envoyproxy / envoyproxy/gateway

Allow usage of same tls certificate for multiple listeners in a gateway for same hostname

Open
#8,928 4 comments 0 reactions 0 assignees View on GitHub
stale triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
1d 22h
Merged PRs (30d)
148

Description

*Description*:
I'm trying to deploy a Gateway with two listeners with tls mode set to `Terminate`.

The idea is to use the same certificate for both listeners, because later we will have more listeners and each listener would then need it's own certificate. That doesn't feel so good.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
annotations:
cert-manager.io/cluster-issuer: acme
name: my-gateway
namespace: envoy-gateway
spec:
gatewayClassName: gwc-envoy
listeners:
- allowedRoutes:
namespaces:
from: All
hostname: bla.fasel.de
name: hec
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: tls-cert
mode: Terminate
- allowedRoutes:
namespaces:
from: All
hostname: bla.fasel.de
name: syslog-tcp-tls-source-1
port: 1234
protocol: TLS
tls:
certificateRefs:
- group: ""
kind: Secret
name: tls-cert
mode: Terminate
```

Unfortunately this doesn't work:
```
No valid secrets exist: envoy-gateway/tls-cert public key algorithm must be unique, certificate domain bla.fasel.de has a conflicting algorithm [RSA].
```

I wonder why this limitation is in place. Shouldn't i be able to use the same certificate on two different listeners for the same hostname?

I'm using the envoy-helm-image in version 1.8-rc1

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.