dns

Documentation

Index

• Variables
• func GetOpenTelekomCloudDnsServerAddress() string
• type OpenTelekomCloudDnsProviderConfig
• type OpenTelekomCloudDnsProviderSecrets
• type OpenTelekomCloudDnsProviderSolver
  • func NewOpenTelekomCloudDnsProviderSolver(ctx context.Context) *OpenTelekomCloudDnsProviderSolver
  • func (s *OpenTelekomCloudDnsProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error
  • func (s *OpenTelekomCloudDnsProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error
  • func (s *OpenTelekomCloudDnsProviderSolver) Name() string
  • func (s *OpenTelekomCloudDnsProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error

Variables

var (
	OpenTelekomCloudDnsServers = []string{primaryDnsIpAddress, secondaryDnsIpAddress}
)

Functions

func GetOpenTelekomCloudDnsServerAddress

func GetOpenTelekomCloudDnsServerAddress() string

Types

type OpenTelekomCloudDnsProviderConfig

type OpenTelekomCloudDnsProviderConfig struct {
	// These fields will be set by users in the
	// `issuer.spec.acme.dns01.providers.webhook.config` field.
	Region             string                    `json:"region,required"`
	AccessKeySecretRef *corev1.SecretKeySelector `json:"accessKeySecretRef,omitempty"`
	SecretKeySecretRef *corev1.SecretKeySelector `json:"secretKeySecretRef,omitempty"`
}

OpenTelekomCloudDnsProviderConfig is a structure that is used to decode into when solving a DNS01 challenge. This information is provided by cert-manager, and may be a reference to additional configuration that's needed to solve the challenge for this particular certificate or issuer. This typically includes references to Secret resources containing DNS provider credentials, in cases where a 'multi-tenant' DNS solver is being created. If you do *not* require per-issuer or per-certificate configuration to be provided to your webhook, you can skip decoding altogether in favour of using CLI flags or similar to provide configuration.

**You should not include sensitive information here**.

If credentials need to be used by your provider here, you should reference a Kubernetes Secret resource and fetch these credentials using a Kubernetes clientset.

type OpenTelekomCloudDnsProviderSecrets

type OpenTelekomCloudDnsProviderSecrets struct {
	AccessKey string `env:"OS_ACCESS_KEY,required"`
	SecretKey string `env:"OS_SECRET_KEY,required"`
}

OpenTelekomCloudDnsProviderSecrets is a structure that is used to load the credentials from environment variables when solving a DNS01 challenge locally as the config.json refers only to Kubernetes secrets for the Open Telekom Cloud Access and Secret keys.

**DESIGN NOTE**

Access and Secret keys could had been set as environment variables for the Webhook and not for each Solver, but in that case we would be limiting each Webhook to a specific Domain/Project. Moving the credential keys as environment variables defined individually for each Solver, via a SecretRef and not directly, gives us the flexibility to work with multiple tenants from the same Webhook.

type OpenTelekomCloudDnsProviderSolver

type OpenTelekomCloudDnsProviderSolver struct {
	// contains filtered or unexported fields
}

OpenTelekomCloudDnsProviderSolver implements the provider-specific logic needed to 'present' an ACME challenge TXT record for your own DNS provider. To do so, it must implement the `github.com/cert-manager/cert-manager/pkg/acme/webhook.Solver` interface.

func NewOpenTelekomCloudDnsProviderSolver

func NewOpenTelekomCloudDnsProviderSolver(ctx context.Context) *OpenTelekomCloudDnsProviderSolver

func (*OpenTelekomCloudDnsProviderSolver) CleanUp

func (s *OpenTelekomCloudDnsProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error

CleanUp should delete the relevant TXT record from the DNS provider console. If multiple TXT records exist with the same record name (e.g. _acme-challenge.example.com) then **only** the record with the same `key` value provided on the ChallengeRequest should be cleaned up. This is in order to facilitate multiple DNS validations for the same domain concurrently.

func (*OpenTelekomCloudDnsProviderSolver) Initialize

func (s *OpenTelekomCloudDnsProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error

Initialize will be called when the webhook first starts. This method can be used to instantiate the webhook, i.e. initialising connections or warming up caches. Typically, the kubeClientConfig parameter is used to build a Kubernetes client that can be used to fetch resources from the Kubernetes API, e.g. Secret resources containing credentials used to authenticate with DNS provider accounts. The stopCh can be used to handle early termination of the webhook, in cases where a SIGTERM or similar signal is sent to the webhook process.

func (*OpenTelekomCloudDnsProviderSolver) Name

func (s *OpenTelekomCloudDnsProviderSolver) Name() string

Name is used as the name for this DNS solver when referencing it on the ACME Issuer resource. This should be unique **within the group name**, i.e. you can have two solvers configured with the same Name() **so long as they do not co-exist within a single webhook deployment**. For example, `cloudflare` may be used as the name of a solver.

func (*OpenTelekomCloudDnsProviderSolver) Present

func (s *OpenTelekomCloudDnsProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error

Present is responsible for actually presenting the DNS record with the DNS provider. This method should tolerate being called multiple times with the same value. cert-manager itself will later perform a self check to ensure that the solver has correctly configured the DNS provider.