-
Notifications
You must be signed in to change notification settings - Fork 3
/
main.go
297 lines (248 loc) · 9.93 KB
/
main.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
package main
import (
"encoding/json"
"fmt"
"os"
"strings"
extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/rest"
"k8s.io/klog"
"github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
"github.com/jetstack/cert-manager/pkg/acme/webhook/cmd"
"github.com/softlayer/softlayer-go/datatypes"
"github.com/softlayer/softlayer-go/filter"
"github.com/softlayer/softlayer-go/services"
"github.com/softlayer/softlayer-go/session"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
var GroupName = os.Getenv("GROUP_NAME")
func main() {
if GroupName == "" {
panic("GROUP_NAME must be specified")
}
// This will register our softlayer DNS provider with the webhook serving
// library, making it available as an API under the provided GroupName.
// You can register multiple DNS provider implementations with a single
// webhook, where the Name() method will be used to disambiguate between
// the different implementations.
cmd.RunWebhookServer(GroupName,
&softlayerDNSProviderSolver{},
)
}
// softlayerDNSProviderSolver implements the provider-specific logic needed to
// 'present' an ACME challenge TXT record for your own DNS provider.
// To do so, it must implement the `github.com/jetstack/cert-manager/pkg/acme/webhook.Solver`
// interface.
type softlayerDNSProviderSolver struct {
client *kubernetes.Clientset
}
// softlayerDNSProviderConfig is a structure that is used to decode into when
// solving a DNS01 challenge.
// This information is provided by cert-manager, and may be a reference to
// additional configuration that's needed to solve the challenge for this
// particular certificate or issuer.
// This typically includes references to Secret resources containing DNS
// provider credentials, in cases where a 'multi-tenant' DNS solver is being
// created.
// If you do *not* require per-issuer or per-certificate configuration to be
// provided to your webhook, you can skip decoding altogether in favour of
// using CLI flags or similar to provide configuration.
// You should not include sensitive information here. If credentials need to
// be used by your provider here, you should reference a Kubernetes Secret
// resource and fetch these credentials using a Kubernetes clientset.
type softlayerDNSProviderConfig struct {
// Change the two fields below according to the format of the configuration
// to be decoded.
// These fields will be set by users in the
// `issuer.spec.acme.dns01.providers.webhook.config` field.
Username string `json:"username"`
APIKeySecretRef cmmeta.SecretKeySelector `json:"apiKeySecretRef"`
}
// Name is used as the name for this DNS solver when referencing it on the ACME
// Issuer resource.
// This should be unique **within the group name**, i.e. you can have two
// solvers configured with the same Name() **so long as they do not co-exist
// within a single webhook deployment**.
// For example, `cloudflare` may be used as the name of a solver.
func (c *softlayerDNSProviderSolver) Name() string {
return "softlayer"
}
func (c *softlayerDNSProviderSolver) validate(cfg *softlayerDNSProviderConfig) error {
// Check that the username is defined
if cfg.Username == "" {
return fmt.Errorf("No Softlayer username provided")
}
// Try to load the API secret name
if cfg.APIKeySecretRef.LocalObjectReference.Name == "" {
return fmt.Errorf("No Softlayer API secret name provided")
}
// Try to load the API secret key
if cfg.APIKeySecretRef.Key == "" {
return fmt.Errorf("No Softlayer API secret keys provided")
}
return nil
}
func (c *softlayerDNSProviderSolver) provider(cfg *softlayerDNSProviderConfig, namespace string) (*session.Session, error) {
secretName := cfg.APIKeySecretRef.LocalObjectReference.Name
klog.V(6).Infof("Try to load secret `%s` with key `%s`", secretName, cfg.APIKeySecretRef.Key)
sec, err := c.client.CoreV1().Secrets(namespace).Get(secretName, metav1.GetOptions{})
if err != nil {
return nil, fmt.Errorf("unable to get secret `%s`; %v", secretName, err)
}
secBytes, ok := sec.Data[cfg.APIKeySecretRef.Key]
if !ok {
return nil, fmt.Errorf("Key %q not found in secret \"%s/%s\"", cfg.APIKeySecretRef.Key, cfg.APIKeySecretRef.LocalObjectReference.Name, namespace)
}
apiKey := string(secBytes)
return session.New(cfg.Username, apiKey), nil
}
// Present is responsible for actually presenting the DNS record with the
// DNS provider.
// This method should tolerate being called multiple times with the same value.
