---
id: gateway-api-envoy-gateway-cert-manager-tls
name: "Envoy Gateway + cert-manager TLS"
description: "Installs cert-manager and envoy-gateway, issues a TLS certificate, creates Gateway with HTTPS listener using cert-manager Secret, and verifies HTTPS serving with expected cert."
labels: {customer: any, profile: gateway-api-tls}
cluster:
  provider: kind
  helm_timeout: 10m
  k8s_version: v1.36.1
  preinstall:
    - kind: helm
      chart: oci://docker.io/envoyproxy/gateway-helm
      version: v1.1.2
      release: envoy-gateway
      namespace: envoy-gateway-system
      values:
        config:
          envoyGateway:
            provider:
              type: Kubernetes
              kubernetes:
                envoyService:
                  type: NodePort
      wait: helm-deployed
      wait_timeout: 5m
    - kind: raw_manifest
      path: https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.1.0/standard-install.yaml
    - kind: helm
      chart: jetstack/cert-manager
      version: v1.14.0
      release: cert-manager
      namespace: cert-manager
      repo:
        name: jetstack
        url: "https://charts.jetstack.io"
      values:
        installCRDs: true
      wait: pods-ready
      wait_timeout: 3m
    - kind: raw_manifest
      path: chart-test/fixtures/certificates/selfsigned-clusterissuer.yaml
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    image.repository: "public.ecr.aws/nginx/nginx"
    image.tag: "1.27-alpine"
    gatewayRoute.enabled: "true"
    gatewayRoute.parentRef.name: "sample-gw"
    gatewayRoute.parentRef.sectionName: "https"
asserts:
  - type: helm-status-deployed
    release: cert-manager
    namespace: cert-manager
  - type: helm-status-deployed
    release: envoy-gateway
    namespace: envoy-gateway-system
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: cert-manager
    timeout: 5m
    selector: app.kubernetes.io/instance=cert-manager
  - type: pods-ready
    namespace: envoy-gateway-system
    selector: app.kubernetes.io/name=gateway-helm
    timeout: 5m
  - type: pods-ready
    namespace: sample
    timeout: 5m
  - type: smoke-script
    path: chart-test/assertions/envoy-gateway-cert-manager-tls.sh
tags: [nightly]
mechanisms: ['addon:envoy-gateway', 'addon:cert-manager', 'gateway-api:envoy']
category: gateway-api
integration: envoy-gateway
tier: live