<p>Created a cluster in EKS (Kubernetes 1.11.5) with multiple node groups however I'm noticing that in the <code>extension-apiserver-authentication</code> configmap that <code>client-ca-file</code> key is missing.</p>

<p>I assume this is due to the way Kubernetes API service is initiated. Has anyone else come across this issue ?</p>

<p>I came across this problem while deploying certificate manager which queries the api server with <code>GET https://10.100.0.1:443/api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication</code>.</p>

<p>In GKE this isnt a problem as <code>extension-apiserver-authentication</code> configmap already includes <code>client-ca-file</code>.</p>

<p><code>extension-apiserver-authentication</code> configmap in AWS,</p>

<pre><code>apiVersion: v1
data:
  requestheader-allowed-names: '["front-proxy-client"]'
  requestheader-client-ca-file: |
    &lt;certificate file&gt;
  requestheader-extra-headers-prefix: '["X-Remote-Extra-"]'
  requestheader-group-headers: '["X-Remote-Group"]'
  requestheader-username-headers: '["X-Remote-User"]'
kind: ConfigMap
metadata:
  creationTimestamp: 2019-01-14T04:56:51Z
  name: extension-apiserver-authentication
  namespace: kube-system
  resourceVersion: "39"
  selfLink: /api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication
  uid: ce2b6f64-17b8-11e9-a6dd-021a269d3ce8
</code></pre>

<p>However in GKE,</p>

<pre><code>apiVersion: v1
data:
  client-ca-file: |
    &lt;client certificate file&gt;
  requestheader-allowed-names: '["aggregator"]'
  requestheader-client-ca-file: |
    &lt;certificate file&gt;
  requestheader-extra-headers-prefix: '["X-Remote-Extra-"]'
  requestheader-group-headers: '["X-Remote-Group"]'
  requestheader-username-headers: '["X-Remote-User"]'
kind: ConfigMap
metadata:
  creationTimestamp: 2018-05-24T12:06:33Z
  name: extension-apiserver-authentication
  namespace: kube-system
  resourceVersion: "32"
  selfLink: /api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication
  uid: e6c0c431-5f4a-11e8-8d8c-42010a9a0191
</code></pre>

nixgadget
<p>I've also run into this issue while trying to use cert-manager on an AWS EKS cluster. It is possible to inject the certificate yourself using the certificate obtained from the AWS CLI. Follow these steps to address this issue:</p>

<p><strong>Obtain the Certificate</strong></p>

<p>The certificate is stored Base64 encoded and can be retrieved using</p>

<pre class="lang-sh prettyprint-override"><code>aws eks describe-cluster \
        --region=${AWS_DEFAULT_REGION} \
        --name=${CLUSTER_NAME} \
        --output=text \
        --query 'cluster.{certificateAuthorityData: certificateAuthority.data}' | base64 -D
</code></pre>

<p><strong>Inject the Certificate</strong></p>

<p>Edit configMap/extension-apiserver-authentication under the kube-system namespace: <code>kubectl -n kube-system edit cm extension-apiserver-authentication</code></p>

<p>Under the data section, add the CA under a new config entry named client-ca-file. For example:</p>

<pre><code>  client-ca-file: |
    -----BEGIN CERTIFICATE-----
...
    -----END CERTIFICATE-----
</code></pre>
