<p>I have already a google managed SSL certificate created (with dns verification option). I want to use same certificate in my istio-ingress for SSL. Is there any possible annotations available ?</p>
<p>We can create ManagedCertificate resource in GKE, but it is uses the loadbalancer verification option which does not support wildcard certificate.</p>
<p>What to do if I want to create certificate like (*.example.com) and attached it with istio-ingress or gke ingress ?</p>

<p>I faced a similar issue:</p>
<ol>
<li>have a wildcard certificate from Certificate Manager</li>
<li>wanted to use it for multiple k8 services for ingress with tls (in my case all services were grpc, but it doesn't matter would work the same for https)</li>
</ol>
<p>First of all, GKE does not support Certificate Manager (at least not yet). Details <a href="https://github.com/kubernetes/ingress-gce/issues/1692" rel="nofollow noreferrer">here</a></p>
<p>This is a workaround that was suggested in the GitHub issue and worked for me:</p>
<ol>
<li>Create a placeholder <code>ManagedCertificate</code> object:</li>
</ol>
<pre><code>apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  labels:
    &lt; set labels here as needed&gt;
  name: placeholder-certificate
spec:
  domains:
  - foo.example.com
</code></pre>
<p>Ingress:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    networking.gke.io/managed-certificates: &quot;placeholder-certificate&quot;  # connecting to dummy ssl, switched via deployment scripts to wildcard ssl
    kubernetes.io/ingress.class: &quot;gce&quot;
spec:
  defaultBackend:
    service:
      name: some-service
      port:
        number: XXXX
</code></pre>
<p>This will make GKE setup target https proxy, which can be updated to point to a certificate map of your certificate:</p>
<ol>
<li><p><code>kubectl describe ingress XXXX</code> (you will need to wait for it become available, takes little time for everything to launch)</p>
</li>
<li><p>find the annotation for <code>ingress.kubernetes.io/https-target-proxy</code></p>
</li>
<li><p>update the target proxy:</p>
</li>
</ol>
<pre><code>gcloud compute target-https-proxies update &lt;target proxy&gt; --certificate-map=&lt;map name&gt;
</code></pre>
