Forte/launchpad
6
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Wiki Activity

feat(forte-drop): issuer dnsZones for *.drop.forteapps.net (subdomain-per-drop) #22

Merged
jorgen.stensrud merged 5 commits from feat/subdomain-drop-wildcard-cert into main 2026-06-26 11:38:31 +00:00
Conversation 5 Commits 5 Files Changed 1
+18 -4
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cluster-resources/letsencrypt-issuer.yaml
+18 -4
View File
@@ -24,8 +24,15 @@ spec:
name: azuredns-config
key: client-secret
selector:
dnsNames:
- '*.forteapps.net'
# NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
# matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
# named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
# instead suffix-matches the zone apex AND every subdomain at any depth, so this single
# entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
danijel.simeunovic commented 2026-06-11 12:56:37 +00:00
Outdated
Review
Copy Link
Copy Source

Jeg skjønner *.drop.forteapps.net, men vil ikke drop.forteapps.net omfattes av *.forteapps.net som allerede finnes?

Jeg skjønner `*.drop.forteapps.net`, men vil ikke `drop.forteapps.net` omfattes av `*.forteapps.net` som allerede finnes?
# drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
# Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
# to match fall through to the http01 solver below.
dnsZones:
- 'forteapps.net'
# HTTP-01 fallback for non-wildcard certificates
- http01:
@@ -58,8 +65,15 @@ spec:
name: azuredns-config
key: client-secret
selector:
dnsNames:
- '*.forteapps.net'
# NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
# matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
# named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
# instead suffix-matches the zone apex AND every subdomain at any depth, so this single
# entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
# drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
# Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
# to match fall through to the http01 solver below.
dnsZones:
- 'forteapps.net'
# HTTP-01 fallback for non-wildcard certificates
- http01: