opened
kfox1111
username_0
I'm currently running a multitenant cluster, where for each tenant, I have two namespaces:
* <tenantname>
* <tenantname>-admin

I'm running an ingress-nginx instance in the admin namespace with the --namespace flag set to only watch <tenantname>. This has been working quite well at providing nice isolation and ease of use for the end users.

I'd like to set it up such that, the admins presetup a letsencrypt based default-ssl-certificate in the <tenantname>-admin namespace as all of the letsencrypt bits are owned by the admins, not the tenant. Currently it only works if all of the creds are stored in the <tenantname>, exposing it all to the end user.
default-ssl-cert with alternate namespace
issue
created
kfox1111
username_0
We discussed a few options on slack. Supporting watching multiple namespaces would be a lot of work.

I looked through the code and it does not look like it would be easy to have the watcher watch just the additional namespace just for the default-ssl-cert secret either.

One more possibility could be to allow the default-ssl-cert to be specified as a file. It could be mounted by secret into the controller. The code looks like it may be fairly easy to work in that mode.
comment