Aside: cert-manager: If You’re Running On-Prem Without Direct DNS Access

One of the more common challenges in disconnected or tightly controlled on-prem OpenShift environments is certificate validation when the cluster doesn’t have direct access to external DNS resolvers.

If cert-manager’s DNS-01 validation cannot reach the appropriate DNS infrastructure, certificate issuance may fail even when the DNS records themselves are correct. In these environments, you can configure the cert-manager operator to use specific internal recursive DNS servers instead of relying on default resolver behavior.

The following patch updates the cert-manager configuration to query only the designated recursive nameservers:

oc patch certmanager cluster --type=merge -p='{
  "spec": {
    "controllerConfig": {
      "overrideArgs": [
        "--dns01-recursive-nameservers=10.0.10.4:53,10.0.10.5:53",
        "--dns01-recursive-nameservers-only"
      ]
    }
  }
}'

This approach is particularly useful in air-gapped, restricted-network, or enterprise environments where outbound DNS traffic is blocked and all name resolution must flow through approved internal resolvers.

A small change, but often the difference between endless certificate troubleshooting and a clean, automated issuance process.