Skip to content

Commit dde759c

Browse files
author
CodingWizKid
committed
add readme and helm chart
1 parent 6871391 commit dde759c

File tree

11 files changed

+489
-3
lines changed

11 files changed

+489
-3
lines changed

‎README.md‎

Lines changed: 97 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,102 @@
1-
# STACKIT Webhook - Cert Manager
2-
1+
# STACKIT Webhook Integration for Cert Manager
32
[![GoTemplate](https://img.shields.io/badge/go/template-black?logo=go)](https://github.com/golang-standards/project-layout)
3+
[![Go](https://img.shields.io/badge/go-1.21.0-blue?logo=go)](https://golang.org/)
4+
[![Helm](https://img.shields.io/badge/helm-3.12.3-blue?logo=helm)](https://helm.sh/)
5+
[![Kubernetes](https://img.shields.io/badge/kubernetes-1.28.0-blue?logo=kubernetes)](https://kubernetes.io/)
6+
[![Cert Manager](https://img.shields.io/badge/cert--manager-1.12.3-blue?logo=cert-manager)](https://cert-manager.io/)
7+
[![Releases](https://img.shields.io/github/v/release/stackitcloud/stackit-cert-manager-webhook?include_prereleases)](https://github.com/stackitcloud/stackit-cert-manager-webhook/releases)
48
[![CI](https://github.com/stackitcloud/stackit-api-manager-cli/actions/workflows/main.yml/badge.svg)](https://github.com/stackitcloud/stackit-cert-manager-webhook/actions/workflows/main.yml)
59
[![Semgrep](https://github.com/stackitcloud/stackit-api-manager-cli/actions/workflows/semgrep.yml/badge.svg)](https://github.com/stackitcloud/stackit-cert-manager-webhook/actions/workflows/semgrep.yml)
610
[![Go Report Card](https://goreportcard.com/badge/github.com/stackitcloud/stackit-api-manager-cli)](https://goreportcard.com/report/github.com/stackitcloud/stackit-cert-manager-webhook)
711

8-
This is the stackit webhook for cert-manager to provide dns01 challenges for STACKIT DNS.
12+
Facilitate a webhook integration for leveraging the STACKIT DNS alongside
13+
its [API](https://docs.api.stackit.cloud/documentation/dns/version/v1) to act as a DNS01
14+
ACME Issuer with [cert-manager](https://cert-manager.io/docs/).
15+
16+
## Installation
17+
```bash
18+
helm install stackit-cert-manager-webhook \
19+
--namespace cert-manager \
20+
https://github.com/stackitcloud/stackit-cert-manager-webhook/releases/download/v0.1.0/stackit-cert-manager-webhook-v0.1.0.tgz
21+
```
22+
23+
## Usage
24+
1. ***Initiation of STACKIT Authentication Token Secret:***
25+
```bash
26+
kubectl create secret generic stackit-cert-manager-webhook \
27+
--namespace=cert-manager \
28+
--from-literal=auth-token=<STACKIT AUTH TOKEN>
29+
```
30+
31+
2. ***Configuration of ClusterIssuer/Issuer:***
32+
For scenarios wherein zones and record sets are encapsulated within a singular project, utilize a ClusterIssuer:
33+
```yaml
34+
apiVersion: cert-manager.io/v1
35+
kind: ClusterIssuer
36+
metadata:
37+
name: letsencrypt-prod
38+
spec:
39+
acme:
40+
server: https://acme-v02.api.letsencrypt.org/directory
41+
email: example@example.com # Replace this with your email address
42+
privateKeySecretRef:
43+
name: letsencrypt-prod
44+
solvers:
45+
- dns01:
46+
webhook:
47+
solverName: stackit
48+
groupName: stackit.de
49+
config:
50+
projectId: <STACKIT PROJECT ID>
51+
```
52+
53+
For diverse project architectures where zones are spread across varying projects, necessitating distinct
54+
authentication tokens per project, the Issuer configuration becomes pertinent. This approach inherently
55+
tethers namespaces to individual projects.
56+
```bash
57+
kubectl create secret generic stackit-cert-manager-webhook \
58+
--namespace=default \
59+
--from-literal=auth-token=<STACKIT AUTH TOKEN>
60+
```
61+
```yaml
62+
apiVersion: cert-manager.io/v1
63+
kind: Issuer
64+
metadata:
65+
name: letsencrypt-prod
66+
namespace: default
67+
spec:
68+
acme:
69+
server: https://acme-v02.api.letsencrypt.org/directory
70+
email: example@example.com # Replace this with your email address
71+
privateKeySecretRef:
72+
name: letsencrypt-prod
73+
solvers:
74+
- dns01:
75+
webhook:
76+
solverName: stackit
77+
groupName: stackit.de
78+
config:
79+
projectId: <STACKIT PROJECT ID>
80+
authTokenSecretNamespace: default
81+
```
82+
*Note:* Ensure the creation of an authentication token secret within the namespace linked to the issuer.
83+
The secret must be vested with permissions to access zones in the stipulated project configuration.
84+
85+
## Test Procedures
86+
- Unit Testing:
87+
```bash
88+
make test
89+
```
90+
91+
- Unit Testing with Coverage Analysis:
92+
```bash
93+
make coverage
94+
```
95+
96+
- Linting:
97+
```bash
98+
make lint
99+
```
100+
101+
- End-to-End Testing Workflow:
102+
Follow the comprehensive guide available [here](e2e_test/README.md).

