From 6a1f6d9273ea58fdcfd57e769746a67fba392e7d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 24 Jul 2026 20:20:16 +0000 Subject: [PATCH] Restore CAA lookup timeout in provision worker Keep the previous per-lookup dnsExchangeTimeout around CheckCAA so rebased dnsclient calls do not drop main's deadline. Signed-off-by: Cursor Agent Co-authored-by: Bryan FRIMIN --- pkg/certmanager/provision_worker.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/certmanager/provision_worker.go b/pkg/certmanager/provision_worker.go index 13cb865b5..edcf61008 100644 --- a/pkg/certmanager/provision_worker.go +++ b/pkg/certmanager/provision_worker.go @@ -348,7 +348,10 @@ func (h *beginChallengeHandler) loadSkipDNSChecks(ctx context.Context, hostname } func (h *beginChallengeHandler) checkCAARecords(ctx context.Context, hostname string) error { - err := h.dnsClient.CheckCAA(ctx, hostname, h.caaIssuerDomain) + dnsCtx, cancel := context.WithTimeout(ctx, dnsExchangeTimeout) + defer cancel() + + err := h.dnsClient.CheckCAA(dnsCtx, hostname, h.caaIssuerDomain) if err == nil { return nil }