Added icon.png

.gitignore

@@ -6,3 +6,4 @@
 apiserver.local.config
 charts
 _test
+icon

README.md

@@ -1,3 +1,4 @@
+#  == Development in progess ==
 # cert-manager Webhook for sthome private DNS
 cert-manager Webhook for sthome private DNS is a ACME [webhook](https://cert-manager.io/docs/configuration/acme/dns01/webhook/) for [cert-manager](https://cert-manager.io/) allowing sthome users to use local DNS for DNS01 challenge.
 

go.mod

@@ -5,9 +5,12 @@ go 1.21
 toolchain go1.22.1
 
 require (
+	/// uncomment and fix tag when github repo is made public
+	//github.com/stuurmcp/cert-manager-webhook-sthome v0.0.1-alpha
 	github.com/cert-manager/cert-manager v1.14.4
 	github.com/miekg/dns v1.1.58
 	github.com/stretchr/testify v1.8.4
+	k8s.io/api v0.29.0
 	k8s.io/apiextensions-apiserver v0.29.0
 	k8s.io/client-go v0.29.0
 )
@@ -97,7 +100,6 @@ require (
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.29.0 // indirect
 	k8s.io/apimachinery v0.29.0 // indirect
 	k8s.io/apiserver v0.29.0 // indirect
 	k8s.io/component-base v0.29.0 // indirect

main.go

@@ -1,22 +1,11 @@
 package main
 
 import (
-	"encoding/json"
-	"fmt"
 	"os"
 
-	extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/rest"
-
-	cmmetav1 "github.com/cert-manager/cert-manager/pkg/apis/meta/v1"
-	"github.com/cert-manager/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
 	"github.com/cert-manager/cert-manager/pkg/acme/webhook/cmd"
-	"github.com/cert-manager/cert-manager/pkg/issuer/acme/dns/util"
-)
 
-const (
-	providerName = "sthome"
+	"github.com/stuurmcp/cert-manager-webhook-sthome/sthome"
 )
 
