CertificateRequest approved but stuck with empty status

[leotomas837]

I installed approver-policy 0.4.2 with cert-manager 1.10.0 and when issuing a certificate, it creates the CertficateRequest but then get stuck without any status (whole status section missing). I can see that it was approved by the policy in the events of the CR, but the status section is missing. Looks like approver-policy is not setting the status once approved ? Find below some details.

$> kubectl describe cr Istio-ca-lzjr8
...
Events:
  Type    Reason    Age                    From                    Message
  ----    ------    ----                   ----                    -------
  Normal  Approved  2m36s (x17 over 8m4s)  policy.cert-manager.io  Approved by CertificateRequestPolicy: "my-root"

$> kubectl get cr Istio-ca-lzjr8
NAMESPACE      NAME             APPROVED   DENIED   READY   ISSUER   REQUESTOR                                         AGE
istio-system   istio-ca-lzjr8                               root     system:serviceaccount:cert-manager:cert-manager   9m7s

Here is the content of my policy (which works fine. I can see in the events that depending on the certificate spec, the CR gets approved or not depending on wether it complies with the CertificateRequestPolicy).

apiVersion: policy.cert-manager.io/v1alpha1
kind: CertificateRequestPolicy
metadata:
  name: my-root
spec:
  allowed:
    isCA: true
    dnsNames:
      required: true
      values:
        - example.com
    subject:
      organizations:
        values:
          - cluster.local
          - cert-manager
  constraints:
    minDuration: 8760h # 1year
    maxDuration: 87600h # 10year
    privateKey:
      algorithm: RSA
      minSize: 2048
      maxSize: 2048
  selector:
    issuerRef:
      name: root
      kind: KMSIssuer
      group: cert-manager.skyscanner.net

[leotomas837]

Looks like the sa to be given the permission to approve signers for external issuer (here KMSIssuer) must be the cert-manager-approver-policy sa not the cert-manager sa. Working now, closing the issue.