Make Route53 dns01 work with EKS pod identity

[mvink-guida]

Make Route53 dns01 work with EKS pod identity

[mvink-guida]

ok cert manager works fine with pod identity, i just needed to add the extraargs since i was testing with an issuer, where this is the default for clusterissuers.

    extraArgs:
      - --issuer-ambient-credentials

when using an arn on the (cluster)issuer to hop on another remote aws-account / dns-manager role, make sure to add sts:TagSession in the trusted policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::222222555555:role/certmanagerpodindentityrolename"
      },
      "Action": [
        "sts:TagSession",
        "sts:AssumeRole"
      ]
    }
  ]
}

---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: podinfo-dns
spec:
  acme:
    preferredChain: ""
    privateKeySecretRef:
      name: podinfo-dns
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
      - dns01:
          route53:
            region: eu-central-1
            role: arn:aws:iam::333333888888:role/dns-manager
        selector:
          dnsZones:
            - "your.zone"