---
id: ingress-controllers-contour-tls-delegation
name: "Contour TLS delegation"
description: "Installs Contour, deploys TLS Secret in tls-secrets NS, grants cross-namespace access via TLSCertificateDelegation, creates HTTPProxy with delegated Secret, verifies HTTPS 200."
labels: {customer: any, profile: ingress}
cluster:
  provider: kind
  k8s_version: v1.36.1
  preinstall:
    - kind: helm
      chart: projectcontour/contour
      version: "0.6.0"
      release: contour
      namespace: projectcontour
      repo:
        name: projectcontour
        url: "https://projectcontour.github.io/helm-charts"
      wait: pods-ready
      wait_timeout: 3m
    - kind: raw_manifest
      path: chart-test/fixtures/ingress-controllers/contour-tls-delegation-ns.yaml
    - kind: raw_manifest
      path: chart-test/fixtures/ingress-controllers/contour-tls-delegation-certdelegation.yaml
      namespace: tls-secrets
    - kind: raw_manifest
      path: chart-test/fixtures/ingress-controllers/contour-tls-delegation-httpproxy.yaml
      namespace: sample
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    image.repository: "public.ecr.aws/nginx/nginx"
    image.tag: "1.27-alpine"
    ingress.enabled: "false"
asserts:
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: sample
    timeout: 5m
  - type: pods-ready
    namespace: projectcontour
    timeout: 3m
    selector: app.kubernetes.io/instance=contour
  - type: smoke-script
    path: chart-test/assertions/contour-tls-delegation.sh
tags: [nightly]
mechanisms: ['addon:contour']
category: networking
integration: contour
tier: live