mirror of
https://github.com/cert-manager/webhook-example.git
synced 2025-07-02 23:05:48 +02:00
Merge pull request #1 from Timdawson264/circleci-project-setup
Circleci project setup
This commit is contained in:
Timothy Dawson
GitHub
commit
f86b0d21a5
4 changed files with 56 additions and 233 deletions
56
.circleci/config.yml
Normal file
56
.circleci/config.yml
Normal file
|
|
@ -0,0 +1,56 @@
|
||||||
|
# Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/2.0/configuration-reference
|
||||||
|
version: 2.1
|
||||||
|
jobs:
|
||||||
|
test:
|
||||||
|
working_directory: ~/repo
|
||||||
|
docker:
|
||||||
|
- image: circleci/golang:1.16
|
||||||
|
- image: mariadb:10.1
|
||||||
|
environment:
|
||||||
|
MYSQL_ROOT_PASSWORD: supersecret
|
||||||
|
- image: psitrax/powerdns
|
||||||
|
environment:
|
||||||
|
MYSQL_USER: root
|
||||||
|
MYSQL_PASS: supersecret
|
||||||
|
MYSQL_PORT: "3306"
|
||||||
|
MYSQL_HOST: "127.0.0.1"
|
||||||
|
command:
|
||||||
|
- "--webserver=yes"
|
||||||
|
- "--api=yes"
|
||||||
|
- "--api-key=password"
|
||||||
|
- "--webserver-port=8080"
|
||||||
|
- "--webserver-loglevel=detailed"
|
||||||
|
- "--loglevel=10"
|
||||||
|
- "--log-dns-queries=yes"
|
||||||
|
- "--master=yes"
|
||||||
|
- "--disable-syslog"
|
||||||
|
- "--webserver-address=0.0.0.0"
|
||||||
|
- "--webserver-allow-from=0.0.0.0/0"
|
||||||
|
steps:
|
||||||
|
- checkout
|
||||||
|
- restore_cache:
|
||||||
|
keys:
|
||||||
|
- go-mod-v4-{{ checksum "go.sum" }}
|
||||||
|
- run:
|
||||||
|
name: Install Dependencies
|
||||||
|
command: |
|
||||||
|
go mod download
|
||||||
|
make _test/kubebuilder
|
||||||
|
- save_cache:
|
||||||
|
key: go-mod-v4-{{ checksum "go.sum" }}
|
||||||
|
paths:
|
||||||
|
- "/go/pkg/mod"
|
||||||
|
- run:
|
||||||
|
name: Run tests
|
||||||
|
command: |
|
||||||
|
while [[ "$(curl -s -o /dev/null -w ''%{http_code}'' localhost:8080)" != "200" ]]; do sleep 3; done
|
||||||
|
curl -sv -X post -H 'X-API-Key: password' --data '{"id":"example.com.","name":"example.com.", "type": "zone", "kind": "native"}' http://localhost:8080/api/v1/servers/localhost/zones
|
||||||
|
mkdir -p /tmp/test-reports
|
||||||
|
env TEST_ZONE_NAME=example.com. gotestsum --junitfile /tmp/test-reports/unit-tests.xml
|
||||||
|
- store_test_results:
|
||||||
|
path: /tmp/test-reports
|
||||||
|
|
||||||
|
workflows:
|
||||||
|
test_publish:
|
||||||
|
jobs:
|
||||||
|
- test
|
||||||
|
|
@ -1,69 +0,0 @@
|
||||||
package example
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/miekg/dns"
|
|
||||||
)
|
|
||||||
|
|
||||||
func (e *exampleSolver) handleDNSRequest(w dns.ResponseWriter, req *dns.Msg) {
|
|
||||||
msg := new(dns.Msg)
|
|
||||||
msg.SetReply(req)
|
|
||||||
switch req.Opcode {
|
|
||||||
case dns.OpcodeQuery:
|
|
||||||
for _, q := range msg.Question {
|
|
||||||
if err := e.addDNSAnswer(q, msg, req); err != nil {
|
|
||||||
msg.SetRcode(req, dns.RcodeServerFailure)
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
w.WriteMsg(msg)
|
|
||||||
}
|
|
||||||
|
|
||||||
func (e *exampleSolver) addDNSAnswer(q dns.Question, msg *dns.Msg, req *dns.Msg) error {
|
|
||||||
switch q.Qtype {
|
|
||||||
// Always return loopback for any A query
|
|
||||||
case dns.TypeA:
|
|
||||||
rr, err := dns.NewRR(fmt.Sprintf("%s 5 IN A 127.0.0.1", q.Name))
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
msg.Answer = append(msg.Answer, rr)
|
|
||||||
return nil
|
|
||||||
|
|
||||||
// TXT records are the only important record for ACME dns-01 challenges
|
|
||||||
case dns.TypeTXT:
|
|
||||||
e.RLock()
|
|
||||||
record, found := e.txtRecords[q.Name]
|
|
||||||
e.RUnlock()
|
|
||||||
if !found {
|
|
||||||
msg.SetRcode(req, dns.RcodeNameError)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
rr, err := dns.NewRR(fmt.Sprintf("%s 5 IN TXT %s", q.Name, record))
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
msg.Answer = append(msg.Answer, rr)
|
|
||||||
return nil
|
|
||||||
|
|
||||||
// NS and SOA are for authoritative lookups, return obviously invalid data
|
|
||||||
case dns.TypeNS:
|
|
||||||
rr, err := dns.NewRR(fmt.Sprintf("%s 5 IN NS ns.example-acme-webook.invalid.", q.Name))
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
msg.Answer = append(msg.Answer, rr)
|
|
||||||
return nil
|
|
||||||
case dns.TypeSOA:
|
|
||||||
rr, err := dns.NewRR(fmt.Sprintf("%s 5 IN SOA %s 20 5 5 5 5", "ns.example-acme-webook.invalid.", "ns.example-acme-webook.invalid."))
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
msg.Answer = append(msg.Answer, rr)
|
|
||||||
return nil
|
|
||||||
default:
|
|
||||||
return fmt.Errorf("unimplemented record type %v", q.Qtype)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,68 +0,0 @@
|
||||||
// package example contains a self-contained example of a webhook that passes the cert-manager
|
|
||||||
// DNS conformance tests
|
|
||||||
package example
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
"sync"
|
|
||||||
|
|
||||||
"github.com/jetstack/cert-manager/pkg/acme/webhook"
|
|
||||||
acme "github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
|
|
||||||
"github.com/miekg/dns"
|
|
||||||
"k8s.io/client-go/rest"
|
|
||||||
)
|
|
||||||
|
|
||||||
type exampleSolver struct {
|
|
||||||
name string
|
|
||||||
server *dns.Server
|
|
||||||
txtRecords map[string]string
|
|
||||||
sync.RWMutex
|
|
||||||
}
|
|
||||||
|
|
||||||
func (e *exampleSolver) Name() string {
|
|
||||||
return e.name
|
|
||||||
}
|
|
||||||
|
|
||||||
func (e *exampleSolver) Present(ch *acme.ChallengeRequest) error {
|
|
||||||
e.Lock()
|
|
||||||
e.txtRecords[ch.ResolvedFQDN] = ch.Key
|
|
||||||
e.Unlock()
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (e *exampleSolver) CleanUp(ch *acme.ChallengeRequest) error {
|
|
||||||
e.Lock()
|
|
||||||
delete(e.txtRecords, ch.ResolvedFQDN)
|
|
||||||
e.Unlock()
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (e *exampleSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {
|
|
||||||
go func(done <-chan struct{}) {
|
|
||||||
<-done
|
|
||||||
if err := e.server.Shutdown(); err != nil {
|
|
||||||
fmt.Fprintf(os.Stderr, "%s\n", err.Error())
|
|
||||||
}
|
|
||||||
}(stopCh)
|
|
||||||
go func() {
|
|
||||||
if err := e.server.ListenAndServe(); err != nil {
|
|
||||||
fmt.Fprintf(os.Stderr, "%s\n", err.Error())
|
|
||||||
os.Exit(1)
|
|
||||||
}
|
|
||||||
}()
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func New(port string) webhook.Solver {
|
|
||||||
e := &exampleSolver{
|
|
||||||
name: "example",
|
|
||||||
txtRecords: make(map[string]string),
|
|
||||||
}
|
|
||||||
e.server = &dns.Server{
|
|
||||||
Addr: ":" + port,
|
|
||||||
Net: "udp",
|
|
||||||
Handler: dns.HandlerFunc(e.handleDNSRequest),
|
|
||||||
}
|
|
||||||
return e
|
|
||||||
}
|
|
||||||
|
|
@ -1,96 +0,0 @@
|
||||||
package example
|
|
||||||
|
|
||||||
import (
|
|
||||||
"crypto/rand"
|
|
||||||
"math/big"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
acme "github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
|
|
||||||
"github.com/miekg/dns"
|
|
||||||
"github.com/stretchr/testify/assert"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestExampleSolver_Name(t *testing.T) {
|
|
||||||
port, _ := rand.Int(rand.Reader, big.NewInt(50000))
|
|
||||||
port = port.Add(port, big.NewInt(15534))
|
|
||||||
solver := New(port.String())
|
|
||||||
assert.Equal(t, "example", solver.Name())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExampleSolver_Initialize(t *testing.T) {
|
|
||||||
port, _ := rand.Int(rand.Reader, big.NewInt(50000))
|
|
||||||
port = port.Add(port, big.NewInt(15534))
|
|
||||||
solver := New(port.String())
|
|
||||||
done := make(chan struct{})
|
|
||||||
err := solver.Initialize(nil, done)
|
|
||||||
assert.NoError(t, err, "Expected Initialize not to error")
|
|
||||||
close(done)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExampleSolver_Present_Cleanup(t *testing.T) {
|
|
||||||
port, _ := rand.Int(rand.Reader, big.NewInt(50000))
|
|
||||||
port = port.Add(port, big.NewInt(15534))
|
|
||||||
solver := New(port.String())
|
|
||||||
done := make(chan struct{})
|
|
||||||
err := solver.Initialize(nil, done)
|
|
||||||
assert.NoError(t, err, "Expected Initialize not to error")
|
|
||||||
|
|
||||||
validTestData := []struct {
|
|
||||||
hostname string
|
|
||||||
record string
|
|
||||||
}{
|
|
||||||
{"test1.example.com.", "testkey1"},
|
|
||||||
{"test2.example.com.", "testkey2"},
|
|
||||||
{"test3.example.com.", "testkey3"},
|
|
||||||
}
|
|
||||||
for _, test := range validTestData {
|
|
||||||
err := solver.Present(&acme.ChallengeRequest{
|
|
||||||
Action: acme.ChallengeActionPresent,
|
|
||||||
Type: "dns-01",
|
|
||||||
ResolvedFQDN: test.hostname,
|
|
||||||
Key: test.record,
|
|
||||||
})
|
|
||||||
assert.NoError(t, err, "Unexpected error while presenting %v", t)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Resolve test data
|
|
||||||
for _, test := range validTestData {
|
|
||||||
msg := new(dns.Msg)
|
|
||||||
msg.Id = dns.Id()
|
|
||||||
msg.RecursionDesired = true
|
|
||||||
msg.Question = make([]dns.Question, 1)
|
|
||||||
msg.Question[0] = dns.Question{dns.Fqdn(test.hostname), dns.TypeTXT, dns.ClassINET}
|
|
||||||
in, err := dns.Exchange(msg, "127.0.0.1:"+port.String())
|
|
||||||
|
|
||||||
assert.NoError(t, err, "Presented record %s not resolvable", test.hostname)
|
|
||||||
assert.Len(t, in.Answer, 1, "RR response is of incorrect length")
|
|
||||||
assert.Equal(t, []string{test.record}, in.Answer[0].(*dns.TXT).Txt, "TXT record returned did not match presented record")
|
|
||||||
}
|
|
||||||
|
|
||||||
// Cleanup test data
|
|
||||||
for _, test := range validTestData {
|
|
||||||
err := solver.CleanUp(&acme.ChallengeRequest{
|
|
||||||
Action: acme.ChallengeActionCleanUp,
|
|
||||||
Type: "dns-01",
|
|
||||||
ResolvedFQDN: test.hostname,
|
|
||||||
Key: test.record,
|
|
||||||
})
|
|
||||||
assert.NoError(t, err, "Unexpected error while cleaning up %v", t)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Resolve test data
|
|
||||||
for _, test := range validTestData {
|
|
||||||
msg := new(dns.Msg)
|
|
||||||
msg.Id = dns.Id()
|
|
||||||
msg.RecursionDesired = true
|
|
||||||
msg.Question = make([]dns.Question, 1)
|
|
||||||
msg.Question[0] = dns.Question{dns.Fqdn(test.hostname), dns.TypeTXT, dns.ClassINET}
|
|
||||||
in, err := dns.Exchange(msg, "127.0.0.1:"+port.String())
|
|
||||||
|
|
||||||
assert.NoError(t, err, "Presented record %s not resolvable", test.hostname)
|
|
||||||
assert.Len(t, in.Answer, 0, "RR response is of incorrect length")
|
|
||||||
assert.Equal(t, dns.RcodeNameError, in.Rcode, "Expexted NXDOMAIN")
|
|
||||||
}
|
|
||||||
|
|
||||||
close(done)
|
|
||||||
}
|
|
||||||
Loading…
Reference in a new issue