DnsException: Login Required about kubernetes-letsencrypt HOT 6 CLOSED

Ah I see. Thanks that fixed it!

from kubernetes-letsencrypt.

That's a Google Cloud error and it seems a bit odd if you've deployed it to a GCP-environment.

GCP usually provides the metadata service which lets you fetch the service account token for the instance.

If your instance does not have DNS management permissions I'd expect it to error with "Permission denied [for the service account of your instance]" rather than "Login required" which implies that you're not logged in at all.

Regardless, if your instance does not have the required permissions for Cloud DNS you can create a service account and make a private key for it. Setting the environment variable GOOGLE_APPLICATION_CREDENTIALS to the location of the key JSON file will cause the Google Cloud SDK to pick them up.

from kubernetes-letsencrypt.

I did create a service account for this, and gave it the correct permissions. Since this is a test project/cluster I actually gave it Editor permissions for the whole project.

from kubernetes-letsencrypt.

Hmm, and you mounted the key JSON into the container and set the environment variable correctly?

from kubernetes-letsencrypt.

Yes. Here's that piece of the config:

spec:
      containers:
        - image: tazjin/letsencrypt-controller:1.8-SNAPSHOT
          imagePullPolicy: Always
          name: letsencrypt-controller
          env:
          - name: GOOGLE_APPLICATION_CREDENTIALS
            value: "/etc/ce"
          volumeMounts:
          - name: ce
            mountPath: "/etc/ce"
            readOnly: true
      volumes:
      - name: ce
        secret:
          secretName: ce

I created the secret as so:

 kubectl create secret generic ce --from-file=./credentials.json -n kube-system

Where credentials.json is the private key file from the service account created.

I also explicitly added DNS Administrator to the service account, but no go.

from kubernetes-letsencrypt.

Oh, the path has to point at the file itself, i.e. /etc/ce/credentials.json (see docs)

from kubernetes-letsencrypt.