cert-manager-webhook-open-provider

This repo implements a cert-manager webhook for DNS01 challenges using Open Provider. It contains the golang code, it's Dockerfile, and helm chart.

Helm Chart

Installation

helm repo add codeberg.org https://codeberg.org/api/packages/open-engineering/helm
helm repo update
helm install cert-manager-webhook-open-provider codeberg.org/cert-manager-webhook-open-provider

Setting the log level

You can update your values.yaml with the following:

# this can any of the following: DEBUG, INFO, WARN, ERROR
logLevel: "DEBUG"

How to Setup the Issuer or ClusterIssuer

Make sure you first have an existing Kubernetes Secret with your Open Provider username and password. Example:

---
apiVersion: v1
kind: Secret
metadata:
  name: openprovider-api-credentials
stringData:
  username: my-username
  password: my-password-that-is-real-and-secur3

Here's a basic example of creating a ClusterIssuer:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # this should be YOUR actual email address
    email: your@email.tld
    privateKeySecretRef:
      name: letsencrypt-staging
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    solvers:
      - dns01:
          webhook:
            # leave this like this unless you changed groupName in the helm values.
            groupName: acme.openprovider.eu
            # this must be this value
            solverName: openprovider
            config:
              userSecretRef:
                # name of the Kubernetes Secret where you have your Open Provider username
                name: openprovider-api-credentials
                # key in your Kubernetes secret with the username
                key: USERNAME
              passwordSecretRef:
                # name of the Kubernetes Secret where you have your Open Provider password
                name: openprovider-api-credentials
                # key in your Kubernetes secret with the password
                key: PASSWORD

Status

This is still in the later beta phases as @jessebot and @cloudymax develop the open provider webhook from scratch :)

We followed this guide for cert-manager webhooks: https://cert-manager.io/docs/contributing/dns-providers/

And this guide for Open Provider's API: https://docs.openprovider.com/doc/all#tag/descDNSQuickstart

We need to add proper tests and ci for said tests, but this is otherwise in a good state for you to start testing in your own dev environments. PRs welcome for those tests after you read our contributing guide!

Limitations and Roadmap

We'd like to take an optional zoneId and/or zoneName in the spec.acme.solvers[].dns01.webhook.config section, so we can allow users to jail a given Issuer or ClusterIssuer to only one specific DNS Zone. Right now, we just assume it's the base domain like domain.tld, but this doesn't cover if you have a special zone like my.domain.tld that you want to use.