Is there a way to specify the domain

[vishrantgupta]

I am looking for a way to create the Bundle with the domain in order to create the PEM

apiVersion: trust.cert-manager.io/v1alpha1
kind: Bundle
metadata:
  name: trust-bundle
  namespace: default
spec:
  sources:
  - domain: https://example.com           # <-- expecting the trust manager to pull the PEM by domain
  target:
    configMap:
      key: trust.pem

[hawksight]

There currently is no mechanism to pull in the CA from a target, whether that be an external bucket, webpage, GitHub or looking it up from a domain name. Trust manage focuses on the distribution of trust. If it was to start pulling trust from sources it opens up the possibility of those source being compromised and that being automatically propagated around your cluster.

You would have to manually get the CA from that domain and add it in cluster (as a secret or configmap) to the namespace where trust-manager is installed.

I have had a similar idea but based on my previous discussions you would be better off writing a Job or CronJob to go and fetch the CA you wanted and then populate the secret or configmap accordingly.

[inteon]

Pulling from target indeed seems a bit dangerous.
You might want to look into creating a cronjob to pull certificates eg. from a trusted URL?

[cert-manager-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
/lifecycle stale

[cert-manager-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
/lifecycle rotten
/remove-lifecycle stale