 var GroupName = os.Getenv("GROUP_NAME")
@@ -26,132 +15,6 @@ func main() {
 		panic("GROUP_NAME must be specified")
 	}
 	cmd.RunWebhookServer(GroupName,
-		&sthomeDNSProviderSolver{},
+		&sthome.LocalDNSProviderSolver{},
 	)
 }
-
-// sthomeDNSProviderSolver implements the provider-specific logic needed to
-// 'present' an ACME challenge TXT record for your own DNS provider.
-// To do so, it must implement the `github.com/cert-manager/cert-manager/pkg/acme/webhook.Solver`
-// interface.
-type sthomeDNSProviderSolver struct {
-	// If a Kubernetes 'clientset' is needed, you must:
-	// 1. uncomment the additional `client` field in this structure below
-	// 2. uncomment the "k8s.io/client-go/kubernetes" import at the top of the file
-	// 3. uncomment the relevant code in the Initialize method below
-	// 4. ensure your webhook's service account has the required RBAC role
-	//    assigned to it for interacting with the Kubernetes APIs you need.
-	client kubernetes.Clientset
-}
-
-// sthomeDNSProviderConfig is a structure that is used to decode into when
-// solving a DNS01 challenge.
-// This information is provided by cert-manager, and may be a reference to
-// additional configuration that's needed to solve the challenge for this
-// particular certificate or issuer.
-// This typically includes references to Secret resources containing DNS
-// provider credentials, in cases where a 'multi-tenant' DNS solver is being
-// created.
-// If you do *not* require per-issuer or per-certificate configuration to be
-// provided to your webhook, you can skip decoding altogether in favour of
-// using CLI flags or similar to provide configuration.
-// You should not include sensitive information here. If credentials need to
-// be used by your provider here, you should reference a Kubernetes Secret
-// resource and fetch these credentials using a Kubernetes clientset.
-type sthomeDNSProviderConfig struct {
-	// Change the two fields below according to the format of the configuration
-	// to be decoded.
-	// These fields will be set by users in the
-	// `issuer.spec.acme.dns01.providers.webhook.config` field.
-
-	Email string `json:"email"`
-	APIKeySecretRef cmmetav1.SecretKeySelector `json:"apiKeySecretRef"`
-}
-
-// Name is used as the name for this DNS solver when referencing it on the ACME
-// Issuer resource.
-// This should be unique **within the group name**, i.e. you can have two
-// solvers configured with the same Name() **so long as they do not co-exist
-// within a single webhook deployment**.
-// For example, `cloudflare` may be used as the name of a solver.
-func (c *sthomeDNSProviderSolver) Name() string {
-	return providerName
-}
-
-// Present is responsible for actually presenting the DNS record with the
-// DNS provider.
-// This method should tolerate being called multiple times with the same value.
-// cert-manager itself will later perform a self check to ensure that the
-// solver has correctly configured the DNS provider.
-func (c *sthomeDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error {
-	domainName := extractDomainName(ch.ResolvedZone)
-	cfg, err := loadConfig(ch.Config)
-	if err != nil {
-		return err
-	}
-
-	// TODO: do something more useful with the decoded configuration
-	fmt.Printf("Decoded configuration %v", cfg)
-	fmt.Printf("presenting record for %s (%s)\n", ch.ResolvedFQDN, domainName)
-	// TODO: add code that sets a record in the DNS provider's console
-	return nil
-}
-
-// CleanUp should delete the relevant TXT record from the DNS provider console.
-// If multiple TXT records exist with the same record name (e.g.
-// _acme-challenge.example.com) then **only** the record with the same `key`
-// value provided on the ChallengeRequest should be cleaned up.
-// This is in order to facilitate multiple DNS validations for the same domain
-// concurrently.
-func (c *sthomeDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
-	// TODO: add code that deletes a record from the DNS provider's console
-	return nil
-}
-
-// Initialize will be called when the webhook first starts.
-// This method can be used to instantiate the webhook, i.e. initialising
-// connections or warming up caches.
-// Typically, the kubeClientConfig parameter is used to build a Kubernetes
-// client that can be used to fetch resources from the Kubernetes API, e.g.
-// Secret resources containing credentials used to authenticate with DNS
-// provider accounts.
-// The stopCh can be used to handle early termination of the webhook, in cases
-// where a SIGTERM or similar signal is sent to the webhook process.
-func (c *sthomeDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {
-	///// UNCOMMENT THE BELOW CODE TO MAKE A KUBERNETES CLIENTSET AVAILABLE TO
-	///// YOUR sthome DNS PROVIDER
-
-	cl, err := kubernetes.NewForConfig(kubeClientConfig)
-	if err != nil {
-		return err
-	}
-
-	c.client = *cl
-
-	///// END OF CODE TO MAKE KUBERNETES CLIENTSET AVAILABLE
-	return nil
-}
-
-// loadConfig is a small helper function that decodes JSON configuration into
-// the typed config struct.
-func loadConfig(cfgJSON *extapi.JSON) (sthomeDNSProviderConfig, error) {
-	cfg := sthomeDNSProviderConfig{}
-	// handle the 'base case' where no configuration has been provided
-	if cfgJSON == nil {
-		return cfg, nil
-	}
-	if err := json.Unmarshal(cfgJSON.Raw, &cfg); err != nil {
-		return cfg, fmt.Errorf("error decoding solver config: %v", err)
-	}
-
-	return cfg, nil
-}
-
-func extractDomainName(zone string) string {
-	authZone, err := util.FindZoneByFqdn(zone, util.RecursiveNameservers)
-	if err != nil {
-		fmt.Printf("could not get zone by fqdn %v", err)
-		return zone
-	}
-	return util.UnFqdn(authZone)
-}

sthome/config.go

@@ -0,0 +1,29 @@
+package sthome
+
+import (
+	v1 "k8s.io/api/core/v1"
+)
+
+// localDNSProviderConfig is a structure that is used to decode into when
+// solving a DNS01 challenge.
+// This information is provided by cert-manager, and may be a reference to
+// additional configuration that's needed to solve the challenge for this
+// particular certificate or issuer.
+// This typically includes references to Secret resources containing DNS
+// provider credentials, in cases where a 'multi-tenant' DNS solver is being
+// created.
+// If you do *not* require per-issuer or per-certificate configuration to be
+// provided to your webhook, you can skip decoding altogether in favour of
+// using CLI flags or similar to provide configuration.
+// You should not include sensitive information here. If credentials need to
+// be used by your provider here, you should reference a Kubernetes Secret
+// resource and fetch these credentials using a Kubernetes clientset.
+type localDNSProviderConfig struct {
+	// Change the two fields below according to the format of the configuration
+	// to be decoded.
+	// These fields will be set by users in the
+	// `issuer.spec.acme.dns01.providers.webhook.config` field.
+
+	Email           string               `json:"email"`
+	APIKeySecretRef v1.SecretKeySelector `json:"apiKeySecretRef"`
+}

sthome/dns.go

@@ -1,3 +1,4 @@
+// not implemented
 package sthome
 
 import (
@@ -6,7 +7,7 @@ import (
 	"github.com/miekg/dns"
 )
 
