shared cert refs between multiple gateways in the same namespace

[KevFan]

Description

For a TLSPolicy, the created Cert uses the name defined in the listener certificate ref defined in the Gateway spec. This allows for sharing Certs across multiple listeners and one single Cert is created with the hostnames of the listeners.

However, if another gateway in the same namespace also defines the same listener certifcate ref with a TLSPolicy attached, the Certifcate will be constantly updated.

kubectl apply -n istio-system -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway-1
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    hostname: '*.toys.io'
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - name: toys
        kind: Secret
    allowedRoutes:
      namespaces:
        from: All    
  - name: http2
    hostname: '*.soys.io'
    port: 599
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - name: toys
        kind: Secret
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway-2
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    hostname: '*.coys.io'
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - name: toys
        kind: Secret
    allowedRoutes:
      namespaces:
        from: All    
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
---
apiVersion: kuadrant.io/v1
kind: TLSPolicy
metadata:
  name: gw1-tls
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: gateway-1
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: selfsigned-issuer
---
apiVersion: kuadrant.io/v1
kind: TLSPolicy
metadata:
  name: gw2-tls
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: gateway-2
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: selfsigned-issuer
EOF

The cert is constantly updated:

watch -n 0.5 "kubectl get certificate toys -n istio-system -o yaml | yq '.spec'"

[KevFan]

\cc @mikenairn