Skip to content

Add doc content for new Ingress annotation http01-ingress-ingressclassname #1848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: release-next
Choose a base branch
from
+34 −10
Open

Add doc content for new Ingress annotation http01-ingress-ingressclassname #1848

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
26521cb
Add docs for new Ingress annotation "acme.cert-manager.io/http01-over…
lunarwhite Nov 19, 2025
c32f9cf
Add redirect for new annotation "acme.cert-manager.io/http01-ingress-…
lunarwhite Nov 19, 2025
077192c
Incorporate review suggestions
lunarwhite Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .spelling
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -853,6 +853,7 @@ example.org
experimental.cert
http01-edit-in-place
http01-ingress-class
http01-ingress-ingressclassname
ingress.class
ip-sans
kubernetes.io
Expand Down
6 changes: 6 additions & 0 deletions content/docs/configuration/acme/http01/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,9 @@ controllers support `ingressClassName`, with the notable exception of
ingress-gce (as per the page [Configure Ingress for external load
balancing](https://cloud.google.com/kubernetes-engine/docs/how-to/load-balance-ingress)).

> You can override the `ingressClassName` on a per-Ingress basis using the
[`acme.cert-manager.io/http01-ingress-ingressclassname`](https://cert-manager.io/docs/reference/annotations/#acmecert-manageriohttp01-ingress-ingressclassname) annotation.

### `class`

If the `class` field is specified, a new Ingress resource with a randomly
Expand All @@ -79,6 +82,9 @@ value set to the value of the `class` field.
This field is only recommended with ingress-gce. ingress-gce [doesn't support the
`ingressClassName` field](https://cloud.google.com/kubernetes-engine/docs/how-to/load-balance-ingress).

> You can override the `class` on a per-Ingress basis using the
[`acme.cert-manager.io/http01-ingress-class`](https://cert-manager.io/docs/reference/annotations/#acmecert-manageriohttp01-ingress-class) annotation.

### `name`

If the `name` field is specified, cert-manager will edit the named
Expand Down
20 changes: 14 additions & 6 deletions content/docs/reference/annotations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,20 @@ This is useful for keeping compatibility with the `ingress-gce` component.
## acme.cert-manager.io/http01-ingress-class
- [Ingress](../usage/ingress.md)

this annotation allows you to configure the ingress class that will be used to
solve challenges for this ingress. Customizing this is useful when you are
trying to secure internal services, and need to solve challenges using a
different ingress class to that of the ingress. If not specified and the
`acme-http01-edit-in-place` annotation is not set, this defaults to the ingress
class defined in the Issuer resource.
Allows the `kubernetes.io/ingress.class` annotation to be configured.
Customizing this is useful when you are trying
to secure internal services, and need to solve challenges using a different ingress class
to that of the ingress. If not specified and the `acme-http01-edit-in-place` annotation is
not set, this defaults to the `http01.ingress.class` defined in the Issuer resource.

## acme.cert-manager.io/http01-ingress-ingressclassname
- [Ingress](../usage/ingress.md)

Allows the Ingress's `spec.ingressClassName` to be configured.
Customizing this is useful when you are trying
to secure internal services, and need to solve challenges using a different ingress class
to that of the ingress. If not specified and the `acme-http01-edit-in-place` annotation is
not set, this defaults to the `http01.ingress.ingressClassName` defined in the Issuer resource.

## cert-manager.io/allow-direct-injection
- `Secret`
Expand Down
16 changes: 12 additions & 4 deletions content/docs/usage/ingress.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Annotated Ingress resource
description: 'cert-manager usage: Kubernetes Ingress'
---

> **apiVersion:** networking.k8s.io/v1
> **apiVersion:** networking.k8s.io/v1
> **kind:** Ingress

<div style={{textAlign: "center"}}>
Expand Down Expand Up @@ -89,11 +89,19 @@ trigger `Certificate` resources to be automatically created:
container.

- `acme.cert-manager.io/http01-ingress-class`: this annotation allows you to
configure the ingress class that will be used to solve challenges for this
ingress. Customizing this is useful when you are trying to secure internal
configure the `kubernetes.io/ingress.class` that will be used to solve challenges
for this ingress. Customizing this is useful when you are trying to secure internal
services, and need to solve challenges using a different ingress class to that
of the ingress. If not specified and the `acme-http01-edit-in-place` annotation
is not set, this defaults to the ingress class defined in the Issuer resource.
is not set, this defaults to the `http01.ingress.class` defined in the Issuer resource.

- `acme.cert-manager.io/http01-ingress-ingressclassname`: this annotation allows you to
configure the `spec.ingressClassName` that will be used to solve challenges
for this ingress. Customizing this is useful when you are trying to secure internal
services, and need to solve challenges using a different ingress class to that
of the ingress. If not specified and the `acme-http01-edit-in-place` annotation
is not set, this defaults to the `http01.ingress.ingressClassName` defined in the
Issuer resource.
Comment on lines 91 to +104
Copy link
Member

@SgtCoDFish SgtCoDFish Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

comment: I'd prefer if this wasn't written "this annotation..." but I totally recognise that's how it already is, and we definitely shouldn't rework this page in this PR. This is really good, thank you 👍


- `acme.cert-manager.io/http01-edit-in-place: "true"`: this controls whether the
ingress is modified 'in-place', or a new one is created specifically for the
Expand Down
1 change: 1 addition & 0 deletions public/_redirects
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,7 @@ https://cert-manager.io/usages https://cert-manager.io/docs/reference/annotation
# (as well as configuration in netlify) for each of these to enable these to work.
https://acme.cert-manager.io/http01-edit-in-place https://cert-manager.io/docs/reference/annotations#acmecert-manageriohttp01-edit-in-place 301!
https://acme.cert-manager.io/http01-ingress-class https://cert-manager.io/docs/reference/annotations#acmecert-manageriohttp01-ingress-class 301!
https://acme.cert-manager.io/http01-ingress-ingressclassname https://cert-manager.io/docs/reference/annotations#acmecert-manageriohttp01-ingress-ingressclassname 301!

https://experimental.cert-manager.io/request-duration https://cert-manager.io/docs/reference/annotations#experimentalcert-manageriorequest-duration 301!
https://experimental.cert-manager.io/request-is-ca https://cert-manager.io/docs/reference/annotations#experimentalcert-manageriorequest-is-ca 301!
Expand Down