6a1a4b9526
Kubebuilder tools version 1.21.2 previously used does not work on arm64 (specifically Raspberry PI). Interestingly, the latest (as of the time of this commit) version 1.24.2 does not work either. An error message like this causes the test to fail: apiserver.go:43: failed to start control plane: unable to start control plane itself: failed to start the controlplane. retried 5 times: timeout waiting for process kube-apiserver to start However, with 1.24.1 the test "mostly" passes, although it may occasionally fail. It might be that Raspberry PI is too slow and something times out. Signed-off-by: Marko Vukovic <anonsoftware@gmail.com> |
||
|---|---|---|
| deploy/example-webhook | ||
| example | ||
| testdata/my-custom-solver | ||
| .gitignore | ||
| Dockerfile | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| main.go | ||
| main_test.go | ||
| Makefile | ||
| OWNERS | ||
| README.md | ||
ACME webhook example
The ACME issuer type supports an optional 'webhook' solver, which can be used to implement custom DNS01 challenge solving logic.
This is useful if you need to use cert-manager with a DNS provider that is not officially supported in cert-manager core.
Why not in core?
As the project & adoption has grown, there has been an influx of DNS provider pull requests to our core codebase. As this number has grown, the test matrix has become un-maintainable and so, it's not possible for us to certify that providers work to a sufficient level.
By creating this 'interface' between cert-manager and DNS providers, we allow users to quickly iterate and test out new integrations, and then packaging those up themselves as 'extensions' to cert-manager.
We can also then provide a standardised 'testing framework', or set of conformance tests, which allow us to validate the a DNS provider works as expected.
Creating your own webhook
Webhook's themselves are deployed as Kubernetes API services, in order to allow administrators to restrict access to webhooks with Kubernetes RBAC.
This is important, as otherwise it'd be possible for anyone with access to your webhook to complete ACME challenge validations and obtain certificates.
To make the set up of these webhook's easier, we provide a template repository that can be used to get started quickly.
Creating your own repository
Running the test suite
All DNS providers must run the DNS01 provider conformance testing suite, else they will have undetermined behaviour when used with cert-manager.
It is essential that you configure and run the test suite when creating a DNS01 webhook.
An example Go test file has been provided in main_test.go.
You can run the test suite with:
$ TEST_ZONE_NAME=example.com. make test
The example file has a number of areas you must fill in and replace with your own options in order for tests to pass.