<p>I'm been doing the steps in this tutorial:
<a href="https://learn.microsoft.com/en-us/azure/aks/ingress-static-ip" rel="nofollow noreferrer">Create an ingress controller with a static public IP address in Azure Kubernetes Service (AKS)</a></p>
<p>When I finish the tutorial, I can browse to the DNS name label for the static ip:
<a href="https://demo-aks-ingress.eastus.cloudapp.azure.com" rel="nofollow noreferrer">https://demo-aks-ingress.eastus.cloudapp.azure.com</a></p>
<p>What I don't get is, lets say I have a sub-domain hello.john.com. How can I configure the DNS of the sub-domain to point to <a href="https://demo-aks-ingress.eastus.cloudapp.azure.com" rel="nofollow noreferrer">https://demo-aks-ingress.eastus.cloudapp.azure.com</a> so it will work with https and letsencrypt that I setup in the AKS tutorial above?</p>

<p>Based on <a href="https://github.com/kubernetes/kubernetes/issues/43633#issuecomment-675437741" rel="nofollow noreferrer">this issue comment</a> on k8s github repo, it looks like it should work if you do the following:</p>
<ul>
<li>create a CNAME record for <code>hello.john.com</code> domain and point it to <code>demo-aks-ingress.eastus.cloudapp.azure.com</code></li>
<li>add second domain to ingress (so that ingress knows how to route it)</li>
<li>add second domain to certificate object (so that cert-manager can generate a valid certificate for this domain)</li>
</ul>
<hr />
<p>Ingress part:</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-world-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-staging
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/use-regex: &quot;true&quot;
    nginx.ingress.kubernetes.io/server-alias: &quot;hello.john.com&quot;  #👈
spec:
  tls:
  - hosts:
    - demo-aks-ingress.eastus.cloudapp.azure.com
    - hello.john.com      #👈
    secretName: tls-secret
  rules:
  - host: demo-aks-ingress.eastus.cloudapp.azure.com
    http:
      paths:
      - backend:
          serviceName: aks-helloworld
          servicePort: 80
        path: /hello-world-one(/|$)(.*)
      - backend:
          serviceName: ingress-demo
          servicePort: 80
        path: /hello-world-two(/|$)(.*)
      - backend:
          serviceName: aks-helloworld
          servicePort: 80
        path: /(.*)
</code></pre>
<p>Docs:</p>
<ul>
<li><a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-alias" rel="nofollow noreferrer">server alias annotation</a></li>
<li><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#ingresstls-v1-networking-k8s-io" rel="nofollow noreferrer">tls.hosts field description</a></li>
</ul>
<hr />
<p>Certificate part:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: tls-secret
  namespace: ingress-basic
spec:
  secretName: tls-secret
  dnsNames:
  - demo-aks-ingress.eastus.cloudapp.azure.com
  - hello.john.com      #👈
  acme:
    config:
    - http01:
        ingressClass: nginx
      domains:
      - demo-aks-ingress.eastus.cloudapp.azure.com
      - hello.john.com      #👈
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
</code></pre>
<p>Docs:</p>
<ul>
<li><a href="https://github.com/jetstack/cert-manager/blob/v1.3.1/pkg/apis/certmanager/v1alpha2/types_certificate.go#L115-L117" rel="nofollow noreferrer">dnsNames field description</a></li>
</ul>
