From 9ed9ebe1677e4ac99f4b0145c79b6b98032515e1 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 2 Aug 2026 18:49:38 +1000 Subject: [PATCH] Add cnameStrategy: Follow to ACME DNS-01 solvers A live smoke test showed cert-manager sending the rfc2136 UPDATE to zone unkin.net (walked from _acme-challenge.unkin.net), which bind-external is not authoritative for, returning NOTAUTH; the solver was not following the delegation CNAME. - Set cnameStrategy: Follow on the letsencrypt and letsencrypt-staging ClusterIssuer DNS-01 solvers so cert-manager chases the _acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net CNAME and updates the acme.unkin.net zone. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml | 1 + apps/base/cert-manager/clusterissuer_letsencrypt.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml b/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml index 03e7600..fd016b8 100644 --- a/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml +++ b/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml @@ -11,6 +11,7 @@ spec: name: letsencrypt-staging-account-key solvers: - dns01: + cnameStrategy: Follow rfc2136: nameserver: "198.18.199.53:53" tsigKeyName: certmanager diff --git a/apps/base/cert-manager/clusterissuer_letsencrypt.yaml b/apps/base/cert-manager/clusterissuer_letsencrypt.yaml index b2950c7..0db344c 100644 --- a/apps/base/cert-manager/clusterissuer_letsencrypt.yaml +++ b/apps/base/cert-manager/clusterissuer_letsencrypt.yaml @@ -11,6 +11,7 @@ spec: name: letsencrypt-account-key solvers: - dns01: + cnameStrategy: Follow rfc2136: nameserver: "198.18.199.53:53" tsigKeyName: certmanager