{"action":"created","issue":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/241","repository_url":"https://api.github.com/repos/jetstack/cert-manager","labels_url":"https://api.github.com/repos/jetstack/cert-manager/issues/241/labels{/name}","comments_url":"https://api.github.com/repos/jetstack/cert-manager/issues/241/comments","events_url":"https://api.github.com/repos/jetstack/cert-manager/issues/241/events","html_url":"https://github.com/jetstack/cert-manager/issues/241","id":287206311,"node_id":"MDU6SXNzdWUyODcyMDYzMTE=","number":241,"title":"CloudDNS: use metadata server to auth with CloudDNS API","user":{"login":"fuel-wlightning","id":6608700,"node_id":"MDQ6VXNlcjY2MDg3MDA=","avatar_url":"https://avatars0.githubusercontent.com/u/6608700?v=4","gravatar_id":"","url":"https://api.github.com/users/fuel-wlightning","html_url":"https://github.com/fuel-wlightning","followers_url":"https://api.github.com/users/fuel-wlightning/followers","following_url":"https://api.github.com/users/fuel-wlightning/following{/other_user}","gists_url":"https://api.github.com/users/fuel-wlightning/gists{/gist_id}","starred_url":"https://api.github.com/users/fuel-wlightning/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fuel-wlightning/subscriptions","organizations_url":"https://api.github.com/users/fuel-wlightning/orgs","repos_url":"https://api.github.com/users/fuel-wlightning/repos","events_url":"https://api.github.com/users/fuel-wlightning/events{/privacy}","received_events_url":"https://api.github.com/users/fuel-wlightning/received_events","type":"User","site_admin":false},"labels":[{"id":728691140,"node_id":"MDU6TGFiZWw3Mjg2OTExNDA=","url":"https://api.github.com/repos/jetstack/cert-manager/labels/area/provider-acme","name":"area/provider-acme","color":"0052cc","default":false},{"id":728658054,"node_id":"MDU6TGFiZWw3Mjg2NTgwNTQ=","url":"https://api.github.com/repos/jetstack/cert-manager/labels/kind/feature","name":"kind/feature","color":"c7def8","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/jetstack/cert-manager/milestones/8","html_url":"https://github.com/jetstack/cert-manager/milestone/8","labels_url":"https://api.github.com/repos/jetstack/cert-manager/milestones/8/labels","id":3488527,"node_id":"MDk6TWlsZXN0b25lMzQ4ODUyNw==","number":8,"title":"v0.5","description":"","creator":{"login":"munnerz","id":203583,"node_id":"MDQ6VXNlcjIwMzU4Mw==","avatar_url":"https://avatars3.githubusercontent.com/u/203583?v=4","gravatar_id":"","url":"https://api.github.com/users/munnerz","html_url":"https://github.com/munnerz","followers_url":"https://api.github.com/users/munnerz/followers","following_url":"https://api.github.com/users/munnerz/following{/other_user}","gists_url":"https://api.github.com/users/munnerz/gists{/gist_id}","starred_url":"https://api.github.com/users/munnerz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/munnerz/subscriptions","organizations_url":"https://api.github.com/users/munnerz/orgs","repos_url":"https://api.github.com/users/munnerz/repos","events_url":"https://api.github.com/users/munnerz/events{/privacy}","received_events_url":"https://api.github.com/users/munnerz/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":8,"state":"open","created_at":"2018-07-11T11:58:53Z","updated_at":"2018-09-10T12:49:18Z","due_on":"2018-08-11T07:00:00Z","closed_at":null},"comments":4,"created_at":"2018-01-09T19:41:39Z","updated_at":"2018-09-10T23:46:41Z","closed_at":"2018-09-10T12:49:18Z","author_association":"NONE","body":"**Is this a BUG REPORT or FEATURE REQUEST?**:\r\n/kind feature\r\n\r\n**What happened**:\r\nWhen creating an Issuer on a GKE cluster, and leaving out the serviceAccountSecretRef it fails to manipulate DNS with built in serviceAccount for the cluster.\r\n\r\n**What you expected to happen**:\r\nWhen on a GKE cluster setup with scopes of https://www.googleapis.com/auth/ndev.clouddns.readwrite I expect cert-manager to be able to use the built in service account to manage CloudDNS within the same project.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\n\r\nThis assumes you have domain example.com setup in your GCP Project CloudDNS\r\n```\r\n#!