cert-manager: 1.20.3 -> 1.21.0
Change-Id: I50161b8cfd621c1b07de87358fe8c14d1b14f711
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
index 039062d..baf9190 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
@@ -3215,6 +3215,24 @@
this challenge solver will apply to.
type: object
type: object
+ waitInsteadOfSelfCheck:
+ description: |-
+ WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+ instead waits this long after presentation before asking the ACME server
+ to validate the challenge.
+
+ This is an advanced escape hatch for environments where cert-manager's
+ self-check cannot succeed from its own network or DNS viewpoint even
+ though the ACME server can still validate successfully, for example due
+ to split-horizon DNS or NAT hairpinning.
+
+ A value of 0 skips the self-check and asks the ACME server to validate
+ immediately after presentation, relying on the ACME server's own
+ validation retries (RFC 8555 section 8.2) to succeed once the challenge
+ has propagated. A negative duration is rejected.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+ for example `30s` or `2m`.
+ type: string
type: object
token:
description: |-
@@ -3253,13 +3271,21 @@
properties:
presented:
description: |-
- presented will be set to true if the challenge values for this challenge
- are currently 'presented'.
- This *does not* imply the self check is passing. Only that the values
- have been 'submitted' for the appropriate challenge mechanism (i.e. the
- DNS01 TXT record has been presented, or the HTTP01 configuration has been
- configured).
+ Presented is true once cert-manager has configured the solver resources
+ needed to expose this challenge's validation material.
+ For example, the DNS01 TXT record has been created, or the HTTP01 solver
+ has been configured to serve the challenge token.
+ This does not imply the self check is passing, that the ACME server has
+ validated the challenge, or that cert-manager has already accepted the
+ challenge with the ACME server.
type: boolean
+ presentedAt:
+ description: |-
+ PresentedAt records when cert-manager first configured the solver
+ resources for this challenge. This is used by the optional delay-based
+ readiness logic.
+ format: date-time
+ type: string
processing:
description: |-
Used to denote whether this challenge should be processed or not.