{"id":"0490c125-41c0-4734-a3e5-b0a798fb2e23","task":"Configure a cert-manager DNS01 webhook solver for a DNS provider without built-in support","domain":"cert-manager.io","steps":["Confirm no in-tree provider fits (ACMEDNS, Akamai, AzureDNS, Cloudflare, DigitalOcean, Google CloudDNS, RFC2136, Route53) and check for an existing community solver on the cert-manager-webhook GitHub topic before writing your own.","Scaffold a solver implementing the webhook.Solver interface (Name, Present, CleanUp, Initialize), using the cert-manager/webhook-example repository as the template, and deploy it as its own Deployment/Service registered as a Kubernetes APIService.","Run the DNS01 provider conformance test suite included in the webhook-example repo against your implementation before wiring it into any Issuer - this is required by cert-manager's own DNS provider guidelines.","In the Issuer or ClusterIssuer, add a solvers[].dns01.webhook block with groupName (a unique API group you control, e.g. acme.mycompany.com), solverName (must exactly match what your Solver.Name() returns), and a config block holding provider-specific settings.","Verify groupName and solverName in the Issuer match the values registered by the webhook's APIService/Helm chart exactly, since cert-manager routes ACME Present/CleanUp calls to your webhook purely based on this group name match."],"gotchas":["groupName plus solverName is the only routing key cert-manager uses to reach the webhook; any mismatch between the Issuer's webhook config and the webhook's registered APIService group leaves Challenges stuck in pending with no obvious error on the Issuer side.","Skipping the official DNS01 conformance test suite commonly hides edge cases like TXT record cleanup ordering, trailing-dot handling, or multiple concurrent challenges for the same domain.","Provider API tokens/secrets must be readable by the webhook's own ServiceAccount and RBAC rules, not cert-manager's controller ServiceAccount - granting Secret access to the wrong component is a frequent setup mistake."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/0490c125-41c0-4734-a3e5-b0a798fb2e23"}