cert-manager
Hard
Concepts
cert-manager can't be given API access to the DNS zone for example.com. How can you still use DNS-01 for it?
Select your answer:
Show answer and explanation
Answer: CNAME _acme-challenge to a zone it can edit and set cnameStrategy: Follow
Explanation
The ACME server follows CNAMEs when it looks up the TXT record. With cnameStrategy: Follow, cert-manager resolves the CNAME and writes the TXT record at its target, in a zone where it has credentials. The credentials for the main zone never enter the cluster.
More hard cert-manager questions
- Which of the following is a valid way to revoke a certificate in cert-manager?
- Which of the following is a valid way to configure a Vault issuer?
- What is the purpose of the 'keystores' field in a Certificate resource?
- What is the purpose of the 'encodeUsagesInRequest' field in a Certificate resource?
- Which of the following is a valid way to debug a failing HTTP-01 challenge?
- Which of the following is a valid way to configure a DNS-01 challenge for a Route53 provider?