-
Notifications
You must be signed in to change notification settings - Fork 24
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Initial commit for use with Linode API
- Loading branch information
Showing
28 changed files
with
1,103 additions
and
314 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,20 +1,27 @@ | ||
| IMAGE_NAME := "webhook" | ||
| IMAGE_TAG := "latest" | ||
| IMAGE_NAME := "slicen/cert-manager-webhook-linode" | ||
| IMAGE_TAG := "v0.1.0" | ||
|
|
||
| OUT := $(shell pwd)/_out | ||
|
|
||
| $(shell mkdir -p "$(OUT)") | ||
|
|
||
| .DEFAULT_GOAL := build | ||
|
|
||
| .PHONY: verify test build clean rendered-manifest.yaml | ||
|
|
||
| verify: | ||
| go test -v . | ||
|
|
||
| test: verify | ||
|
|
||
| build: | ||
| docker build -t "$(IMAGE_NAME):$(IMAGE_TAG)" . | ||
| docker build --rm -t "$(IMAGE_NAME):$(IMAGE_TAG)" -t "$(IMAGE_NAME):latest" . | ||
|
|
||
| clean: | ||
| rm -r "$(OUT)" | ||
|
|
||
| .PHONY: rendered-manifest.yaml | ||
| rendered-manifest.yaml: | ||
| helm template \ | ||
| --name example-webhook \ | ||
| --set image.repository=$(IMAGE_NAME) \ | ||
| --set image.tag=$(IMAGE_TAG) \ | ||
| deploy/example-webhook > "$(OUT)/rendered-manifest.yaml" | ||
| deploy/cert-manager-webhook-linode > "$(OUT)/rendered-manifest.yaml" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,54 +1,102 @@ | ||
| # ACME webhook example | ||
| # Cert-Manager ACME DNS01 Webhook Solver for Linode DNS Manager | ||
|
|
||
| The ACME issuer type supports an optional 'webhook' solver, which can be used | ||
| to implement custom DNS01 challenge solving logic. | ||
| [](https://goreportcard.com/report/github.com/slicen/cert-manager-webhook-linode) | ||
| [](https://github.com/slicen/cert-manager-webhook-linode/releases) | ||
| [](https://github.com/slicen/cert-manager-webhook-linode/blob/master/LICENSE) | ||
|
|
||
| This is useful if you need to use cert-manager with a DNS provider that is not | ||
| officially supported in cert-manager core. | ||
| A webhook to use [Linode DNS | ||
| Manager](https://www.linode.com/docs/platform/manager/dns-manager) as a DNS01 | ||
| ACME Issuer for [cert-manager](https://github.com/jetstack/cert-manager). | ||
|
|
||
| ## Why not in core? | ||
| ## Installation | ||
|
|
||
| As the project & adoption has grown, there has been an influx of DNS provider | ||
| pull requests to our core codebase. As this number has grown, the test matrix | ||
| has become un-maintainable and so, it's not possible for us to certify that | ||
| providers work to a sufficient level. | ||
|
|
||
| By creating this 'interface' between cert-manager and DNS providers, we allow | ||
| users to quickly iterate and test out new integrations, and then packaging | ||
| those up themselves as 'extensions' to cert-manager. | ||
| ```bash | ||
| helm install cert-manager-webhook-linode \ | ||
| --namespace cert-manager \ | ||
| https://github.com/slicen/cert-manager-webhook-linode/releases/download/v0.1.0/cert-manager-webhook-linode-v0.1.0.tgz | ||
| ``` | ||
|
|
||
| We can also then provide a standardised 'testing framework', or set of | ||
| conformance tests, which allow us to validate the a DNS provider works as | ||
| expected. | ||
| ## Usage | ||
|
|
||
| ## Creating your own webhook | ||
| ### Create Linode API Token Secret | ||
|
|
||
| Webhook's themselves are deployed as Kubernetes API services, in order to allow | ||
| administrators to restrict access to webhooks with Kubernetes RBAC. | ||
| ```bash | ||
| kubectl create secret generic linode-credentials \ | ||
| --namespace=cert-manager \ | ||
| --from-literal=token=<LINODE TOKEN> | ||
| ``` | ||
|
|
||
| This is important, as otherwise it'd be possible for anyone with access to your | ||
| webhook to complete ACME challenge validations and obtain certificates. | ||
| ### Create Issuer | ||
|
|
||
| #### Cluster-wide Linode API Token | ||
|
|
||
| ```yaml | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| kind: ClusterIssuer | ||
