ACME DNS solver error "account credentials not found for domain"

[appcoders]

I used the documentation at https://cert-manager.io/docs/configuration/acme/dns01/acme-dns/

Bug:
My acmedns secret looks like this (adapted the secret contents)

kind: Secret
metadata:
  name: auth-company-com
stringData:
  acmedns.json: |
    {
      "company.com": {
        "username": "eabcdb41-d89f-4580-826f-3e62e9755ef2",
        "password": "pbAXVjlIOE01xbut7YnAbkhMQIkcwoHO0ek2j4Q0",
        "fulldomain": "d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.company.com",
        "subdomain": "d420c923-bbd7-4056-ab64-c3ca54c9b3cf",
        "allowfrom": ["10.244.0.0/16"]
      },
    }   

When I create a certificate for subdomain.company.com I get

"account credentials not found for domain subdomain.company.com"

I need to add a second entry with the subdomain added to get the certificate issued

kind: Secret
metadata:
  name: auth-company-com
stringData:
  acmedns.json: |
    {
      "company.com": {
        "username": "eabcdb41-d89f-4580-826f-3e62e9755ef2",
        "password": "pbAXVjlIOE01xbut7YnAbkhMQIkcwoHO0ek2j4Q0",
        "fulldomain": "d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.company.com",
        "subdomain": "d420c923-bbd7-4056-ab64-c3ca54c9b3cf",
        "allowfrom": ["10.244.0.0/16"]
      },
      "subdomain.company.com": {
        "username": "eabcdb41-d89f-4580-826f-3e62e9755ef2",
        "password": "pbAXVjlIOE01xbut7YnAbkhMQIkcwoHO0ek2j4Q0",
        "fulldomain": "d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.company.com",
        "subdomain": "d420c923-bbd7-4056-ab64-c3ca54c9b3cf",
        "allowfrom": ["10.244.0.0/16"]
      },
    }   

Expected behaviour:
If there is no specific subdomain matching in the list then the root domain should be matched.

/kind bug

[jetstack-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[jetstack-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle rotten
/remove-lifecycle stale

[jetstack-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

[jetstack-bot]

@jetstack-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[EmielBruijntjes]

Hello @appcoders, did you manage to solve this yourself (I am running into the same problem)

[appcoders]

@EmielBruijntjes I manually add all the needed subdomains as stated above, which is for sure not what I want :-) No one ever looked into this.

[jetstack-bot]

@EmielBruijntjes: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen
/remove-lifecycle rotten

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[haoyixin]

+1

[anisoptera]

+1.