‎deploy/stackit/.helmignore‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj

‎deploy/stackit/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
appVersion: "1.0"
3+
description: A Helm chart for Kubernetes
4+
name: stackit-cert-manager-webhook
5+
version: 0.1.0

‎deploy/stackit/templates/Notes.txt‎

Whitespace-only changes.

‎deploy/stackit/templates/_helpers.tpl‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "stackit-cert-manager-webhook.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "stackit-cert-manager-webhook.fullname" -}}
15+
{{- if .Values.fullnameOverride -}}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
17+
{{- else -}}
18+
{{- $name := default .Chart.Name .Values.nameOverride -}}
19+
{{- if contains $name .Release.Name -}}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
21+
{{- else -}}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
23+
{{- end -}}
24+
{{- end -}}
25+
{{- end -}}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "stackit-cert-manager-webhook.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
32+
{{- end -}}
33+
34+
{{- define "stackit-cert-manager-webhook.selfSignedIssuer" -}}
35+
{{ printf "%s-selfsign" (include "stackit-cert-manager-webhook.fullname" .) }}
36+
{{- end -}}
37+
38+
{{- define "stackit-cert-manager-webhook.rootCAIssuer" -}}
39+
{{ printf "%s-ca" (include "stackit-cert-manager-webhook.fullname" .) }}
40+
{{- end -}}
41+
42+
{{- define "stackit-cert-manager-webhook.rootCACertificate" -}}
43+
{{ printf "%s-ca" (include "stackit-cert-manager-webhook.fullname" .) }}
44+
{{- end -}}
45+
46+
{{- define "stackit-cert-manager-webhook.servingCertificate" -}}
47+
{{ printf "%s-webhook-tls" (include "stackit-cert-manager-webhook.fullname" .) }}
48+
{{- end -}}

‎deploy/stackit/templates/apiservice.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: apiregistration.k8s.io/v1
2+
kind: APIService
3+
metadata:
4+
name: v1alpha1.{{ .Values.groupName }}
5+
labels:
6+
app: {{ include "stackit-cert-manager-webhook.name" . }}
7+
chart: {{ include "stackit-cert-manager-webhook.chart" . }}
8+
release: {{ .Release.Name }}
9+
heritage: {{ .Release.Service }}
10+
annotations:
11+
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "stackit-cert-manager-webhook.servingCertificate" . }}"
12+
spec:
13+
group: {{ .Values.groupName }}
14+
groupPriorityMinimum: 1000
15+
versionPriority: 15
16+
service:
17+
name: {{ include "stackit-cert-manager-webhook.fullname" . }}
18+
namespace: {{ .Release.Namespace }}
19+
version: v1alpha1

‎deploy/stackit/templates/deployment.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "stackit-cert-manager-webhook.fullname" . }}
5+
namespace: {{ .Release.Namespace | quote }}
6+
labels:
7+
app: {{ include "stackit-cert-manager-webhook.name" . }}
8+
chart: {{ include "stackit-cert-manager-webhook.chart" . }}
9+
release: {{ .Release.Name }}
10+
heritage: {{ .Release.Service }}
11+
spec:
12+
replicas: {{ .Values.replicaCount }}
13+
selector:
14+
matchLabels:
15+
app: {{ include "stackit-cert-manager-webhook.name" . }}
16+
release: {{ .Release.Name }}
17+
template:
18+
metadata:
19+
labels:
20+
app: {{ include "stackit-cert-manager-webhook.name" . }}
21+
release: {{ .Release.Name }}
22+
spec:
23+
serviceAccountName: {{ include "stackit-cert-manager-webhook.fullname" . }}
24+
containers:
25+
- name: {{ .Chart.Name }}
26+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
27+
imagePullPolicy: {{ .Values.image.pullPolicy }}
28+
args:
29+
- --tls-cert-file=/tls/tls.crt
30+
- --tls-private-key-file=/tls/tls.key
31+
env:
32+
- name: GROUP_NAME
33+
value: {{ .Values.groupName | quote }}
34+
ports:
35+
- name: https
36+
containerPort: 443
37+
protocol: TCP
38+
livenessProbe:
39+
httpGet:
40+
scheme: HTTPS
41+
path: /healthz
42+
port: https
43+
readinessProbe:
44+
httpGet:
45+
scheme: HTTPS
46+
path: /healthz
47+
port: https
48+
volumeMounts:
49+
- name: certs
50+
mountPath: /tls
51+
readOnly: true
52+
resources:
53+
{{ toYaml .Values.resources | indent 12 }}
54+
volumes:
55+
- name: certs
56+
secret:
57+
secretName: {{ include "stackit-cert-manager-webhook.servingCertificate" . }}
58+
{{- with .Values.nodeSelector }}
59+
nodeSelector:
60+
{{ toYaml . | indent 8 }}
61+
{{- end }}
62+
{{- with .Values.affinity }}
63+
affinity:
64+
{{ toYaml . | indent 8 }}
65+
{{- end }}
66+
{{- with .Values.tolerations }}
67+
tolerations:
68+
{{ toYaml . | indent 8 }}
69+
{{- end }}

