<p>I have already a google managed SSL certificate created (with dns verification option). I want to use same certificate in my istio-ingress for SSL. Is there any possible annotations available ?</p>
<p>We can create ManagedCertificate resource in GKE, but it is uses the loadbalancer verification option which does not support wildcard certificate.</p>
<p>What to do if I want to create certificate like (*.example.com) and attached it with istio-ingress or gke ingress ?</p>

<p>You can create the wild card certificate with the Cert-manger.</p>
<p>Here is my <a href="https://medium.com/@harsh.manvar111/wild-card-certificate-using-cert-manager-in-kubernetes-3406b042d5a2" rel="nofollow noreferrer">article</a> on requesting the <strong>wild card</strong> certificate with <strong>DNS</strong> verification as it's not supported with <strong>HTTP</strong>.</p>
<p><a href="https://medium.com/@harsh.manvar111/wild-card-certificate-using-cert-manager-in-kubernetes-3406b042d5a2" rel="nofollow noreferrer">https://medium.com/@harsh.manvar111/wild-card-certificate-using-cert-manager-in-kubernetes-3406b042d5a2</a></p>
<p>For GCP DNS verification you can follow official guide : <a href="https://cert-manager.io/docs/configuration/acme/dns01/google/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/acme/dns01/google/</a></p>
<p>Once auth is successful you will be able to request the certificate and it will get stored in K8s secret.</p>
<p><strong>create a service account</strong> :</p>
<pre><code>PROJECT_ID=myproject-id
gcloud iam service-accounts create dns01-solver --display-name &quot;dns01-solver&quot;
</code></pre>
<p><strong>Binding policy</strong> :</p>
<pre><code>gcloud projects add-iam-policy-binding $PROJECT_ID \
   --member serviceAccount:dns01-solver@$PROJECT_ID.iam.gserviceaccount.com \
   --role roles/dns.admin
</code></pre>
<p><strong>K8s secret</strong> :</p>
<pre><code>gcloud iam service-accounts keys create key.json \
   --iam-account dns01-solver@$PROJECT_ID.iam.gserviceaccount.com
kubectl create secret generic clouddns-dns01-solver-svc-acct \
   --from-file=key.json
</code></pre>
<p><strong>issuer</strong></p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: gcp-issuer
spec:
  acme:
    ...
    solvers:
    - dns01:
        cloudDNS:
          # The ID of the GCP project
          project: $PROJECT_ID
          # This is the secret used to access the service account
          serviceAccountSecretRef:
            name: clouddns-dns01-solver-svc-acct
            key: key.json
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: le-crt
spec:
  secretName: tls-secret
  issuerRef: 
    kind: Issuer
    name: letsencrypt-prod
  commonName: &quot;*.devops.example.in&quot;
  dnsNames:
    - &quot;*.devops.example.in&quot; 
</code></pre>
<p>You can attach this newly auto-created <strong>secret</strong> to <strong>Ingress</strong> or <strong>Gateway</strong> in <strong>Istio</strong> as per need. That <strong>secret</strong> will be storing your wild card <strong>certificate</strong>.</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: gateway
  annotations:
      cert-manager.io/issuer: gcp-issuer
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: tls-secret # This should match the Certificate secretName
    hosts:
    - *.devops.example.in
</code></pre>
