Context
#2812 delivered operator-provided wildcard certificates (publishing.certificates.wildcardSecretName) for platform services and the root tenant only. The MVP is scoped to tenant-root because everything there is same-namespace: the operator places one TLS Secret in tenant-root, the root ingress controller references it via --default-ssl-certificate, and the root TenantGateway references it in certMode: existingSecret — no cross-namespace access needed.
Child tenants are not covered. Each tenant runs its own ingress-nginx controller (and optionally its own Gateway) in its own namespace, with namespace-scoped RBAC under a default-deny CiliumNetworkPolicy. A controller in a child tenant namespace cannot read a Secret from tenant-root, so a cross-namespace --default-ssl-certificate reference would fail, and a Gateway certificateRefs to another namespace needs a ReferenceGrant.
Goal
Make the operator-provided wildcard usable by child-tenant ingress controllers and Gateways, with the same single operator input, without granting cross-namespace Secret reads.
Approach to evaluate
Replicate the one operator wildcard Secret into each tenant namespace that runs a TLS termination point (ingress: true / gateway: true), then point each per-tenant controller / Gateway at its local copy. Cozystack already ships clustersecret-operator (the ClusterSecret CRD), which is the natural mechanism: one ClusterSecret syncs the wildcard into a label/namespace-selector set.
Open questions:
- Selector: which namespaces receive the copy — every tenant namespace, or only those with a termination point?
- Lifecycle: rotation of the source Secret must propagate to copies; deletion must clean them up.
- Gateway path: a same-namespace copy avoids a ReferenceGrant; confirm the
existingSecret reconciler picks up the replicated Secret per tenant.
- Private-key blast radius: one key in every tenant namespace that terminates TLS — does this match the threat model, vs. the root-only MVP?
Scope
Builds on #2812. Part of #2811 (WS1).
Context
#2812 delivered operator-provided wildcard certificates (
publishing.certificates.wildcardSecretName) for platform services and the root tenant only. The MVP is scoped totenant-rootbecause everything there is same-namespace: the operator places one TLS Secret intenant-root, the root ingress controller references it via--default-ssl-certificate, and the rootTenantGatewayreferences it incertMode: existingSecret— no cross-namespace access needed.Child tenants are not covered. Each tenant runs its own ingress-nginx controller (and optionally its own Gateway) in its own namespace, with namespace-scoped RBAC under a default-deny CiliumNetworkPolicy. A controller in a child tenant namespace cannot read a Secret from
tenant-root, so a cross-namespace--default-ssl-certificatereference would fail, and a GatewaycertificateRefsto another namespace needs a ReferenceGrant.Goal
Make the operator-provided wildcard usable by child-tenant ingress controllers and Gateways, with the same single operator input, without granting cross-namespace Secret reads.
Approach to evaluate
Replicate the one operator wildcard Secret into each tenant namespace that runs a TLS termination point (
ingress: true/gateway: true), then point each per-tenant controller / Gateway at its local copy. Cozystack already shipsclustersecret-operator(theClusterSecretCRD), which is the natural mechanism: oneClusterSecretsyncs the wildcard into a label/namespace-selector set.Open questions:
existingSecretreconciler picks up the replicated Secret per tenant.Scope
Builds on #2812. Part of #2811 (WS1).