@@ -3,7 +3,7 @@ title: Annotated Gateway resource
33description : ' cert-manager usage: Kubernetes Gateways'
44---
55
6- > ** apiVersion:** gateway.networking.k8s.io/v1alpha2
6+ > ** apiVersion:** gateway.networking.k8s.io/v1
77> ** kind:** Gateway
88
99<div style ={{textAlign : "center"}} >
@@ -23,7 +23,7 @@ HTTP-01](../configuration/acme/http01/README.md).
2323
2424<div className =" info " >
2525
26- 🚧 cert-manager 1.8 + is tested with v1alpha2 Kubernetes Gateway API. It should also work
26+ 🚧 cert-manager 1.14 + is tested with v1 Kubernetes Gateway API. It should also work
2727with v1beta1 because of resource conversion, but has not been tested with it.
2828
2929</div >
@@ -51,7 +51,7 @@ feature flag to the cert-manager controller.
5151To install v1.5.1 Gateway API bundle (Gateway CRDs and webhook), run the following command:
5252
5353``` sh
54- kubectl apply -f " https://github.com/kubernetes-sigs/gateway-api/releases/download/v0.5.1 /standard-install.yaml"
54+ kubectl apply -f " https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0 /standard-install.yaml"
5555```
5656
5757To enable the feature in cert-manager, turn on the ` GatewayAPI ` feature gate:
@@ -89,7 +89,7 @@ following Gateway will trigger the creation of a Certificate with the name
8989` example-com-tls ` :
9090
9191``` yaml
92- apiVersion : gateway.networking.k8s.io/v1alpha2
92+ apiVersion : gateway.networking.k8s.io/v1
9393kind : Gateway
9494metadata :
9595 name : example
@@ -157,27 +157,37 @@ In the following example, the first four listener blocks will not be used to
157157generate Certificate resources :
158158
159159` ` ` yaml
160- apiVersion: gateway.networking.k8s.io/v1alpha2
160+ apiVersion: gateway.networking.k8s.io/v1
161161kind: Gateway
162162metadata:
163163 name: my-gateway
164164 namespace: default
165165 annotations:
166166 cert-manager.io/issuer: my-issuer
167167spec:
168+ gatewayClassName: foo
168169 listeners:
169170 # ❌ Missing "tls" block, the following listener is skipped.
170- - hostname: example.com
171+ - name: example-1
172+ port: 80
173+ protocol: HTTP
174+ hostname: example.com
171175
172176 # ❌ Missing "hostname", the following listener is skipped.
173- - tls:
177+ - name: example-2
178+ port: 443
179+ protocol: HTTPS
180+ tls:
174181 certificateRefs:
175182 - name: example-com-tls
176- kind: Secret"
183+ kind: Secret
177184 group: core
178185
179186 # ❌ "mode: Passthrough" is not supported, the following listener is skipped.
180- - hostname: example.com
187+ - name: example-3
188+ hostname: example.com
189+ port: 8443
190+ protocol: HTTPS
181191 tls:
182192 mode: Passthrough
183193 certificateRefs:
@@ -186,8 +196,9 @@ spec:
186196 group: core
187197
188198 # ❌ Cross-namespace secret references are not supported, the following listener is skipped.
189- - hostname: foo.example.com
190- port: 443
199+ - name: example-4
200+ hostname: foo.example.com
201+ port: 8443
191202 protocol: HTTPS
192203 allowedRoutes:
193204 namespaces:
@@ -201,8 +212,9 @@ spec:
201212 namespace: other-namespace
202213
203214 # ✅ The following listener is valid.
204- - hostname: foo.example.com # ✅ Required.
205- port: 443
215+ - name: example-5
216+ hostname: bar.example.com # ✅ Required.
217+ port: 8443
206218 protocol: HTTPS
207219 allowedRoutes:
208220 namespaces:
@@ -239,7 +251,7 @@ The same Secret name can be re-used in multiple TLS blocks, regardless of the
239251hostname. Let us imagine that you have these two listeners :
240252
241253` ` ` yaml
242- apiVersion: gateway.networking.k8s.io/v1alpha2
254+ apiVersion: gateway.networking.k8s.io/v1
243255kind: Gateway
244256metadata:
245257 name: example
@@ -249,14 +261,10 @@ spec:
249261 gatewayClassName: foo
250262 listeners:
251263 # Listener 1.
252- - hostname: example.com
264+ - name: example-1
265+ hostname: example.com
253266 port: 443
254267 protocol: HTTPS
255- routes:
256- kind: HTTPRoute
257- parentRefs:
258- - name: example
259- kind: Gateway
260268 tls:
261269 mode: Terminate
262270 certificateRefs:
@@ -265,14 +273,10 @@ spec:
265273 group: core
266274
267275 # Listener 2: Same Secret name as Listener 1, with a different hostname.
268- - hostname: *.example.com
276+ - name: example-2
277+ hostname: "*.example.com"
269278 port: 443
270279 protocol: HTTPS
271- routes:
272- kind: HTTPRoute
273- parentRefs:
274- - name: example
275- kind: Gateway
276280 tls:
277281 mode: Terminate
278282 certificateRefs:
@@ -281,14 +285,10 @@ spec:
281285 group: core
282286
283287 # Listener 3: also same Secret name, except the hostname is also the same.
284- - hostname: *.example.com
288+ - name: example-3
289+ hostname: "*.example.com"
285290 port: 8443
286291 protocol: HTTPS
287- routes:
288- kind: HTTPRoute
289- parentRefs:
290- - name: example
291- kind: Gateway
292292 tls:
293293 mode: Terminate
294294 certificateRefs:
@@ -297,14 +297,10 @@ spec:
297297 group: core
298298
299299 # Listener 4: different Secret name.
300- - hostname: site.org
300+ - name: example-4
301+ hostname: site.org
301302 port: 443
302303 protocol: HTTPS
303- routes:
304- kind: HTTPRoute
305- parentRefs:
306- - name: example
307- kind: Gateway
308304 tls:
309305 mode: Terminate
310306 certificateRefs:
0 commit comments