Skip to content

Commit 9420237

Browse files
reevejdreevejd
committed
feat: initial implementation of ibm cis webhook
1 parent 5131c1f commit 9420237

File tree

31 files changed

+696
-546
lines changed

31 files changed

+696
-546
lines changed

‎.github/workflows/release-helm-chart.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Release Helm Chart
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
tags:
8+
- "**"
9+
pull_request:
10+
branches:
11+
- master
12+
13+
jobs:
14+
release:
15+
if: github.event_name == 'push' # This ensures release only runs on push events, not on pull_request events
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v2
20+
with:
21+
fetch-depth: 0
22+
23+
- name: Install yq - portable yaml processor
24+
uses: mikefarah/[email protected]
25+
26+
- name: Install Helm
27+
uses: azure/setup-helm@v1
28+
with:
29+
version: v3.4.0
30+
31+
- name: Lint chart
32+
run: helm lint deploy/cert-manager-ibm-cis-webhook
33+
34+
- name: Fetch charts dependencies
35+
run: |
36+
cd deploy/cert-manager-ibm-cis-webhook
37+
helm dependency build
38+
39+
- name: Package Helm Chart
40+
run: |
41+
helm package deploy/cert-manager-ibm-cis-webhook
42+
43+
- name: Check Out Helm Chart Repository
44+
uses: actions/checkout@v2
45+
with:
46+
repository: ibm-skills-network/charts
47+
token: ${{ secrets.PUBLIC_HELM_CHART_REPO_PUBLISH_TOKEN }}
48+
path: charts-repo
49+
ref: gh-pages
50+
51+
- name: Copy Packaged Chart to Charts Repo
52+
run: |
53+
cp cert-manager-ibm-cis-webhook*.tgz charts-repo/
54+
55+
- name: Update Helm Chart Repository Index
56+
run: |
57+
cd charts-repo
58+
git config user.name "$GITHUB_ACTOR"
59+
git config user.email "[email protected]"
60+
helm repo index . --url https://ibm-skills-network.github.io/charts/ --merge index.yaml
61+
git add .
62+
git commit -m "Update Helm chart for my-chart"
63+
git push

‎.github/workflows/release-image.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Build and Publish Docker Image
2+
3+
on:
4+
push:
5+
branches:
6+
- '*'
7+
tags:
8+
- '*'
9+
10+
jobs:
11+
build-and-publish:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
packages: write
16+
17+
steps:
18+
- name: Check Out Repository
19+
uses: actions/checkout@v4
20+
21+
- name: Set up Docker Buildx
22+
uses: docker/setup-buildx-action@v3
23+
24+
- name: Log in to GitHub Container Registry
25+
if: startsWith(github.ref, 'refs/tags/')
26+
uses: docker/login-action@v3
27+
with:
28+
registry: ghcr.io
29+
username: ${{ github.actor }}
30+
password: ${{ secrets.GITHUB_TOKEN }}
31+
32+
- name: Extract Tag Name
33+
if: startsWith(github.ref, 'refs/tags/')
34+
id: tag_name
35+
run: echo "::set-output name=TAG_NAME::${GITHUB_REF##*/}"
36+
37+
- name: Build Docker Image
38+
uses: docker/build-push-action@v5
39+
with:
40+
context: .
41+
file: Dockerfile
42+
push: ${{ startsWith(github.ref, 'refs/tags/') }}
43+
tags: |
44+
ghcr.io/${{ github.repository }}:latest
45+
ghcr.io/${{ github.repository }}:1
46+
${{ steps.tag_name.outputs.TAG_NAME != '' && format('ghcr.io/{0}:{1}', github.repository, steps.tag_name.outputs.TAG_NAME) }}