// cert-manager itself will later perform a self check to ensure that the
// solver has correctly configured the DNS provider.
func (c *softlayerDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error {
klog.V(6).Infof("call function Present: namespace=%s, zone=%s, fqdn=%s", ch.ResourceNamespace, ch.ResolvedZone, ch.ResolvedFQDN)
cfg, err := loadConfig(ch.Config)
if err != nil {
return fmt.Errorf("unable to load config: %s", err)
}
provider, err := c.provider(&cfg, ch.ResourceNamespace)
if err != nil {
return fmt.Errorf("unable to get provider: %s", err)
}
zone, err := c.getHostedZone(provider, ch.ResolvedZone)
if err != nil {
return fmt.Errorf("unable to get hosted zone: %s", err)
}
// Look for existing records.
svc := services.GetDnsDomainService(provider)
records, err := svc.Id(*zone).GetResourceRecords()
if len(records) == 0 || err != nil {
return fmt.Errorf("unable to get resource records: %s", err)
}
entry := strings.TrimSuffix(ch.ResolvedFQDN, "."+ch.ResolvedZone)
recordsTxt, err := c.findTxtRecords(provider, *zone, entry, ch.Key)
if err != nil {
return fmt.Errorf("unable to find txt records: %s", err)
}
if len(recordsTxt) > 0 {
// the record is already set to the desired value
return nil
}
if len(recordsTxt) >= 1 {
svcRecord := services.GetDnsDomainResourceRecordService(provider)
del, err := svcRecord.DeleteObjects(recordsTxt)
if del == false || err != nil {
return fmt.Errorf("unable to delete objects: %s", err)
}
}
ttl := 60
_, err = svc.Id(*zone).CreateTxtRecord(&entry, &ch.Key, &ttl)
if err != nil {
return fmt.Errorf("unable to create txt record: %s", err)
}
return nil
}
// CleanUp should delete the relevant TXT record from the DNS provider console.
// If multiple TXT records exist with the same record name (e.g.
// _acme-challenge.example.com) then **only** the record with the same `key`
// value provided on the ChallengeRequest should be cleaned up.
// This is in order to facilitate multiple DNS validations for the same domain
// concurrently.
func (c *softlayerDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
klog.V(6).Infof("call function CleanUp: namespace=%s, zone=%s, fqdn=%s", ch.ResourceNamespace, ch.ResolvedZone, ch.ResolvedFQDN)
cfg, err := loadConfig(ch.Config)
if err != nil {
return err
}
provider, err := c.provider(&cfg, ch.ResourceNamespace)
if err != nil {
return err
}
zone, err := c.getHostedZone(provider, ch.ResolvedZone)
if err != nil {
return err
}
entry := strings.TrimSuffix(ch.ResolvedFQDN, "."+ch.ResolvedZone)
records, err := c.findTxtRecords(provider, *zone, entry, ch.Key)
if err != nil {
return err
}
svc := services.GetDnsDomainResourceRecordService(provider)
del, err := svc.DeleteObjects(records)
if del == false || err != nil {
return err
}
return nil
}
// Initialize will be called when the webhook first starts.
// This method can be used to instantiate the webhook, i.e. initialising
// connections or warming up caches.
// Typically, the kubeClientConfig parameter is used to build a Kubernetes
// client that can be used to fetch resources from the Kubernetes API, e.g.
// Secret resources containing credentials used to authenticate with DNS
// provider accounts.
// The stopCh can be used to handle early termination of the webhook, in cases
// where a SIGTERM or similar signal is sent to the webhook process.
func (c *softlayerDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {
cl, err := kubernetes.NewForConfig(kubeClientConfig)
if err != nil {
return fmt.Errorf("unable to get k8s client: %s", err)
}
c.client = cl
return nil
}
// loadConfig is a small helper function that decodes JSON configuration into
// the typed config struct.
func loadConfig(cfgJSON *extapi.JSON) (softlayerDNSProviderConfig, error) {
cfg := softlayerDNSProviderConfig{}
// handle the 'base case' where no configuration has been provided
if cfgJSON == nil {
return cfg, nil
}
if err := json.Unmarshal(cfgJSON.Raw, &cfg); err != nil {
return cfg, fmt.Errorf("error decoding solver config: %v", err)
}
return cfg, nil
}
// getHostedZone returns the managed-zone
func (c *softlayerDNSProviderSolver) getHostedZone(session *session.Session, domain string) (*int, error) {
svc := services.GetAccountService(session)
filters := filter.New(
filter.Path("domains.name").Eq(strings.TrimSuffix(domain, ".")),
)
zones, err := svc.Filter(filters.Build()).GetDomains()
if err != nil {
return nil, fmt.Errorf("Softlayer API call failed: %v", err)
}
if len(zones) == 0 {
return nil, fmt.Errorf("No matching Softlayer domain found for domain %s", domain)
}
if len(zones) > 1 {
return nil, fmt.Errorf("Too many Softlayer domains found for domain %s", domain)
}
return zones[0].Id, nil
}
func (c *softlayerDNSProviderSolver) findTxtRecords(session *session.Session, zone int, entry, key string) ([]datatypes.Dns_Domain_ResourceRecord, error) {
txtType := "txt"
// Look for existing records.
svc := services.GetDnsDomainService(session)
filters := filter.New(
filter.Path("resourceRecords.type").Eq(txtType),
filter.Path("resourceRecords.host").Eq(entry),
)
recs, err := svc.Id(zone).Filter(filters.Build()).GetResourceRecords()
if err != nil {
return nil, err
}
found := []datatypes.Dns_Domain_ResourceRecord{}
for _, r := range recs {
if *r.Type == txtType && *r.Host == entry && *r.Data == key {
found = append(found, r)
}
}
return found, nil
}