ACME/cert-manager-webhook-sthome
ACME/cert-manager-webhook-sthome
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: ACME:be59e240cbaabe56921cb0590415abde353673bd
Branches Tags
ACME:main
..
compare: ACME:6869fdc80f1e0d74d1c88ce9e1d33b2064c72610
Branches Tags
ACME:main

No commits in common. "be59e240cbaabe56921cb0590415abde353673bd" and "6869fdc80f1e0d74d1c88ce9e1d33b2064c72610" have entirely different histories.
be59e240cb ... 6869fdc80f

10 changed files with 13 additions and 293 deletions
Show Stats Expand all files Collapse all files

5
deploy/sthome-webhook/Chart.yaml
View File

@ -1,6 +1,5 @@
apiVersion: v1
appVersion: "v0.0.2"
appVersion: "v0.0.1"
description: Cert-Manager webhook for sthome
name: sthome-webhook
version: 0.0.2
version: 0.0.1

20
deploy/sthome-webhook/values.yaml
View File

@ -8,29 +8,13 @@
# here is recommended.
groupName: acme.sthome.net
labels: sthome-webhook
certManager:
namespace: ix-cert-manager
serviceAccountName: cert-manager-certmanager
#secrets:
# apiID:
# apiToken:
clusterIssuer:
enabled: true
staging: false
#email:
# https://cert-manager.io/docs/configuration/acme/#adding-multiple-solver-types
#selector:
# dnsZones:
# - 'sthome.net'
serviceAccountName: cert-manager
image:
repository: stuurmcp/cert-manager-webhook-sthome
tag: 0.0.2
tag: 0.0.1
#pullPolicy should be IfNotPresent. Set to Always for testing purposes
pullPolicy: IfNotPresent

2
go.mod
View File

@ -5,6 +5,8 @@ go 1.21
toolchain go1.22.1
require (
/// uncomment and fix tag when github repo is made public
//github.com/stuurmcp/cert-manager-webhook-sthome v0.0.1-alpha
github.com/cert-manager/cert-manager v1.14.4
github.com/miekg/dns v1.1.58
github.com/stretchr/testify v1.8.4

12
sthome/config.go
View File

@ -6,11 +6,6 @@ import (
v1 "k8s.io/api/core/v1"
)
const (
SthomeAccessKeyEnv = "STHOME_ACCESS_KEY"
SthomeSecretKeyEnv = "STHOME_SECRET_KEY"
)
// localDNSProviderConfig is a structure that is used to decode into when
// solving a DNS01 challenge.
// This information is provided by cert-manager, and may be a reference to
@ -25,10 +20,7 @@ const (
// You should not include sensitive information here. If credentials need to
// be used by your provider here, you should reference a Kubernetes Secret
// resource and fetch these credentials using a Kubernetes clientset.
type LocalDNSProviderConfig struct {
AccessKey *v1.SecretKeySelector `json:"accessKeySecretRef,omitempty"`
SecretKey *v1.SecretKeySelector `json:"secretKeySecretRef,omitempty"`
type localDNSProviderConfig struct {
// Change the two fields below according to the format of the configuration
// to be decoded.
// These fields will be set by users in the
@ -86,7 +78,7 @@ type LocalDNSProviderConfig struct {
// IsAllowedZone checks if the webhook is allowed to edit the given zone, per
// AllowedZones setting. All zones allowed if AllowedZones is empty (the default setting)
func (cfg LocalDNSProviderConfig) IsAllowedZone(zone string) bool {
func (cfg localDNSProviderConfig) IsAllowedZone(zone string) bool {
if len(cfg.AllowedZones) == 0 {
return true
}

6
sthome/solver_local.go
View File

@ -21,8 +21,8 @@ const (
// To do so, it must implement the `github.com/cert-manager/cert-manager/pkg/acme/webhook.Solver`
// interface.
type LocalDNSProviderSolver struct {
//client kubernetes.Clientset
client kubernetes.Interface
client kubernetes.Clientset
//client kubernetes.Interface
}
// Name is used as the name for this DNS solver when referencing it on the ACME
@ -127,7 +127,7 @@ func (loc *LocalDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, sto
if err != nil {
return fmt.Errorf("failed to get kubernetes client: %w", err)
}
loc.client = cl
loc.client = *cl
klog.InfoS("Successfully initialised kubernetes client!")
return nil
}

