Skip to content

Commit ecbb47e

Browse files
springhackspringhack
committed
using secret on acmesh
1 parent 8fe5c8e commit ecbb47e

File tree

7 files changed

+99
-40
lines changed

7 files changed

+99
-40
lines changed

‎acmesh/Dockerfile‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,14 @@
1-
FROM golang:1.16-alpine AS build_deps
1+
FROM golang:alpine AS builder
22
RUN apk add --no-cache git curl ca-certificates socat bash openssl
33
WORKDIR /workspace
4-
COPY go.mod .
5-
COPY go.sum .
6-
RUN go mod download
7-
8-
FROM build_deps AS build
94
COPY . .
5+
RUN go mod download
106
RUN CGO_ENABLED=0 go build -o webhook -ldflags '-w -extldflags "-static"' .
117
RUN curl -fsSL https://get.acme.sh | sh -s email=infinity-server@dosk.host
128

139
FROM alpine
14-
COPY --from=build /workspace/webhook /usr/local/bin/webhook
15-
COPY --from=build /root/.acme.sh /root/.acme.sh
10+
COPY --from=builder /workspace/webhook /usr/local/bin/webhook
11+
COPY --from=builder /root/.acme.sh /root/.acme.sh
1612
ADD acme_delegate /root/acme_delegate
1713
RUN apk add --no-cache ca-certificates curl socat bash openssl && chmod 755 /root/acme_delegate
1814

‎acmesh/go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ go 1.13
55
require (
66
github.com/jetstack/cert-manager v1.2.0
77
k8s.io/apiextensions-apiserver v0.19.0
8+
k8s.io/apimachinery v0.19.0
89
k8s.io/client-go v0.19.0
910
k8s.io/klog v1.0.0
1011
)

‎acmesh/main.go‎

Lines changed: 37 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,20 @@
11
package main
22

33
import (
4-
"encoding/json"
5-
"fmt"
6-
"github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util"
7-
"k8s.io/client-go/kubernetes"
84
"os"
5+
"fmt"
6+
"context"
7+
"encoding/json"
98

10-
extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
11-
"k8s.io/client-go/rest"
129
"k8s.io/klog"
10+
"k8s.io/client-go/rest"
11+
"k8s.io/client-go/kubernetes"
12+
extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
1313

14-
"github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
1514
"github.com/jetstack/cert-manager/pkg/acme/webhook/cmd"
15+
"github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util"
16+
"github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
17+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1618
)
1719

1820
const (
@@ -36,51 +38,51 @@ type customDNSProviderSolver struct {
3638
client *kubernetes.Clientset
3739
}
3840

41+
type envSecretRef struct {
42+
Name string `json:"name"`
43+
Namespace string `json:"namespace"`
44+
}
45+
3946
type customDNSProviderConfig struct {
40-
TTL *uint64 `json:"ttl"`
41-
DNSAPI string `json:"dnsapi"`
42-
Env []string `json:"env"`
47+
TTL *uint64 `json:"ttl"`
48+
DNSAPI string `json:"dnsapi"`
49+
EnvSecretRef envSecretRef `json:"env"`
4350
}
4451

52+
type envFromSecret []string
53+
4554
func (c *customDNSProviderSolver) Name() string {
4655
return "acmesh"
4756
}
4857

49-
func (c *customDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error {
58+
func (c *customDNSProviderSolver) DoDNSAPI(action string, ch *v1alpha1.ChallengeRequest) error {
5059
cfg, err := loadConfig(ch.Config)
5160
if err != nil {
5261
klog.Errorf("Failed to log config %v: %v", ch.Config, err)
5362
return err
5463
}
5564

56-
procAttr := &os.ProcAttr{
57-
Files: []*os.File{os.Stdin, os.Stdout, os.Stderr},
58-
Env: cfg.Env,
59-
}
60-
process, err := os.StartProcess(acmeDelegate, []string{
61-
acmeDelegate, cfg.DNSAPI, "add", util.UnFqdn(ch.ResolvedFQDN), ch.Key,
62-
}, procAttr)
65+
envSecret, err := c.client.CoreV1().Secrets(cfg.EnvSecretRef.Namespace).Get(context.TODO(), cfg.EnvSecretRef.Name, metav1.GetOptions{})
6366
if err != nil {
6467
return err
6568
}
6669

67-
process.Wait()
68-
return nil
69-
}
70+
envData, ok := envSecret.Data["env"]
71+
if !ok {
72+
return fmt.Errorf("no env in secret")
73+
}
7074

71-
func (c *customDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
72-
cfg, err := loadConfig(ch.Config)
73-
if err != nil {
74-
klog.Errorf("Failed to log config %v: %v", ch.Config, err)
75+
env := envFromSecret{}
76+
if err := json.Unmarshal(envData, &env); err != nil {
7577
return err
7678
}
7779

