# How Do I configure Okteto with cert-manager and AWS Route53?

**URL:** <https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273>\
**Category:** How Do I?\
**Created:** [September 29, 2022, 6:46am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273 "2022-09-29T06:46:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pchico83](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/pchico83/32/25_2.png) [@pchico83](https://community.okteto.com/u/pchico83)\
**Post date:** [September 29, 2022, 6:46am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273/1 "2022-09-29T06:46:05Z")

</div>

How do I configure the Okteto wildcard certificate with cert-manager and Route53?

---

<div class="post-metadata">

**Author:** ![pchico83](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/pchico83/32/25_2.png) [@pchico83](https://community.okteto.com/u/pchico83)\
**Post date:** [September 29, 2022, 12:25pm UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273/2 "2022-09-29T12:25:57Z")

</div>

The recommended solution is to use [IAM Roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).

In order to do that, configure a role with the following policy permissions:

```auto
  {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "route53:GetChange",
            "Resource": "arn:aws:route53:::change/*"
        },
        {
            "Effect": "Allow",
            "Action": "route53:ChangeResourceRecordSets",
            "Resource": "arn:aws:route53:::hostedzone/*"
        }
    ]
}

```

Create an AWS IAM Role for the cert-manager service account. Replace the variables below with your own information.

```auto
eksctl create iamserviceaccount \
  --cluster $CLUSTER_NAME \
  --region $REGION \
  --name cert-manager \
  --namespace $RELEASE_NAMESPACE \
  --attach-policy-arn $POLICY_ARN \
  --role-name ${YOUR_ROLE_NAME} \
  --role-only \
  --approve

```

and add these options to your cert-manager Helm configuration file:

```auto
  extraArgs: [--issuer-ambient-credentials=true]
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: 'arn:aws:iam::<<aws-account-id>>:role/<<your-role-name>>'

```

Once your cert-manager is configured this way, create the following `Issuer` in the `okteto` namespace:

```auto
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: okteto-letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: "<<your-email>>"
    privateKeySecretRef:
      name: okteto-letsencrypt-acme
    solvers:
    - http01:
        ingress:
          serviceType: ClusterIP
          class: nginx
    - dns01:
        route53:            
          region: "<<your-cluster-region>>"

```

and the following Certificate:

```auto
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: okteto-letsencrypt
spec:
 secretName: okteto-letsencrypt
 duration: 8760h0m0s
 renewBefore: 600h0m0s # 25d
 issuerRef:
   name: okteto-letsencrypt
   kind: Issuer
 dnsNames:
   - "*.<<your-okteto-subdomain>>"

```

Now, add the following to your Okteto Helm configuration file to tell Okteto and NGINX to use your certificate:

```auto
wildcardCertificate:
  create: false
  name: okteto-letsencrypt

ingress-nginx:
  controller:
    extraArgs:
      default-ssl-certificate: $(POD_NAMESPACE)/okteto-letsencrypt

```

Finally, upgrade your Okteto installation for the new configuration to be applied.

For troubleshooting, you can check the cert manager logs, and the events associated to the resources `Challenge`, `Order` and `CertificateRequest`.

---

<div class="post-metadata">

**Author:** ![davidtacheny](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/davidtacheny/32/286_2.png) [@davidtacheny](https://community.okteto.com/u/davidtacheny)\
**Post date:** [January 22, 2023, 9:29pm UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273/3 "2023-01-22T21:29:02Z")

</div>

There is a typo in the document

```auto
  {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "route53:GetChange",
            "Resource": "arn:aws:route53:::change/*"
        },
        {
            "Effect": "Allow",
            "Action": "route53:ChangeResourceRecordSets",
            "Resource": "arn:aws:route53:::hostedzone/*"
        },
    ]
}

```

Should be:

```auto
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "route53:GetChange",
            "Resource": "arn:aws:route53:::change/*"
        },
        {
            "Effect": "Allow",
            "Action": "route53:ChangeResourceRecordSets",
            "Resource": "arn:aws:route53:::hostedzone/*"
        }
    ]
}

```

---

<div class="post-metadata">

**Author:** ![pchico83](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/pchico83/32/25_2.png) [@pchico83](https://community.okteto.com/u/pchico83)\
**Post date:** [January 24, 2023, 10:31am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273/4 "2023-01-24T10:31:22Z")

</div>

Thanks @davidtacheny , updated!

---

<div class="post-metadata">

**Author:** ![fsargent](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/fsargent/32/508_2.png) [@fsargent](https://community.okteto.com/u/fsargent)\
**Post date:** [February 8, 2024, 10:22pm UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273/5 "2024-02-08T22:22:02Z")

</div>

I’ve done this a few times and I keep struggling on the commands to do this, so here’s it for people unfamiliar with Kubernetes.

1. Make sure you’re in the right context
2. `helm install \ cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ --version v1.13.1 \ --set installCRDs=true --set "extraArgs[0]=--issuer-ambient-credentials=true" \ --set "serviceAccount.annotations.eks\.amazonaws\.com/role-arn=arn:aws:iam::XXXXXXXXX:role/eksctl-okteto-cluster-ServiceRole-XXXXXXX"`
3. `kubectl apply -f issuer.yaml -n okteto `
4. `kubectl apply -f certificate.yaml -n okteto `