<p>I have a scenario where I need to update the Ingress gateway tls cert <code>(/etc/istio/ingressgateway-certs/tls.crt)</code> and key every 24 hours. I am able to fetch the raw bytes and create the secret using C# Kubernetes client, <strong>but unless the Ingress Gateway restarts, it does not pick up the updated certs.</strong> Is there a way to do that through code without restarting the ingress-gateway deployment?</p>
<p>Any other suggestions is also highly appreciated.</p>

Jim
<p>You are mounting your cert/key by file reference. Istio supports <code>SDS</code> now, so you can mount the cert by <code>credentialName </code>. This mode will detect a new cert without restarting. From docs:</p>
<pre><code> apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mygateway
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: httpbin-credential # must be the same as secret
    hosts:
    - httpbin.example.com
</code></pre>
<p>Btw: docs state that...</p>
<blockquote>
<p>The secret name should <strong>not begin with istio</strong> or prometheus, and the secret should not contain a token field.</p>
</blockquote>
<p><a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/#configure-a-tls-ingress-gateway-for-a-single-host" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/#configure-a-tls-ingress-gateway-for-a-single-host</a></p>
