Editing Contour Ingress Controller (section)

=== Using HTTPProxy ===
The workaround for this problem is to create a dummy Ingress with enough information to pass YAML validation and trigger cert-manager to create a certificate ... but not enough to actually create any routes.  Here are the resulting manifests using the examples as above:

 apiVersion: projectcontour.io/v1
 kind: HTTPProxy
 metadata:
   name: httpbinproxy
 spec:
   virtualhost:
     fqdn: httpbinproxy.davecheney.com
     tls:
       secretName: httpbin
   routes:
   - services:
     - name: httpbin
       port: 8080

This object will be marked as Invalid by Contour, since the TLS secret doesn’t exist yet. Once that’s done, create the dummy Ingress object:

 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     ingress.kubernetes.io/force-ssl-redirect: "true"
     kubernetes.io/tls-acme: "true"
   name: httpbinproxy
   namespace: default
 spec:
   rules:
   - host: httpbinproxy.davecheney.com
     http:
       paths:
       - backend:
           serviceName: httpbin
           servicePort: 8080
   tls:
   - hosts:
     - httpbinproxy.davecheney.com
     secretName: httpbin

Set the hostname as appropriate, and make sure the secret names match.  This seems excessive, as this does nothing more than the example in the Ingress section above ... but it does come in handy when the added capability of a HTTPProxy is needed.