After testing the suggested policy both with the AWS policy simulator and by using it with cert-manager I have found that the ARN prefix in the resources included in the statement cause the provider to fail with an access denied error. This new policy is equivalent and valid according to the AWS policy simulator.
Add annotation to the ingress-shim documentation
Remove debug output.
Update documentation errors.
Implement suggestions of using edit-in-place annotation to control behaviour.
Fix reference to editInPlaceAnnotation
Remove the presence of editInPlaceAnnotation from returning true to shouldSync() and relevant test.
Update comment reference to correct annotation name.
Remove tests that relied on annotation impacting result from shouldSync()
Only edit in-place when explicitly requested to do so.
Don't return error if unable to determine Ingress class, continue without setting either ingress or ingressClass.
Update annotation to certmanager.k8s.io/acme-http01-edit-in-place in order to make use case more obvious and have consistent naming.
Update docs to reflect possible values more accurately
This change maintains backwards compatibility, but makes the `accessKeyID` and `secretAccessKeySecretRef` fields of the `route53` DNS provider optional.
If not provided, AWS credentials will be loaded from `AWS_*` environment variables or the EC2 metadata service.
This should also work for things that impersonate the EC2 metadata service, such as [kube2iam](https://github.com/jtblin/kube2iam) and [kail](https://github.com/uswitch/kiam).
Signed-off-by: Matt Moyer <moyer@heptio.com>
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Clarify ClusterIssuer resource namespace
**What this PR does / why we need it**:
Clarify ClusterIssuer resource namespace in the migrating from kube lego guide
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Document common ingressShim.extraArgs use case in chart
**What this PR does / why we need it**:
Lots of new users don't realize:
(a) They need to create a Issuer/ClusterIssuer themselves
(b) They need to tell `ingress-shim` the name via `extra-args`
This PR adds a comment to the helm chart `values.yaml` to address these issues.
(Ideally the `helm` would create an ClusterIssuer for you by default, and set these options, if you specify and email address to use with LE.)
Release note:
```release-note
NONE
```
