{"action":"created","issue":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/208","repository_url":"https://api.github.com/repos/jetstack/cert-manager","labels_url":"https://api.github.com/repos/jetstack/cert-manager/issues/208/labels{/name}","comments_url":"https://api.github.com/repos/jetstack/cert-manager/issues/208/comments","events_url":"https://api.github.com/repos/jetstack/cert-manager/issues/208/events","html_url":"https://github.com/jetstack/cert-manager/issues/208","id":277508489,"number":208,"title":"authentication error on route53","user":{"login":"acartapanis","id":4094797,"avatar_url":"https://avatars2.githubusercontent.com/u/4094797?v=4","gravatar_id":"","url":"https://api.github.com/users/acartapanis","html_url":"https://github.com/acartapanis","followers_url":"https://api.github.com/users/acartapanis/followers","following_url":"https://api.github.com/users/acartapanis/following{/other_user}","gists_url":"https://api.github.com/users/acartapanis/gists{/gist_id}","starred_url":"https://api.github.com/users/acartapanis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/acartapanis/subscriptions","organizations_url":"https://api.github.com/users/acartapanis/orgs","repos_url":"https://api.github.com/users/acartapanis/repos","events_url":"https://api.github.com/users/acartapanis/events{/privacy}","received_events_url":"https://api.github.com/users/acartapanis/received_events","type":"User","site_admin":false},"labels":[{"id":728658048,"url":"https://api.github.com/repos/jetstack/cert-manager/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2017-11-28T19:26:48Z","updated_at":"2018-03-07T14:00:48Z","closed_at":null,"author_association":"NONE","body":"/kind bug\r\n\r\n**What happened**:\r\ncert-manager fails to create the aws route53 records.\r\n\r\n**What you expected to happen**:\r\ncert-manager create an aws route53 record for DNS-01 challenge.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\ntry to create a certificate with dns01 on route53.\r\n\r\n**Anything else we need to know?**:\r\nThe cert-manager give me the following error :\r\n```\r\nE1128 19:20:50.525952       1 controller.go:196] certificates controller: Re-queuing item \"xxxxx/my-domain-com-cert\" due to error processing: error presenting acme authorization for domain \"XXX\": Failed to change Route 53 record set: SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\r\nstatus code: 403, request id:xxx\r\n```\r\n\r\nThe credentials are OK, i can use the aws cli with them.\r\n\r\nThe issuer : \r\n```apiVersion: certmanager.k8s.io/v1alpha1\r\nkind: Issuer\r\nmetadata:\r\n  name: letsencrypt-staging\r\n  namespace: xxxxx\r\nspec:\r\n  acme:\r\n    server: https://acme-staging.api.letsencrypt.org/directory\r\n    email: xxx@xx.x\r\n    privateKeySecretRef:\r\n      name: letsencrypt-staging\r\n    dns01:\r\n      # Here we define a list of DNS-01 providers that can solve DNS challenges\r\n      providers:\r\n      - name: route53\r\n        route53:\r\n          # The Route53 access key ID\r\n          accessKeyID: XXXXXXXX\r\n          # A secretKeyRef to a the route53 secret access key\r\n          secretAccessKeySecretRef:\r\n            key: password.txt\r\n            name: cert-manager-secret-access-key\r\n          # The Route53 region\r\n          region: eu-west-1\r\n          hostedZoneID: XXXXXX\r\n```\r\n\r\nThe certificate request :\r\n```apiVersion: certmanager.k8s.io/v1alpha1\r\nkind: Certificate\r\nmetadata:\r\n  name: my-domain-com-cert\r\n  namespace: xxxxx\r\nspec:\r\n  secretName: my-domain-com-sample-tls\r\n  issuerRef:\r\n    name: letsencrypt-staging\r\n  commonName: my.domain.com\r\n  dnsNames:\r\n  - my.domain.com\r\n  acme:\r\n    config:\r\n    - dns01:\r\n        provider: route53\r\n      domains:\r\n      - my.domain.com\r\n```\r\n\r\nI can say that i have a hosted zone \"domain.com\" declared in route53, but no record for \"my.domain.com\".\r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`): 1.8.3\r\n- Cloud provider or hardware configuration**: aws\r\n- Install tools: helm charts\r\n- Others:\r\n"},"comment":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/comments/371146726","html_url":"https://github.com/jetstack/cert-manager/issues/208#issuecomment-371146726","issue_url":"https://api.github.com/repos/jetstack/cert-manager/issues/208","id":371146726,"user":{"login":"gianrubio","id":5694860,"avatar_url":"https://avatars1.githubusercontent.com/u/5694860?v=4","gravatar_id":"","url":"https://api.github.com/users/gianrubio","html_url":"https://github.com/gianrubio","followers_url":"https://api.github.com/users/gianrubio/followers","following_url":"https://api.github.com/users/gianrubio/following{/other_user}","gists_url":"https://api.github.com/users/gianrubio/gists{/gist_id}","starred_url":"https://api.github.com/users/gianrubio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gianrubio/subscriptions","organizations_url":"https://api.github.com/users/gianrubio/orgs","repos_url":"https://api.github.com/users/gianrubio/repos","events_url":"https://api.github.com/users/gianrubio/events{/privacy}","received_events_url":"https://api.github.com/users/gianrubio/received_events","type":"User","site_admin":false},"created_at":"2018-03-07T14:00:48Z","updated_at":"2018-03-07T14:00:48Z","author_association":"CONTRIBUTOR","body":"Same issue here, reading the comment from @euank solved my issue.\r\n\r\nIf you are generating the credentials on Mac use echo with `-n` option, ex: `echo -n KEY|base64`\r\n\r\nThis issue could be closed!"}}
{"actor":{"display_login":"gianrubio"}}