Configurable DNS servers

[rcoxns]

This PR mimics the --dns01-recursive-nameservers flag in cert-manager for split DNS.

Currently if you have an internal DNS server that responds with SOAs for zones that do not exist in NS1, you get errors such as:

  status:
    presented: false
    processing: true
    reason: 'PUT https://api.nsone.net/v1/zones/fake.domain.net/_acme-challenge.host.fake.fake.domain.net/TXT:
      403 User has no access for "_acme-challenge.host.fake.fake.domain.net"'

This appears to be because of how util.FindZoneByFqdn works. Being able to specify external nameservers fixes this issue.

Another solution would be to have this webhook query the NS1 api for zones and compare, but I opted for this as it keeps it in line with how cert-manager works.

[thiagorider]

Hi, @jfarrell-NS1 / @rcoxns. I’m encountering the same issue. Is there a fix available?

Adding the following to the deployment resolves it:

      dnsConfig:
        nameservers:
        - 8.8.8.8
        - 1.1.1.1
      dnsPolicy: None

However, the Helm chart currently doesn’t support this configuration.