v0.0.2

deploy/sthome-webhook/Chart.yaml

@@ -1,5 +1,6 @@
 apiVersion: v1
-appVersion: "v0.0.1"
+appVersion: "v0.0.2"
 description: Cert-Manager webhook for sthome
 name: sthome-webhook
-version: 0.0.1
+version: 0.0.2
+

deploy/sthome-webhook/values.yaml

@@ -8,13 +8,29 @@
 # here is recommended.
 groupName: acme.sthome.net
 
+labels: sthome-webhook
+
 certManager:
   namespace: ix-cert-manager
-  serviceAccountName: cert-manager
+  serviceAccountName: cert-manager-certmanager
+
+#secrets:
+# apiID:
+# apiToken:
+
+clusterIssuer:
+  enabled: true
+  staging: false
+  #email:
+
+  # https://cert-manager.io/docs/configuration/acme/#adding-multiple-solver-types
+  #selector:
+  #  dnsZones:
+  #    - 'sthome.net'
 
 image:
   repository: stuurmcp/cert-manager-webhook-sthome
-  tag: 0.0.1
+  tag: 0.0.2
   #pullPolicy should be IfNotPresent. Set to Always for testing purposes
   pullPolicy: IfNotPresent
 

go.mod

@@ -5,8 +5,6 @@ go 1.21
 toolchain go1.22.1
 
 require (
-	/// uncomment and fix tag when github repo is made public
-	//github.com/stuurmcp/cert-manager-webhook-sthome v0.0.1-alpha
 	github.com/cert-manager/cert-manager v1.14.4
 	github.com/miekg/dns v1.1.58
 	github.com/stretchr/testify v1.8.4

sthome/config.go

@@ -6,6 +6,11 @@ import (
 	v1 "k8s.io/api/core/v1"
 )
 
+const (
+	SthomeAccessKeyEnv = "STHOME_ACCESS_KEY"
+	SthomeSecretKeyEnv = "STHOME_SECRET_KEY"
+)
+
 // localDNSProviderConfig is a structure that is used to decode into when
 // solving a DNS01 challenge.
 // This information is provided by cert-manager, and may be a reference to
@@ -20,7 +25,10 @@ import (
 // You should not include sensitive information here. If credentials need to
 // be used by your provider here, you should reference a Kubernetes Secret
 // resource and fetch these credentials using a Kubernetes clientset.
-type localDNSProviderConfig struct {
+type LocalDNSProviderConfig struct {
+	AccessKey *v1.SecretKeySelector `json:"accessKeySecretRef,omitempty"`
+	SecretKey *v1.SecretKeySelector `json:"secretKeySecretRef,omitempty"`
+
 	// Change the two fields below according to the format of the configuration
 	// to be decoded.
 	// These fields will be set by users in the
@@ -78,7 +86,7 @@ type localDNSProviderConfig struct {
 
 // IsAllowedZone checks if the webhook is allowed to edit the given zone, per
 // AllowedZones setting. All zones allowed if AllowedZones is empty (the default setting)
-func (cfg localDNSProviderConfig) IsAllowedZone(zone string) bool {
+func (cfg LocalDNSProviderConfig) IsAllowedZone(zone string) bool {
 	if len(cfg.AllowedZones) == 0 {
 		return true
 	}

sthome/solver_local.go

@@ -21,8 +21,8 @@ const (
 // To do so, it must implement the `github.com/cert-manager/cert-manager/pkg/acme/webhook.Solver`
 // interface.
 type LocalDNSProviderSolver struct {
-	client kubernetes.Clientset
+	//client kubernetes.Clientset
-	//client kubernetes.Interface
+	client kubernetes.Interface
 }
 
