Support ARM64 images

[cert-manager]

Support ARM64 images

[JoshVanL]

Hi @xunholy, yep this is definitely something we can include.

/assign

[JoshVanL]

@xunholy, I think this will also have problems as this Issuer is expecting issued certificates as being used for TLS between the Cloudflare servers and your services.

External issuers that as far as I know would work are aws-privateca-issuer, google-cas-issuer, and step-issuer. Pricing varies! 🙂

[xunholy]

@JoshVanL did you need any help? I have some arm64 nodes I can test out any images you're building out at present.

[JoshVanL]

Hi @xunholy, apologies for the delay. I have opened a PR and will push the image shortly after it merges.

[JoshVanL]

@xunholy A multi-arch image and new helm chart version has been pushed. Let me know if things are working for you.

[xunholy]

Testing it out now. Here was the below findings:

  Warning  Unhealthy  2m39s (x6499 over 11h)  kubelet  Readiness probe failed: HTTP probe failed with statuscode: 500

panic: interface conversion: runtime.Object is nil, not *v1.CertificateRequest

goroutine 280 [running]:
github.com/cert-manager/istio-csr/pkg/certmanager.(*manager).waitForCertificateRequest(0x40002c8230, {0x26757d0, 0x400101ad40}, {0x26988f8, 0x4000cbc1e0}, 0x400037bb00)
	/workspace/pkg/certmanager/certmanager.go:188 +0x5b8
github.com/cert-manager/istio-csr/pkg/certmanager.(*manager).Sign(0x40002c8230, {0x26757d0, 0x400101ad40}, {0x22ff29c, 0x11}, {0x4001294000, 0x3c8, 0x799}, 0x34630b8a000, {0x4001048080, ...})
	/workspace/pkg/certmanager/certmanager.go:138 +0x550
github.com/cert-manager/istio-csr/pkg/tls.(*Provider).fetchCertificate(0x4000fcdea0, {0x26757d0, 0x400101ad40})
	/workspace/pkg/tls/tls.go:266 +0x284
github.com/cert-manager/istio-csr/pkg/tls.(*Provider).Start(0x4000fcdea0, {0x26757d0, 0x400101ad40})
	/workspace/pkg/tls/tls.go:119 +0x4c
sigs.k8s.io/controller-runtime/pkg/manager.(*controllerManager).startRunnable.func1(0x4001012000, {0x25f74a0, 0x4000fcdea0})
	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/manager/internal.go:697 +0x70
created by sigs.k8s.io/controller-runtime/pkg/manager.(*controllerManager).startRunnable
	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/manager/internal.go:695 +0x68

@JoshVanL

I should note I didn't integrate it yet with any CA or Istio, just spun up the helm chart as it currently is right now.

[xunholy]

Error: failed to fetch initial serving certificate: failed to sign serving certificate: failed to wait for CertificateRequest istio-system/istio-csr-89jlq to be signed: created CertificateRequest has failed: [{Approved True 2021-09-05 22:15:41 +0000 UTC cert-manager.io Certificate request has been approved by cert-manager.io} {Ready False 2021-09-05 22:15:42 +0000 UTC Failed Failed to wait for order resource "istio-csr-89jlq-3417425060" to become ready: order is in "errored" state: Failed to create Order: 400 urn:ietf:params:acme:error:rejectedIdentifier: Error creating new order :: Cannot issue for "cert-manager-istio-csr.network.svc": Domain name does not end with a valid public suffix (TLD)}]

[JoshVanL]

Hi @xunholy 🙂

panic: interface conversion: runtime.Object is nil, not *v1.CertificateRequest

This edge case is quite surprising to me. I wouldn't have expected that value to ever be nil. Will fix that..

Error: failed to fetch initial serving certificate: failed to sign serving certificate: failed to wait for CertificateRequest istio-system/istio-csr-89jlq to be signed: created CertificateRequest has failed: [{Approved True 2021-09-05 22:15:41 +0000 UTC cert-manager.io Certificate request has been approved by cert-manager.io} {Ready False 2021-09-05 22:15:42 +0000 UTC Failed Failed to wait for order resource "istio-csr-89jlq-3417425060" to become ready: order is in "errored" state: Failed to create Order: 400 urn:ietf:params:acme:error:rejectedIdentifier: Error creating new order :: Cannot issue for "cert-manager-istio-csr.network.svc": Domain name does not end with a valid public suffix (TLD)}]

This looks as though you are attempting to use a public ACME server for your istio-csr issuer which won't work. You will need to use an Issuer which is able to sign certs for private DNS/URIs.

[xunholy]

@JoshVanL thanks for the advice, so rather than using LE as a public ACME, I will need to have LE create a CA internally and then reference that as an issuer if my understanding is correct?

[JoshVanL]

@xunholy no, LE etc. won't issue intermediates since you could then sign yourself google.com which would be publicly trusted 😬

You will need to use something like the CA Issuer like in the demo example, Vault, Venafi, or an appropriate external issuer. These will use a CA that you control and will be the root of trust for your istio mesh.

[xunholy]

Perfect, thanks for confirming. Gives me a reason to redeploy origin-ca-issuer which appears to be supported.

origin-ca-issuer: Used to request certificates signed by Cloudflare Origin CA to enable TLS between Cloudflare edge and your Kubernetes workloads.

[JoshVanL]

Issue has now been resolved and confirmed ARM images are working.

/close

[jetstack-bot]

@JoshVanL: Closing this issue.

In response to this:

Issue has now been resolved and confirmed ARM images are working.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.