Gateway API Took Away Self-Service TLS. ListenerSets Give It Back.

Thu, 23 Apr 2026 00:00:00 +0000

When we moved from Ingress to Gateway API, I expected the usual migration pain: new resource kinds, different annotations, a few broken routes. What I didn’t expect was losing something so basic that I hadn’t even thought about it as a feature.

With Ingress, a developer dropped a manifest in their namespace, added cert-manager.io/cluster-issuer: letsencrypt, and walked away. cert-manager saw it, issued a certificate, done. The developer never talked to the platform team.

With Gateway API, that certificate lives on the Gateway object. Which lives in the platform namespace. Which is managed by the platform team. Want a cert for paste.k8s.one? Open a ticket. Wait for a merge. Hope nobody fat-fingers the shared Gateway config while they’re at it.

I’ve been the platform team fielding those tickets. It’s not fun for anyone.

Gateway-Api on Andrea Cervesato

Gateway API Took Away Self-Service TLS. ListenerSets Give It Back.