From 1fd7d92ce2a997814cea24dfa73b67b72bac10cf Mon Sep 17 00:00:00 2001 From: Nils Cant Date: Tue, 5 Nov 2019 15:22:32 +0100 Subject: [PATCH 1/3] Correct order api group owner reference when creating challenges Signed-off-by: Nils Cant --- pkg/controller/acmeorders/util.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/controller/acmeorders/util.go b/pkg/controller/acmeorders/util.go index a3698f205..cd316d5cc 100644 --- a/pkg/controller/acmeorders/util.go +++ b/pkg/controller/acmeorders/util.go @@ -33,7 +33,7 @@ import ( ) var ( - orderGvk = cmapi.SchemeGroupVersion.WithKind("Order") + orderGvk = cmacme.SchemeGroupVersion.WithKind("Order") ) func buildRequiredChallenges(ctx context.Context, cl acmecl.Interface, issuer cmapi.GenericIssuer, o *cmacme.Order) ([]cmacme.Challenge, error) { From 9ede3c3e0ff7a3a6ba0cfb9eb114ad9f625c91e6 Mon Sep 17 00:00:00 2001 From: Nils Cant Date: Tue, 5 Nov 2019 15:32:05 +0100 Subject: [PATCH 2/3] Add update permission on certificaterequests/finalizers to cert-manager-controller-certificates cluster role --- deploy/charts/cert-manager/templates/rbac.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/charts/cert-manager/templates/rbac.yaml b/deploy/charts/cert-manager/templates/rbac.yaml index 203be1574..00f858e01 100644 --- a/deploy/charts/cert-manager/templates/rbac.yaml +++ b/deploy/charts/cert-manager/templates/rbac.yaml @@ -121,7 +121,7 @@ rules: # admission controller enabled: # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement - apiGroups: ["cert-manager.io"] - resources: ["certificates/finalizers"] + resources: ["certificates/finalizers", "certificaterequests/finalizers"] verbs: ["update"] - apiGroups: ["acme.cert-manager.io"] resources: ["orders"] From 841670cc466612c7ac46c5c0170ac7faff86b14c Mon Sep 17 00:00:00 2001 From: Nils Cant Date: Tue, 5 Nov 2019 15:35:20 +0100 Subject: [PATCH 3/3] Revert "Add update permission on certificaterequests/finalizers to cert-manager-controller-certificates cluster role" This reverts commit dcd1f9fc014ebb72c597a765ab4064c89af3b292. --- deploy/charts/cert-manager/templates/rbac.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/charts/cert-manager/templates/rbac.yaml b/deploy/charts/cert-manager/templates/rbac.yaml index 00f858e01..203be1574 100644 --- a/deploy/charts/cert-manager/templates/rbac.yaml +++ b/deploy/charts/cert-manager/templates/rbac.yaml @@ -121,7 +121,7 @@ rules: # admission controller enabled: # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement - apiGroups: ["cert-manager.io"] - resources: ["certificates/finalizers", "certificaterequests/finalizers"] + resources: ["certificates/finalizers"] verbs: ["update"] - apiGroups: ["acme.cert-manager.io"] resources: ["orders"]