jakman85andClaude Opus 4.8
cdb546bc6e
The wildcard cert stalled: challenge Presented=true (Cloudflare TXT created OK — token works) but propagation self-check looped 'DNS record not yet propagated'. Verified the record IS publicly resolvable (1.1.1.1/8.8.8.8); the NAT'd k3s-dev cluster's own DNS just can't see it. Set dns01RecursiveNameservers=1.1.1.1:53, 8.8.8.8:53 + dns01RecursiveNameserversOnly=true so the self-check bypasses cluster DNS. Realises the pre-existing TODO in this file. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
34 lines
1.2 KiB
YAML
34 lines
1.2 KiB
YAML
---
|
|
# cert-manager — issues trusted Let's Encrypt certs via ACME DNS-01 (ADR-0006). Phase 0 STUB.
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: cert-manager
|
|
namespace: cert-manager
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: cert-manager
|
|
version: ">=1.16.0 <1.17.0" # TODO(WS-SEC): pin at bring-up; Renovate maintains
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: jetstack
|
|
namespace: cert-manager
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
crds:
|
|
enabled: true # install CRDs with the chart
|
|
# DNS-01 self-check via PUBLIC resolvers. The k3s-dev cluster is NAT'd and its DNS can't resolve
|
|
# the public _acme-challenge TXT that cert-manager creates in Cloudflare (VERIFIED: the record IS
|
|
# publicly resolvable via 1.1.1.1/8.8.8.8, but the in-cluster self-check timed out — "not yet
|
|
# propagated"). Point the propagation check straight at public resolvers so it never relies on
|
|
# cluster/split-horizon DNS (docs/09 split-horizon note; realises the TODO that was here).
|
|
dns01RecursiveNameservers: "1.1.1.1:53,8.8.8.8:53"
|
|
dns01RecursiveNameserversOnly: true
|