template-solver

The template-solver is a Cert-Manager Webhook solver implementation, that itself constructs and sends webhooks or API requests.

Requirements

• Kubernetes Cluster
• Cert-Manager v0.12.0
• go
• ko

Usage

Config

Note: headers, urlData and bodyData values need to start with an upper-case letter.

If bodyTemplate is defined a POST request will be sent.

Cleanup requests contain an empty DNSKey.

webhook:
  groupName: template-solver
  solverName: template-solver
  config:
    apiKeySecretRef:
      name: api-key
      key: example.com
    headers:
      Content-Type: "application/json"
    urlTemplate: "{{.URLData.Url}}{{.APIKey}}={{.DNSKey}}"
    urlData:
      Url: "https://ns.example.com/update.html?"
    bodyTemplate: ""
    bodyData:

Example

Secret to store webhook API key:

Note: the api-key secret must be created in the same namespace as the Certificate.

apiVersion: v1
kind: Secret
metadata:
  name: api-key
  namespace: default
type: Opaque
stringData:
  example.com: 92f6766fc1a43d9a96ccd93d33294cc6

Issuer:

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: template-solver-issuer
  namespace: default
spec:
  acme:
    email: user@example.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: template-solver-issuer-account-key
    solvers:
    - dns01:
        webhook:
          groupName: template-solver
          solverName: template-solver
          config:
            apiKeySecretRef:
              name: api-key
              key: example.com
            urlTemplate: "{{.URLData.Url}}{{.APIKey}}={{.DNSKey}}"
            urlData:
              Url: "https://ns.example.com/update.html?"

Certificate:

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: example-com
  namespace: default
spec:
  secretName: example-com-tls
  duration: 2160h
  renewBefore: 360h
  isCA: false
  keySize: 2048
  keyAlgorithm: rsa
  keyEncoding: pkcs1
  usages:
    - server auth
    - client auth
  dnsNames:
  - '*.example.com'
  issuerRef:
    name: template-solver-issuer

Build and run

echo KO_DOCKER_REPO='gcr.io/my-gcloud-project-name' >env.txt

./build.sh