otcdns

Documentation

Overview

This part of the otcdns package offers a client that provides the ability to create and cleanup the needed TXT records in the OTC DNS. The methods are implemented in a way that they are most useful to build a solver. This is not a generic library.

Index

• Constants
• Variables
• func NewSolver() webhook.Solver
• type OtcDnsClient
  • func NewDNSV2Client() (*OtcDnsClient, error)
  • func NewDNSV2ClientWithAuth(authOpts otc.AuthOptionsProvider, endpointOpts otc.EndpointOpts) (*OtcDnsClient, error)
  • func (dnsClient *OtcDnsClient) DeleteRecordSet(zone *zones.Zone, recordset *recordsets.RecordSet) error
  • func (dnsClient *OtcDnsClient) DeleteTxtRecordValue(zone *zones.Zone, challengeValue string, deleteRecordsetIfEmpty bool) (*recordsets.RecordSet, error)
  • func (dnsClient *OtcDnsClient) GetHostedZone(zoneName string) (*zones.Zone, error)
  • func (dnsClient *OtcDnsClient) GetTxtRecordSet(zone *zones.Zone) (*recordsets.RecordSet, error)
  • func (dnsClient *OtcDnsClient) HasTxtRecordSet(zone *zones.Zone) (bool, error)
  • func (dnsClient *OtcDnsClient) HasTxtRecordValue(zone *zones.Zone, challengeValue string) (bool, *recordsets.RecordSet, error)
  • func (dnsClient *OtcDnsClient) NewTxtRecordSet(zone *zones.Zone, challengeValue string) (*recordsets.RecordSet, error)
  • func (dnsClient *OtcDnsClient) UpdateTxtRecordValues(zone *zones.Zone, recordset *recordsets.RecordSet, challengeValues []string) (*recordsets.RecordSet, error)
• type OtcDnsConfig
• type OtcDnsSolver
  • func (s *OtcDnsSolver) CleanUp(challengeRequest *v1alpha1.ChallengeRequest) error
  • func (s *OtcDnsSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error
  • func (s *OtcDnsSolver) Name() string
  • func (s *OtcDnsSolver) Present(challengeRequest *v1alpha1.ChallengeRequest) error

Constants

const (

	// otcuser, otcaksk
	OtcProfileNameUser string = "otcuser"
	OtcProfileNameAkSk string = "otcaksk"
)

Variables

var EnvOS = otcos.NewEnv(envPrefix)

Functions

func NewSolver

func NewSolver() webhook.Solver

Types

type OtcDnsClient

type OtcDnsClient struct {
	Sc *otc.ServiceClient

	//
	// Optional subdomain, which will be inserted between "_acme-challenge." and the zone name.
	//
	Subdomain string
}

The DNS client we use to trigger our DNS actions.

func NewDNSV2Client

func NewDNSV2Client() (*OtcDnsClient, error)

Creates a new DNSv2 ServiceClient. See also gophertelekomcloud/acceptance/clients/clients.go

func NewDNSV2ClientWithAuth

func NewDNSV2ClientWithAuth(authOpts otc.AuthOptionsProvider, endpointOpts otc.EndpointOpts) (*OtcDnsClient, error)

Creates a new DNSv2 ServiceClient. See also gophertelekomcloud/acceptance/clients/clients.go

func (*OtcDnsClient) DeleteRecordSet

func (dnsClient *OtcDnsClient) DeleteRecordSet(zone *zones.Zone, recordset *recordsets.RecordSet) error

Deletes the given recordset. The intention is that the given zone and recordset are the ones created for the ACME challenge.

func (*OtcDnsClient) DeleteTxtRecordValue

func (dnsClient *OtcDnsClient) DeleteTxtRecordValue(zone *zones.Zone, challengeValue string, deleteRecordsetIfEmpty bool) (*recordsets.RecordSet, error)

Deletes the given TXT value from the records for the ACME challenge.

challengeValue: The value that shall be deleted. deleteRecordsetIfEmpty: The OTC API does not allow to delete the last TXT value.

If this is set to true, the whole recordset is deleted, when there value to delete is the last one.

func (*OtcDnsClient) GetHostedZone

func (dnsClient *OtcDnsClient) GetHostedZone(zoneName string) (*zones.Zone, error)

Retrieves a Zone data structure by its name. https://pkg.go.dev/github.com/opentelekomcloud/gophertelekomcloud@v0.3.2/openstack/dns/v2/zones github.com/opentelekomcloud/gophertelekomcloud/openstack/dns/v2/zones

func (*OtcDnsClient) GetTxtRecordSet

func (dnsClient *OtcDnsClient) GetTxtRecordSet(zone *zones.Zone) (*recordsets.RecordSet, error)

Reads the TXT recordset created for the ACME challenge. Valid results are 1 or 0 recordsets. Error if query is not successful or more than 1 result.

func (*OtcDnsClient) HasTxtRecordSet

func (dnsClient *OtcDnsClient) HasTxtRecordSet(zone *zones.Zone) (bool, error)

Tests, if a TXT recordset exists for the ACME challenge.

func (*OtcDnsClient) HasTxtRecordValue

func (dnsClient *OtcDnsClient) HasTxtRecordValue(zone *zones.Zone, challengeValue string) (bool, *recordsets.RecordSet, error)

Tests, if the given challengeValue exists in the TXT records of the recordset.

func (*OtcDnsClient) NewTxtRecordSet

func (dnsClient *OtcDnsClient) NewTxtRecordSet(zone *zones.Zone, challengeValue string) (*recordsets.RecordSet, error)

Creates a new TXT recordset for the ACME challenge and sets the given challengeValue as TXT record. https://pkg.go.dev/github.com/opentelekomcloud/gophertelekomcloud@v0.3.2/openstack/dns/v2/recordsets github.com/opentelekomcloud/gophertelekomcloud/openstack/dns/v2/recordsets

func (*OtcDnsClient) UpdateTxtRecordValues

func (dnsClient *OtcDnsClient) UpdateTxtRecordValues(zone *zones.Zone, recordset *recordsets.RecordSet, challengeValues []string) (*recordsets.RecordSet, error)

Updates the given recordset with the set of TXT records for the ACME challenge. This allows you to add or remove TXT value records.

The challengeValues must have at least one entry. The OTC API has a bug. When we send an empty array the values are not deleted as expected.

type OtcDnsConfig

type OtcDnsConfig struct {
	// Only for testing. Fallback to store secret as Kuberentes configuration, when it is not configured as Kubernetes secret.
	// Especially useful until it becomes clear how to inject secrets in kubebuilder.
	AccessKey string `json:"accessKey"`
	// Only for testing. Fallback to store secret as Kuberentes configuration, when it is not configured as Kubernetes secret.
	// