# How Do I configure Okteto with cert-manager and AWS Route53?

**URL:** <https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273>\
**Category:** How Do I?\
**Created:** [September 29, 2022, 6:46am UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273 "2022-09-29T06:46:05Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![pchico83](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/pchico83/32/25_2.png) [@pchico83](https://community.okteto.com/u/pchico83)\
**Post date:** [September 29, 2022, 12:25pm UTC](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273/2 "2022-09-29T12:25:57Z")

</div>

The recommended solution is to use [IAM Roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).

In order to do that, configure a role with the following policy permissions:

```auto
  {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "route53:GetChange",
            "Resource": "arn:aws:route53:::change/*"
        },
        {
            "Effect": "Allow",
            "Action": "route53:ChangeResourceRecordSets",
            "Resource": "arn:aws:route53:::hostedzone/*"
        }
    ]
}

```

Create an AWS IAM Role for the cert-manager service account. Replace the variables below with your own information.

```auto
eksctl create iamserviceaccount \
  --cluster $CLUSTER_NAME \
  --region $REGION \
  --name cert-manager \
  --namespace $RELEASE_NAMESPACE \
  --attach-policy-arn $POLICY_ARN \
  --role-name ${YOUR_ROLE_NAME} \
  --role-only \
  --approve

```

and add these options to your cert-manager Helm configuration file:

```auto
  extraArgs: [--issuer-ambient-credentials=true]
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: 'arn:aws:iam::<<aws-account-id>>:role/<<your-role-name>>'

```

Once your cert-manager is configured this way, create the following `Issuer` in the `okteto` namespace:

```auto
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: okteto-letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: "<<your-email>>"
    privateKeySecretRef:
      name: okteto-letsencrypt-acme
    solvers:
    - http01:
        ingress:
          serviceType: ClusterIP
          class: nginx
    - dns01:
        route53:            
          region: "<<your-cluster-region>>"

```

and the following Certificate:

```auto
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: okteto-letsencrypt
spec:
 secretName: okteto-letsencrypt
 duration: 8760h0m0s
 renewBefore: 600h0m0s # 25d
 issuerRef:
   name: okteto-letsencrypt
   kind: Issuer
 dnsNames:
   - "*.<<your-okteto-subdomain>>"

```

Now, add the following to your Okteto Helm configuration file to tell Okteto and NGINX to use your certificate:

```auto
wildcardCertificate:
  create: false
  name: okteto-letsencrypt

ingress-nginx:
  controller:
    extraArgs:
      default-ssl-certificate: $(POD_NAMESPACE)/okteto-letsencrypt

```

Finally, upgrade your Okteto installation for the new configuration to be applied.

For troubleshooting, you can check the cert manager logs, and the events associated to the resources `Challenge`, `Order` and `CertificateRequest`.

---

_[View the full topic](https://community.okteto.com/t/how-do-i-configure-okteto-with-cert-manager-and-aws-route53/273)._