[Feature Request] Support offline/air-gapped certificate renewal in 'dapr mtls renew-certificate' with local chart/binary parameters

[CoolIORI]

Description

Currently, executing dapr mtls renew-certificate -k attempts to fetch/download external resources (such as Helm charts or binaries) over the internet.

In strict air-gapped / offline production environments where nodes or operator workstations do not have outbound internet access, this command hangs or fails due to network timeouts.

We need a way to perform mTLS certificate renewal entirely offline by providing local file paths or flags.

Proposed Solution

1. Add a parameter to specify a local Helm chart or local binaries/templates:
   • Provide a flag like --chart-path <path-to-chart.tgz> or --use-local-chart so the CLI can render/apply manifests locally without contacting external registries/GitHub.
2. Ensure complete air-gapped capability:
   • If --cert-path is provided along with a local chart/manifest source, dapr mtls renew-certificate should perform zero network outbound calls and rely purely on local files and the target Kubernetes API server.

Context & Impact

• Environment: Air-gapped / Enterprise Kubernetes Clusters (No internet access).
• Impact: Operators currently cannot use the official dapr mtls renew-certificate CLI workflow in isolated environments during certificate rotation windows and must resort to manual openssl + kubectl workarounds.

Suggested Flags

• --chart-path string: Path to a local Dapr Helm chart tarball or directory.
• --offline: Explicitly force the CLI to use only local resources and disable all remote fetching.

[dapr-bot]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged (pinned, good first issue, help wanted or triaged/resolved) or other activity occurs. Thank you for your contributions.