Procedure
To access the service account, cert-manager uses a key stored in a Kubernetes Secret.
-
Create a key for the service account and download it as a JSON file:
$ gcloud iam service-accounts keys create key.json \ --iam-account mailto:dns01-solver@eclipse-che-1.iam.gserviceaccount.com[_dns01-solver@eclipse-che-1.iam.gserviceaccount.com_]
The following is the output of the preceding command:
created key [05e94ca2e7754b94a63049605ee8d2813d16ff37] of type [json] as [key.json] for [dns01-solver@eclipse-che-1.iam.gserviceaccount.com]
The key file is generated:
$ ls -la key.json -rw------- 1 joe staff 2318 Jul 29 12:13 key.json
Keep the key file safe, and do not share it with anyone because it can be used to gain access to your cloud resources. The key file can be deleted after it has been used to generate the Secret. -
Create a Secret from this file.
$ kubectl create secret generic clouddns-dns01-solver-svc-acct --from-file=key.json --namespace=cert-manager