Support wildcard domain names in `ClusterDomainClaim` about serving HOT 4 CLOSED

Just to comment, even with the changes to the namespace certs, I have still found cases in a multi-tenant environment where wildcards in a ClusterDomainClaim would allow different sort of functionality. Especially when different "patterns" for domains might be desired by different tenants. The wildcard in ClusterDomainClaim allows for allocating the domain with all subdomains to a namespace then allowing the end user to configure their services as desired with any of those domains.

Single tenant environments can leverage the global configuration for namespace wildcards and the URL template to probably get what is desired without the extra steps.

This is also a duplicate of #14688

from serving.

@braunsonm np, I actually forgot I created that issue, its been awhile, I think keeping things consolidated into one makes sense as I think we both are after the same thing.

from serving.

Interesting - I'm wondering if your ask is necessary if you setup external-tls/autoTLS with the right knobs

Here we have the general template to configure URLs for Services
https://github.com/knative/networking/blob/66bdffa75840a1a7c1b3829740c196783e8babd0/config/config-network.yaml#L109

This knob lets you enable wild card certs for certain namespaces
https://github.com/knative/networking/blob/66bdffa75840a1a7c1b3829740c196783e8babd0/config/config-network.yaml#L84

Originally you could only have one wildcard domain - but @arsenetar just landed a feature to enable multiple domains - #14364 - this feature should be out in our v1.14 release in April.

For services you want to remain private you can add a visibility label
https://knative.dev/docs/serving/services/private-services/#making-individual-services-private

from serving.

@dprotaso I don't think this exactly addresses the need. While it is one part (the need for wildcard certs to be created) it does not address limiting/allowing access for a namespace to create DomainMappings for a specific subdomain.

Sorry @arsenetar I should have searched. I'm fine closing this in favour of your issue!

from serving.