using vault issuer expects common name from cert-manager-istio-csr when attempting to create server cert

[cert-manager]

using vault issuer expects common name from cert-manager-istio-csr when attempting to create server cert

[jithkaringada-corp]

@JoshVanL I am setting up my minikube instance with istio, and it seems like I would have run into issues with workload certs. I hadn't got that far as I spent a lot of time trying to figure out the CN thing. It looks like if you don't provide vault the specific configuration on the role to not require common names, it will default to requiring it. It may be worth noting and documenting for vault issuers. Thank you for the information. This was super helpful. Understanding that the CN is not needed is more than sufficient. We use the common name to do whitelisting in the company i work for, so it was just an expectation that common name would be supported, I don't really have a reason for needing it.

[jithkaringada-corp]

When I update the vault policy to have require_cn: false, then it works but I would like to use CN. How do I get the cert-manager-istio-csr to supply a common name when requesting for a certificate?

[JoshVanL]

Hi @jithkaringada-corp, common names are not used for istio certificates and instead make use of spiffe URIs, and DNS alt names for istiod's webhook. istio-csr similarly only uses DNS.

Whilst we could change istio-csr to use a common name for its serving certificate, it is superfluous and you would have the same issue for istio's own certs.

What is the reason for the common name requirement?

[JoshVanL]

Thanks @jithkaringada-corp, glad the issue has been fixed. I will mark this issue as closed with a mind on improving documentation for what kinds of policy istio certificates require.

Feel free to re-open if something else comes up.

/close

[jetstack-bot]

@JoshVanL: Closing this issue.

In response to this:

Thanks @jithkaringada-corp, glad the issue has been fixed. I will mark this issue as closed with a mind on improving documentation for what kinds of policy istio certificates require.

Feel free to re-open if something else comes up.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.