cert-manager

Our webhook solver runs in your cluster and reads one API key from a Secret. Install it alongside cert-manager, which issues the webhook its own serving certificate:

$ helm install cert-manager-webhook-dnsmint \
    oci://ghcr.io/dnsmint/charts/cert-manager-webhook-dnsmint \
    --namespace cert-manager

Put the key beside the Issuer, reference it from a solver, and request a Certificate for the hostname and its wildcard.

$ kubectl create secret generic dnsmint-api-key \
    --namespace cert-manager --from-literal=api-key="$DNSMINT_KEY"

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: dnsmint
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: you@example.com
    privateKeySecretRef:
      name: dnsmint-issuer-key
    solvers:
      - dns01:
          webhook:
            groupName: acme.dnsmint.com
            solverName: dnsmint
            config:
              apiKeySecretRef:
                name: dnsmint-api-key
                key: api-key

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: q7k4m2
spec:
  secretName: q7k4m2-tls
  issuerRef:
    name: dnsmint
  dnsNames:
    - q7k4m2.a3f9c1-d4e7b8.dev
    - "*.q7k4m2.a3f9c1-d4e7b8.dev"