unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Point cert-manager DNS-01 at public recursive nameservers #337

Merged
benvin merged 1 commits from benvin/certmanager-recursive-ns into main 2026-08-08 18:14:28 +10:00
Conversation 0 Commits 1 Files Changed 1
+5

1 Commits

Author SHA1 Message Date
Ben Vincent 2d034593a7 Point cert-manager DNS-01 self-check at public recursive nameservers
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details 
unkin.net is split-horizon: the _acme-challenge.unkin.net delegation CNAME
to _acme-challenge.acme.unkin.net exists only in the public Google Cloud
DNS view. cert-manager CNAME following resolved via in-cluster CoreDNS and
the nodes internal resolver, which serves an internal view lacking that
CNAME, so Follow found no delegation and still targeted zone unkin.net on
bind-external, giving NOTAUTH. Follow needs a public-view resolver for both
the CNAME chase and the propagation self-check.

- Set acmeDNS01.recursiveNameservers to 8.8.8.8:53 and 1.1.1.1:53 with
  recursiveNameserversOnly true in the cert-manager ControllerConfiguration
  so DNS-01 resolution and self-checks use the public DNS view.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
 2026-08-06 23:37:36 +10:00