{"action":"created","issue":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/446","repository_url":"https://api.github.com/repos/jetstack/cert-manager","labels_url":"https://api.github.com/repos/jetstack/cert-manager/issues/446/labels{/name}","comments_url":"https://api.github.com/repos/jetstack/cert-manager/issues/446/comments","events_url":"https://api.github.com/repos/jetstack/cert-manager/issues/446/events","html_url":"https://github.com/jetstack/cert-manager/pull/446","id":312922841,"number":446,"title":"Add new DNS-over-HTTPS propagation check for ACME DNS01 challenges","user":{"login":"redbaron","id":16624,"avatar_url":"https://avatars3.githubusercontent.com/u/16624?v=4","gravatar_id":"","url":"https://api.github.com/users/redbaron","html_url":"https://github.com/redbaron","followers_url":"https://api.github.com/users/redbaron/followers","following_url":"https://api.github.com/users/redbaron/following{/other_user}","gists_url":"https://api.github.com/users/redbaron/gists{/gist_id}","starred_url":"https://api.github.com/users/redbaron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/redbaron/subscriptions","organizations_url":"https://api.github.com/users/redbaron/orgs","repos_url":"https://api.github.com/users/redbaron/repos","events_url":"https://api.github.com/users/redbaron/events{/privacy}","received_events_url":"https://api.github.com/users/redbaron/received_events","type":"User","site_admin":false},"labels":[{"id":728658090,"url":"https://api.github.com/repos/jetstack/cert-manager/labels/needs-ok-to-test","name":"needs-ok-to-test","color":"b60205","default":false},{"id":727722560,"url":"https://api.github.com/repos/jetstack/cert-manager/labels/release-note","name":"release-note","color":"c2e0c6","default":false},{"id":727703419,"url":"https://api.github.com/repos/jetstack/cert-manager/labels/size/L","name":"size/L","color":"ee9900","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-04-10T13:29:42Z","updated_at":"2018-04-11T01:06:01Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/jetstack/cert-manager/pulls/446","html_url":"https://github.com/jetstack/cert-manager/pull/446","diff_url":"https://github.com/jetstack/cert-manager/pull/446.diff","patch_url":"https://github.com/jetstack/cert-manager/pull/446.patch"},"body":"**What this PR does / why we need it**:\r\nIf cert-manger is run behind proxy it often cannot do direct\r\nDNS requests to authoritative servers. It is also not uncommon\r\nfor internal networks to have different DNS view of the same\r\ndomain (aka DNS split horizon setup) in which case changes made\r\nto public DNS provider wont be visible from the inside and\r\nDNS solver propagation check never succeeds.\r\n\r\nThis change adds new way to check for DNS propagation with\r\nthe help over DNS over HTTPS resolvers. In the current form it\r\nuses Cloudflare DNS server with JSON format described in\r\nhttps://developers.cloudflare.com/1.1.1.1/dns-over-https/json-format/\r\n\r\nDNS check method to be used is controlled with\r\n--acme-dns01-check-method=[dnslookup,dns-over-https] command line flag.\r\nIt keeps using DNS lookup as a default method.\r\n\r\n\r\n**Release note**:\r\n```release-note\r\n--acme-dns01-check-method=[dnslookup,dns-over-https] command line flag to switch DNS challenge propagation check from DNS lookup to DNS over HTTPS\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/comments/380293920","html_url":"https://github.com/jetstack/cert-manager/pull/446#issuecomment-380293920","issue_url":"https://api.github.com/repos/jetstack/cert-manager/issues/446","id":380293920,"user":{"login":"euank","id":2147649,"avatar_url":"https://avatars0.githubusercontent.com/u/2147649?v=4","gravatar_id":"","url":"https://api.github.com/users/euank","html_url":"https://github.com/euank","followers_url":"https://api.github.com/users/euank/followers","following_url":"https://api.github.com/users/euank/following{/other_user}","gists_url":"https://api.github.com/users/euank/gists{/gist_id}","starred_url":"https://api.github.com/users/euank/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/euank/subscriptions","organizations_url":"https://api.github.com/users/euank/orgs","repos_url":"https://api.github.com/users/euank/repos","events_url":"https://api.github.com/users/euank/events{/privacy}","received_events_url":"https://api.github.com/users/euank/received_events","type":"User","site_admin":false},"created_at":"2018-04-11T01:06:01Z","updated_at":"2018-04-11T01:06:01Z","author_association":"CONTRIBUTOR","body":"@redbaron I believe that the same problem you describe could instead be solved outside of cert-manager by using the Kubernetes 1.10 feature of `dnsConfig` to set the nameservers to a public dns server, or an in-cluster dns server that can resolve public ips.\r\n\r\nIt could be used to do dns-over-https for traffic outside the cluster by having a dns resolver in-cluster that uses dns-over-https instead.\r\n\r\nI think it may be better for the feature of configuring cert-manager's dns resolver to live in K8s since it's already implemented there and seems like a more generic solution."}}
{"actor":{"display_login":"euank"}}