Add support for fetching k8s Ingress TLS data from secrets

docs/user-guide/kubernetes.md

@@ -330,6 +330,45 @@ echo "$(minikube ip) traefik-ui.minikube" | sudo tee -a /etc/hosts
 
 We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube) in the browser and view the Træfik Web UI.
 
+### Add a TLS Certificate to the Ingress
+
+!!! note
+    For this example to work you need a tls entrypoint. You don't have to provide a tls certificate at this point. For more details see [here](/configuration/entrypoints/).
+
+To setup a https protected ingress, you can leverage the tls feature of the ingress resource.
+
+```yaml
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: traefik-web-ui
+  namespace: kube-system
+  annotations:
+    kubernetes.io/ingress.class: traefik
+spec:
+  rules:
+  - host: traefik-ui.minikube
+    http:
+      paths:
+      - backend:
+          serviceName: traefik-web-ui
+          servicePort: 80
+  tls:
+  - hosts:
+    - traefik-ui.minikube
+    secretName: traefik-ui-tls-cert
+```
+
+In addition to the modified ingress you need to provide the tls certificate via a kubernetes secret in the same namespace as the ingress. The following two commands will generate a new certificate and create a secret containing the key and cert files.
+
+```shell
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/tls.key -out /tmp/tls.crt -subj "/CN=traefik-ui.minikube"
+kubectl -n kube-system create secret tls traefik-ui-tls-cert --key=/tmp/tls.key --cert=/tmp/tls.crt
+```
+
+!!! note
+    The secret must have two entries named `tls.key`and `tls.crt`. See the [kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls) for more details.
+
 ## Basic Authentication
 
 It's possible to add additional authentication annotations in the Ingress rule.

provider/kubernetes/kubernetes.go

@@ -18,6 +18,7 @@ import (
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/provider"
 	"github.com/containous/traefik/safe"
+	"github.com/containous/traefik/tls"
 	"github.com/containous/traefik/types"
 	"k8s.io/client-go/pkg/api/v1"
 	"k8s.io/client-go/pkg/apis/extensions/v1beta1"
@@ -140,8 +141,9 @@ func (p *Provider) loadIngresses(k8sClient Client) (*types.Configuration, error)
 	ingresses := k8sClient.GetIngresses()
 
 	templateObjects := types.Configuration{
-		Backends:  map[string]*types.Backend{},
-		Frontends: map[string]*types.Frontend{},
+		Backends:         map[string]*types.Backend{},
+		Frontends:        map[string]*types.Frontend{},
+		TLSConfiguration: []*tls.Configuration{},
 	}
 	for _, i := range ingresses {
 		ingressClass := i.Annotations[annotationKubernetesIngressClass]
@@ -308,6 +310,56 @@ func (p *Provider) loadIngresses(k8sClient Client) (*types.Configuration, error)
 				}
 			}
 		}
+
+		for _, t := range i.Spec.TLS {
+			tlsSecret, exists, err := k8sClient.GetSecret(i.Namespace, t.SecretName)
+			if err != nil {
+				log.Errorf("Unable to retrieve secret %s/%s: %s", i.Namespace, t.SecretName, err)
+				continue
+			}
+			if !exists {
+				log.Warnf("Unable to find secret %s/%s", i.Namespace, t.SecretName)
+				continue
+			}
+
+			tlsCrtData, tlsCrtExists := tlsSecret.Data["tls.crt"]
+			tlsKeyData, tlsKeyExists := tlsSecret.Data["tls.key"]
+			if !tlsCrtExists || !tlsKeyExists {
+				if !tlsCrtExists {
+					log.Warnf("Secret %s/%s doesn't have an entry named 'tls.crt'", i.Namespace, t.SecretName)
+				}
+				if !tlsKeyExists {
+					log.Warnf("Secret %s/%s doesn't have an entry named 'tls.key'", i.Namespace, t.SecretName)
+				}
+				continue
+			}
+
+			var hosts []string
+			if len(t.Hosts) > 0 {
+				hosts = t.Hosts
+			} else {
+				// If no hosts are provided the hosts property should default ot the wildcard host. To ensure that the
+				// tls config only matches rules in this ingress, add all the used hosts to simulate a wildcard like
+				// behavior.
+				hosts = []string{}
+
+				for _, r := range i.Spec.Rules {
+					if r.Host != "" {
+						hosts = append(hosts, r.Host)
+					}
+				}
+			}
+
+			tlsConfig := &tls.Configuration{
+				EntryPoints: hosts,
+				Certificate: &tls.Certificate{
+					CertFile: tls.FileOrContent(tlsCrtData),
+					KeyFile:  tls.FileOrContent(tlsKeyData),
+				},
+			}
+
+			templateObjects.TLSConfiguration = append(templateObjects.TLSConfiguration, tlsConfig)
+		}
 	}
 	return &templateObjects, nil
 }