Skip to content

CNF-13731: Cert Manager HTTP01 Proxy - #1773

Closed
sebrandon1 wants to merge 2 commits into
openshift:masterfrom
sebrandon1:enhancement_cert_manager_http01_proxy
Closed

CNF-13731: Cert Manager HTTP01 Proxy#1773
sebrandon1 wants to merge 2 commits into
openshift:masterfrom
sebrandon1:enhancement_cert_manager_http01_proxy

Conversation

@sebrandon1

@sebrandon1 sebrandon1 commented Mar 28, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

Draft for adding an enhancement for the Cert Manager HTTP01 proxy.

Based on #1682 for inspiration. Thanks @swghosh for pointing me to that.

cc @mvazquezc

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 28, 2025
@openshift-ci-robot

openshift-ci-robot commented Mar 28, 2025 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@sebrandon1: This pull request references CNF-13731 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.19.0" version, but no target version was set.

Details

In response to this:

Draft for adding an enhancement for the Cert Manager HTTP01 proxy.

Based on #1682 for inspiration. Thanks @swghosh for pointing me to that.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from ashcrow and celebdor March 28, 2025 19:40
@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Mar 28, 2025
@openshift-ci

openshift-ci Bot commented Mar 28, 2025

Copy link
Copy Markdown
Contributor

Hi @sebrandon1. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci-robot

openshift-ci-robot commented Mar 28, 2025 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@sebrandon1: This pull request references CNF-13731 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.19.0" version, but no target version was set.

Details

In response to this:

Draft for adding an enhancement for the Cert Manager HTTP01 proxy.

Based on #1682 for inspiration. Thanks @swghosh for pointing me to that.

cc @mvazquezc

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-bot

openshift-bot commented Apr 26, 2025

Copy link
Copy Markdown

Inactive enhancement proposals go stale after 28d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle stale.
Stale proposals rot after an additional 7d of inactivity and eventually close.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 26, 2025
imiller0
imiller0 reviewed Apr 28, 2025
View reviewed changes
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
@sebrandon1
sebrandon1 force-pushed the enhancement_cert_manager_http01_proxy branch from faf4430 to b77ce7e Compare April 28, 2025 20:38
everettraven
everettraven reviewed Apr 30, 2025
View reviewed changes
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
@everettraven

everettraven commented May 1, 2025

Copy link
Copy Markdown
Contributor

It looks like the markdownlint job is, correctly, failing due to missing sections:

enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "### Goals"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "## Proposal"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "#### Hypershift / Hosted Control Planes"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "#### Standalone Clusters"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "#### Single-node Deployments or MicroShift"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "## Alternatives (Not Implemented)"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "## Test Plan"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "## Graduation Criteria"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "### Dev Preview -> Tech Preview"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "### Tech Preview -> GA"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "### Removing a deprecated feature"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "## Upgrade / Downgrade Strategy"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "## Version Skew Strategy"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "## Operational Aspects of API Extensions"
enhancements/cert-manager-proxy/http01_challenge_proxy.md missing "## Support Procedures"

I'm not sure what the policy is on removing certain sections all together, but at the very least I would expect to still see the following sections:

  • Hypershift / Hosted Control Planes
  • Standalone Clusters
  • Single-node Deployments or MicroShift
  • Test Plan
  • Graduation Criteria
  • Dev Preview -> Tech Preview
  • Tech Preview -> GA
  • Upgrade / Downgrade Strategy
  • Version Skew Strategy
  • Operational Aspects of API Extensions
  • Support Procedures

If you need a more explicit template to follow for this EP, there is one with some good general advice for what should be in each section here: https://github.com/openshift/enhancements/blob/master/guidelines/enhancement_template.md

@openshift-bot

openshift-bot commented May 9, 2025

Copy link
Copy Markdown

Stale enhancement proposals rot after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Rotten proposals close after an additional 7d of inactivity.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

@openshift-ci openshift-ci Bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels May 9, 2025
@sebrandon1
sebrandon1 force-pushed the enhancement_cert_manager_http01_proxy branch from ae29d68 to 21b454b Compare May 12, 2025 17:41
@sebrandon1 sebrandon1 mentioned this pull request May 12, 2025
Closed
everettraven
everettraven reviewed May 13, 2025
View reviewed changes
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
@openshift-bot

openshift-bot commented May 30, 2025

Copy link
Copy Markdown

Rotten enhancement proposals close after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Reopen the proposal by commenting /reopen.
Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Exclude this proposal from closing again by commenting /lifecycle frozen.

/close

@openshift-ci openshift-ci Bot closed this May 30, 2025
@openshift-ci

openshift-ci Bot commented May 30, 2025

Copy link
Copy Markdown
Contributor

@openshift-bot: Closed this PR.

Details

In response to this:

Rotten enhancement proposals close after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Reopen the proposal by commenting /reopen.
Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Exclude this proposal from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@sebrandon1

sebrandon1 commented May 30, 2025

Copy link
Copy Markdown
Member Author

/reopen

@openshift-ci openshift-ci Bot reopened this May 30, 2025
@openshift-ci

openshift-ci Bot commented May 30, 2025

Copy link
Copy Markdown
Contributor

@sebrandon1: Reopened this PR.

Details

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci-robot

openshift-ci-robot commented May 30, 2025 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@sebrandon1: This pull request references CNF-13731 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.20.0" version, but no target version was set.

Details

In response to this:

Draft for adding an enhancement for the Cert Manager HTTP01 proxy.

