You can use http challenges with kcm as well. Which is what ensures you don't need to inject dns credentials.
edit: Oh my, and I can use this for the HTTP challenge and still use it with other Ingress controllers. I'd love to buy you a beer/rootbeer or something, I'm so tickled to have this!