feat(forte-drop): issuer dnsZones for *.drop.forteapps.net (subdomain-per-drop) (#22)

2026-06-26 11:38:30 +00:00
parent 9297398d56
commit 3a23451802
1 changed files with 18 additions and 4 deletions
@@ -24,8 +24,15 @@ spec:
            name: azuredns-config
            key: client-secret
      selector:
-        dnsNames:
-        - '*.forteapps.net'
+        # NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
+        # matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
+        # named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
+        # instead suffix-matches the zone apex AND every subdomain at any depth, so this single
+        # entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
+        # drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
+        # Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
+        # to match fall through to the http01 solver below.
+        dnsZones:
        - 'forteapps.net'
    # HTTP-01 fallback for non-wildcard certificates
    - http01:
@@ -58,8 +65,15 @@ spec:
            name: azuredns-config
            key: client-secret
      selector:
-        dnsNames:
-        - '*.forteapps.net'
+        # NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
+        # matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
+        # named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
+        # instead suffix-matches the zone apex AND every subdomain at any depth, so this single
+        # entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
+        # drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
+        # Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
+        # to match fall through to the http01 solver below.
+        dnsZones:
        - 'forteapps.net'
    # HTTP-01 fallback for non-wildcard certificates
    - http01: