{"action":"closed","issue":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/877","repository_url":"https://api.github.com/repos/jetstack/cert-manager","labels_url":"https://api.github.com/repos/jetstack/cert-manager/issues/877/labels{/name}","comments_url":"https://api.github.com/repos/jetstack/cert-manager/issues/877/comments","events_url":"https://api.github.com/repos/jetstack/cert-manager/issues/877/events","html_url":"https://github.com/jetstack/cert-manager/issues/877","id":358106105,"node_id":"MDU6SXNzdWUzNTgxMDYxMDU=","number":877,"title":"looks like cert-manager ignores resolv.conf and make direct requests to dns","user":{"login":"zystem","id":10708003,"node_id":"MDQ6VXNlcjEwNzA4MDAz","avatar_url":"https://avatars3.githubusercontent.com/u/10708003?v=4","gravatar_id":"","url":"https://api.github.com/users/zystem","html_url":"https://github.com/zystem","followers_url":"https://api.github.com/users/zystem/followers","following_url":"https://api.github.com/users/zystem/following{/other_user}","gists_url":"https://api.github.com/users/zystem/gists{/gist_id}","starred_url":"https://api.github.com/users/zystem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zystem/subscriptions","organizations_url":"https://api.github.com/users/zystem/orgs","repos_url":"https://api.github.com/users/zystem/repos","events_url":"https://api.github.com/users/zystem/events{/privacy}","received_events_url":"https://api.github.com/users/zystem/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-09-07T15:10:43Z","updated_at":"2018-09-13T19:50:14Z","closed_at":"2018-09-13T19:50:14Z","author_association":"NONE","body":"**Describe the bug**:\r\nI have kubernetes behind firewall what block dns requests on port 53 to dns servers others than ours internal dns.\r\nLooking on error I was got\r\nread udp 10.1.58.15:35038->205.251.198.***:53: i/o timeout\r\nlooks like cert-manager ignores resolv.conf and make direct requests to dns\r\n\r\n**Expected behaviour**:\r\ncert manager must to receive answer from 10.0.0.10\r\n\r\n**Steps to reproduce the bug**:\r\nReal domain name was replaced to example.com\r\n\r\n    apiVersion: certmanager.k8s.io/v1alpha1\r\n    kind: ClusterIssuer\r\n    metadata:\r\n      name: letsencrypt-staging\r\n    spec:\r\n      acme:\r\n        server: https://acme-v02.api.letsencrypt.org/directory\r\n        email: ***@***\r\n        privateKeySecretRef:\r\n          name: letsencrypt-staging-private-key\r\n        dns01:\r\n          providers:\r\n          - name: route53\r\n            route53:\r\n              region: eu-central-1\r\n              hostedZoneID: Z******\r\n              accessKeyID: A******\r\n              secretAccessKeySecretRef:\r\n                name: certmanager\r\n                key: AWS_SECRET_ACCESS_KEY\r\n\r\n    apiVersion: certmanager.k8s.io/v1alpha1\r\n    kind: Certificate\r\n    metadata:\r\n      name: examplecom\r\n      namespace: default\r\n    spec:\r\n      secretName: examplecom\r\n      issuerRef:\r\n        name: letsencrypt-staging\r\n        kind: ClusterIssuer\r\n      commonName: example.com\r\n      dnsNames:\r\n        - example.com\r\n      acme:\r\n        config:\r\n        - dns01:\r\n            provider: route53\r\n          domains:\r\n          - example.com\r\n\r\nFirewalled port 53 \r\nallowed  connection to 10.0.0.10:53 and from 10.0.0.10 to any\r\n\r\n**Anything else we need to know?**:\r\nReal domain name was replaced to example.com\r\n\r\nFull output\r\n\r\n    #kubectl describe certificate examplecom\r\n    Name:         examplecom\r\n    Namespace:    default\r\n    Labels:       <none>\r\n    Annotations:  kubectl.kubernetes.io/last-applied-configuration={\"apiVersion\":\"certmanager.k8s.io/v1alpha1\",\"kind\":\"Certificate\",\"metadata\":{\"annotations\":{},\"name\":\"examplecom\",\"namespace\":\"default\"},\"spec\":{\"acme\":{\"...\r\n    API Version:  certmanager.k8s.io/v1alpha1\r\n    Kind:         Certificate\r\n    Metadata:\r\n      Cluster Name:        \r\n      Creation Timestamp:  2018-09-07T12:00:15Z\r\n      Generation:          0\r\n      Resource Version:    20230135\r\n      Self Link:           /apis/certmanager.k8s.io/v1alpha1/namespaces/default/certificates/examplecom\r\n      UID:                 9***\r\n    Spec:\r\n      Acme:\r\n        Config:\r\n          Dns 01:\r\n            Provider:  route53\r\n          Domains:\r\n            cyren.io\r\n      Common Name:  example.com\r\n      Dns Names:\r\n        example.com\r\n      Issuer Ref:\r\n        Kind:       ClusterIssuer\r\n        Name:       letsencrypt-staging\r\n      Secret Name:  examplecom\r\n    Status:\r\n      Acme:\r\n        Order:\r\n          Challenges:\r\n            Authz URL:  https://acme-v02.api.letsencrypt.org/acme/authz/6***\r\n            Dns 01:\r\n              Provider:  route53\r\n            Domain:      example,com\r\n            Key:         X***\r\n            Token:       Q***\r\n            Type:        dns-01\r\n            URL:         https://acme-v02.api.letsencrypt.org/acme/challenge/6***\r\n            Wildcard:    false\r\n          URL:           https://acme-v02.api.letsencrypt.org/acme/order/4***\r\n      Conditions:\r\n        Last Transition Time:  2018-09-07T13:49:08Z\r\n        Message:               read udp 10.1.58.15:35038->205.251.198.***:53: i/o timeout\r\n        Reason:                ValidateError\r\n        Status:                False\r\n        Type:                  Ready\r\n \r\n**Environment details:**:\r\n- Kubernetes version : v1.8.5\r\n- Cloud-provider/provisioner : bare metal\r\n- cert-manager version : v0.4.1\r\n- Install method : helm for cert-manager, static manifests for certificate\r\n\r\n"}}
{"actor":{"display_login":"munnerz"}}