TLS certificates shared by all routes?

Traefik
1

I noticed something when I tested copying an Ingress resource: When I have two ingress resources with the same hosts, but only one references a TLS secret, both routers in Traefik have TLS.

I noticed this when I copied an existing ingress to another namespace, where I did not have access to the secret.

I assume this is by design: The TLS store is populated when the ingress resource is read and by the routers are then just taking whatever is in the store, right?

My question now is: Is that working as designed? Or is that something that could change in the future?

I'm asking because I'm thinking about building a functionality around that. I'm implementing a Maintenance Mode for my cluster, that should basically "overlay" a set of ingresses with a maintenance page. To have that working properly without enabling support for ExternalName services, I'd have to create those ingresses in the namespace of the maintenance app. In there I don't have access to the TLS secrets of the application namespaces, of course.

Thanks in advance!

2

I ran into this exact behavior when mirroring an Ingress across namespaces, where the second router picked up TLS even though it referenced no secret. The shared TLS store explains why the certificate still applied, which matches what I observed. It does make maintenance overlays trickier since you can't easily keep the copied router cert-free.