SA Token Authentication Deprecation

[h3adex]

What happened?

SA Service Account Token are getting deprecated: https://docs.stackit.cloud/stackit/en/deprecation-plan-for-service-account-access-tokens-and-migration-guide-373293307.html.

I suggest we update the readme and favor sa key authentication per default.

How can we reproduce this?

Search

• I did search for other open and closed issues before opening this.

Code of Conduct

• I agree to follow this project's Code of Conduct

Additional context

No response

[slm0n87]

Agree, that also affects our Tutorial:
https://docs.stackit.cloud/stackit/en/how-to-use-stackit-dns-for-dns01-to-act-as-a-dns01-acme-issuer-with-cert-manager-152633984.html

[JanGrosse]

Would it be possible to provide a own private key ? Something like a seperate secret.
Because as of now, at least if I understood the code correctly, it just assumes the private key being part of the sa.json.
Or it should be documented that one has to update the sa.json manually, if the person decided to generate their own keys, to include the missing privateKey field.

[cschneemann]

Any news on this? I'm trying to use the webhook but I do not find the correct configuration to not be asked for a secret containing a token.

[PatrickKoss]

Hey,

we will update our public docs soon.
@JanGrosse All of our stackit services use the same auth mechanism so we will link the public docs to the authorization as well.
@cschneemann did you follow the Readme? There is an example to how configure the service account.

[cschneemann]

@PatrickKoss Yes, I followed the README, I was able to install the hook and everything looks good. But when I try to create an Issuer it is searching for a secret with a token inside by default? How to create this secret stackit-cert-manager-webhookis documented, but we want to use the key, maybe I missed something?
But I can wait for your docs update and test again then.

[PatrickKoss]

It is pretty hard to debug if we don´t see the exact manifests, so feel free sharing the rendered helm chart. I can imagine there is something missing regarding the secret mount and configured secret path for the service account. In the stackit-cert-manager-webhook you should see a volumenmount and envs configured like:

        env:
        - name: GROUP_NAME
          value: acme.stackit.de
        - name: STACKIT_SERVICE_ACCOUNT_KEY_PATH
          value: /var/run/secrets/stackit/sa.json
        image: ghcr.io/stackitcloud/stackit-cert-manager-webhook:v0.3.5
      volumes:
      - name: certs
        secret:
          defaultMode: 420
          secretName: stackit-cert-manager-webhook-webhook-tls
      - name: stackit-sa-authentication
        secret:
          defaultMode: 420
          secretName: stackit-sa-authentication

That might be enough. And if not you may also need to configure the secret path in the issuer/clusterissuer like:

    solvers:
    - dns01:
        webhook:
          config:
            acmeTxtRecordTTL: 600
            projectId: <project-id>
            serviceAccountKeyPath: /var/run/secrets/stackit/sa.json
          groupName: acme.stackit.de
          solverName: stackit

[cschneemann]

@PatrickKoss I messed up to enable the service account authentication

stackitSaAuthentication.enabled: true

So authentication works now, now I have other problems, that maybe another issue for that.

[ondbeh]

The README has been updated to remove information about SA Token authentification and add more details about authenticating with Service Account directly.