‎.github/workflows/test.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Test
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
jobs:
9+
test:
10+
concurrency:
11+
group: test
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Check Out Repository
15+
uses: actions/checkout@v2
16+
- name: Run tests
17+
run: |
18+
cat > testdata/ibm-cloud-cis/config.json <<EOF
19+
{
20+
"ibmCloudCisCrns": [ "$TEST_CIS_INSTANCE_CRN" ]
21+
}
22+
EOF
23+
24+
cat testdata/ibm-cloud-cis/config.json
25+
26+
make test
27+
env:
28+
TEST_ZONE_NAME: ${{ vars.TEST_ZONE_NAME }}
29+
TEST_DNS_RECORD: ${{ vars.TEST_DNS_RECORD }}
30+
TEST_CIS_INSTANCE_CRN: ${{ vars.TEST_CIS_INSTANCE_CRN }}
31+
IBMCLOUD_API_KEY: ${{ secrets.IBMCLOUD_API_KEY }}

‎.tool-versions‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
golang 1.21.5

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ RUN go mod download
1111

1212
FROM build_deps AS build
1313

14-
COPY . .
14+
COPY main.go .
1515

1616
RUN CGO_ENABLED=0 go build -o webhook -ldflags '-w -extldflags "-static"' .
1717

18-
FROM alpine:3.18
18+
FROM alpine:3.18 as final
1919

2020
RUN apk add --no-cache ca-certificates
2121

‎Makefile‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@ GO ?= $(shell which go)
22
OS ?= $(shell $(GO) env GOOS)
33
ARCH ?= $(shell $(GO) env GOARCH)
44

5-
IMAGE_NAME := "webhook"
5+
IMAGE_NAME := "icr.io/skills-network/cert-manager-webhook-ibm-cis"
66
IMAGE_TAG := "latest"
77

88
OUT := $(shell pwd)/_out
99

1010
KUBEBUILDER_VERSION=1.28.0
1111

12-
HELM_FILES := $(shell find deploy/example-webhook)
12+
HELM_FILES := $(shell find deploy/cert-manager-ibm-cis-webhook)
1313

1414
test: _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kube-apiserver _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kubectl
1515
TEST_ASSET_ETCD=_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd \
@@ -29,17 +29,17 @@ clean:
2929

3030
.PHONY: build
3131
build:
32-
docker build -t "$(IMAGE_NAME):$(IMAGE_TAG)" .
32+
docker buildx build -t "$(IMAGE_NAME):$(IMAGE_TAG)" . --platform linux/amd64
3333

3434
.PHONY: rendered-manifest.yaml
3535
rendered-manifest.yaml: $(OUT)/rendered-manifest.yaml
3636

3737
$(OUT)/rendered-manifest.yaml: $(HELM_FILES) | $(OUT)
3838
helm template \
39-
--name example-webhook \
39+
--name cert-manager-ibm-cis-webhook \
4040
--set image.repository=$(IMAGE_NAME) \
4141
--set image.tag=$(IMAGE_TAG) \
42-
deploy/example-webhook > $@
42+
deploy/cert-manager-ibm-cis-webhook > $@
4343

4444
_test $(OUT) _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH):
4545
mkdir -p $@

‎README.md‎

Lines changed: 43 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,57 @@
1-
<p align="center">
2-
<img src="https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png" height="256" width="256" alt="cert-manager project logo" />
3-
</p>
1+
# Cert Manager IBM Cloud Internet Services Webhook Solver
42

5-
# ACME webhook example
6-
7-
The ACME issuer type supports an optional 'webhook' solver, which can be used
3+
Cert Manager's ACME (automated certificate management environment) issuer type supports an optional 'webhook' solver, which can be used
84
to implement custom DNS01 challenge solving logic.
95

