github.com/projectcontour/contour@v1.28.2/site/content/docs/v1.14.2/config/tls-delegation.md (about)

     1  # TLS Certificate Delegation
     2  
     3  In order to support wildcard certificates, TLS certificates for a `*.somedomain.com`, which are stored in a namespace controlled by the cluster administrator, Contour supports a facility known as TLS Certificate Delegation.
     4  This facility allows the owner of a TLS certificate to delegate, for the purposes of referencing the TLS certificate, permission to Contour to read the Secret object from another namespace.
     5  Delegation works for both HTTPProxy and Ingress resources.
     6  
     7  The [`TLSCertificateDelegation`][1] resource defines a set of `delegations` in the `spec`.
     8  Each delegation references a `secretName` from the namespace where the `TLSCertificateDelegation` is created as well as describing a set of `targetNamespaces` in which the certificate can be referenced.
     9  If all namespaces should be able to reference the secret, then set `"*"` as the value of `targetNamespaces` (see example below).
    10  
    11  ```yaml
    12  apiVersion: projectcontour.io/v1
    13  kind: TLSCertificateDelegation
    14  metadata:
    15    name: example-com-wildcard
    16    namespace: www-admin
    17  spec:
    18    delegations:
    19      - secretName: example-com-wildcard
    20        targetNamespaces:
    21        - example-com
    22      - secretName: another-com-wildcard
    23        targetNamespaces:
    24        - "*"
    25  ---
    26  apiVersion: projectcontour.io/v1
    27  kind: HTTPProxy
    28  metadata:
    29    name: www
    30    namespace: example-com
    31  spec:
    32    virtualhost:
    33      fqdn: foo2.bar.com
    34      tls:
    35        secretName: www-admin/example-com-wildcard
    36    routes:
    37      - services:
    38          - name: s1
    39            port: 80
    40  ```
    41  
    42  In this example, the permission for Contour to reference the Secret `example-com-wildcard` in the `admin` namespace has been delegated to HTTPProxy objects in the `example-com` namespace.
    43  Also, the permission for Contour to reference the Secret `another-com-wildcard` from all namespaces has been delegated to all HTTPProxy objects in the cluster.
    44  
    45  [1]: /docs/{{< param version >}}/config/api/#projectcontour.io/v1.TLSCertificateDelegation