Webhook support cert-manager

[icu-nl]

Is your feature request related to a problem?

The Clusterissuer chart currently only supports a few ACME providers. Other DNS providers are not listed, but might support ACME DNS01 validation using a cert-manager webhook.

Describe the solution you'd like

Additional configuration of clusterissuer to support custom DNS providers using webhooks for cert-manager

Describe alternatives you've considered

Moving my domains to cloudfare is a bit too much

Additional context

see https://github.com/robbietjuh/cert-manager-webhook-transip

I've read and agree with the following

• I've checked all open and closed issues and my request is not there.
• I've checked all open and closed pull requests and my request is not there.

[icu-nl]

Perhaps acme.sh (https://github.com/acmesh-official/acme.sh) is a more flexible tool

[stavros-k]

What does acme.sh have to do with cert-manager?

[leapwill]

There is a significant impediment to implementing this. Per the cert-manager webhook documentation, there is per-webhook custom config. For example, the TransIP webhook you linked needs accountName, ttl, and a privateKeySecretRef. This deSEC webhook that I want to use requires an apiKeySecretRef.

Because each webhook can have different fields, TrueCharts can't just add a single "custom webhook" field and call it done. Each DNS provider's webhook would need custom Helm code from TrueCharts devs (unless some Helm wizard finds a way).

IMO, this is a design flaw in the cert-manager webhook spec. I have not looked into any available documentation or discussions on how cert-manager reached this design; there may be good reason for it.

[PrivatePuffin]

There is a significant impediment to implementing this. Per the cert-manager webhook documentation, there is per-webhook custom config

Hence we need per-webhook enhancement requests

Each DNS provider's webhook would need custom Helm code from TrueCharts devs (unless some Helm wizard finds a way).

No that won't happen, because webhooks will be integrated in the cert-manager or clusterissuer charts.
We also need to spin-up SCALE GUI, which cannot be templated at all at this time.

IMO, this is a design flaw in the cert-manager webhook spec. I have not looked into any available documentation or discussions on how cert-manager reached this design; there may be good reason for it.

The problem is that every API is differnent. So they picked the solution that would always work.

[PrivatePuffin]

If you want to expedite this enhancement, please consider putting a bounty on it here:

https://opencollective.com/truecharts-bounties/contribute/place-bounty-72003

[truecharts-admin]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in two weeks if no further activity occurs. Thank you for your contributions.