unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Point cert-manager DNS-01 at public recursive nameservers #337

Merged
benvin merged 1 commits from benvin/certmanager-recursive-ns into main 2026-08-08 18:14:28 +10:00
Conversation 0 Commits 1 Files Changed 1
+5
unkinben commented 2026-08-06 23:39:03 +10:00
Owner
Copy Link
Copy Source

unkin.net is split-horizon: the _acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net delegation CNAME exists only in the public Google Cloud DNS view. cert-manager's CNAME following (cnameStrategy: Follow) resolves via in-cluster CoreDNS to the nodes' internal resolver, which serves an internal view of unkin.net lacking that CNAME; Follow therefore finds no delegation and still sends the rfc2136 UPDATE to zone unkin.net on bind-external (only authoritative for acme.unkin.net), returning NOTAUTH. Follow needs a public-view resolver for both the CNAME chase and the propagation self-check. TSIG is proven fine.

  • Set acmeDNS01.recursiveNameservers to 8.8.8.8:53 and 1.1.1.1:53 with acmeDNS01.recursiveNameserversOnly: true in the cert-manager ControllerConfiguration so DNS-01 resolution and self-checks use the public DNS view.
  • Keeps cnameStrategy: Follow on the ClusterIssuers (merged in #331); this PR gives that following a resolver that can see the delegation.

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

unkin.net is split-horizon: the `_acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net` delegation CNAME exists only in the public Google Cloud DNS view. cert-manager's CNAME following (`cnameStrategy: Follow`) resolves via in-cluster CoreDNS to the nodes' internal resolver, which serves an internal view of unkin.net lacking that CNAME; Follow therefore finds no delegation and still sends the rfc2136 UPDATE to zone unkin.net on bind-external (only authoritative for acme.unkin.net), returning NOTAUTH. Follow needs a public-view resolver for both the CNAME chase and the propagation self-check. TSIG is proven fine. - Set `acmeDNS01.recursiveNameservers` to `8.8.8.8:53` and `1.1.1.1:53` with `acmeDNS01.recursiveNameserversOnly: true` in the cert-manager ControllerConfiguration so DNS-01 resolution and self-checks use the public DNS view. - Keeps `cnameStrategy: Follow` on the ClusterIssuers (merged in #331); this PR gives that following a resolver that can see the delegation. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkinben added 1 commit 2026-08-06 23:39:03 +10:00
Point cert-manager DNS-01 self-check at public recursive nameservers
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
2d034593a7 
unkin.net is split-horizon: the _acme-challenge.unkin.net delegation CNAME
to _acme-challenge.acme.unkin.net exists only in the public Google Cloud
DNS view. cert-manager CNAME following resolved via in-cluster CoreDNS and
the nodes internal resolver, which serves an internal view lacking that
CNAME, so Follow found no delegation and still targeted zone unkin.net on
bind-external, giving NOTAUTH. Follow needs a public-view resolver for both
the CNAME chase and the propagation self-check.

- Set acmeDNS01.recursiveNameservers to 8.8.8.8:53 and 1.1.1.1:53 with
  recursiveNameserversOnly true in the cert-manager ControllerConfiguration
  so DNS-01 resolution and self-checks use the public DNS view.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
benvin merged commit b99682861b into main 2026-08-08 18:14:28 +10:00
benvin deleted branch benvin/certmanager-recursive-ns 2026-08-08 18:14:28 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#337
Delete Branch "benvin/certmanager-recursive-ns"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?