ClusterIssuer - unexpected value for field Subject

avekrivoy commented 2 years ago

Can't get freeipa-issuer working with ClusterIssuer I'm getting

The certificate request has failed to complete and will be retried: Failed to sign certificate request: fail listing services: unexpected value for field Subject: <nil> (<nil>)

Seems like ClusterIssuer is missing ignoreError: true option

apiVersion: certmanager.freeipa.org/v1beta1
kind: ClusterIssuer
metadata:
  name: freeipa-clusterissuer
spec:
  host: auth.my.infra
  user:
    namespace: freeipa-issuer-system
    name: freeipa-auth
    key: user
  password:
    namespace: freeipa-issuer-system
    name: freeipa-auth
    key: password

  # Optionals
  serviceName: HTTP
  addHost: false
  addService: true
  addPrincipal: true
  ca: ipa
  insecure: true

Ingress annotations:

      cert-manager.io/issuer: freeipa-clusterissuer
      cert-manager.io/issuer-group: certmanager.freeipa.org
      cert-manager.io/common-name: test.my.infra
      cert-manager.io/issuer-kind: ClusterIssuer

What am I doing wrong here? Is ClusterIssuer supported?

StefanAbl commented 2 years ago

I have a ClusterIssuer with a similar configuration as you running fine. I believe the problem is that addHost is set to false. I did some modifications to the code to make the option addHost: false work.

See here: https://github.com/StefanAbl/freeipa-issuer/pull/1/files#diff-45fb5b58d0c8a723d00aa738172f2bb24066efa30a8d38a10d20ea34e09ab2b8R122-R131

For debugging you could also try with addHost set to true.

avekrivoy commented 2 years ago

Thanks for the answer! I just managed to get it working by adding addService: false. Anyways, I’m creating those entries on the IPA side along with the A-record

avekrivoy commented 2 years ago

Here's how I got my ingress working with ClusterIssuer

Created A-record and service via FreeIPA cli tool:

ipa dnsrecord-add my.infra host --a-rec 192.168.1.4
ipa service-add HTTP/host.my.infra --force --skip-host-check

Defined cluster issuer:

apiVersion: certmanager.freeipa.org/v1beta1
kind: ClusterIssuer
metadata:
  name: freeipa-clusterissuer
spec:
  host: auth.my.infra
  user:
    namespace: freeipa-issuer-system
    name: freeipa-auth
    key: user
  password:
    namespace: freeipa-issuer-system
    name: freeipa-auth
    key: password
  serviceName: HTTP
  addHost: false
  addService: false
  addPrincipal: true
  ca: ipa
  insecure: true

Ingress annotations

      cert-manager.io/issuer: freeipa-clusterissuer
      cert-manager.io/issuer-group: certmanager.freeipa.org
      cert-manager.io/common-name: host.my.infra
      cert-manager.io/issuer-kind: ClusterIssuer

I had troubles with specifying correct cluster issuer, because cert-manager.io/cluster-issuer and cert-manager.io/issuer-group are incompatible. But I assume this is CertManager's behavior. So, maybe someone will find this note helpful

guilhem / freeipa-issuer

ClusterIssuer - unexpected value for field Subject #20