<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.): no.</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): <code class="notranslate">ingress</code> <code class="notranslate">tls</code>.</p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one): FEATURE REQUEST</p>

<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>): 1.4</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>: GKE</li>
<li><strong>OS</strong> (e.g. from /etc/os-release):</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>):</li>
<li><strong>Install tools</strong>:</li>
<li><strong>Others</strong>:</li>
</ul>
<p dir="auto"><strong>What happened</strong>: Currently Ingress resources can only have one TLS certificate configured:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test
spec:
  tls:
    - secretName: testsecret
  rules:
  - host: foo.bar.com
    http:
      paths:
      - backend:
          serviceName: s1
          servicePort: 80
  - host: bar.foo.com
    http:
      paths:
      - backend:
          serviceName: s2
          servicePort: 80"><pre class="notranslate"><span class="pl-ent">apiVersion</span>: <span class="pl-s">extensions/v1beta1</span>
<span class="pl-ent">kind</span>: <span class="pl-s">Ingress</span>
<span class="pl-ent">metadata</span>:
  <span class="pl-ent">name</span>: <span class="pl-s">test</span>
<span class="pl-ent">spec</span>:
  <span class="pl-ent">tls</span>:
    - <span class="pl-ent">secretName</span>: <span class="pl-s">testsecret</span>
  <span class="pl-ent">rules</span>:
  - <span class="pl-ent">host</span>: <span class="pl-s">foo.bar.com</span>
    <span class="pl-ent">http</span>:
      <span class="pl-ent">paths</span>:
      - <span class="pl-ent">backend</span>:
          <span class="pl-ent">serviceName</span>: <span class="pl-c1">s1</span>
          <span class="pl-ent">servicePort</span>: <span class="pl-c1">80</span>
  - <span class="pl-ent">host</span>: <span class="pl-s">bar.foo.com</span>
    <span class="pl-ent">http</span>:
      <span class="pl-ent">paths</span>:
      - <span class="pl-ent">backend</span>:
          <span class="pl-ent">serviceName</span>: <span class="pl-c1">s2</span>
          <span class="pl-ent">servicePort</span>: <span class="pl-c1">80</span></pre></div>
<p dir="auto"><strong>What you expected to happen</strong>: Would it make sense to have a TLS certificate per route rule. Something like this:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test
spec:
  rules:
  - host: foo.bar.com
    tls:
      - secretName: testsecret
    http:
      paths:
      - backend:
          serviceName: s1
          servicePort: 80
  - host: bar.foo.com
    tls:
      - secretName: testsecret
    http:
      paths:
      - backend:
          serviceName: s2
          servicePort: 80"><pre class="notranslate"><span class="pl-ent">apiVersion</span>: <span class="pl-s">extensions/v1beta1</span>
<span class="pl-ent">kind</span>: <span class="pl-s">Ingress</span>
<span class="pl-ent">metadata</span>:
  <span class="pl-ent">name</span>: <span class="pl-s">test</span>
<span class="pl-ent">spec</span>:
  <span class="pl-ent">rules</span>:
  - <span class="pl-ent">host</span>: <span class="pl-s">foo.bar.com</span>
    <span class="pl-ent">tls</span>:
      - <span class="pl-ent">secretName</span>: <span class="pl-s">testsecret</span>
    <span class="pl-ent">http</span>:
      <span class="pl-ent">paths</span>:
      - <span class="pl-ent">backend</span>:
          <span class="pl-ent">serviceName</span>: <span class="pl-c1">s1</span>
          <span class="pl-ent">servicePort</span>: <span class="pl-c1">80</span>
  - <span class="pl-ent">host</span>: <span class="pl-s">bar.foo.com</span>
    <span class="pl-ent">tls</span>:
      - <span class="pl-ent">secretName</span>: <span class="pl-s">testsecret</span>
    <span class="pl-ent">http</span>:
      <span class="pl-ent">paths</span>:
      - <span class="pl-ent">backend</span>:
          <span class="pl-ent">serviceName</span>: <span class="pl-c1">s2</span>
          <span class="pl-ent">servicePort</span>: <span class="pl-c1">80</span></pre></div>
<p dir="auto">I am not aware of the design decisions behind the current implementation so this might not make sense at all.<br>
The reason I propose this is because I see Ingress'es as public IP addresses. You might want to have several public IPs pointing to your cluster but also only one IP and then have several hosts point to that IP.</p>
<p dir="auto">Initially submitted at <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="190274412" data-permission-text="Title is private" data-url="https://github.com/kubernetes-retired/contrib/issues/2058" data-hovercard-type="issue" data-hovercard-url="/kubernetes-retired/contrib/issues/2058/hovercard" href="https://github.com/kubernetes-retired/contrib/issues/2058">kubernetes-retired/contrib#2058</a>, but per request of <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/aledbf/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/aledbf">@aledbf</a>, submitting here.</p>