Is your feature request related to a problem? Please describe.

We are using AWS Route53 for our DNS. We are not using AWS Certificate Manager (with a private CA or otherwise) for our certificates, and we do want to use DNS01 validation for our LetsEncrypt certificates.

All our other systems are using AWS IAM Roles Anywhere for authentication into AWS, using our private PKI infrastructure. For this to work with the aws_signing_helper you have to be able to deploy a sidecar container alongside whatever container needs access to AWS.

Currently, this is not possible in the cert manager helm chart.

Describe the solution you'd like

I want the same solution as has already been implemented for cert-manager's aws-privateca-issuer, i.e. an extraContainers property on the helm chart that allows me to define arbitrary sidecar containers to be deployed in the main cert-manager operator pod.

Describe alternatives you've considered

There are various other AWS auth methods already supported, but they all either:

• only work within AWS, or
• require long-lived credentials

IAM Roles Anywhere has the advantage of being AWS' (relatively new) solution for how to securely get access to AWS from outside, without long-lived credentials.

/kind feature