v.1.15.3 / k8s 1.21 on EKS (w/Fargate pods)
Disclaimer: Very new to all things k8s and cert-manager, any of these assertions could be wrong.
I followed the instructions to use IAM roles for my ServiceAccount, but I was always getting this:
Error presenting challenge: error instantiating route53 challenge solver: unable to assume role: AccessDenied: User: arn:aws:sts::xxx is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::yyy
Now I'm not completely sure that this fixed it, but I redeployed with the following values and it works now:
#cert-manager-values.yml
installCRDs: true
serviceAccount:
create: false
name: cert-manager
# the securityContext is required, so the pod can access files required to assume the IAM role
securityContext:
fsGroup: 1001
runAsUser: 1001
# this part is only required on Fargate; there's a port conflict there
webhook:
securePort: 10251
Differences vs. the docs (and what I was trying initially) are
- I used
eksctl create iamserviceaccount to make the ServiceAccount, and told the chart not to make its own one. So C+Ping the ARN is not needed.
- I added
runAsUser: 1001
I think the chart-created SA should have been fine, but this feels less error prone to me. But I guess the runAsUser was what fixed it? If so, could that be added to the examples?
p.s. a minimal ClusterIssuer looks like
apiVersion: v1
kind: Namespace
metadata:
name: letsencrypt-staging
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging-issuer
namespace: letsencrypt-staging
spec:
acme:
# The ACME server URL
server: https://acme-staging-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: your@email.here
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-staging
solvers:
- selector:
dnsZones: ['your.domain.here']
dns01:
route53:
region: your-region-heremaybe something like that could be added to the docs? Originally I had the role ARN in here but that's not needed in the IRSA case it seems.
v.1.15.3 / k8s 1.21 on EKS (w/Fargate pods)
Disclaimer: Very new to all things k8s and cert-manager, any of these assertions could be wrong.
I followed the instructions to use IAM roles for my ServiceAccount, but I was always getting this:
Now I'm not completely sure that this fixed it, but I redeployed with the following values and it works now:
Differences vs. the docs (and what I was trying initially) are
eksctl create iamserviceaccountto make theServiceAccount, and told the chart not to make its own one. So C+Ping the ARN is not needed.runAsUser: 1001I think the chart-created SA should have been fine, but this feels less error prone to me. But I guess the
runAsUserwas what fixed it? If so, could that be added to the examples?p.s. a minimal
ClusterIssuerlooks likemaybe something like that could be added to the docs? Originally I had the role ARN in here but that's not needed in the IRSA case it seems.