/bin/bash\r\nCLUSTERNAME=\"test-cert-manager\"\r\nPROJECT=\"yourgcpproject\"\r\nEMAIL=\"youremail@email.com\"\r\nYOURGCPDOMAIN=\"example.com\"\r\n\r\n# Provision GKE\r\ngcloud --project=${PROJECT} container clusters create ${CLUSTERNAME} \\\r\n        --zone=us-west1-b \\\r\n        --num-nodes 1 \\\r\n        --cluster-version 1.8.5-gke.0 \\\r\n        --scopes \"https://www.googleapis.com/auth/ndev.clouddns.readwrite\"\r\n\r\n# Init Helm\r\nkubectl create serviceaccount --namespace kube-system tiller\r\nkubectl create clusterrolebinding tiller-cluster-rule \\\r\n        --clusterrole=cluster-admin \\\r\n        --serviceaccount=kube-system:tiller\r\nhelm init --service-account tiller\r\n\r\n# Install Cert-Manager\r\nhelm install --name cert-manager --namespace kube-system contrib/charts/cert-manager\r\n\r\n# Init Let's Encrypt as issuer\r\nkubectl apply -f - <<EOF\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: Issuer\r\nmetadata:\r\n  name: letsencrypt-staging\r\nspec:\r\n  acme:\r\n    # The ACME server URL\r\n    server: https://acme-staging.api.letsencrypt.org/directory\r\n    # Email address used for ACME registration\r\n    email: ${EMAIL}\r\n    # Name of a secret used to store the ACME account private key\r\n    privateKeySecretRef:\r\n      name: letsencrypt-staging\r\n    # ACME DNS-01 provider configurations\r\n    dns01:\r\n      # Here we define a list of DNS-01 providers that can solve DNS challenges\r\n      providers:\r\n      - name: gcpdns\r\n        clouddns:\r\n          project: ${PROJECT}\r\nEOF\r\n\r\n# Init Let's Encrypt as issuer\r\nkubectl apply -f - <<EOF\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: Certificate\r\nmetadata:\r\n  name: app-ssl\r\nspec:\r\n  secretName: app-ssl-secret\r\n  issuerRef:\r\n    name: letsencrypt-staging\r\n  commonName: test-name.${YOURGCPDOMAIN}\r\n  acme:\r\n    config:\r\n    - dns01:\r\n        provider: gcpdns\r\n      domains:\r\n      - test-name.${YOURGCPDOMAIN}\r\nEOF\r\n\r\nkubectl describe certificate app-ssl\r\n```\r\n\r\nUnder events output of the last command:\r\n```\r\nEvents:\r\n  Type     Reason                   Age                From                     Message\r\n  ----     ------                   ----               ----                     -------\r\n  Warning  ErrorCheckCertificate    13s (x7 over 14s)  cert-manager-controller  Error checking existing TLS certificate: secret \"app-ssl-secret\" not found\r\n  Normal   PrepareCertificate       13s (x6 over 14s)  cert-manager-controller  Preparing certificate with issuer\r\n  Normal   PresentChallenge         13s (x6 over 13s)  cert-manager-controller  Presenting dns-01 challenge for domain test-name.example.com\r\n  Warning  ErrorPrepareCertificate  13s (x6 over 13s)  cert-manager-controller  Error preparing issuer for certificate: error presenting acme authorization for domain \"test-name.example.com\": error getting clouddns service account: secret \"\" not found\r\n\r\n```\r\n\r\n**Anything else we need to know?**:\r\nUsing default client from the oauth2 google golang lib should automatically use this to authenticate your client if you don't pass in the service account.\r\nhttps://godoc.org/golang.org/x/oauth2/google\r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`):\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"8\", GitVersion:\"v1.8.4\", GitCommit:\"9befc2b8928a9426501d3bf62f72849d5cbcd5a3\", GitTreeState:\"clean\", BuildDate:\"2017-11-20T05:28:34Z\", GoVersion:\"go1.8.3\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"8+\", GitVersion:\"v1.8.5-gke.0\", GitCommit:\"2c2a807131fa8708abc92f3513fe167126c8cce5\", GitTreeState:\"clean\", BuildDate:\"2017-12-19T20:05:45Z\", GoVersion:\"go1.8.3b4\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n- Cloud provider or hardware configuration**:\r\nGoogle Cloud Platform: Google Kubernetes Engine: 1.8.5-gke.0\r\n`gcloud --version` output:\r\n```\r\nGoogle Cloud SDK 183.0.0\r\nbeta 2017.09.15\r\nbq 2.0.27\r\ncontainer-builder-local \r\ncore 2017.12.08\r\ndocker-credential-gcr \r\ngsutil 4.28\r\nkubectl \r\n```\r\n- Install