Closed akunszt closed 3 years ago
Should be related to #12
I compiled and tried the latest code. The situation is better as the aws-pca-issuer
doesn't want to handle non-PCA issues but it's also worse as it stopped working completely. As that's a different issue then I opened a new ticket for it (#25) and this can be closed as resolved.
Thanks.
I don't know if it's an issue in
cert-manager
or inaws-pca-issuer
. If it's the former then I'll open an issue there. I just experienced this only withaws-pca-issuer
.When
aws-pca-issuer
is running then it tries to handle Certificate resources even if the issuerRef points to a "plain" Issuer resource.In the
opa
namespace I wanted to create a self-signed CA and a Certificate signed by that CA. The self-signed CA is created butaws-pca-issuer
complains about that it doesn't support CA certificates. There aren't any reference to PCA in the YAML, so it shouldn't be even aware of it or it should be skipped silently.The log I saw in the
aws-pca-issuer
.The Certificate couldn't be created, it complains about that it can't find the issuer. Also I saw that
aws-pca-issuer
tried to look for an AWSPCAClusterIssuer which is - of course - doesn't exist as I created an Issuer only. Again there isn't anything PCA related in the certificate at all.The log I saw in the
aws-pca-issuer
pod:When I scale down the
aws-pca-issuer
deployment to zero and re-create the certificate it works.We're using v0.2.1 with
disableApprovedCheck: true
as we havecert-manager:1.2.0
.