Can't get this to work with cert-manager

[barbirict]

Hi all,
I followed the guide here. The problem is I can't issue certificates because I get these cert-manager serviceaccount permission errors. I've tried modifying them with zero success. It's not mentioned in the guide either. Any help would be greatley appriciated!

 E1101 17:45:45.699949       1 controller.go:157] "re-queuing item due to error processing" err="admission webhook \"webhook.cert-manager.io\" denied the reques │
│ t: status.conditions: Forbidden: user \"system:serviceaccount:cert-manager:cert-manager\" does not have permissions to set approved/denied conditions for issue │
│ r {issuer-infisical ClusterIssuer infisical-issuer.infisical.com}" logger="cert-manager.controller"                                                             │
│ I1101 17:46:05.700170       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "test-cert-1" condition "Approved" to 2024-11-01 17:46:05.70 │
│ 0160344 +0000 UTC m=+136.972497873                                                                                                                              │
│ E1101 17:46:05.711468       1 controller.go:157] "re-queuing item due to error processing" err="admission webhook \"webhook.cert-manager.io\" denied the reques │
│ t: status.conditions: Forbidden: user \"system:serviceaccount:cert-manager:cert-manager\" does not have permissions to set approved/denied conditions for issue │
│ r {issuer-infisical ClusterIssuer infisical-issuer.infisical.com}" logger="cert-manager.controller"                                                             │                                                                                

[paulwilljones]

You can edit the ClusterRole cert-manager-controller-approve:cert-manager-io to add the permissions for the infisical-issuer.

$ kubectl get clusterrole cert-manager-controller-approve:cert-manager-io -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    meta.helm.sh/release-name: cert-manager
    meta.helm.sh/release-namespace: cert-manager
  creationTimestamp: "2025-02-24T11:06:46Z"
  labels:
    app: cert-manager
    app.kubernetes.io/component: cert-manager
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.17.1
    helm.sh/chart: cert-manager-v1.17.1
  name: cert-manager-controller-approve:cert-manager-io
  resourceVersion: "23220"
  uid: 83a744f8-e6ee-4701-a310-290e01ab196e
rules:
- apiGroups:
  - cert-manager.io
  resourceNames:
  - issuers.infisical-issuer.infisical.com/*
  - issuers.cert-manager.io/*
  - clusterissuers.cert-manager.io/*
  resources:
  - signers
  verbs:
  - approve