Cert-manager account cannot create resource regru-dns at the cluster scope #9
Comments
|
I've faced the same issue on k3s cluster running inside multipass VM (Ubuntu 22.04) apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include \"cert-manager-webhook-regru.fullname\" . }}:secrets-reader
labels:
app: {{ include \"cert-manager-webhook-regru.name\" . }}
chart: {{ include \"cert-manager-webhook-regru.chart\" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
rules:
- apiGroups:
- ''
- 'flowcontrol.apiserver.k8s.io'
resources:
- '*'
verbs:
- 'get'
- 'list'
- 'watch'So I've just added here I'm not sure if it is supposed to work like this, so I prefer to consider it as a temporary workaround and it would be cool if someone could explain this incident |
|
Thank you for your advice. After editing this cluster role, error logs from pod was gone. But problem with creating resource regru-dns still remains. Pod logs |
|
I can't see any error logs here, also I'm not sure about what you meant by Personally I've faced some errors after editing rbac rules as well, I've had some errors like this: But this errors didn't affect anything, my certificate was successfully created after some time (Also, perhaps, these errors may be caused by k3s distribution in my case, as I'm not using "vanilla k8s") Also I may advice you to check out the |
|
I think my error may be related to cluster issuer solverName, what solverName did you set? ClusterIssuer.yaml |
|
Same as you did: apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
creationTimestamp: "2023-02-19T21:17:10Z"
generation: 1
name: regru-dns
resourceVersion: "933"
uid: 8654a09f-8ce0-4cdb-a419-92f10e463de5
spec:
acme:
email: [email protected]
preferredChain: ""
privateKeySecretRef:
name: cert-manager-letsencrypt-private-key
server: https://acme-v02.api.letsencrypt.org/directory
solvers:
- dns01:
webhook:
config:
regruPasswordSecretRef:
key: REGRU_PASSWORD
name: regru-password
groupName: acme.regru.ru
solverName: regru-dns
But I can see that we have different values for |
|
@Voldemat, hello! What is quickclick.online.cert? You need set value |
|
The following RBAC configuration resolved this permission issues. |
Cluster was obtained using Yandex.Cloud Managed Kubernetes solution.
Any modifications of RBAC roles didn't work.
kubectl get challenge letsencrypt-jvzb2-2152256332-2670382356 -o yaml
Chunk of web hook pod logs:
The text was updated successfully, but these errors were encountered: