Why:
- The cert-manager v1.20.2 controller crashloops: strict decoding of its
ControllerConfiguration rejects the unknown field `acmeDNS01`, so
/var/cert-manager/config/config.yaml fails to load and the controller
never starts; the stuck rollout leaves only the old pod serving.
- PR #337 placed the DNS-01 recursive-nameserver settings under `acmeDNS01`,
but the field in the controller.config.cert-manager.io/v1alpha1 schema is
`acmeDNS01Config`.
How:
- Rename the config block `acmeDNS01` to `acmeDNS01Config`, keeping
`recursiveNameservers` (8.8.8.8:53, 1.1.1.1:53) and
`recursiveNameserversOnly: true` so DNS-01 resolution and self-checks
still use the public DNS view for the split-horizon delegation.
Ben Vincent
9882bbe5d5