unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Add cnameStrategy: Follow to ACME DNS-01 solvers #331

Merged
benvin merged 1 commits from benvin/issuer-cname-follow into main 2026-08-02 19:01:33 +10:00
Conversation 0 Commits 1 Files Changed 2
+2
unkinben commented 2026-08-02 18:49:53 +10:00
Owner
Copy Link
Copy Source

A live DNS-01 smoke test returned NOTAUTH because the solver walked _acme-challenge.unkin.net to zone unkin.net and sent the rfc2136 UPDATE there, but bind-external is only authoritative for acme.unkin.net; without cnameStrategy: Follow the solver does not chase the delegation CNAME.

  • Set cnameStrategy: Follow on the letsencrypt and letsencrypt-staging ClusterIssuer DNS-01 solvers so cert-manager follows the _acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net CNAME and updates the acme.unkin.net zone.

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

A live DNS-01 smoke test returned NOTAUTH because the solver walked _acme-challenge.unkin.net to zone unkin.net and sent the rfc2136 UPDATE there, but bind-external is only authoritative for acme.unkin.net; without cnameStrategy: Follow the solver does not chase the delegation CNAME. - Set `cnameStrategy: Follow` on the `letsencrypt` and `letsencrypt-staging` ClusterIssuer DNS-01 solvers so cert-manager follows the `_acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net` CNAME and updates the `acme.unkin.net` zone. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkinben added 1 commit 2026-08-02 18:49:53 +10:00
Add cnameStrategy: Follow to ACME DNS-01 solvers
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
9ed9ebe167 
A live smoke test showed cert-manager sending the rfc2136 UPDATE to zone
unkin.net (walked from _acme-challenge.unkin.net), which bind-external is
not authoritative for, returning NOTAUTH; the solver was not following the
delegation CNAME.

- Set cnameStrategy: Follow on the letsencrypt and letsencrypt-staging
  ClusterIssuer DNS-01 solvers so cert-manager chases the
  _acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net CNAME and
  updates the acme.unkin.net zone.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
benvin merged commit 4fc4aed358 into main 2026-08-02 19:01:33 +10:00
benvin deleted branch benvin/issuer-cname-follow 2026-08-02 19:01:33 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#331
Delete Branch "benvin/issuer-cname-follow"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?