-func (e *sthomeSolver) handleDNSRequest(w dns.ResponseWriter, req *dns.Msg) {
+func (e *SthomeSolver) handleDNSRequest(w dns.ResponseWriter, req *dns.Msg) {
 	msg := new(dns.Msg)
 	msg.SetReply(req)
 	switch req.Opcode {
@@ -21,7 +22,7 @@ func (e *sthomeSolver) handleDNSRequest(w dns.ResponseWriter, req *dns.Msg) {
 	w.WriteMsg(msg)
 }
 
-func (e *sthomeSolver) addDNSAnswer(q dns.Question, msg *dns.Msg, req *dns.Msg) error {
+func (e *SthomeSolver) addDNSAnswer(q dns.Question, msg *dns.Msg, req *dns.Msg) error {
 	switch q.Qtype {
 	// Always return loopback for any A query
 	case dns.TypeA:

sthome/shell.go

@@ -0,0 +1,28 @@
+package sthome
+
+import (
+	"os"
+	"os/exec"
+)
+
+func Execute(script string, command []string) (bool, error) {
+
+	cmd := &exec.Cmd{
+		Path:   script,
+		Args:   command,
+		Stdout: os.Stdout,
+		Stderr: os.Stderr,
+	}
+
+	err := cmd.Start()
+	if err != nil {
+		return false, err
+	}
+
+	err = cmd.Wait()
+	if err != nil {
+		return false, err
+	}
+
+	return true, nil
+}

sthome/solver_local.go

@@ -0,0 +1,115 @@
+package sthome
+
+import (
+	"fmt"
+
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+
+	"github.com/cert-manager/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
+	"github.com/cert-manager/cert-manager/pkg/issuer/acme/dns/util"
+)
+
+const (
+	providerName     = "sthome"
+	dnsUpdaterScript = "/mnt/stpool1/scripts/acme/updatedns.sh"
+)
+
+// LocalDNSProviderSolver implements the provider-specific logic needed to
+// 'present' an ACME challenge TXT record for your own DNS provider.
+// To do so, it must implement the `github.com/cert-manager/cert-manager/pkg/acme/webhook.Solver`
+// interface.
+type LocalDNSProviderSolver struct {
+	client kubernetes.Clientset
+	//client kubernetes.Interface
+}
+
+// Name is used as the name for this DNS solver when referencing it on the ACME
+// Issuer resource.
+// This should be unique **within the group name**, i.e. you can have two
+// solvers configured with the same Name() **so long as they do not co-exist
+// within a single webhook deployment**.
+// For example, `cloudflare` may be used as the name of a solver.
+func (p *LocalDNSProviderSolver) Name() string {
+	return providerName
+}
+
+// Present is responsible for actually presenting the DNS record with the
+// DNS provider.
+// This method should tolerate being called multiple times with the same value.
+// cert-manager itself will later perform a self check to ensure that the
+// solver has correctly configured the DNS provider.
+func (loc *LocalDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error {
+	domainName := extractDomainName(ch.ResolvedZone)
+	cfg, err := loadConfig(ch.Config)
+	if err != nil {
+		return err
+	}
+
+	// TODO: do something more useful with the decoded configuration
+	fmt.Printf("Decoded configuration %v", cfg)
+	fmt.Printf("presenting record for %s (%s)\n", ch.ResolvedFQDN, domainName)
+	// TODO: add code that sets a record in the DNS provider's console
+
+	// shell command
+	command := []string{
+		dnsUpdaterScript,
+		"arg1=-set",
+		"arg2=.net",
+		fmt.Sprintf("arg3=%s", ch.DNSName),
+		"arg4=TXT",
+		fmt.Sprintf("arg5=%s", ch.Key),
+	}
+	Execute(dnsUpdaterScript, command)
+
+	return nil
+}
+
+// CleanUp should delete the relevant TXT record from the DNS provider console.
+// If multiple TXT records exist with the same record name (e.g.
+// _acme-challenge.example.com) then **only** the record with the same `key`
+// value provided on the ChallengeRequest should be cleaned up.
+// This is in order to facilitate multiple DNS validations for the same domain
+// concurrently.
+func (s *LocalDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
+	// TODO: add code that deletes a record from the DNS provider's console
+
+	// shell command
+	command := []string{
+		dnsUpdaterScript,
+		"arg1=-unset",
+		"arg2=.net",
+		fmt.Sprintf("arg3=%s", ch.DNSName),
+		"arg4=TXT",
+		fmt.Sprintf("arg5=%s", ch.Key),
+	}
+	Execute(dnsUpdaterScript, command)
+	return nil
+}
+
+// Initialize will be called when the webhook first starts.
+// This method can be used to instantiate the webhook, i.e. initialising
+// connections or warming up caches.
+// Typically, the kubeClientConfig parameter is used to build a Kubernetes
+// client that can be used to fetch resources from the Kubernetes API, e.g.
+// Secret resources containing credentials used to authenticate with DNS
+// provider accounts.
+// The stopCh can be used to handle early termination of the webhook, in cases
+// where a SIGTERM or similar signal is sent to the webhook process.
+func (c *LocalDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {
+	cl, err := kubernetes.NewForConfig(kubeClientConfig)
+	if err != nil {
+		return fmt.Errorf("failed to get kubernetes client: %w", err)
+	}
+	c.client = *cl
+	return nil
+}
+
+func extractDomainName(zone string) string {
+	authZone, err := util.FindZoneByFqdn(zone, util.RecursiveNameservers)
+	if err != nil {
+		fmt.Printf("could not get zone by fqdn %v", err)
+		return zone
+	}
+	return util.UnFqdn(authZone)
+}

