in. As far as I can tell this means I have to create a unique issuer per gateway anyway which seems like the cluster issuer isn't as useful versus the old style ingress cluster issuers.

Describe the solution you'd like
When I ask cert-manager to create certificates for a gateway I have to put annotations on the gateway anyway, so I'd like cert-manager to just harvest the gateway name from that CRD and use it instead of also having to specify it on a cluster issuer.

Describe alternatives you've considered
As described above - create a unique issuer for every gateway. Also I have not tested it but perhaps create gateways in different namespaces but the same name? It might also work to just create a single gateway across the whole system with many host names.

Additional context
The current implementation seems like an unnecessary limitation that may hamper adoption of Gateway API.

Environment details (remove if not applicable):

  • Kubernetes version: 1.33.3
  • Cloud-provider/provisioner: Proxmox / Talos / Cilium
  • cert-manager version: 1.18.2
  • Install method: helm chart

/kind feature

Metadata

Metadata

Assignees

Labels

area/acme/http01Indicates a PR modifies ACME HTTP01 provider codekind/featureCategorizes issue or PR as related to a new feature.priority/awaiting-more-evidenceLowest priority. Possibly useful, but not yet enough support to actually get it done.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions