Request to support upstream JetStack Cert Manager Pod arguments for Split Horizon DNS issue

[jperera-interloc]

Hello,

When using the upstream JetStack Cert Manager, in case the customer has an internal DNS and a separate external DNS the DNS01 issuer cannot progress due to the TXT record never being validated on the internal DNS.

The issue can be helped by adding the following on the CSV for the JetStack Cert Manager:

    spec:
      containers:
      - args:
        ....<some non related arguments here>....
        - --dns01-recursive-nameservers="<resolver-ip>:53"
        - --dns01-recursive-nameservers-only

Which will cause DNS resolution to use whatever DNS server we want for Cert Manager only, by replacing with values such as 8.8.8.8, etc. (the rest of the Cluster is unaffected).

However, looking at what seems possible in the IBM Cert Manager, there is apparently no way of customizing the Controller Pod arguments (they will get overwritten if we modify the Deployment as it is managed by the CertManager CRD).

Therefore requesting to evaluate incorporating such a feature.

For example, adding to the resources of the Cert Manager CRD spec.DNS01RecursiveNameServers and spec.DNS01RecursiveNameServesOnly so if they have values then proper arguments will be added to the Deployment and passed to the Controller Pod Image on execution.

Or even a flexible way to pass additional arguments to the Pods on an upstream definition that doesn't get overwritten.

Thanks in advance,

Julio.

[bzzwh]

+1

[jperera-interloc]

We worked around this by disabling/deinstalling the use of the IBM Cert Manager altogether and installing/using the JetStack Cert Manager instead. Done by modifying the ibm-cpp-config ConfigMap as per:

https://www.ibm.com/docs/en/cpfs?topic=operator-preparing-install-foundational-services#cert
and
https://www.ibm.com/docs/en/cpfs?topic=tcms-problem-when-you-install-two-different-cert-managers