Add support for fallback TLS

[aledbf]

Using a new flag like --fallback-tls-secret.
When this flag is configured we can omit the tls section in the Ingress rules and still listen in port 443.
The use case for this could be the use of a wildcard SSL certificate as default for a list of hosts.
This is useful because right now we need to copy the wildcard certificate in different namespaces.

[aledbf]

cc @coresolve

[aledbf]

This feature is useful for the upcoming wildcard certificates in Let's Encrypt

[zeeZ]

From looking at the controller source and my limited understanding about how the sections I looked at fit into the grand scheme of things, I gathered that it:

• Sorts all ingresses ascending by resourceVersion
• Iterates over all ingresses and for each rule
  • if a certificate is already set immediately skips to the next rule
  • if no secret is defined sets the certificate to the default certificate

If you have multiple ingresses, with only one of them containing a reference to the secret, you'll end up with either:

• the certificate defined in the ingress with the reference to the secret, because it had the lowest resourceVersion, or
• the default certificate, because the lowest resourceVersion had no secret defined, so the controller set the default certificate. All further checks were skipped because a certificate was already defined (the default one).

Wouldn't it be possible to rewrite the controller to set the default certificate after processing all rules, or keep processing that rule if no certificate or the default certificate was set? This way you could define an ingress without rules but with a secret as a fallback, and wouldn't have to set a flag.

[kfox1111]

I'm needing this feature as well.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[aledbf]

Closing. This is already implemented. By default, uses the default nginx certificate or the one behind the flag --default-ssl-certificate