I am using AWS EKS with Traefik as the ingress controller.
I am using HELM to install Traefik.
I am trying to create a wildcard certificate using Route53 as the provider.
However, nothing happens, and the acme.json file remains empty.
Below are snippets of the code, I am using Terraform.
kubectl exec -n traefik traefik-7f7f8f59bb-rdfls -- ls -l /data
Defaulted container "traefik" out of: traefik, volume-permissions (init)
total 0
-rw------- 1 65532 root 0 Aug 13 23:50 acme.json
The AmazonEKS_EBS_CSI_DriverRole also has permissions for access to Route53, but nothing appears in the log, no errors. The acme.json file is zero bytes. Has anyone managed to get this configuration to work this way?
I read the documentation and was able to make progress on building my Terraform setup. However, I'm having trouble generating the certificate. I'll show parts of the cert-manager and the error, as I'm still trying to figure it out.
#create namespace for cert mananger
resource "kubernetes_namespace" "cert_manager" {
metadata {
name = "cert-manager"
}
}
resource "helm_release" "cert_manager" {
chart = "cert-manager"
name = "cert-manager"
create_namespace = false
namespace = kubernetes_namespace.cert_manager.metadata[0].name
repository = "https://charts.jetstack.io"
version = "v1.15.2"
force_update = true
wait = true
set {
name = "crds.enabled"
value = "true"
}
set {
name = "serviceAccount.name"
value = kubernetes_service_account_v1.cert_manager.metadata[0].name
}
set {
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
value = aws_iam_role.cert_manager_role.arn
}
set {
name = "serviceAccount.create"
value = "false"
}
set {
name = "securityContext.enabled"
value = true
}
set {
name = "securityContext.fsGroup"
value = 1001
}
}
resource "kubernetes_service_account_v1" "cert_manager" {
metadata {
name = "cert-manager"
namespace = kubernetes_namespace.cert_manager.metadata[0].name
annotations = {
"eks.amazonaws.com/role-arn" = aws_iam_role.cert_manager_role.arn
}
}
}
data "aws_iam_policy_document" "cert_manager_trust" {
statement {
actions = ["sts:AssumeRoleWithWebIdentity"]
principals {
type = "Federated"
identifiers = [var.oidc_provider_arn]
}
condition {
test = "StringEquals"
variable = "${var.oidc_provider}:aud"
values = ["sts.amazonaws.com"]
}
condition {
test = "StringEquals"
variable = "${var.oidc_provider}:sub"
values = ["system:serviceaccount:cert-manager:cert-manager"]
}
}
}
resource "aws_iam_role" "cert_manager_role" {
name = "cert-manager-role"
description = "eks cert-manager"
assume_role_policy = data.aws_iam_policy_document.cert_manager_trust.json
}
data "aws_iam_policy_document" "cert_manager_policy" {
statement {
effect = "Allow"
actions = [
"route53:GetChange",
]
resources = ["arn:aws:route53:::change/*"]
}
statement {
effect = "Allow"
actions = [
"route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets"
]
resources = [
"arn:aws:route53:::hostedzone/*"
]
}
statement {
effect = "Allow"
actions = [
"route53:ListHostedZonesByName"
]
resources = [
"*",
]
}
}
resource "aws_iam_role_policy" "cert_manager" {
role = aws_iam_role.cert_manager_role.name
name = "cert-manager"
policy = data.aws_iam_policy_document.cert_manager_policy.json
}
resource "kubernetes_role_v1" "tokenrequest_role" {
metadata {
name = "${kubernetes_service_account_v1.cert_manager.metadata[0].name}-tokenrequest"
namespace = kubernetes_namespace.cert_manager.metadata[0].name
}
rule {
api_groups = [""]
resources = ["serviceaccounts/token"]
resource_names = [kubernetes_service_account_v1.cert_manager.metadata[0].name]
verbs = ["create"]
}
}
resource "kubernetes_role_binding_v1" "tokenrequest_rolebinding" {
metadata {
name = "cert-manager-${kubernetes_service_account_v1.cert_manager.metadata[0].name}-tokenrequest"
namespace = kubernetes_namespace.cert_manager.metadata[0].name
}
subject {
kind = "ServiceAccount"
name = "cert-manager"
namespace = kubernetes_namespace.cert_manager.metadata[0].name
}
role_ref {
api_group = "rbac.authorization.k8s.io"
kind = "Role"
name = kubernetes_role_v1.tokenrequest_role.metadata[0].name
}
}