From d25b707820812aa86c4aac521c61d0c592d6ff81 Mon Sep 17 00:00:00 2001
From: arturenault <arenault@google.com>
Date: Mon, 28 Sep 2020 07:30:45 -0700
Subject: [PATCH] Add documentation for disabling AutoTLS per service/route via
 annotation (#2838)

---
 docs/serving/using-auto-tls.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/docs/serving/using-auto-tls.md b/docs/serving/using-auto-tls.md
index 880690970..26908890a 100644
--- a/docs/serving/using-auto-tls.md
+++ b/docs/serving/using-auto-tls.md
@@ -319,3 +319,25 @@ be able to handle HTTPS traffic.
     ```
 
     Note that the URL will be **https** in this case.
+
+### Disable Auto TLS per service or route
+
+If you have Auto TLS enabled in your cluster, you can choose to disable Auto TLS for individual services or routes by adding the annotation `networking.knative.dev/disableAutoTLS: true`.
+
+Using the previous `autoscale-go` example:
+
+1. Edit the service using `kubectl edit service.serving.knative.dev/autoscale-go -n default` and add the annotation:
+```yaml
+ apiVersion: serving.knative.dev/v1
+ kind: Service
+ metadata:
+   annotations:
+    ...
+     networking.knative.dev/disableAutoTLS: "true"
+    ...
+```
+2. The service URL should now be **http**, indicating that AutoTLS is disabled:
+```
+NAME           URL                                          LATEST               AGE     CONDITIONS   READY   REASON
+autoscale-go   http://autoscale-go.default.1.arenault.dev   autoscale-go-dd42t   8m17s   3 OK / 3     True    
+```