DNS01 Route53 ClusterIssuer

DNS01 issuer for wildcard certs; IRSA/secret must grant route53 change-record perms

kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-dns
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-dns
    solvers:
    - dns01:
        route53:
          region: us-east-1
          hostedZoneID: <id>
EOF

tool: cert-manager16 commands
tags: cert-manager tls dns cloud

More cert-manager commands

Stuck ACME challenges

kubectl get challenges -A -o wide && kubectl describe challenge -n <ns> <name>

List pending validations and read the propagation/self-check error blocking issuance
Install cert-manager via Helm

helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set installCRDs=true

Install cert-manager with CRDs into its own namespace
Check cert-manager pods

kubectl get pods -n cert-manager

Verify all cert-manager components are running
List certificates

kubectl get certificates -A

List all Certificate resources across namespaces
Describe certificate

kubectl describe certificate my-cert -n default

Show status and events for a Certificate resource

all 16 cert-manager commands