cert-manager OCI Webhook (module.cert-manager-oci-webhook)

Purpose: Optional. Issues TLS certificates via DNS-01 validation when the operator does not provide their own certificate and the cluster is not internet-accessible.

This module is needed when both of these conditions are true:

  • The operator does not bring their own TLS certificate

  • The cluster is not reachable from the internet. Firewall rules (public_lb_cidrs) block port 80, or the DR standby cluster needs the certificate issued before failover when no traffic is routed to it yet.

Deployed on: Any workspace with cert_dns01_provider="oci" and cert_dns01_webhook_enabled=true when DNS-01 is needed.

This diagram shows how Terraform provisions the webhook resources and how the runtime certificate issuance flow works end-to-end using DNS-01 validation:

OCI Webhook provisioning

Step by step certificate flow:

Step Component Action
1 Ingress Annotation triggers cert-manager to request a certificate
2 cert-manager Creates ACME Order with DNS-01 challenge type
3 ClusterIssuer Routes challenge to OCI DNS webhook via APIService
4 Webhook Reads OCI API credentials from oci-dns-credentials secret
5 Webhook Creates _acme-challenge.{domain} TXT record in OCI DNS
6 Let's Encrypt Queries DNS, finds the token, validates domain ownership
7 cert-manager Stores issued certificate in Kubernetes Secret
8 Webhook Removes the challenge TXT record (cleanup)

HTTP-01 vs DNS-01 Comparison:

Aspect HTTP-01 DNS-01 (Webhook)
Strimzi Kafka cluster Must allow Let's Encrypt IPs to port 80 No inbound access needed
Humio operator Required Not required
HumioCluster CR Not supported Supported
nginx-ingress May fail during DNS switch Works anytime
cert-manager Simple Requires webhook + OCI credentials

Configuration (tfvars):

terraform
cert_dns01_provider         = "oci"
cert_dns01_webhook_enabled  = true
cert_dns01_webhook_mode     = "auto"   # or "always"