| metadata: | ||
| name: letsencrypt-staging | ||
| spec: | ||
| acme: | ||
| server: https://acme-staging-v02.api.letsencrypt.org/directory | ||
| email: [email protected] | ||
| privateKeySecretRef: | ||
| name: letsencrypt-staging | ||
| solvers: | ||
| - dns01: | ||
| webhook: | ||
| solverName: linode | ||
| groupName: acme.slicen.me | ||
| ``` | ||
| To make the set up of these webhook's easier, we provide a template repository | ||
| that can be used to get started quickly. | ||
| By default, the Linode API token used will be obtained from the | ||
| linode-credentials Secret in the same namespace as the webhook. | ||
| #### Per Namespace Linode API Tokens | ||
| If you would prefer to use separate Linode API tokens for each namespace (e.g. | ||
| in a multi-tenant environment): | ||
| ```yaml | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| kind: Issuer | ||
| metadata: | ||
| name: letsencrypt-staging | ||
| namespace: default | ||
| spec: | ||
| acme: | ||
| server: https://acme-staging-v02.api.letsencrypt.org/directory | ||
| email: [email protected] | ||
| privateKeySecretRef: | ||
| name: letsencrypt-staging | ||
| solvers: | ||
| - dns01: | ||
| webhook: | ||
| solverName: linode | ||
| groupName: acme.slicen.me | ||
| config: | ||
| apiKeySecretRef: | ||
| name: linode-credentials | ||
| key: token | ||
| ``` | ||
| ### Creating your own repository | ||
| ## Development | ||
| ### Running the test suite | ||
| All DNS providers **must** run the DNS01 provider conformance testing suite, | ||
| else they will have undetermined behaviour when used with cert-manager. | ||
| Conformance testing is achieved through Kubernetes emulation via the | ||
| kubebuilder-tools suite, in conjunction with real calls to the Linode API on an | ||
| test domain, using a valid API token. | ||
| **It is essential that you configure and run the test suite when creating a | ||
| DNS01 webhook.** | ||
| The test configures a cert-manager-dns01-tests TXT entry, attempts to verify its | ||
| presence, and removes the entry, thereby verifying the Prepare and CleanUp | ||
| functions. | ||
| An example Go test file has been provided in [main_test.go](). | ||
|
|
||
| You can run the test suite with: | ||
| Run the test suite with: | ||
| ```bash | ||
| $ TEST_ZONE_NAME=example.com go test . | ||
| ./scripts/fetch-test-binaries.sh | ||
| export LINODE_TOKEN=$(echo -n "<your API token>" | base64 -w 0) | ||
| envsubst < testdata/linode/secret.yaml.example > testdata/linode/secret.yaml | ||
| TEST_ZONE_NAME=yourdomain.com. make verify | ||
| ``` | ||
|
|
||
| The example file has a number of areas you must fill in and replace with your | ||
| own options in order for tests to pass. |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| apiVersion: v2 | ||
| appVersion: "v0.1.0" | ||
| description: A Helm chart for cert-manager-webhook-linode | ||
| name: cert-manager-webhook-linode | ||
| version: v0.1.0 |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
19 changes: 19 additions & 0 deletions
19
deploy/cert-manager-webhook-linode/templates/apiservice.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| apiVersion: apiregistration.k8s.io/v1beta1 | ||
| kind: APIService | ||
| metadata: | ||
| name: v1alpha1.{{ .Values.api.groupName }} | ||
| labels: | ||
| app: {{ include "cert-manager-webhook-linode.name" . }} | ||
| chart: {{ include "cert-manager-webhook-linode.chart" . }} | ||
| release: {{ .Release.Name }} | ||
| heritage: {{ .Release.Service }} | ||
| annotations: | ||
| cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "cert-manager-webhook-linode.servingCertificate" . }}" | ||
| spec: | ||
| group: {{ .Values.api.groupName }} | ||
| groupPriorityMinimum: 1000 | ||
| versionPriority: 15 | ||
| service: | ||
| name: {{ include "cert-manager-webhook-linode.fullname" . }} | ||
| namespace: {{ .Release.Namespace | quote }} | ||
| version: v1alpha1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.