route53.role can be omitted when using IRSA

[mamachanko]

It's the documentation cert-manager/cert-manager#4053 comment section is asking for.

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joshvanl for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for cert-manager-website ready!

Name	Link
🔨 Latest commit	c6e1c24
🔍 Latest deploy log	https://app.netlify.com/sites/cert-manager-website/deploys/6657128f56751d000842a91d
😎 Deploy Preview	https://deploy-preview-1487--cert-manager-website.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[wallrj]

Thanks. I have some suggestions and questions.

[wallrj]

Move this note to the EKS IAM Role for Service Accounts (IRSA) (below).

• https://cert-manager.io/docs/configuration/acme/dns01/route53/#eks-iam-role-for-service-accounts-irsa

And update the example ClusterIssuer config in that IRSA section:

• https://cert-manager.io/docs/configuration/acme/dns01/route53/#issuerclusterissuer-config

I don't know much about AWS and IRSA....can you explain (in the documentation note) why the role does not need to be supplied in this case.

The documentation for the Go Web SDK suggests that RoleARN is required

• https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials/stscreds#AssumeRoleOptions
• https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials/stscreds#WebIdentityRoleOptions

I'm interested to understand this because I'm currently working on the following update to the Route53 solver code in cert-manager:

• Route53: Allow STS token to be refreshed by the AWS client if necessary cert-manager#7236

[mamachanko]

@wallrj thank you for reviewing this! I must admit that - just like you - I don't know much about AWS and IRSA. The reason I opened this PR was the positive feedback on the comment demonstrating "the solution".

For now I reckon the best course of action is to close this PR, because I am afraid I am unable to back it up beyond said comment.

[wallrj]

Supplanted by #1555

• Update AWS Route53 documentation to better explain the authentication options #1555