‎deploy/stackit/templates/pki.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
# Create a selfsigned Issuer, in order to create a root CA certificate for
3+
# signing webhook serving certificates
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
name: {{ include "stackit-cert-manager-webhook.selfSignedIssuer" . }}
8+
namespace: {{ .Release.Namespace | quote }}
9+
labels:
10+
app: {{ include "stackit-cert-manager-webhook.name" . }}
11+
chart: {{ include "stackit-cert-manager-webhook.chart" . }}
12+
release: {{ .Release.Name }}
13+
heritage: {{ .Release.Service }}
14+
spec:
15+
selfSigned: {}
16+
17+
---
18+
19+
# Generate a CA Certificate used to sign certificates for the webhook
20+
apiVersion: cert-manager.io/v1
21+
kind: Certificate
22+
metadata:
23+
name: {{ include "stackit-cert-manager-webhook.rootCACertificate" . }}
24+
namespace: {{ .Release.Namespace | quote }}
25+
labels:
26+
app: {{ include "stackit-cert-manager-webhook.name" . }}
27+
chart: {{ include "stackit-cert-manager-webhook.chart" . }}
28+
release: {{ .Release.Name }}
29+
heritage: {{ .Release.Service }}
30+
spec:
31+
secretName: {{ include "stackit-cert-manager-webhook.rootCACertificate" . }}
32+
duration: 43800h # 5y
33+
issuerRef:
34+
name: {{ include "stackit-cert-manager-webhook.selfSignedIssuer" . }}
35+
commonName: "ca.stackit-cert-manager-webhook.cert-manager"
36+
isCA: true
37+
38+
---
39+
40+
# Create an Issuer that uses the above generated CA certificate to issue certs
41+
apiVersion: cert-manager.io/v1
42+
kind: Issuer
43+
metadata:
44+
name: {{ include "stackit-cert-manager-webhook.rootCAIssuer" . }}
45+
namespace: {{ .Release.Namespace | quote }}
46+
labels:
47+
app: {{ include "stackit-cert-manager-webhook.name" . }}
48+
chart: {{ include "stackit-cert-manager-webhook.chart" . }}
49+
release: {{ .Release.Name }}
50+
heritage: {{ .Release.Service }}
51+
spec:
52+
ca:
53+
secretName: {{ include "stackit-cert-manager-webhook.rootCACertificate" . }}
54+
55+
---
56+
57+
# Finally, generate a serving certificate for the webhook to use
58+
apiVersion: cert-manager.io/v1
59+
kind: Certificate
60+
metadata:
61+
name: {{ include "stackit-cert-manager-webhook.servingCertificate" . }}
62+
namespace: {{ .Release.Namespace | quote }}
63+
labels:
64+
app: {{ include "stackit-cert-manager-webhook.name" . }}
65+
chart: {{ include "stackit-cert-manager-webhook.chart" . }}
66+
release: {{ .Release.Name }}
67+
heritage: {{ .Release.Service }}
68+
spec:
69+
secretName: {{ include "stackit-cert-manager-webhook.servingCertificate" . }}
70+
duration: 8760h # 1y
71+
issuerRef:
72+
name: {{ include "stackit-cert-manager-webhook.rootCAIssuer" . }}
73+
dnsNames:
74+
- {{ include "stackit-cert-manager-webhook.fullname" . }}
75+
- {{ include "stackit-cert-manager-webhook.fullname" . }}.{{ .Release.Namespace }}
76+
- {{ include "stackit-cert-manager-webhook.fullname" . }}.{{ .Release.Namespace }}.svc

0 commit comments

Comments
 (0)