diff --git a/pkg/controller/acmeorders/sync.go b/pkg/controller/acmeorders/sync.go index f3ac6d791..0975d57fc 100644 --- a/pkg/controller/acmeorders/sync.go +++ b/pkg/controller/acmeorders/sync.go @@ -452,8 +452,12 @@ func challengeSpecForAuthorization(ctx context.Context, cl acmecl.Interface, iss continue } - if cfg.Selector == nil && selectedSolver == nil { - dbg.Info("selecting solver due to nil selector and no previously selected solver") + if cfg.Selector == nil { + if selectedSolver != nil { + dbg.Info("not selecting solver as previously selected solver has a just as or more specific selector") + continue + } + dbg.Info("selecting solver due to match all selector and no previously selected solver") selectedSolver = cfg.DeepCopy() selectedChallenge = acmech continue diff --git a/pkg/controller/acmeorders/sync_test.go b/pkg/controller/acmeorders/sync_test.go index 98a39ba5a..aced2ef8c 100644 --- a/pkg/controller/acmeorders/sync_test.go +++ b/pkg/controller/acmeorders/sync_test.go @@ -1412,6 +1412,39 @@ func TestChallengeSpecForAuthorization(t *testing.T) { }, }, }, + "uses correct solver when selector explicitly names dnsName (reversed)": { + acmeClient: basicACMEClient, + issuer: &v1alpha1.Issuer{ + Spec: v1alpha1.IssuerSpec{ + IssuerConfig: v1alpha1.IssuerConfig{ + ACME: &v1alpha1.ACMEIssuer{ + Solvers: []v1alpha1.ACMEChallengeSolver{ + exampleComDNSNameSelectorSolver, + emptySelectorSolverHTTP01, + }, + }, + }, + }, + }, + order: &v1alpha1.Order{ + Spec: v1alpha1.OrderSpec{ + DNSNames: []string{"example.com"}, + }, + }, + authz: &acmeapi.Authorization{ + Identifier: acmeapi.AuthzID{ + Value: "example.com", + }, + Challenges: []*acmeapi.Challenge{acmeChallengeHTTP01}, + }, + expectedChallengeSpec: &v1alpha1.ChallengeSpec{ + Type: "http-01", + DNSName: "example.com", + Token: acmeChallengeHTTP01.Token, + Key: "http01", + Solver: &exampleComDNSNameSelectorSolver, + }, + }, } for name, test := range tests { t.Run(name, func(t *testing.T) {