sthome/solver_sthome.go

@@ -1,4 +1,4 @@
-// must pass cert-manager DNS conformance tests
+// not implemented
 package sthome
 
 import (
@@ -12,32 +12,32 @@ import (
 	"k8s.io/client-go/rest"
 )
 
-type sthomeSolver struct {
+type SthomeSolver struct {
 	name       string
 	server     *dns.Server
 	txtRecords map[string]string
 	sync.RWMutex
 }
 
-func (e *sthomeSolver) Name() string {
+func (e *SthomeSolver) Name() string {
 	return e.name
 }
 
-func (e *sthomeSolver) Present(ch *acme.ChallengeRequest) error {
+func (e *SthomeSolver) Present(ch *acme.ChallengeRequest) error {
 	e.Lock()
 	e.txtRecords[ch.ResolvedFQDN] = ch.Key
 	e.Unlock()
 	return nil
 }
 
-func (e *sthomeSolver) CleanUp(ch *acme.ChallengeRequest) error {
+func (e *SthomeSolver) CleanUp(ch *acme.ChallengeRequest) error {
 	e.Lock()
 	delete(e.txtRecords, ch.ResolvedFQDN)
 	e.Unlock()
 	return nil
 }
 
-func (e *sthomeSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {
+func (e *SthomeSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {
 	go func(done <-chan struct{}) {
 		<-done
 		if err := e.server.Shutdown(); err != nil {
@@ -54,7 +54,7 @@ func (e *sthomeSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan s
 }
 
 func New(port string) webhook.Solver {
-	e := &sthomeSolver{
+	e := &SthomeSolver{
 		name:       "sthome",
 		txtRecords: make(map[string]string),
 	}

sthome/utils.go

@@ -0,0 +1,28 @@
+// private repo workaround
+// Will use this file and remove same content from main.go when github repo is made public
+
+package sthome
+
+import (
+	"encoding/json"
+	"fmt"
+
+	extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+)
+
+// loadConfig is a small helper function that decodes JSON configuration into
+// the typed config struct.
+func loadConfig(cfgJSON *extapi.JSON) (localDNSProviderConfig, error) {
+	cfg := localDNSProviderConfig{}
+	// handle the 'base case' where no configuration has been provided
+	if cfgJSON == nil {
+		return cfg, nil
+	}
+	if err := json.Unmarshal(cfgJSON.Raw, &cfg); err != nil {
+		return cfg, fmt.Errorf("error decoding solver config: %v", err)
+	}
+
+	return cfg, nil
+}
+
+// end of private repo workaround