-
Notifications
You must be signed in to change notification settings - Fork 492
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Evolves the Gateway Name field #70
Conversation
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: danehans The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
@danehans: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think that we should separate changes to certificate handling into its own PR, with use cases and all the rest. I would expect there to be a range of opinions around wildcard certificates :)
// | ||
// * Generating a wildcard certificate for the subdomain of Name when | ||
// the TLS configuration of an HTTPS listener does not include a | ||
// certificate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't see any mention of wildcard certificates elsewhere in the spec. If this is a new feature, we should first capture a use case and then propose it independently.
// | ||
// If apiGroup and kind are empty, will default to Kubernetes Secrets resources. | ||
// If unspecified, a wildcard certificate is generated for the subdomain of the | ||
// listener's name. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think that wildcard certificate handling should be proposed and discussed as an independent item. Generating wildcard certificates is something that ought to require explicit configuration, and I don't think that it should happen as a side-effect of naming a listener.
I'll also note that many ingress controllers don't generate certificates, so I'm not sure the the spec should place requirements on them to do so.
/hold for resolution to #75 |
Superseded by #76 |
…e/single-cluster-regional-lb Single Cluster Regional L7 ILB with Gateway API
Evolves the following
Gateway
fields:Name
used for generating a listener wildcard certificate when unspecified by the TLS configuration.Certificate
godocs.Partially fixes #49
/assign @bowei