MeshGateway TLS configuration for multi-domain certificate support
0 reputation · 20 Mar 2020, 07:32 UTC
Traefik Mesh utilizes the MeshGateway resource to handle ingress traffic and TLS termination. Currently, the tls block within a MeshGateway definition allows for the reference of a single Kubernetes Secret containing a certificate and private key.
In environments requiring multiple domains to be served through a single gateway instance, the current architecture necessitates the creation of separate MeshGateway resources for each unique certificate. This approach increases the number of managed resources and may complicate the mapping of ingress traffic to specific backend services when a unified entry point is desired.
Assuming Traefik Mesh v0.6.x, there is uncertainty regarding the ability to associate a collection of certificates with one gateway to enable Server Name Indication (SNI) routing without deploying multiple gateway instances.
- Can a single
MeshGatewaybe configured to reference multiple TLS secrets for multi-domain support? - Is there a documented method to implement dynamic certificate rotation within the
tlsblock without recreating theMeshGatewayresource?
traefikmesh