Bundle secret source not found about trust-manager HOT 4 CLOSED

I just read that the secret has to be the same namespace as trust-manager. I guess that solves the problem. Any reason why this is scoped to the trust-managers namespace?

from trust-manager.

Works now. Had it tangled up somehow

from trust-manager.

1- security issue: never give permission "read all secrets from any namespaces" ^^ you can check ClusterRole here https://github.com/cert-manager/trust-manager/blob/main/deploy/charts/trust-manager/templates/clusterrole.yaml
2- related code: https://github.com/cert-manager/trust-manager/blob/main/deploy/charts/trust-manager/templates/trust.cert-manager.io_bundles.yaml#L80 https://github.com/cert-manager/trust-manager/blob/main/pkg/bundle/sync.go#L121

Set the "default" source namespace:

• https://github.com/cert-manager/trust-manager/blob/main/pkg/bundle/bundle.go#L62
• https://github.com/cert-manager/trust-manager/blob/main/cmd/trust-manager/app/options/options.go#L148

I think this can be done easily :-)

from trust-manager.

I see how I can make it work with values -> app.trust.namespace = "my-namespace" but I am still a bit confused.
I want to use a ClusterIssuer to bootstrap a Certificate for a CA Issuer (let's say in a default namespace).

Option 1:
I create Certificate in the namespace cert-manager. Then trust-manager can access it and create a ConfigMap, however the Issuer has no access to it from the default namespace :(

Option 2:
I create Certificate in the default namespace. Issuer can access it but trust-manager will need a values -> app.trust.namespace = "default" value to access it. This works but does not scale – what if I have another Issuer in namespace custom?

What is the recommended behaviour? Should I create a custom ClusterRole for trust-manager? Looks like I am missing something :(

from trust-manager.