4
sthome/utils.go
View File

@ -12,8 +12,8 @@ import (
// loadConfig is a small helper function that decodes JSON configuration into
// the typed config struct.
func loadConfig(cfgJSON *extapi.JSON) (LocalDNSProviderConfig, error) {
cfg := LocalDNSProviderConfig{}
func loadConfig(cfgJSON *extapi.JSON) (localDNSProviderConfig, error) {
cfg := localDNSProviderConfig{}
// handle the 'base case' where no configuration has been provided
if cfgJSON == nil {
return cfg, nil

201
sthome/utils_test.go
View File

@ -1,201 +0,0 @@
package sthome
import (
"context"
"fmt"
"os"
"reflect"
"testing"
"github.com/cert-manager/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
//client "github.com/kubernetes-sdk-for-go-101/pkg/client"
v1 "k8s.io/api/core/v1"
extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
testclient "k8s.io/client-go/kubernetes/fake"
)
func Test_loadConfig(t *testing.T) {
testCases := []struct {
json string
config LocalDNSProviderConfig
shouldErr bool
}{
{
json: `{
"accessKeySecretRef": {
"name": "sthome-secret",
"key": "STHOME_ACCESS_KEY"
},
"secretKeySecretRef": {
"name": "sthome-secret",
"key": "STHOME_SECRET_KEY"
}
}`,
config: LocalDNSProviderConfig{
AccessKey: &v1.SecretKeySelector{
LocalObjectReference: v1.LocalObjectReference{
Name: "sthome-secret",
},
Key: "STHOME_ACCESS_KEY",
},
SecretKey: &v1.SecretKeySelector{
LocalObjectReference: v1.LocalObjectReference{
Name: "sthome-secret",
},
Key: "STHOME_SECRET_KEY",
},
},
shouldErr: false,
},
{
json: `{
"dummy": }
}`,
shouldErr: true,
},
{
shouldErr: false,
config: LocalDNSProviderConfig{},
},
}
for _, test := range testCases {
json := &extapi.JSON{
Raw: []byte(test.json),
}
if test.json == "" {
json = nil
}
config, err := loadConfig(json)
if err != nil {
if !test.shouldErr {
t.Errorf("got error %v where no error was expected", err)
}
} else if test.shouldErr {
t.Errorf("didn't get an error where an error was expected")
}
if !reflect.DeepEqual(config, test.config) {
t.Errorf("Wrong config value: wanted %v got %v", test.config, config)
}
}
}
func Test_getDomainAPI(t *testing.T) {
jsonBothKey := &extapi.JSON{
Raw: []byte(`{
"accessKeySecretRef": {
"name": "sthome-secret",
"key": "STHOME_ACCESS_KEY"
},
"secretKeySecretRef": {
"name": "sthome-secret",
"key": "STHOME_SECRET_KEY"
}
}`),
}
testCases := []struct {
ch *v1alpha1.ChallengeRequest
env map[string]string
secret *v1.Secret
shouldErr bool
errMessage string
}{
{
ch: &v1alpha1.ChallengeRequest{},
shouldErr: true,
errMessage: "failed to initialize sthome client: access key cannot be empty",
},
{
ch: &v1alpha1.ChallengeRequest{},
env: map[string]string{
SthomeAccessKeyEnv: "STHOMEXXXXXXXXXXXXXXXXX",
},
shouldErr: true,
errMessage: "failed to initialize sthome client: ssecret key cannot be empty",
},
{
ch: &v1alpha1.ChallengeRequest{},
env: map[string]string{
SthomeAccessKeyEnv: "STHOMEXXXXXXXXXXXXXX",
SthomeSecretKeyEnv: "66666666-7777-8888-9999-000000000000",
},
shouldErr: false,
},
{
ch: &v1alpha1.ChallengeRequest{
Config: jsonBothKey,
ResourceNamespace: "test",
},
secret: &v1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: "sthome-secret",
Namespace: "test",
},
Data: map[string][]byte{
SthomeAccessKeyEnv: []byte("STHOMEXXXXXXXXXXXXXX"),
},
},
shouldErr: true,
errMessage: "could not get key STHOME_SECRET_KEY in secret sthome-secret",
},
{
ch: &v1alpha1.ChallengeRequest{
Config: jsonBothKey,
ResourceNamespace: "test",
},
secret: &v1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: "sthome-secret",
Namespace: "test",
},
Data: map[string][]byte{
SthomeSecretKeyEnv: []byte("66666666-7777-8888-9999-000000000000"),
SthomeAccessKeyEnv: []byte("STHOMEXXXXXXXXXXXXXXXXX"),
},
},
shouldErr: false,
},
}
for _, test := range testCases {
fakeKubernetesClient := testclient.NewSimpleClientset()
pSolver := &LocalDNSProviderSolver{
client: fakeKubernetesClient,
}
if test.secret != nil {
_, err := pSolver.client.CoreV1().Secrets(test.ch.ResourceNamespace).Create(context.Background(), test.secret, metav1.CreateOptions{})
if err != nil {
t.Errorf("failed to create kubernetes secret")
}
}
for k, v := range test.env {
os.Setenv(k, v)
}
_, err := getDomainAPI(test.ch)
if err != nil {
if !test.shouldErr {
t.Errorf("got error %v where no error was expected", err)
}
if err.Error() != test.errMessage {
t.Errorf("expected error %s, got %s", test.errMessage, err.Error())
}
} else if test.shouldErr {
t.Errorf("didn't get an error where an error was expected with message %s", test.errMessage)
}
for k := range test.env {
os.Unsetenv(k)
}
}
}
// dummy, should actually return the API, but here we just return the config
func getDomainAPI(ch *v1alpha1.ChallengeRequest) (*LocalDNSProviderConfig, error) {
config, err := loadConfig(ch.Config)
if err != nil {
return nil, fmt.Errorf("failed to load config: %w", err)
}
return &config, err
}