7880
procAttr := &os.ProcAttr{
7981
Files: []*os.File{os.Stdin, os.Stdout, os.Stderr},
80-
Env: cfg.Env,
82+
Env: env,
8183
}
8284
process, err := os.StartProcess(acmeDelegate, []string{
83-
acmeDelegate, cfg.DNSAPI, "rm", util.UnFqdn(ch.ResolvedFQDN), ch.Key,
85+
acmeDelegate, cfg.DNSAPI, "add", util.UnFqdn(ch.ResolvedFQDN), ch.Key,
8486
}, procAttr)
8587
if err != nil {
8688
return err
@@ -90,6 +92,14 @@ func (c *customDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
9092
return nil
9193
}
9294

95+
func (c *customDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error {
96+
return c.DoDNSAPI("add", ch)
97+
}
98+
99+
func (c *customDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
100+
return c.DoDNSAPI("rm", ch)
101+
}
102+
93103
func (c *customDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {
94104
cl, err := kubernetes.NewForConfig(kubeClientConfig)
95105
if err != nil {

‎charts/cert-manager-webhook-acmesh/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
appVersion: 1.2.0
33
description: cert-manager webhook solver for acmesh
44
name: cert-manager-webhook-acmesh
5-
version: 1.3.0
5+
version: 1.3.3
66
type: application
77
maintainers:
88
- name: springhack

‎charts/cert-manager-webhook-acmesh/templates/pki.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,10 +106,9 @@ spec:
106106
config:
107107
ttl: {{ .Values.clusterIssuer.ttl }}
108108
dnsapi: {{ required ".Values.clusterIssuer.dnsapi is required" .Values.clusterIssuer.dnsapi }}
109-
env:
110-
{{- range .Values.clusterIssuer.env}}
111-
- {{ . }}
112-
{{- end}}
109+
envSecretRef:
110+
name: {{ include "acmesh-webhook.fullname" . }}-secret
111+
namespace: {{ .Values.certManager.namespace }}
113112
{{- if .Values.clusterIssuer.selector }}
114113
selector: {{ toYaml .Values.clusterIssuer.selector | nindent 8 }}
115114
{{- end }}

‎charts/cert-manager-webhook-acmesh/templates/rbac.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,3 +127,41 @@ subjects:
127127
kind: ServiceAccount
128128
name: {{ include "acmesh-webhook.fullname" . }}
129129
namespace: {{ .Release.Namespace }}
130+
---
131+
apiVersion: rbac.authorization.k8s.io/v1
132+
kind: ClusterRole
133+
metadata:
134+
name: {{ include "acmesh-webhook.fullname" . }}:flowcontrol-solver
135+
labels:
136+
app: {{ include "acmesh-webhook.name" . }}
137+
chart: {{ include "acmesh-webhook.chart" . }}
138+
release: {{ .Release.Name }}
139+
heritage: {{ .Release.Service }}
140+
rules:
141+
- apiGroups:
142+
- "flowcontrol.apiserver.k8s.io"
143+
resources:
144+
- "prioritylevelconfigurations"
145+
- "flowschemas"
146+
verbs:
147+
- list
148+
- watch
149+
---
150+
apiVersion: rbac.authorization.k8s.io/v1
151+
kind: ClusterRoleBinding
152+
metadata:
153+
name: {{ include "acmesh-webhook.fullname" . }}:flowcontrol-solver
154+
labels:
155+
app: {{ include "acmesh-webhook.name" . }}
156+
chart: {{ include "acmesh-webhook.chart" . }}
157+
release: {{ .Release.Name }}
158+
heritage: {{ .Release.Service }}
159+
roleRef:
160+
apiGroup: rbac.authorization.k8s.io
161+
kind: ClusterRole
162+
name: {{ include "acmesh-webhook.fullname" . }}:flowcontrol-solver
163+
subjects:
164+
- apiGroup: ""
165+
kind: ServiceAccount
166+
name: {{ include "acmesh-webhook.fullname" . }}
167+
namespace: {{ .Release.Namespace }}

‎charts/cert-manager-webhook-acmesh/templates/secret.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- if .Values.clusterIssuer.enabled }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ include "acmesh-webhook.fullname" . }}-secret
6+
namespace: {{ .Values.certManager.namespace }}
7+
labels:
8+
app: {{ include "acmesh-webhook.name" . }}
9+
chart: {{ include "acmesh-webhook.chart" . }}
10+
release: {{ .Release.Name }}
11+
heritage: {{ .Release.Service }}
12+
type: Opaque
13+
data:
14+
env: {{ required ".Values.clusterIssuer.env is required" .Values.clusterIssuer.env | mustToJson | b64enc | quote }}
15+
{{- end }}

0 commit comments

Comments
 (0)