Fix cert-manager checks with split DNS

2026-10-16 16:42:46 +00:00
parent 0663196fa0
commit a8431d15c6
1 changed files with 8 additions and 0 deletions
@@ -7,3 +7,11 @@ cert-manager:
    # separate manual step. `installCRDs` is the older, deprecated name for
    # this same setting.
    enabled: true
+
+  # Technitium serves a private, split-horizon ahmza.com zone, while DNS-01
+  # challenge TXT records are created in the public Cloudflare zone. Use
+  # public resolvers for ACME self-checks so cert-manager sees the same TXT
+  # record Let's Encrypt sees; ordinary Pods still use normal cluster DNS.
+  extraArgs:
+    - --dns01-recursive-nameservers-only
+    - --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53