cert-manager + Cloudflare DNS-01: Automated TLS for Everything

I spent two days chasing a cert-manager error that looked like it was coming from the future. The message was clean: Error: failed to solve challenge: failed to update DNS record: 403 Forbidden . I had followed the docs, created the API token, set up the ClusterIssuer, and even double-checked the zone. But the error wouldn’t go away. Turns out, the token didn’t have the right scope, and I had no idea. That’s the kind of thing that happens when you skip the part of the documentation that says "ma