 // Name is used as the name for this DNS solver when referencing it on the ACME
@@ -127,7 +127,7 @@ func (loc *LocalDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, sto
 	if err != nil {
 		return fmt.Errorf("failed to get kubernetes client: %w", err)
 	}
-	loc.client = *cl
+	loc.client = cl
 	klog.InfoS("Successfully initialised kubernetes client!")
 	return nil
 }

sthome/utils.go

@@ -12,8 +12,8 @@ import (
 
 // loadConfig is a small helper function that decodes JSON configuration into
 // the typed config struct.
-func loadConfig(cfgJSON *extapi.JSON) (localDNSProviderConfig, error) {
+func loadConfig(cfgJSON *extapi.JSON) (LocalDNSProviderConfig, error) {
-	cfg := localDNSProviderConfig{}
+	cfg := LocalDNSProviderConfig{}
 	// handle the 'base case' where no configuration has been provided
 	if cfgJSON == nil {
 		return cfg, nil

sthome/utils_test.go

@@ -0,0 +1,201 @@
+package sthome
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"reflect"
+	"testing"
+
+	"github.com/cert-manager/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
+	//client "github.com/kubernetes-sdk-for-go-101/pkg/client"
+	v1 "k8s.io/api/core/v1"
+	extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testclient "k8s.io/client-go/kubernetes/fake"
+)
+
+func Test_loadConfig(t *testing.T) {
+	testCases := []struct {
+		json      string
+		config    LocalDNSProviderConfig
+		shouldErr bool
+	}{
+		{
+			json: `{
+  "accessKeySecretRef": {
+    "name": "sthome-secret",
+    "key": "STHOME_ACCESS_KEY"
+  },
+  "secretKeySecretRef": {
+    "name": "sthome-secret",
+    "key": "STHOME_SECRET_KEY"
+  }
+}`,
+			config: LocalDNSProviderConfig{
+				AccessKey: &v1.SecretKeySelector{
+					LocalObjectReference: v1.LocalObjectReference{
+						Name: "sthome-secret",
+					},
+					Key: "STHOME_ACCESS_KEY",
+				},
+				SecretKey: &v1.SecretKeySelector{
+					LocalObjectReference: v1.LocalObjectReference{
+						Name: "sthome-secret",
+					},
+					Key: "STHOME_SECRET_KEY",
+				},
+			},
+			shouldErr: false,
+		},
+		{
+			json: `{
+  "dummy": }
+}`,
+			shouldErr: true,
+		},
+		{
+			shouldErr: false,
+			config:    LocalDNSProviderConfig{},
+		},
+	}
+
+	for _, test := range testCases {
+		json := &extapi.JSON{
+			Raw: []byte(test.json),
+		}
+		if test.json == "" {
+			json = nil
+		}
+		config, err := loadConfig(json)
+		if err != nil {
+			if !test.shouldErr {
+				t.Errorf("got error %v where no error was expected", err)
+			}
+		} else if test.shouldErr {
+			t.Errorf("didn't get an error where an error was expected")
+		}
+		if !reflect.DeepEqual(config, test.config) {
+			t.Errorf("Wrong config value: wanted %v got %v", test.config, config)
+		}
+	}
+}
+
+func Test_getDomainAPI(t *testing.T) {
+	jsonBothKey := &extapi.JSON{
+		Raw: []byte(`{
+  "accessKeySecretRef": {
+    "name": "sthome-secret",
+    "key": "STHOME_ACCESS_KEY"
+  },
+  "secretKeySecretRef": {
+    "name": "sthome-secret",
+    "key": "STHOME_SECRET_KEY"
+  }
+}`),
+	}
+
+	testCases := []struct {
+		ch         *v1alpha1.ChallengeRequest
+		env        map[string]string
+		secret     *v1.Secret
+		shouldErr  bool
+		errMessage string
+	}{
+		{
+			ch:         &v1alpha1.ChallengeRequest{},
+			shouldErr:  true,
+			errMessage: "failed to initialize sthome client: access key cannot be empty",
+		},
+		{
+			ch: &v1alpha1.ChallengeRequest{},
+			env: map[string]string{
+				SthomeAccessKeyEnv: "STHOMEXXXXXXXXXXXXXXXXX",
+			},
+			shouldErr:  true,
+			errMessage: "failed to initialize sthome client: ssecret key cannot be empty",
+		},
+		{
+			ch: &v1alpha1.ChallengeRequest{},
+			env: map[string]string{
+				SthomeAccessKeyEnv: "STHOMEXXXXXXXXXXXXXX",
+				SthomeSecretKeyEnv: "66666666-7777-8888-9999-000000000000",
+			},
+			shouldErr: false,
+		},
+		{
+			ch: &v1alpha1.ChallengeRequest{
+				Config:            jsonBothKey,
+				ResourceNamespace: "test",
+			},
+			secret: &v1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "sthome-secret",
+					Namespace: "test",
+				},
+				Data: map[string][]byte{
+					SthomeAccessKeyEnv: []byte("STHOMEXXXXXXXXXXXXXX"),
+				},
+			},
+			shouldErr:  true,
+			errMessage: "could not get key STHOME_SECRET_KEY in secret sthome-secret",
+		},
+		{
+			ch: &v1alpha1.ChallengeRequest{
+				Config:            jsonBothKey,
+				ResourceNamespace: "test",
+			},
+			secret: &v1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "sthome-secret",
+					Namespace: "test",
+				},
+				Data: map[string][]byte{
+					SthomeSecretKeyEnv: []byte("66666666-7777-8888-9999-000000000000"),
+					SthomeAccessKeyEnv: []byte("STHOMEXXXXXXXXXXXXXXXXX"),
+				},
+			},
+			shouldErr: false,
+		},
+	}
+
+	for _, test := range testCases {
+		fakeKubernetesClient := testclient.NewSimpleClientset()
+		pSolver := &LocalDNSProviderSolver{
+			client: fakeKubernetesClient,
+		}
+
+		if test.secret != nil {
+			_, err := pSolver.client.CoreV1().Secrets(test.ch.ResourceNamespace).Create(context.Background(), test.secret, metav1.CreateOptions{})
+			if err != nil {
+				t.Errorf("failed to create kubernetes secret")
+			}
+		}
+		for k, v := range test.env {
+			os.Setenv(k, v)
+		}
+		_, err := getDomainAPI(test.ch)
+		if err != nil {
+			if !test.shouldErr {
+				t.Errorf("got error %v where no error was expected", err)
+			}
+			if err.Error() != test.errMessage {
+				t.Errorf("expected error %s, got %s", test.errMessage, err.Error())
+			}
+		} else if test.shouldErr {
+			t.Errorf("didn't get an error where an error was expected with message %s", test.errMessage)
+		}
+		for k := range test.env {
+			os.Unsetenv(k)
+		}
+	}
+}
+
+// dummy, should actually return the API, but here we just return the config
+func getDomainAPI(ch *v1alpha1.ChallengeRequest) (*LocalDNSProviderConfig, error) {
+	config, err := loadConfig(ch.Config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load config: %w", err)
+	}
+	return &config, err
+}

