add secretTemplate to Certificates created by the ingress-shim

[rikirolly]

I have found this documentation in the values.yaml file of the helm installation.

  # Please note that this does not add labels to the resources created dynamically by the controllers.
  # For these resources, you have to add the labels in the template in the cert-manager custom resource:
  # eg. podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress
  #    ref: https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress
  # eg. secretTemplate in CertificateSpec
  #    ref: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec

I am using ClusterIssuer to auto generate Certificates using the cert-manager.io/cluster-issuer annotation in the Ingress resource.
I understood the ingress-shim is responsabile to create this Certificate but I cannot understand how to configure ingress-shim to include the secretTemplate section in the Certificate.

Has somebody already solved this problem?

[maelvls]

It looks like configuring secretTemplate through the ingress-shim is not possible.

As a workaround, you may create a pre-existing Secret resource. cert-manager will pick up that Secret when creating the Certificate. For example, with the following ClusterIssuer and Ingress (with nginx-ingress):

kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    solvers:
      - http01:
          ingress:
            class: nginx
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: httpbin
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  rules:
  - host: mael.pw
    http:
      paths:
      - path: /
        pathType: ImplementationSpecific
        backend:
          service:
            name: httpbin
            port:
              number: 80
  tls:
  - secretName: httpbin
    hosts:
    - mael.pw
---
apiVersion: v1
kind: Secret
metadata:
  name: httpbin
  annotations:
    your-annotation: "true" # Your custom annotations.

Admittedly, using a pre-existing Secret isn't well documented, but it works really well.

[rikirolly]

Thank you very much!!!