From b31babe5a2e4669a4deceeff381f27f8cc6e1d63 Mon Sep 17 00:00:00 2001 From: Adam Kunicki Date: Tue, 14 Aug 2018 00:22:25 -0700 Subject: [PATCH] Add delayBeforeCheck parameter. (#6734) This is helpful in the scenario where you want to use dns-01 challenges in a public route53 zone, but your cluster's resolver is using a private route53 zone and the initial TXT check fails. This allows you to skip the check and instead use a fixed delay before the ACME verification happens. --- stable/traefik/Chart.yaml | 2 +- stable/traefik/README.md | 1 + stable/traefik/templates/configmap.yaml | 3 +++ stable/traefik/values.yaml | 1 + 4 files changed, 6 insertions(+), 1 deletion(-) diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml index 36508386ba..fbf79e7796 100755 --- a/stable/traefik/Chart.yaml +++ b/stable/traefik/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: traefik -version: 1.40.0 +version: 1.41.0 appVersion: 1.6.5 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support keywords: diff --git a/stable/traefik/README.md b/stable/traefik/README.md index 3c9815bcc9..08428e44d3 100644 --- a/stable/traefik/README.md +++ b/stable/traefik/README.md @@ -117,6 +117,7 @@ The following table lists the configurable parameters of the Traefik chart and t | `ssl.defaultKey` | Base64 encoded private key for the certificate above | The private key for the certificate above | | `acme.enabled` | Whether to use Let's Encrypt to obtain certificates | `false` | | `acme.challengeType` | Type of ACME challenge to perform domain validation. `tls-sni-01`, `http-01` or `dns-01` | `tls-sni-01` | +| `acme.delayBeforeCheck` | By default, the provider will verify the TXT DNS challenge record before letting ACME verify. If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds. Useful when Traefik cannot resolve external DNS queries. | `0` | | `acme.dnsProvider.name` | Which DNS provider to use. See [here](https://github.com/xenolf/lego/tree/master/providers/dns) for the list of possible values. | `nil` | | `acme.dnsProvider.$name` | The configuration environment variables (encoded as a secret) needed for the DNS provider to do DNS challenge. See [here](#example-aws-route-53). | `{}` | | `acme.email` | Email address to be used in certificates obtained from Let's Encrypt | `admin@example.com` | diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml index 40dd6a3930..7eacc9b16c 100644 --- a/stable/traefik/templates/configmap.yaml +++ b/stable/traefik/templates/configmap.yaml @@ -188,6 +188,9 @@ data: {{- if eq .Values.acme.challengeType "dns-01" }} [acme.dnsChallenge] provider = "{{ .Values.acme.dnsProvider.name }}" + {{- if .Values.acme.delayBeforeCheck }} + delayBeforeCheck = {{ .Values.acme.delayBeforeCheck }} + {{- end }} {{- else if eq .Values.acme.challengeType "http-01" }} [acme.httpChallenge] entryPoint = "http" diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml index e05281c924..b85beaea4e 100644 --- a/stable/traefik/values.yaml +++ b/stable/traefik/values.yaml @@ -138,6 +138,7 @@ acme: challengeType: tls-sni-01 ## Configure dnsProvider to perform domain verification using dns challenge ## Applicable only if using the dns-01 challenge type + delayBeforeCheck: 0 dnsProvider: name: nil auroradns: