aws / aws/amazon-eks-pod-identity-webhook
CSR not created in self hosted setup
- Dominant language
- Go
- Stars
- 691
- Forks
- 202
- Avg merge
- 4h 38m
- Merged PRs (30d)
- 1
Description
**What happened**:
I am trying to setup pod identity webhook on a self hosted kubernetes cluster. Here's what I did:
1. Followed the instructions in https://github.com/aws/amazon-eks-pod-identity-webhook/blob/master/SELF_HOSTED_SETUP.md
2. Ran `make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest`
The output of `make cluster-up` is `Waiting for CSR to be created` because of https://github.com/aws/amazon-eks-pod-identity-webhook/blob/b19c295a269ad9de50b10e3a9cdc9ec1f7d48a19/Makefile#L86
It looks like from v0.3.0 CSR will not be created because of `in-cluster=False` as per https://github.com/aws/amazon-eks-pod-identity-webhook/blob/master/README.md#in-cluster
```
Use in-cluster=false so that the webhook reloads certificates from the filesystem rather than creating CSRs to request certificates (using CSRs is now deprecated and will not work versions later than v0.3.0).
```
Does the Makefile need an update?
Is this https://github.com/aws/amazon-eks-pod-identity-webhook/blob/b19c295a269ad9de50b10e3a9cdc9ec1f7d48a19/Makefile#L88 not required anymore?
**What you expected to happen**:
`make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest` to run without errors
**How to reproduce it (as minimally and precisely as possible)**:
Setup a kubernetes v1.21.5 cluster
Install cert-manager
Follow https://github.com/aws/amazon-eks-pod-identity-webhook/blob/master/SELF_HOSTED_SETUP.md
Run `make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest`
**Anything else we need to know?**:
**Environment**:
- AWS Region:
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`):
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`): v1.21.5
- Webhook Version:
Contributor guide
Research direction
Start with Makefile around the cluster-up target and compare it with SELF_HOSTED_SETUP.md and the README's in-cluster guidance. Reproduce the issue on Kubernetes v1.21.5 using the documented make cluster-up command, then verify that the self-hosted setup completes without waiting indefinitely for a CSR.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- build-system, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100