k8s Unable to generate Let's Encrypt Certificates for GoDaddy Domains using cert-manager

user_4591496 0
Viewed 121

I manage my DNS using GoDaddy and I was hoping to have Lets Encrypt certificates generated for my kubernetes deployment. However, trying to generate a certificate generates the error

I0728 17:31:12.123952       1 dns.go:88] cert-manager/controller/challenges/Present "msg"="presenting DNS01 challenge for domain" "dnsName"="XXXX" "domain"="XXX" "resource_kind"="Challenge" "resource_name"="letsencrypt-staging-bflxn-153714257-3821133841" "resource_namespace"="default" "resource_version"="v1" "type"="DNS-01" 
E0728 17:31:12.129511       1 controller.go:163] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="godaddy.acme.mycompany.com is forbidden: User \"system:serviceaccount:cert-manager:cert-manager\" cannot create resource \"godaddy\" in API group \"acme.mycompany.com\" at the cluster scope" "key"="default/letsencrypt-staging-bflxn-153714257-3821133841"

At the core of this problem, I believe, is what the groupName and solver should be for my ClusterIssuer.

secret.yml

apiVersion: v1
kind: Secret
metadata:
  name: godaddy-api-key
  namespace: cert-manager
type: Opaque
stringData:
  token: GO_DADDY_KEY:GO_DADDY_SECRET

issuer.yml

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: XXXX
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - selector:
          dnsNames:
          - '*.company.com'
        dns01:
          webhook:
            config:
              apiKeySecretRef:
                name: godaddy-api-key
                key: token
              production: true
              ttl: 600
            groupName: acme.mycompany.com
            solverName: godaddy

NB: I've tried different permutations of groupName including using a unique domain with no success

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: letsencrypt-staging
spec:
  secretName: letsencrypt-staging
  renewBefore: 240h
  dnsNames:
    - "*.company.com"
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer

But the certificate is never generated

$ k get certificate letsencrypt-staging 
NAME                  READY   SECRET                AGE
letsencrypt-staging   False   letsencrypt-staging   8m27s

I'm using this webhook https://github.com/snowdrop/godaddy-webhook

cert-manager kubernetes ssl-certificate
1 Answers

I also encountered this issue. I got it fixed by adding a missing ClusterRole and ClusterRolebinding. This is the manifest that fixed the issue for me.

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dns-challenge-missing-role
rules:
- apiGroups: ["acme.mycompany.com"] # "" indicates the core API group
  resources: ["godaddy"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dns-challenge-missing-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dns-challenge-missing-role
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
user_38990380
Related