From 4fc4aed3583349fd57902a8a4b1d475be4542770 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 2 Aug 2026 19:01:32 +1000 Subject: [PATCH] Add cnameStrategy: Follow to ACME DNS-01 solvers (#331) A live DNS-01 smoke test returned NOTAUTH because the solver walked _acme-challenge.unkin.net to zone unkin.net and sent the rfc2136 UPDATE there, but bind-external is only authoritative for acme.unkin.net; without cnameStrategy: Follow the solver does not chase the delegation CNAME. - Set `cnameStrategy: Follow` on the `letsencrypt` and `letsencrypt-staging` ClusterIssuer DNS-01 solvers so cert-manager follows the `_acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net` CNAME and updates the `acme.unkin.net` zone. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --------- Co-authored-by: Ben Vincent Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/331 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml | 1 + apps/base/cert-manager/clusterissuer_letsencrypt.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml b/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml index 03e7600..fd016b8 100644 --- a/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml +++ b/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml @@ -11,6 +11,7 @@ spec: name: letsencrypt-staging-account-key solvers: - dns01: + cnameStrategy: Follow rfc2136: nameserver: "198.18.199.53:53" tsigKeyName: certmanager diff --git a/apps/base/cert-manager/clusterissuer_letsencrypt.yaml b/apps/base/cert-manager/clusterissuer_letsencrypt.yaml index b2950c7..0db344c 100644 --- a/apps/base/cert-manager/clusterissuer_letsencrypt.yaml +++ b/apps/base/cert-manager/clusterissuer_letsencrypt.yaml @@ -11,6 +11,7 @@ spec: name: letsencrypt-account-key solvers: - dns01: + cnameStrategy: Follow rfc2136: nameserver: "198.18.199.53:53" tsigKeyName: certmanager