<p>I recently set up a GKE autopilot but realized it doesn't support webhooks which cert-manager is dependent on. What are the other options we have to add/manage SSL certificates to a GKE auto-pilot cluster?</p>

<p>As of May 2021, GKE Autopilot has no support for 3rd party webhooks. Without webhooks, many Kubernetes plugins such as cert-manager cannot operate correctly. Cert-manager uses a custom mutating admission webhook to manage certificates, which is immutable on GKE Autopilot.</p>
<p>To add/manage SSL certificates for Autopilot clusters, you should first start with this official GCP doc  <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs" rel="noreferrer">Google-managed SSL certificates</a>.</p>
<p>You can configure Google-managed SSL certificates using a ManagedCertificate custom resource, which is available in different API versions, depending on your GKE cluster version.  It's recommended that you use a newer API version.</p>
<ul>
<li>ManagedCertificate v1beta2 API is available in GKE cluster versions
1.15 and later.</li>
<li>ManagedCertificate v1 API is available in GKE cluster versions
1.17.9-gke.6300 and later.</li>
</ul>
<blockquote>
<p><strong>Note</strong>: Google-managed SSL certificates aren't currently supported for internal HTTPS load balancers. For internal HTTPS load balancers, use self-managed SSL certificates instead. This feature is only available for Ingress for External HTTP(S) Load Balancing, can read more <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress" rel="noreferrer">here</a>.</p>
</blockquote>
<p>To configure a Google-managed SSL certificate and associate it with an Ingress, follow the two basic steps first:</p>
<ul>
<li>Create a ManagedCertificate object in the same namespace as the
Ingress.</li>
<li>Associate the ManagedCertificate object to an Ingress by adding an
annotation networking.gke.io/managed-certificates to the Ingress.
This annotation is a comma-separated list of ManagedCertificate
resources, cert1,cert2,cert3 for example.
Which is mentioned in detail <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#creating_an_ingress_with_a_google-managed_certificate" rel="noreferrer">here</a>.</li>
</ul>
<p>You have to follow some <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#prerequisites" rel="noreferrer">prerequisites</a>:</p>
<ul>
<li>You must own the domain name (Google Domains or another registrar).</li>
<li>Your &quot;kubernetes.io/ingress.class&quot; must be &quot;gce&quot;.</li>
<li>Create a reserved (static) external IP address. If you do not reserve
an address, it may change, requiring you to reconfigure your domain's
DNS records.</li>
</ul>
<p>For setting up a Google-managed certificate, go through the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#setting_up_a_google-managed_certificate" rel="noreferrer">sample ManagedCertificate manifest</a>.</p>
