aws / aws/amazon-eks-pod-identity-webhook

CSR not created in self hosted setup

Open
#144 3 comments 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
691
Forks
202
Avg merge
4h 38m
Merged PRs (30d)
1

Description

**What happened**:

I am trying to setup pod identity webhook on a self hosted kubernetes cluster. Here's what I did:
1. Followed the instructions in https://github.com/aws/amazon-eks-pod-identity-webhook/blob/master/SELF_HOSTED_SETUP.md
2. Ran `make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest`

The output of `make cluster-up` is `Waiting for CSR to be created` because of https://github.com/aws/amazon-eks-pod-identity-webhook/blob/b19c295a269ad9de50b10e3a9cdc9ec1f7d48a19/Makefile#L86

It looks like from v0.3.0 CSR will not be created because of `in-cluster=False` as per https://github.com/aws/amazon-eks-pod-identity-webhook/blob/master/README.md#in-cluster
```
Use in-cluster=false so that the webhook reloads certificates from the filesystem rather than creating CSRs to request certificates (using CSRs is now deprecated and will not work versions later than v0.3.0).
```
Does the Makefile need an update?

Is this https://github.com/aws/amazon-eks-pod-identity-webhook/blob/b19c295a269ad9de50b10e3a9cdc9ec1f7d48a19/Makefile#L88 not required anymore?

**What you expected to happen**:

`make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest` to run without errors

**How to reproduce it (as minimally and precisely as possible)**:

Setup a kubernetes v1.21.5 cluster
Install cert-manager
Follow https://github.com/aws/amazon-eks-pod-identity-webhook/blob/master/SELF_HOSTED_SETUP.md
Run `make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest`
**Anything else we need to know?**:

**Environment**:
- AWS Region:
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`):
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`): v1.21.5
- Webhook Version:

Contributor guide

Open the contributing guide

Research direction

Start with Makefile around the cluster-up target and compare it with SELF_HOSTED_SETUP.md and the README's in-cluster guidance. Reproduce the issue on Kubernetes v1.21.5 using the documented make cluster-up command, then verify that the self-hosted setup completes without waiting indefinitely for a CSR.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
build-system, devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.