Support automatic ACME DNS-01 delegation CNAME generation

What would you like to be added:

I would like ExternalDNS to support optional generation of DNS-01 ACME delegation CNAME records for hostnames discovered from existing sources such as Gateway API HTTPRoute, Ingress, and possibly Service.

Example:

Given an HTTPRoute hostname:

spec:
  hostnames:
    - app.example.com

ExternalDNS could optionally generate an additional record:

_acme-challenge.app.example.com CNAME app.example.acme.example.com

The exact target transformation should be configurable, for example via a template:

{{ .HostnameWithoutWildcard }}.acme.example.com

or a more explicit configuration such as:

--acme-cname-delegation-enabled
--acme-cname-delegation-target-template={{ .Hostname }}.acme.example.com

Possible configuration options:

• enable/disable ACME CNAME generation globally
• restrict it by source
• restrict it by domain filter
• configure the source hostname to target hostname transformation
• configure TTL
• optionally use an annotation to opt individual resources in or out
• optionally support wildcard handling, e.g. *.app.example.com → _acme-challenge.app.example.com
• generate ownership TXT records using the existing registry mechanism

This could also be modeled as a new source wrapper/middleware rather than provider-specific logic, since the feature is independent of the DNS provider.

The behavior should be opt-in and should not change existing record generation by default.

Why is this needed:

Many organizations use cert-manager with DNS-01 challenges but do not want cert-manager to have write access to every application DNS zone.

A common operational pattern is to delegate ACME challenge records into a dedicated zone that cert-manager is allowed to modify.

Example:

_acme-challenge.app.example.com CNAME app.example.acme.example.com

Then cert-manager only needs write permissions for:

acme.example.com

and does not need write permissions for:

example.com

This has several advantages:

• smaller blast radius for cert-manager credentials
• centralized DNS-01 challenge zone
• easier permission model across many teams and namespaces
• better fit for multi-tenant clusters
• application teams can still self-service routes/ingresses without getting DNS write permissions
• avoids granting cert-manager access to production application zones

ExternalDNS already knows the hostnames that need normal DNS records through sources like Gateway API HTTPRoute, Ingress, and Service. It is therefore in a good position to also create the corresponding ACME delegation CNAMEs.

Currently the alternatives are:

1. Manage ACME delegation CNAMEs manually or with Terraform.

   • Works for static hostnames.
   • Does not scale well for dynamic/self-service HTTPRoute or Ingress hostnames.

2. Require every application to create a separate DNSEndpoint.

   • Works, but duplicates hostname information.
   • Easy to forget.
   • Requires application teams to understand the ACME delegation convention.

3. Build a separate controller or Kyverno policy to generate DNSEndpoint resources from HTTPRoute / Ingress.

   • Possible, but adds another moving part.
   • Duplicates logic that ExternalDNS already has around source parsing, domain filters, ownership, and provider sync.

Having ExternalDNS support this as an opt-in feature would make DNS-01 delegation workflows easier and safer, especially for Gateway API based platforms.

I would be willing to contribute an implementation if maintainers agree this belongs in ExternalDNS and can provide guidance on the preferred design.