38
tests/suite_test.go
View File

@ -1,38 +0,0 @@
//go:build integration
// +build integration
package tests
import (
"os"
"testing"
"github.com/cert-manager/cert-manager/test/acme/dns"
"github.com/cert-manager/cert-manager-webhook-sthome/sthome"
)
var (
zone = os.Getenv("TEST_ZONE_NAME")
)
func TestRunsSuite(t *testing.T) {
// The manifest path should contain a file named config.json that is a
// snippet of valid configuration that should be included on the
// ChallengeRequest passed as part of the test cases.
currentDir, err := os.Getwd()
if err != nil {
t.Fatalf("error getting current working dir: %s", err.Error())
}
fixture := dns.NewFixture(&sthome.ProviderSolver{},
dns.SetResolvedZone(zone),
dns.SetAllowAmbientCredentials(true),
dns.SetBinariesPath(currentDir+"/kubebuilder/bin"),
dns.SetManifestPath(currentDir+"/testdata"),
dns.SetStrict(true),
)
fixture.RunConformance(t)
}

10
tests/testdata/config.json vendored
View File

@ -1,10 +0,0 @@
{
"accessKeySecretRef": {
"name": "sthome-secret",
"key": "STHOME_ACCESS_KEY"
},
"secretKeySecretRef": {
"name": "sthome-secret",
"key": "STHOME_SECRET_KEY"
}
}

8
tests/testdata/secret.yaml vendored
View File

@ -1,8 +0,0 @@
apiVersion: v1
stringData:
STHOME_ACCESS_KEY: STHOMEXXXXXXXXXXXXXX
STHOME_SECRET_KEY: 66666666-7777-8888-9999-000000000000
kind: Secret
metadata:
name: sthome-secret
type: Opaque