-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Cluster issuer for HTTP-01 gatewayHTTPRoute should not require a gateway parentRef #7890
Description
Is your feature request related to a problem? Please describe.
I want to be able to create multiple gateways (with different host names) for separate applications & application environments but use a common cluster issuer. The problem is that cluster issuers require the spec.acme.solvers.http01.gatewayHTTPRoute.parentRefs[0].name field to be filled in. As far as I can tell this means I have to create a unique issuer per gateway anyway which seems like the cluster issuer isn't as useful versus the old style ingress cluster issuers.
Describe the solution you'd like
When I ask cert-manager to create certificates for a gateway I have to put annotations on the gateway anyway, so I'd like cert-manager to just harvest the gateway name from that CRD and use it instead of also having to specify it on a cluster issuer.
Describe alternatives you've considered
As described above - create a unique issuer for every gateway. Also I have not tested it but perhaps create gateways in different namespaces but the same name? It might also work to just create a single gateway across the whole system with many host names.
Additional context
The current implementation seems like an unnecessary limitation that may hamper adoption of Gateway API.
Environment details (remove if not applicable):
- Kubernetes version: 1.33.3
- Cloud-provider/provisioner: Proxmox / Talos / Cilium
- cert-manager version: 1.18.2
- Install method: helm chart
/kind feature