Based on #1682 for inspiration. Thanks @swghosh for pointing me to that.

cc @mvazquezc

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@sebrandon1
sebrandon1 force-pushed the enhancement_cert_manager_http01_proxy branch from bc39b89 to ab590b5 Compare June 3, 2025 19:38
@sebrandon1
sebrandon1 force-pushed the enhancement_cert_manager_http01_proxy branch from 0975367 to 67d3e63 Compare June 11, 2025 21:14
everettraven
everettraven reviewed Jun 18, 2025
View reviewed changes

@everettraven everettraven left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Circling back around to this to read the latest updates and overall this looks like it is moving in the right direction.

Some things that are still needed IMO:

  • Explicit decision on what is going to deploy and manage the resources associated with this proxy
  • Call out in the implementation section the new feature gate that will be added for this feature

Comment thread enhancements/cert-manager-proxy/http01_challenge_proxy.md Outdated
@sebrandon1

sebrandon1 commented Jun 23, 2025

Copy link
Copy Markdown
Member Author

@everettraven For other features that have this boolean style on/off type of feature implementation, what do they do as far as the toggle and where/how does that get implemented? Are there any other such features that you would recommend following that are similar?

I think if we could stick closer to another implementation it would be better than re-inventing the wheel for a similar feature?

What do you think?

@openshift-ci openshift-ci Bot added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Sep 20, 2025
@sebrandon1

sebrandon1 commented Sep 22, 2025

Copy link
Copy Markdown
Member Author

/remove-lifecycle rotten

@openshift-ci openshift-ci Bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Sep 22, 2025
@openshift-bot

openshift-bot commented Oct 21, 2025

Copy link
Copy Markdown

Inactive enhancement proposals go stale after 28d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle stale.
Stale proposals rot after an additional 7d of inactivity and eventually close.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 21, 2025
@sebrandon1

sebrandon1 commented Oct 21, 2025

Copy link
Copy Markdown
Member Author

/remove-lifecycle rotten

@sebrandon1

sebrandon1 commented Oct 21, 2025

Copy link
Copy Markdown
Member Author

/remove-lifecycle stale

@openshift-ci openshift-ci Bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 21, 2025
@openshift-bot

openshift-bot commented Nov 19, 2025

Copy link
Copy Markdown

Inactive enhancement proposals go stale after 28d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle stale.
Stale proposals rot after an additional 7d of inactivity and eventually close.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 19, 2025
@sebrandon1

sebrandon1 commented Nov 19, 2025

Copy link
Copy Markdown
Member Author

/remove-lifecycle stale

@openshift-ci openshift-ci Bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 19, 2025
@openshift-bot

openshift-bot commented Dec 18, 2025

Copy link
Copy Markdown

Inactive enhancement proposals go stale after 28d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle stale.
Stale proposals rot after an additional 7d of inactivity and eventually close.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 18, 2025
@openshift-bot

openshift-bot commented Dec 25, 2025

Copy link
Copy Markdown

Stale enhancement proposals rot after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Rotten proposals close after an additional 7d of inactivity.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

@openshift-ci openshift-ci Bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Dec 25, 2025
@openshift-bot

openshift-bot commented Jan 2, 2026

Copy link
Copy Markdown

Rotten enhancement proposals close after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Reopen the proposal by commenting /reopen.
Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Exclude this proposal from closing again by commenting /lifecycle frozen.

/close

@openshift-ci openshift-ci Bot closed this Jan 2, 2026
@openshift-ci

openshift-ci Bot commented Jan 2, 2026

Copy link
Copy Markdown
Contributor

@openshift-bot: Closed this PR.

Details

In response to this:

Rotten enhancement proposals close after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Reopen the proposal by commenting /reopen.
Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Exclude this proposal from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Jan 26, 2026
@sebrandon1 @claude
CNF-13731: HTTP01 Challenge Proxy for cert-manager-operator
b73dacf 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Jan 26, 2026
@sebrandon1 @claude
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator
23bfec3 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@sebrandon1 sebrandon1 mentioned this pull request Jan 26, 2026
Open
sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Jan 26, 2026
@sebrandon1 @claude
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator
58b2f96 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Jan 27, 2026
@sebrandon1 @claude
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator
f1cbdfd 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Mar 9, 2026
@sebrandon1 @claude
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator
697f4bc 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Mar 18, 2026
@sebrandon1 @claude
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator
c62f651 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Jul 6, 2026
@sebrandon1 @claude
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator
b2bd795 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Jul 8, 2026
@sebrandon1 @claude
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator
59494aa 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sebrandon1 added a commit to sebrandon1/enhancements that referenced this pull request Jul 8, 2026
@sebrandon1
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator
58d42f7 
Add enhancement for HTTP01 Challenge Proxy as a controller within
cert-manager-operator, following the istio-csr-controller pattern.

This enables cert-manager to complete HTTP01 challenges for the API
endpoint (api.cluster.example.com) on baremetal platforms where DNS01
is not available.

Key design decisions:
- New HTTP01Proxy CRD in cert-manager-operator (not openshift/api)
- Optional day-2 feature (not core payload)
- Follows same pattern as istiocsrs.operator.openshift.io
- DaemonSet on control plane nodes with nftables traffic redirection

Supersedes: openshift#1773
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JoelSpeed JoelSpeed JoelSpeed left review comments
@everettraven everettraven everettraven left review comments
@ashcrow ashcrow Awaiting requested review from ashcrow
@celebdor celebdor Awaiting requested review from celebdor
@benluddy benluddy Awaiting requested review from benluddy
@p0lyn0mial p0lyn0mial Awaiting requested review from p0lyn0mial
+5 more reviewers
@cgoncalves cgoncalves cgoncalves left review comments
@mvazquezc mvazquezc mvazquezc left review comments
@yuqi-zhang yuqi-zhang yuqi-zhang left review comments
@imiller0 imiller0 imiller0 left review comments
@lunarwhite lunarwhite lunarwhite left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.