Integration with cert-manager, istio-csr fails pod to pod mTLS. about aws-privateca-issuer HOT 5 CLOSED

Thank you for raising this issue with the AWS Private CA Issuer plugin. We will review your submission and respond back to you here as soon as possible.

from aws-privateca-issuer.

@kuberkaul I am not sure what is incorrect with the setup. This repository is responsible for ensuring a certificate from Private CA is issued correctly. I believe that is done correctly, so I will close this issue. For issues with Istio setup, please reach out to Istio or post an issue there: https://github.com/istio/istio.io/issues. They can best help you correct the setup.

Please feel free to re-open if there is a bug in certificate issuance.

from aws-privateca-issuer.

@kuberkaul Was the certificate issued by the plugin? As long as the certificate was issued, and you can see that the certificate is correct, this is likely an issue with your setup and not a bug in this plugin.

from aws-privateca-issuer.

@divyansh-gupta yes, I can see for both sample apps they are using the cert generated using cert-manager :

2023-01-20T20:29:44.088751Z	info	SDS socket not found. Starting Istio SDS Server
2023-01-20T20:29:44.088768Z	info	CA Endpoint cert-manager-istio-csr.cert-manager.svc:443, provider Citadel
2023-01-20T20:29:44.088792Z	info	Using CA cert-manager-istio-csr.cert-manager.svc:443 cert with certs: var/run/secrets/istio/root-cert.pem

The cert in istio-system are in READY state :

[root@eks-monitor test/vir/build centos]$ kubectl get certificate -n istio-system
NAME       READY   SECRET       AGE
istio-ca   True    istio-ca     18h
istiod     True    istiod-tls   18h

The cluster issuer is up :

 kubectl get AWSPCAClusterIssuer
NAME                  AGE
awspcaclusterissuer   4d1h

kubectl get AWSPCAClusterIssuer -o yaml

spec:
  arn: arn:aws:acm-pca:us-east-1:xxxx:certificate-authority/fa3412ec-adasas-43aa-8asas0c-4567asas29d4e
  region: us-east-1

from aws-privateca-issuer.

@divyansh-gupta do you an issue with the setup ? its a very generic setup that should work in any EKS with cert-manager, istio-csr, aws-privateca-issuer, istio installed. Nothing special about the setup so Im not sure what exactly might not be right here.

from aws-privateca-issuer.