The zoo MPC nodes have served their API for as long as they have been up, with
no name pointing at them. Nothing in an Ingress creates a record and no
external-dns runs here, so the host existed only as far as the cluster.
dns-sync.sh could not have created it either: it spoke only Bearer tokens, and
what the estate has deployed for cert-manager is a global key with an email. It
now takes whichever is present, preferring the token, so one credential serves
both jobs instead of a second one being minted to do the same work.
Proxied, like every other zoo.cloud host that resolves. The origin serves the
ingress default certificate, so a direct record reaches a server whose
certificate no client accepts -- on this zone TLS is terminated at the edge or
it is not terminated at all.
Co-authored-by: Hanzo Dev <[email protected]>
zeekayandHanzo AI
5c94c1624f