hostedZoneName in Cloud DNS issuer being ignored

[ivanaguilario]

I'm attempting to issue cretificates for my domains in Google Cloud DNS, but apparently cert-manager is not checking the correct DNS zone.

I'm using the following cluster issuer

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: le-prod
spec:
  acme:
    email: <redacted>
    server: <redacted>
    privateKeySecretRef:
      name: <redacted>
    solvers:
      - dns01:
          cloudDNS:
            project: <redacted>
            hostedZoneName: mydomaincom-public
            serviceAccountSecretRef:
              name: <redacted>
              key: <redacted>

Note that I'm using mydomaincom-public as the hostedZoneName.

This is because in my GCP project I have 2 DNS zones:

• mydomaincom-public whis is an EXTERNAL DNS zone
• mydomaincom-private whis is an INTERNAL DNS zone

Both DNS zones are configured for mydomain.com.

When both DNS zones exist, cert-manager creates a TXT record in the mydomaincom-public zone, but when it tries to check for propagation, it uses mydomaincom-private instead.

I see the following logs in my cert-manager pod:

1 controller.go:173] cert-manager/challenges "msg"="finished processing work item" "key"="cert-manager/<redacted>" 

1 controller.go:153] cert-manager/challenges "msg"="syncing item" "key"="cert-manager/<redacted>" 

1 dns.go:116] cert-manager/challenges/Check "msg"="checking DNS propagation" "dnsName"="mydomain.com" "domain"="mydomain.com" "resource_kind"="Challenge" "resource_name"="<redacted>" "resource_namespace"="cert-manager" "resource_version"="v1" "type"="DNS-01" "nameservers"=["10.12.0.10:53"]

1 wait.go:298] Searching fqdn "_acme-challenge.mydomain.com." using seed nameservers [10.12.0.10:53]

1 wait.go:329] Returning cached zone record mydomain.com." for fqdn "_acme-challenge.mydomain.com."

1 wait.go:316] Returning authoritative nameservers [ns-gcp-private.googledomains.com.]

1 wait.go:141] Looking up TXT records for "_acme-challenge.mydomain.com."

1 sync.go:186] cert-manager/challenges "msg"="propagation check failed" "error"="DNS record for \"mydomain.com\" not yet propagated" "dnsName"="mydomain.com" "resource_kind"="Challenge" "resource_name"="<redacted>" "resource_namespace"="cert-manager" "resource_version"="v1" "type"="DNS-01" 

As you can see, the name server used to check the TXT record is ns-gcp-private.googledomains.com, which is the one used for mydomaincom-private.

If I delete mydomaincom-private from GCP everything works as expected.

Any ideas?

[ivanaguilario]

I was able to fix this by adding the following flags to my deployment:

--dns01-recursive-nameservers-only
--dns01-recursive-nameservers=8.8.8.8:53