tests/suite_test.go

@@ -0,0 +1,38 @@
+//go:build integration
+// +build integration
+
+package tests
+
+import (
+	"os"
+	"testing"
+
+	"github.com/cert-manager/cert-manager/test/acme/dns"
+
+	"github.com/cert-manager/cert-manager-webhook-sthome/sthome"
+)
+
+var (
+	zone = os.Getenv("TEST_ZONE_NAME")
+)
+
+func TestRunsSuite(t *testing.T) {
+	// The manifest path should contain a file named config.json that is a
+	// snippet of valid configuration that should be included on the
+	// ChallengeRequest passed as part of the test cases.
+
+	currentDir, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("error getting current working dir: %s", err.Error())
+	}
+
+	fixture := dns.NewFixture(&sthome.ProviderSolver{},
+		dns.SetResolvedZone(zone),
+		dns.SetAllowAmbientCredentials(true),
+		dns.SetBinariesPath(currentDir+"/kubebuilder/bin"),
+		dns.SetManifestPath(currentDir+"/testdata"),
+		dns.SetStrict(true),
+	)
+
+	fixture.RunConformance(t)
+}

tests/testdata/config.json

@@ -0,0 +1,10 @@
+{
+  "accessKeySecretRef": {
+    "name": "sthome-secret",
+    "key": "STHOME_ACCESS_KEY"
+  },
+  "secretKeySecretRef": {
+    "name": "sthome-secret",
+    "key": "STHOME_SECRET_KEY"
+  }
+}

tests/testdata/secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+stringData:
+  STHOME_ACCESS_KEY: STHOMEXXXXXXXXXXXXXX
+  STHOME_SECRET_KEY: 66666666-7777-8888-9999-000000000000
+kind: Secret
+metadata:
+  name: sthome-secret
+type: Opaque