Add optional TLS spec for RouteGroups

apis/zalando.org/v1/types.go

@@ -51,6 +51,10 @@ type RouteGroupSpec struct {
 	// Routes describe how a matching HTTP request is handled and where it is forwarded to
 	// +kubebuilder:validation:MinItems=1
 	Routes []RouteGroupRouteSpec `json:"routes,omitempty"`
+	// TLS defines which Kubernetes secret will be used to terminate the connection
+	// based on the matching hostnames
+	// +optional
+	TLS []RouteGroupTLSSpec `json:"tls,omitempty"`
 }
 
 // RouteGroupBackendType is the type of the route group backend.
@@ -168,6 +172,19 @@ type RouteGroupRouteSpec struct {
 	Methods []HTTPMethod `json:"methods,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+type RouteGroupTLSSpec struct {
+	// Host specifies the list of hosts included in the TLS secret.
+	// The values in this list must match the name/s used in the tlsSecret.
+	// +kubebuilder:validation:MinItems=1
+	Hosts []string `json:"hosts,omitempty"`
+
+	// SecretName is the name of the secret used to terminate TLS traffic on port 443.
+	// Field is left optional to allow TLS routing based on SNI hostname alone.
+	// +optional
+	SecretName string `json:"secretName,omitempty"`
+}
+
 // +k8s:deepcopy-gen=true
 type RouteGroupStatus struct {
 	// LoadBalancer is similar to ingress status, such that

zalando.org_routegroups.yaml

@@ -214,6 +214,27 @@ spec:
                   type: object
                 minItems: 1
                 type: array
+              tls:
+                description: TLS defines which Kubernetes secret will be used to terminate
+                  the connection based on the matching hostnames
+                items:
+                  properties:
+                    hosts:
+                      description: Host specifies the list of hosts included in the
+                        TLS secret. The values in this list must match the name/s
+                        used in the tlsSecret.
+                      items:
+                        pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?([.][a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+                        type: string
+                      minItems: 1
+                      type: array
+                    secretName:
+                      description: SecretName is the name of the secret used to terminate
+                        TLS traffic on port 443. Field is left optional to allow TLS
+                        routing based on SNI hostname alone.
+                      type: string
+                  type: object
+                type: array
             required:
             - backends
             type: object