From cdb546bc6e046f24f7a3a9535fe89c1c063db503 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 17 Aug 2026 01:44:28 -0500 Subject: [PATCH] fix(cert-manager): DNS-01 self-check via public resolvers (split-horizon) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The wildcard cert stalled: challenge Presented=true (Cloudflare TXT created OK — token works) but propagation self-check looped 'DNS record not yet propagated'. Verified the record IS publicly resolvable (1.1.1.1/8.8.8.8); the NAT'd k3s-dev cluster's own DNS just can't see it. Set dns01RecursiveNameservers=1.1.1.1:53, 8.8.8.8:53 + dns01RecursiveNameserversOnly=true so the self-check bypasses cluster DNS. Realises the pre-existing TODO in this file. Co-Authored-By: Claude Opus 4.8 (1M context) --- platform/cert-manager/helmrelease.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/platform/cert-manager/helmrelease.yaml b/platform/cert-manager/helmrelease.yaml index aa48ba5..72f0a20 100644 --- a/platform/cert-manager/helmrelease.yaml +++ b/platform/cert-manager/helmrelease.yaml @@ -24,5 +24,10 @@ spec: values: crds: enabled: true # install CRDs with the chart - # TODO(WS-SEC, Phase 2): DNS-01 recursive nameserver config if split-horizon DNS interferes - # with propagation checks (docs/09 split-horizon note). + # DNS-01 self-check via PUBLIC resolvers. The k3s-dev cluster is NAT'd and its DNS can't resolve + # the public _acme-challenge TXT that cert-manager creates in Cloudflare (VERIFIED: the record IS + # publicly resolvable via 1.1.1.1/8.8.8.8, but the in-cluster self-check timed out — "not yet + # propagated"). Point the propagation check straight at public resolvers so it never relies on + # cluster/split-horizon DNS (docs/09 split-horizon note; realises the TODO that was here). + dns01RecursiveNameservers: "1.1.1.1:53,8.8.8.8:53" + dns01RecursiveNameserversOnly: true