From 2d034593a7c879a967a5e8c245582196a7c790f4 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 6 Aug 2026 23:37:36 +1000 Subject: [PATCH] Point cert-manager DNS-01 self-check at public recursive nameservers unkin.net is split-horizon: the _acme-challenge.unkin.net delegation CNAME to _acme-challenge.acme.unkin.net exists only in the public Google Cloud DNS view. cert-manager CNAME following resolved via in-cluster CoreDNS and the nodes internal resolver, which serves an internal view lacking that CNAME, so Follow found no delegation and still targeted zone unkin.net on bind-external, giving NOTAUTH. Follow needs a public-view resolver for both the CNAME chase and the propagation self-check. - Set acmeDNS01.recursiveNameservers to 8.8.8.8:53 and 1.1.1.1:53 with recursiveNameserversOnly true in the cert-manager ControllerConfiguration so DNS-01 resolution and self-checks use the public DNS view. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- apps/overlays/au-syd1/cert-manager/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/overlays/au-syd1/cert-manager/values.yaml b/apps/overlays/au-syd1/cert-manager/values.yaml index 7dd96da..3e94eb4 100644 --- a/apps/overlays/au-syd1/cert-manager/values.yaml +++ b/apps/overlays/au-syd1/cert-manager/values.yaml @@ -5,6 +5,11 @@ config: apiVersion: controller.config.cert-manager.io/v1alpha1 kind: ControllerConfiguration enableGatewayAPI: true + acmeDNS01: + recursiveNameservers: + - "8.8.8.8:53" + - "1.1.1.1:53" + recursiveNameserversOnly: true replicaCount: 2 -- 2.47.3