Merge pull request #2989 from meyskens/cf-no-email

Make Cloudflare email an optional field

deploy/crds/crd-challenges.yaml

@@ -275,8 +275,6 @@ spec:
                       description: ACMEIssuerDNS01ProviderCloudflare is a structure
                         containing the DNS configuration for Cloudflare
                       type: object
-                      required:
-                      - email
                       properties:
                         apiKeySecretRef:
                           type: object

deploy/crds/crd-clusterissuers.yaml

@@ -313,8 +313,6 @@ spec:
                             description: ACMEIssuerDNS01ProviderCloudflare is a structure
                               containing the DNS configuration for Cloudflare
                             type: object
-                            required:
-                            - email
                             properties:
                               apiKeySecretRef:
                                 type: object

deploy/crds/crd-issuers.yaml

@@ -313,8 +313,6 @@ spec:
                             description: ACMEIssuerDNS01ProviderCloudflare is a structure
                               containing the DNS configuration for Cloudflare
                             type: object
-                            required:
-                            - email
                             properties:
                               apiKeySecretRef:
                                 type: object

pkg/apis/acme/v1alpha2/types_issuer.go

@@ -303,6 +303,7 @@ type ACMEIssuerDNS01ProviderCloudDNS struct {
 // ACMEIssuerDNS01ProviderCloudflare is a structure containing the DNS
 // configuration for Cloudflare
 type ACMEIssuerDNS01ProviderCloudflare struct {
+	// +optional
 	Email    string                    `json:"email"`
 	APIKey   *cmmeta.SecretKeySelector `json:"apiKeySecretRef,omitempty"`
 	APIToken *cmmeta.SecretKeySelector `json:"apiTokenSecretRef,omitempty"`

pkg/apis/acme/v1alpha3/types_issuer.go

@@ -303,6 +303,7 @@ type ACMEIssuerDNS01ProviderCloudDNS struct {
 // ACMEIssuerDNS01ProviderCloudflare is a structure containing the DNS
 // configuration for Cloudflare
 type ACMEIssuerDNS01ProviderCloudflare struct {
+	// +optional
 	Email    string                    `json:"email"`
 	APIKey   *cmmeta.SecretKeySelector `json:"apiKeySecretRef,omitempty"`
 	APIToken *cmmeta.SecretKeySelector `json:"apiTokenSecretRef,omitempty"`

pkg/internal/apis/certmanager/validation/issuer.go

@@ -316,7 +316,7 @@ func ValidateACMEChallengeSolverDNS01(p *cmacme.ACMEChallengeSolverDNS01, fldPat
 			if p.Cloudflare.APIKey == nil && p.Cloudflare.APIToken == nil {
 				el = append(el, field.Required(fldPath.Child("cloudflare"), "apiKeySecretRef or apiTokenSecretRef is required"))
 			}
-			if len(p.Cloudflare.Email) == 0 {
+			if len(p.Cloudflare.Email) == 0 && p.Cloudflare.APIKey != nil {
 				el = append(el, field.Required(fldPath.Child("cloudflare", "email"), ""))
 			}
 		}

pkg/issuer/acme/dns/cloudflare/cloudflare.go

@@ -48,7 +48,7 @@ func NewDNSProvider(dns01Nameservers []string) (*DNSProvider, error) {
 // NewDNSProviderCredentials uses the supplied credentials to return a
 // DNSProvider instance configured for cloudflare.
 func NewDNSProviderCredentials(email, key, token string, dns01Nameservers []string) (*DNSProvider, error) {
-	if email == "" || (key == "" && token == "") {
+	if (email == "" && key != "") || (key == "" && token == "") {
 		return nil, fmt.Errorf("CloudFlare credentials missing")
 	}
 	if key != "" && token != "" {
@@ -221,7 +221,9 @@ func (c *DNSProvider) makeRequest(method, uri string, body io.Reader) (json.RawM
 		return nil, err
 	}
 
-	req.Header.Set("X-Auth-Email", c.authEmail)
+	if c.authEmail != "" {
+		req.Header.Set("X-Auth-Email", c.authEmail)
+	}
 	if c.authToken != "" {
 		req.Header.Set("Authorization", "Bearer "+c.authToken)
 	} else {