CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator #1929
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@sebrandon1: This pull request references CNF-18992 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
sebrandon1
force-pushed
the
enhancement_cert_manager_http01_proxy
branch
from
23bfec3 to
58b2f96
Compare
|
/retest |
Add enhancement for HTTP01 Challenge Proxy as a controller within cert-manager-operator, following the istio-csr-controller pattern. This enables cert-manager to complete HTTP01 challenges for the API endpoint (api.cluster.example.com) on baremetal platforms where DNS01 is not available. Key design decisions: - New HTTP01Proxy CRD in cert-manager-operator (not openshift/api) - Optional day-2 feature (not core payload) - Follows same pattern as istiocsrs.operator.openshift.io - DaemonSet on control plane nodes with nftables traffic redirection Supersedes: openshift#1773 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sebrandon1
force-pushed
the
enhancement_cert_manager_http01_proxy
branch
from
58b2f96 to
f1cbdfd
Compare
|
/retest |
|
@sebrandon1: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
Add enhancement for HTTP01 Challenge Proxy as a controller within cert-manager-operator, following the istio-csr-controller pattern.
This enables cert-manager to complete HTTP01 challenges for the API endpoint (
api.cluster.example.com) on baremetal platforms where DNS01 is not available.Supersedes: #1773
Key Design Decisions
HTTP01ProxyCRD in cert-manager-operator (not openshift/api)istiocsrs.operator.openshift.ioChanges from Previous Approach
The original enhancement proposed adding configuration to the
APIServerCRD incluster-kube-apiserver-operator. This updated approach:cert-manager-operatorwhere it logically belongsHTTP01ProxyCRD following the istio-csr-controller patternTracking