cert-manager: Cloudflare ACME DNS-01 challenge fails with API error requires permissions

Describe the bug: When performing an ACME DNS-01 challenge against Cloudflare, the API routine around Cloudflare zones fails with

Error: 0: Actor 'com.cloudflare.api.token.xxxxxxxxxxxx' requires permission 'com.cloudflare.api.account.zone.list' to list zones

Expected behaviour: DNS-01 challenge completes and certificate is issued

Steps to reproduce the bug: Create DNS-01 challenge based on Cloudflare documentation API Tokens section (not API Keys)

Create certificate request in the usual way.

It will fail with the above error when doing ‘kubectl get challenge -A’

Anything else we need to know?:

This is a cloudflare API specific error that’s thrown. This seems to occur when either an invalid, or empty zone is passed - I believe at line 154 of cloudflare.go

curl -X GET "https://api.cloudflare.com/client/v4/zones?name=mybadzone.com"      -H "Authorization: Bearer xxxxxxxxxxxx"      -H "Content-Type:application/json"
{"success":false,"errors":[{"code":0,"message":"Actor 'com.cloudflare.api.token.xxxxxxxxxxxx' requires permission 'com.cloudflare.api.account.zone.list' to list zones"}],"messages":[],"result":null}

curl -X GET "https://api.cloudflare.com/client/v4/zones?name="      -H "Authorization: Bearer xxxxxxxxxxxx"      -H "Content-Type:application/json"
{"success":false,"errors":[{"code":0,"message":"Actor 'com.cloudflare.api.token.xxxxxxxxxxxx' requires permission 'com.cloudflare.api.account.zone.list' to list zones"}],"messages":[],"result":null}

If the fqdn is blank, and you drop the ?name= it works fine.

What I’m not very clear on is how the fqdn in the Present section of the cloudflare.go is obtained / passed. I don’t see any way in the documentation to specify this.

This seems is also very much like issue #2986

Environment details::

• Kubernetes version (e.g. v1.10.2): v1.18.4 (k3s)
• Cloud-provider/provisioner (e.g. GKE, kops AWS, etc): k3s
• cert-manager version (e.g. v0.4.0): v0.15.1
• Install method (e.g. helm or static manifests): static manifests (https://github.com/jetstack/cert-manager/releases/download/v0.15.1/cert-manager.yaml)

/kind bug