Aws-load-balancer-controller: Feature req: Support multiple SSL certificate ARNs

[tomfotherby]

Since Oct/17 Application Load Balancers support Server Name Indicator (SNI) that enables use of multiple SSL certificates on the same IP and port: https://aws.amazon.com/about-aws/whats-new/2017/10/elastic-load-balancing-application-load-balancers-now-support-multiple-ssl-certificates-and-smart-certificate-selection-using-server-name-indication-sni/

For example: current annotations:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: "test-alb-ingress"
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80, "HTTPS": 443}]'
    alb.ingress.kubernetes.io/subnets: 'blah1,blah2'
    alb.ingress.kubernetes.io/security-groups: 'xxx,yyy'
    alb.ingress.kubernetes.io/certificate-arn: zzz

Would be nice to be able to define multiple certificates like:

alb.ingress.kubernetes.io/certificate-arn: 'zzz,bbb'

Currently we get a error if we do it this:

Warning ERROR 24s ingress-controller Error parsing annotations: ACM certificate ARN does not exist. ARN: arn:aws:acm:us-east-1:xxx:certificate/cfaf99c1-6616-478d-8e21-zzzzzz,arn:aws:acm:us-east-1:xxx:certificate/d5a1f5ad-d6cc-4f99-9e81-bbbbbbb

This is needed so we can serve multiple https websites from the same ALB thereby reducing the cost of needing a separate ELB for each website.

[KristianWindsor]

Is there any update on this feature? This would be extremely helpful.

[bingochen87]

Mark

[mward29]

bump

[omerfsen]

This can be achieved by SNI I think ? https://en.wikipedia.org/wiki/Server_Name_Indication so one cert will simply contain more domains.

[nesl247]

SNI doesn't solve this when you don't want the different domains to show up in the certificate.

[rifelpet]

also needed for supporting more domains than the SNI limit. We are successfully using the cert discovery feature using the ingress' rules' hostnames, but one of our future projects will be accepting more hostnames than we can feasibly define in an ingress resource, so being able to explicitly provide a list of certs would be great.