[Question]: how to set issuer to AWSPCAClusterIssuer about csi-driver

[JoshVanL]

@GStones one of your attribute keys has a misspelling:

csi:cert-manager.io/issuer-group to csi.cert-manager.io/issuer-group

[munnerz]

You must also set the 'issuer-group' annotation to the API group of your issuer type so the driver can look up the resource properly 😊

[djkormo]

I have the same using adcs issuer

https://djkormo.github.io/adcs-issuer/

  volumes:
    - name: tls
      csi:
        driver: csi.cert-manager.io
        readOnly: true
        volumeAttributes:
          csi.cert-manager.io/issuer-name: adcs-sim-adcsclusterissuer
          csi.cert-manager.io/issuer-kind: ClusterAdcsIssuer
          csi.cert-manager.io/dns-names: ${POD_NAME}.${POD_NAMESPACE}.svc.cluster.local
          csi.cert-manager.io/uri-sans: "spiffe://cluster.local/ns/${POD_NAMESPACE}/pod/${POD_NAME}/${POD_UID}"
          csi.cert-manager.io/common-name: "${SERVICE_ACCOUNT_NAME}.${POD_NAMESPACE}"

Events:
8s Normal cert-manager.io certificaterequest/adcs-sim-cert-4952p Certificate request has been approved by cert-manager.io
2s Warning FailedMount pod/csi-driver-app-pod MountVolume.SetUp failed for volume "tls" : rpc error: code = Unknown desc = submitting request: admission webhook "webhook.cert-manager.io"
denied the request: spec.issuerRef.kind: Invalid value: "ClusterAdcsIssuer": must be one of Issuer or ClusterIssuer

[djkormo]

After adding missing annotations

  volumes:
    - name: tls
      csi:
        driver: csi.cert-manager.io
        readOnly: true
        volumeAttributes:
          csi.cert-manager.io/issuer-name: adcs-sim-adcsclusterissuer
          csi.cert-manager.io/issuer-kind: ClusterAdcsIssuer
          csi.cert-manager.io/issuer-group: adcs.certmanager.csf.nokia.com
          csi.cert-manager.io/dns-names: ${POD_NAME}.${POD_NAMESPACE}.svc.cluster.local
          csi.cert-manager.io/uri-sans: "spiffe://cluster.local/ns/${POD_NAMESPACE}/pod/${POD_NAME}/${POD_UID}"
          csi.cert-manager.io/common-name: "${SERVICE_ACCOUNT_NAME}.${POD_NAMESPACE}"

I can see files inside my pod

/tls # ls -la
total 4
dr-xr-x---    3 root     root           140 Feb 16 08:55 .
drwxr-xr-x    1 root     root          4096 Feb 16 08:55 ..
drwxr-xr-x    2 root     root           100 Feb 16 08:55 ..2024_02_16_08_55_39.1114861249
lrwxrwxrwx    1 root     root            32 Feb 16 08:55 ..data -> ..2024_02_16_08_55_39.1114861249
lrwxrwxrwx    1 root     root            13 Feb 16 08:55 ca.crt -> ..data/ca.crt
lrwxrwxrwx    1 root     root            14 Feb 16 08:55 tls.crt -> ..data/tls.crt
lrwxrwxrwx    1 root     root            14 Feb 16 08:55 tls.key -> ..data/tls.key

[GStones]

@munnerz I deploy this config and still has error:

  Warning  FailedMount  1s (x3 over 4s)  kubelet   MountVolume.SetUp failed for volume "tls" : rpc error: code = Unknown desc = submitting request: admission webhook "webhook.cert-manager.io" denied the request: spec.issuerRef.kind: Invalid value: "AWSPCAClusterIssuer": must be one of Issuer or ClusterIssuer  

volumes:
  - name: tls
    csi:
      readOnly: true
      driver: csi.cert-manager.io
      volumeAttributes:
        csi.cert-manager.io/issuer-name: "rumble-root-ca"
        csi.cert-manager.io/dns-names: ${POD_NAME}.${POD_NAMESPACE}.svc.cluster.local
        csi.cert-manager.io/issuer-kind: "AWSPCAClusterIssuer"
        csi:cert-manager.io/issuer-group: "awspca.cert-manager.io"
        csi.cert-manager.io/common-name: "${SERVICE_ACCOUNT_NAME}.${POD_NAMESPACE}"

[GStones]

Many thanks!