10-
This is useful if you need to use cert-manager with a DNS provider that is not
11-
officially supported in cert-manager core.
12-
13-
## Why not in core?
14-
15-
As the project & adoption has grown, there has been an influx of DNS provider
16-
pull requests to our core codebase. As this number has grown, the test matrix
17-
has become un-maintainable and so, it's not possible for us to certify that
18-
providers work to a sufficient level.
19-
20-
By creating this 'interface' between cert-manager and DNS providers, we allow
21-
users to quickly iterate and test out new integrations, and then packaging
22-
those up themselves as 'extensions' to cert-manager.
23-
24-
We can also then provide a standardised 'testing framework', or set of
25-
conformance tests, which allow us to validate the a DNS provider works as
26-
expected.
6+
IBM Cloud Internet Services is not officially supported in cert-manager core, so if you want to automatically provision certificates with cert-manager using DNS challenges, you can use this repository to do so.
277

28-
## Creating your own webhook
8+
## Usage
299

30-
Webhook's themselves are deployed as Kubernetes API services, in order to allow
31-
administrators to restrict access to webhooks with Kubernetes RBAC.
10+
### Prerequisites
3211

33-
This is important, as otherwise it'd be possible for anyone with access to your
34-
webhook to complete ACME challenge validations and obtain certificates.
12+
You must have cert-manager already installed in your cluster.
3513

36-
To make the set up of these webhook's easier, we provide a template repository
37-
that can be used to get started quickly.
14+
See [installation instructions here](https://cert-manager.io/docs/installation/).
3815

39-
### Creating your own repository
16+
### Installation
4017

41-
### Running the test suite
18+
You can install this webhook using helm:
4219

43-
All DNS providers **must** run the DNS01 provider conformance testing suite,
44-
else they will have undetermined behaviour when used with cert-manager.
45-
46-
**It is essential that you configure and run the test suite when creating a
47-
DNS01 webhook.**
20+
```shell
21+
helm install cert-manager-ibm-cis-webhook --set ibmCloudApiKey="<your IBM Cloud API key>"
22+
```
4823

49-
An example Go test file has been provided in [main_test.go](https://github.com/cert-manager/webhook-example/blob/master/main_test.go).
24+
### Issuer
25+
26+
Create or update an `Issuer` (or `ClusterIssuer`) to reference the newly installed solver:
27+
28+
```yaml
29+
apiVersion: cert-manager.io/v1
30+
kind: ClusterIssuer
31+
metadata:
32+
name: acme-dns-issuer
33+
spec:
34+
acme:
35+
email: [email protected]
36+
privateKeySecretRef:
37+
name: letsencrypt
38+
server: https://acme-v02.api.letsencrypt.org/directory
39+
solvers:
40+
- dns01:
41+
webhook:
42+
config:
43+
ibmCloudCisCrns:
44+
- 'crn:v1:bluemix:public:internet-svcs:global:a/***:***::'
45+
groupName: acme.skills.network
46+
solverName: ibm-cloud-cis
47+
selector:
48+
dnsZones:
49+
- your.site.domain.com
50+
```
5051
51-
You can run the test suite with:
52+
After update your issuer, cert-manager should be able to automatically complete challenges for your certificates on IBM CIS-managed domains.
5253
53-
```bash
54-
$ TEST_ZONE_NAME=example.com. make test
55-
```
54+
## Contributing
5655
57-
The example file has a number of areas you must fill in and replace with your
58-
own options in order for tests to pass.
56+
Contributions are welcome.
57+
Please see [docs/CONTRIBUTING.md](./docs/CONTRIBUTING.md) to get started.

‎chart-releaser.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
owner: ibm-skills-network
2+
git-repo: charts
3+
# package-path: deploy/cert-manager-ibm-cis-webhook/
4+
# package-path: charts

‎deploy/example-webhook/.helmignore‎ renamed to ‎deploy/cert-manager-ibm-cis-webhook/.helmignore‎

File renamed without changes.

‎deploy/example-webhook/Chart.yaml‎ renamed to ‎deploy/cert-manager-ibm-cis-webhook/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
apiVersion: v1
22
appVersion: "1.0"
33
description: A Helm chart for Kubernetes
4-
name: example-webhook
5-
version: 0.1.0
4+
name: cert-manager-ibm-cis-webhook
5+
version: 1.0.0

0 commit comments

Comments
 (0)