<p>I have created a vault cluster that uses OpenSSL self-signed certs generated by <a href="https://github.com/hashicorp/terraform-aws-vault/tree/master/modules/private-tls-cert" rel="nofollow noreferrer">terraform-aws-vault</a> module</p>

<p>I am getting following error when I tried to create an issuer resource in Kubernetes which uses this Vault cluster. </p>

<pre><code>validation failure list:
spec.vault.caBundle in body must be of type byte: "../certs/vault-cabundle.pem"
</code></pre>

<p>This is my issuer yaml file</p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: vault-clusterissuer
spec:
  vault:
    path: pki_int/sign/cert-manager
    server: https://vault-cluster.example.com:8200
    caBundle: /etc/ssl/certs/istio-ingress/vault-cabundle.pem
    auth:
      appRole:
        path: approle
        roleId: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" 
        secretRef:
          name: cert-manager-vault-approle
          key: secretId
</code></pre>

<p>I have used this command for base64 encrypting the caBundle file -</p>

<pre><code>openssl base64 -in cabundle.pem -out vault-cabundle.pem
</code></pre>

<p>Any help on this is highly appreciated.</p>

<p>That seems to be due to the expected format in yaml file for attribute caBundle. I couldn't find a documented schema for it. But, I found an example <a href="https://github.com/kubernetes/kubernetes/issues/61171" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/61171</a>. The caBundle seems to be taking a single line of string which is base64. I have tested this and it works for me. </p>

<p>It should work if you place entire base64 encoded file in one line and put it against caBundle. Refer to the link posted for an example.</p>
