diff options
| author | Timon Schnell <timon.schnell@btc-it-services.com> | 2026-06-09 12:10:42 +0000 |
|---|---|---|
| committer | Premysl Kouril <premysl.kouril@ultimum.io> | 2026-08-05 16:16:39 +0000 |
| commit | abe305634a9dd5a8a0ba06df8f349617a745ea31 (patch) | |
| tree | edca95f7a51a9f1e7e69a306ec4a5b723c64cf57 /releasenotes | |
| parent | 8e912a9db7f013a1abfc1e70a829e435d50622db (diff) | |
| download | kolla-abe305634a9dd5a8a0ba06df8f349617a745ea31.tar.gz kolla-abe305634a9dd5a8a0ba06df8f349617a745ea31.zip | |
letsencrypt: Add ACME dns-01 challenge support
This adds support for the ACME dns-01 challenge while keeping http-01
the default. A new --challenge option (default http-01) selects the
challenge type. When dns-01 is selected, --dns-provider names any DNS
provider compiled into the bundled lego binary, and an optional
--dns-additional-opts passthrough forwards extra lego DNS flags (such as
--dns.resolvers or --dns.propagation-disable-ans) for environments where
the authoritative name server propagation check cannot be performed.
Provider credentials are supplied via --env-file: lego DNS providers
read credentials only from environment variables, so the wrapper
exports the file's contents before lego runs. The file is parsed like
docker --env-file: literal KEY=VALUE pairs split on the first '=',
comments and blank lines ignored, values taken verbatim and never
executed as shell. Selecting dns-01 without --dns-provider fails fast.
Co-Authored-By: Premysl Kouril <premysl.kouril@ultimum.io>
Assisted-By: Claude Code
Change-Id: I61dc5e3f399f6eec02475c7b90e0f41c85c6093c
Signed-off-by: Timon Schnell <timon.schnell@btc-it-services.com>
Signed-off-by: Jan Horstmann <horstmann@osism.tech>
Diffstat (limited to 'releasenotes')
| -rw-r--r-- | releasenotes/notes/letsencrypt-dns01-challenge-432b5122dc832f4a.yaml | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/releasenotes/notes/letsencrypt-dns01-challenge-432b5122dc832f4a.yaml b/releasenotes/notes/letsencrypt-dns01-challenge-432b5122dc832f4a.yaml new file mode 100644 index 000000000..0b35c17ca --- /dev/null +++ b/releasenotes/notes/letsencrypt-dns01-challenge-432b5122dc832f4a.yaml @@ -0,0 +1,14 @@ +--- +features: + - | + The ``letsencrypt-lego`` image now supports the ACME ``dns-01`` challenge + in addition to the existing ``http-01`` challenge. The + ``letsencrypt-certificates`` script accepts a new ``--challenge`` option + (defaulting to ``http-01``) and, when ``dns-01`` is selected, a + ``--dns-provider`` option naming any DNS provider supported by the bundled + ``lego`` binary. An optional ``--dns-additional-opts`` passthrough allows + forwarding extra ``lego`` DNS flags (such as ``--dns.resolvers`` or + ``--dns.propagation-disable-ans``) for environments where the default + authoritative name server propagation check cannot be performed. The + default behaviour is unchanged: without ``--challenge`` the ``http-01`` + challenge is used exactly as before. |