emissary-ingress / emissary

open source Kubernetes-native API gateway for microservices built on the Envoy Proxy
https://www.getambassador.io
Apache License 2.0
4.35k stars 681 forks source link

Handle `Host` without a tlsSecret.name defined in a better way #4947

Open alexbowers opened 1 year ago

alexbowers commented 1 year ago

Please describe your use case / problem. Currently, when you want to create a Host for a new Hostname (eg. something.example.com) you can define a Host. If you want to have TLS with this as well, you would define a Certificate (via Cert Manager).

If you're using HTTP-01 challenge on the certificate, then you need the Host to be accessible.

To do that, with a Mapping you would define a Mapping as shown in the documentation; however, there is a problem.

There isn't a Host thats registered, because the certificate secret is invalid (or doesn't exist).

To counter this, you need to have a wildcard Host (hostname: '*').

It would be better if the Host instead "downgraded" itself to one without the TLS configuration, so that it was ready to receive HTTP requests to handle the Cert Manager request.

alexbowers commented 1 year ago

This is especially a problem if you're registering many Hostnames (such as providing a service where you can register a custom domain)