tools:\r\n- Others:\r\n"},"comment":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/comments/420097826","html_url":"https://github.com/jetstack/cert-manager/issues/241#issuecomment-420097826","issue_url":"https://api.github.com/repos/jetstack/cert-manager/issues/241","id":420097826,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDA5NzgyNg==","user":{"login":"fuel-wlightning","id":6608700,"node_id":"MDQ6VXNlcjY2MDg3MDA=","avatar_url":"https://avatars0.githubusercontent.com/u/6608700?v=4","gravatar_id":"","url":"https://api.github.com/users/fuel-wlightning","html_url":"https://github.com/fuel-wlightning","followers_url":"https://api.github.com/users/fuel-wlightning/followers","following_url":"https://api.github.com/users/fuel-wlightning/following{/other_user}","gists_url":"https://api.github.com/users/fuel-wlightning/gists{/gist_id}","starred_url":"https://api.github.com/users/fuel-wlightning/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fuel-wlightning/subscriptions","organizations_url":"https://api.github.com/users/fuel-wlightning/orgs","repos_url":"https://api.github.com/users/fuel-wlightning/repos","events_url":"https://api.github.com/users/fuel-wlightning/events{/privacy}","received_events_url":"https://api.github.com/users/fuel-wlightning/received_events","type":"User","site_admin":false},"created_at":"2018-09-10T23:46:41Z","updated_at":"2018-09-10T23:46:41Z","author_association":"NONE","body":"This appears to still not be working with canary based on git revision (c60f3de0382d6c4c1c0fb46fdf67f001d4362c24) which is post this merge.\r\n\r\nI used the following ClusterIssuer (replacing <yourprojectid> with my project name):\r\n```\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: ClusterIssuer\r\nmetadata:\r\n  name: cloud-dns-ambient-test\r\nspec:\r\n  acme:\r\n    # The ACME server URL\r\n    server: https://acme-staging-v02.api.letsencrypt.org/directory\r\n    # Email address used for ACME registration\r\n    email: my@email.com\r\n    # Name of a secret used to store the ACME account private key\r\n    privateKeySecretRef:\r\n      name: cloud-dns-ambient-test\r\n    # ACME DNS-01 provider configurations\r\n    dns01:\r\n      # Here we define a list of DNS-01 providers that can solve DNS challenges\r\n      providers:\r\n      - name: cloud-dns\r\n        clouddns:\r\n          # The project in which to update the DNS zone\r\n          project: <yourprojectid>\r\n\r\n```\r\n\r\nThe message I get thereafter is:\r\n\r\n> Resource validation failed: [spec.acme.dns01.providers[0].clouddns.serviceAccountSecretRef.name: Required value: secret name is required, spec.acme.dns01.providers[0].clouddns.serviceAccountSecretRef.key: Required value: secret key is required]\r\n\r\nCommand to get it is:\r\n`kubectl describe clusterissuer cloud-dns-ambient-test`\r\n\r\nFull output is:\r\n\r\n```\r\nFM-WILLIG2-MAC:clusterissuer williamlightning$ kubectl describe clusterissuer cloud-dns-ambient-test\r\nName:         cloud-dns-ambient-test\r\nNamespace:    \r\nLabels:       <none>\r\nAnnotations:  kubectl.kubernetes.io/last-applied-configuration={\"apiVersion\":\"certmanager.k8s.io/v1alpha1\",\"kind\":\"ClusterIssuer\",\"metadata\":{\"annotations\":{},\"name\":\"cloud-dns-ambient-test\",\"namespace\":\"\"},\"spec\":...\r\nAPI Version:  certmanager.k8s.io/v1alpha1\r\nKind:         ClusterIssuer\r\nMetadata:\r\n  Cluster Name:        \r\n  Creation Timestamp:  2018-09-10T23:39:10Z\r\n  Generation:          0\r\n  Resource Version:    5509\r\n  Self Link:           /apis/certmanager.k8s.io/v1alpha1/cloud-dns-ambient-test\r\n  UID:                 b76c86f3-b552-11e8-8061-42010a8a004a\r\nSpec:\r\n  Acme:\r\n    Dns 01:\r\n      Providers:\r\n        Clouddns:\r\n          Project:  audiologyedge\r\n          Service Account Secret Ref:\r\n            Key:   \r\n            Name:  \r\n        Name:      cloud-dns\r\n    Email:         my@email.com\r\n    Private Key Secret Ref:\r\n      Key:   \r\n      Name:  cloud-dns-ambient-test\r\n    Server:  https://acme-staging-v02.api.letsencrypt.org/directory\r\nStatus:\r\n  Conditions:\r\n    Last Transition Time:  2018-09-10T23:39:10Z\r\n    Message:               Resource validation failed: [spec.acme.dns01.providers[0].clouddns.serviceAccountSecretRef.name: Required value: secret name is required, spec.acme.dns01.providers[0].clouddns.serviceAccountSecretRef.key: Required value: secret key is required]\r\n    Reason:                ConfigError\r\n    Status:                False\r\n    Type:                  Ready\r\nEvents:                    <none>\r\nFM-WILLIG2-MAC:clusterissuer williamlightning$\r\n```"}}
{"actor":{"display_login":"fuel-wlightning"}}