Red Hat OpenShift Container Platform

Configuring an ACME issuer by using ambient credentials on AWS

You can use cert-manager Operator for Red Hat OpenShift to set up an ACME issuer to solve DNS-01 challenges by using ambient credentials on AWS. This procedure uses Let’s Encrypt as the ACME CA server and shows how to solve DNS-01 challenges with Amazon Route 53.

Prerequisites

If your cluster is configured to use the AWS Security Token Service (STS), you followed the instructions from the Configuring cloud credentials for the cert-manager Operator for Red Hat OpenShift for the AWS Security Token Service cluster section.
If your cluster does not use the AWS STS, you followed the instructions from the Configuring cloud credentials for the cert-manager Operator for Red Hat OpenShift on AWS section.

Procedure

Optional: Override the name server settings for the DNS-01 self check.

This step is required only when the target public-hosted zone overlaps with the cluster’s default private-hosted zone.
1. Edit the CertManager resource by running the following command:
  $ oc edit certmanager cluster
2. Add a spec.controllerConfig section with the following override arguments:
  apiVersion: operator.openshift.io/v1alpha1 kind: CertManager metadata: name: cluster ... spec: ... controllerConfig: overrideArgs: - '--dns01-recursive-nameservers-only' - '--dns01-recursive-nameservers=1.1.1.1:53'
  where:
  
  --dns01-recursive-nameservers-only
  
  Specifies recursive name servers instead of checking the authoritative name servers associated with that domain.
  
  --dns01-recursive-nameservers=1.1.1.1:53
  
  Specifies a comma-separated list of <host>:<port> name servers to query for the DNS-01 self check. You must use a 1.1.1.1:53 value to avoid the public and private zones overlapping.
3. Save the file to apply the changes.
Optional: Create a namespace for the issuer:
```
$ oc new-project <issuer_namespace>
```

Modify the CertManager resource to add the --issuer-ambient-credentials argument:

$ oc patch certmanager/cluster \
  --type=merge \
  -p='{"spec":{"controllerConfig":{"overrideArgs":["--issuer-ambient-credentials"]}}}'

Create an issuer:
1. Create a YAML file that defines the Issuer object:
  Example issuer.yaml file
  apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: <issuer_name> namespace: <issuer_namespace> spec: acme: server: <server> email: "<email_address>" privateKeySecretRef: name: <secret_private_key> solvers: - dns01: route53: hostedZoneID: <hosted_zone_id> region: us-east-1
  where:
  
  <issuer_name>
  
  Specifies a name for the issuer.
  
  <issuer_namespace>
  
  Specifies the namespace that you created for the issuer.
  
  <server>
  
  Specifies the URL to access the ACME server’s directory endpoint. This example uses the Let’s Encrypt staging environment.
  
  <email_address>
  
  Specifies your email address.
  
  <secret_private_key>
  
  Specifies the name of the secret to store the ACME account private key in.
  
  <hosted_zone_id>
  
  Specifies your hosted zone ID.
2. Create the Issuer object by running the following command:
  $ oc create -f issuer.yaml