Update AWS SDK for Go to 1.48.7

[JoeNorth]

Pull Request Motivation

Updates the AWS SDK for Go to 1.48.7 to support Amazon EKS Pod Identity

Kind

Release Note

Updates the AWS SDK for Go to 1.48.7 to support Amazon EKS Pod Identity

[jetstack-bot]

Hi @JoeNorth. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[inteon]

/approve

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[inteon]

/ok-to-test

[inteon]

/lgtm

[inteon]

Thanks @JoeNorth !

[Prashy27]

Is there a container image for this PR that I can use ?

[inteon]

Not yet, this will be part of the 1.14 release. You can build the images locally https://cert-manager.io/docs/contributing/building/#building

[Prashy27]

Not yet, this will be part of the 1.14 release. You can build the images locally https://cert-manager.io/docs/contributing/building/#building

thanks @inteon, already in progress of that. Was curious to know if its available already

[wallrj]

/kind feature

[truongnht]

@JoeNorth < I see this PR has been merged, however pod identity is not working yet in my case and I am not sure what I did wrong. Have you successfully setup Pod Identity with Cert manager?

[JoeNorth]

@truongnht I haven’t tested in my dev cluster with the official 1.14 release however I can see that this PR is included starting at that point. Will test it today and get back to you.

[truongnht]

please let me know, thanks. To me I keep having issue with

Failed to change Route 53 record set: NoCredentialProviders: no valid providers in chain. Deprecated.
		For verbose messaging see aws.Config.CredentialsChainVerboseErrors

even though the creds should have been with the pod already

[JoeNorth]

When you run kubectl describe on the cert-manager pod are you seeing the expected environment variables like AWS_CONTAINER_CREDENTIALS_FULL_URI?

Keep in mind that Pod Identity is only supported for pods running on Linux EC2 instances and is not supported on Fargate. You’ll also want to make sure you have the Pod Identity Agent addon installed in the cluster.

[truongnht]

I know this Fargate limitation, our nodes run Bottlerocket

[truongnht]

kubectl describe gives

k describe -n cert-manager pod cert-manager-85cc7864c8-fknsb
Name:             cert-manager-85cc7864c8-fknsb
Namespace:        cert-manager
Priority:         0
Service Account:  cert-manager
Node:             ip-10-20-15-221.eu-west-1.compute.internal/10.20.15.221
Start Time:       Tue, 27 Feb 2024 15:48:56 +0100
Labels:           app=cert-manager
                  app.kubernetes.io/component=controller
                  app.kubernetes.io/instance=cert-manager
                  app.kubernetes.io/managed-by=Helm
                  app.kubernetes.io/name=cert-manager
                  app.kubernetes.io/version=v1.14.0
                  helm.sh/chart=cert-manager-v1.14.0
                  pod-template-hash=85cc7864c8
Annotations:      kubectl.kubernetes.io/restartedAt: 2024-02-27T14:19:01Z
                  prometheus.io/path: /metrics
                  prometheus.io/port: 9402
                  prometheus.io/scrape: true
Status:           Running
SeccompProfile:   RuntimeDefault
IP:               10.20.14.149
IPs:
  IP:           10.20.14.149
Controlled By:  ReplicaSet/cert-manager-85cc7864c8
Containers:
  cert-manager-controller:
    Container ID:  containerd://48d1d04fcc03e37420965a57551ec5773d95a19b69b0ead2e6ac238d67f027ea
    Image:         quay.io/jetstack/cert-manager-controller:v1.14.0
    Image ID:      quay.io/jetstack/cert-manager-controller@sha256:341c15d96d08a6a5bcaeb035b5054c34c00c7ad38eda5c235594d11dc7767b10
    Ports:         9402/TCP, 9403/TCP
    Host Ports:    0/TCP, 0/TCP
    Args:
      --v=6
      --cluster-resource-namespace=$(POD_NAMESPACE)
      --leader-election-namespace=kube-system
      --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.14.0
      --max-concurrent-challenges=60
    State:          Running
      Started:      Tue, 27 Feb 2024 15:48:58 +0100
    Ready:          True
    Restart Count:  0
    Limits:
      memory:  64Mi
    Requests:
      cpu:     10m
      memory:  32Mi
    Liveness:  http-get http://:http-healthz/livez delay=10s timeout=15s period=10s #success=1 #failure=8
    Environment:
      POD_NAMESPACE:                           cert-manager (v1:metadata.namespace)
      AWS_STS_REGIONAL_ENDPOINTS:              regional
      AWS_DEFAULT_REGION:                      eu-west-1
      AWS_REGION:                              eu-west-1
      AWS_CONTAINER_CREDENTIALS_FULL_URI:      http://169.254.170.23/v1/credentials
      AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE:  /var/run/secrets/pods.eks.amazonaws.com/serviceaccount/eks-pod-identity-token
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-cvdz9 (ro)
      /var/run/secrets/pods.eks.amazonaws.com/serviceaccount from eks-pod-identity-token (ro)
Conditions:
  Type                        Status
  PodReadyToStartContainers   True 
  Initialized                 True 
  Ready                       True 
  ContainersReady             True 
  PodScheduled                True 
Volumes:
  eks-pod-identity-token:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  86400
  kube-api-access-cvdz9:
    Type:                     Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:   3607
    ConfigMapName:            kube-root-ca.crt
    ConfigMapOptional:        <nil>
    DownwardAPI:              true
QoS Class:                    Burstable
Node-Selectors:               kubernetes.io/os=linux
Tolerations:                  node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                              node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Topology Spread Constraints:  topology.kubernetes.io/zone:DoNotSchedule when max skew 1 is exceeded for selector app=cert-manager
Events:
  Type     Reason           Age   From               Message
  ----     ------           ----  ----               -------
  Warning  PolicyViolation  33m   kyverno-admission  policy require-unique-uid-per-workload/require-unique-uid fail: Only cluster-unique UIDs are allowed
  Normal   Scheduled        33m   default-scheduler  Successfully assigned cert-manager/cert-manager-85cc7864c8-fknsb to ip-10-20-15-221.eu-west-1.compute.internal
  Normal   Pulling          33m   kubelet            Pulling image "quay.io/jetstack/cert-manager-controller:v1.14.0"
  Normal   Pulled           33m   kubelet            Successfully pulled image "quay.io/jetstack/cert-manager-controller:v1.14.0" in 1.951s (1.951s including waiting)
  Normal   Created          33m   kubelet            Created container cert-manager-controller
  Normal   Started          33m   kubelet            Started container cert-manager-controller

[wallrj]

@truongnht and @JoeNorth Thanks for testing this. Please update https://cert-manager.io/docs/configuration/acme/dns01/route53/ (via PRs in https://github.com/cert-manager/website) if you think we can improve the documentation. Perhaps something needs to be written about EKS Pod Identity and that it only works on Linux EC2 instances, not Fargate.

[truongnht]

@JoeNorth if you haven't tested you dont need to. I confirm cert-manager, with both 1.14.0 and 1.14.3, works with pod identity. Issue is due to our SCP denyingAssumeRoleForPodIdentity
@wallrj fyi