Route53 configuration for K8S cluster issuers

route53-cluster-issuers.yaml

---
apiVersion: v1
kind: Secret
metadata:
  name: cluster-issuer-secret
  namespace: kube-system
data:
  secret-access-key: <AWS_ACCESS_KEY>
type: Opaque
---
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: lets-encrypt-issuer-dev
spec:
  acme:
    dns01:
      providers:
      - name: route53
        route53:
          accessKeyID: <AWS_ACCESS_ID>
          hostedZoneID: <AWS_HOSTED_ZONE_ID>
          region: <AWS_REGION_K8S_IS_RUNNING_IN>
          secretAccessKeySecretRef:
            name: cluster-issuer-secret
            key: secret-access-key
    email: <DEVOPS_ALIAS_EMAIL>
    privateKeySecretRef:
      name: lets-encrypt-issuer-dev
    server: https://acme-staging-v02.api.letsencrypt.org/directory
---
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: lets-encrypt-issuer-prod
spec:
  acme:
    dns01:
      providers:
      - name: route53
        route53:
          accessKeyID: <AWS_ACCESS_ID>
          hostedZoneID: <AWS_HOSTED_ZONE_ID>
          region: <AWS_REGION_K8S_IS_RUNNING_IN>
          secretAccessKeySecretRef:
            name: cluster-issuer-secret
            key: secret-access-key
    email: <DEVOPS_ALIAS_EMAIL>
    privateKeySecretRef:
      name: lets-encrypt-issuer-prod
    server: https://acme-v02.api.letsencrypt.org/directory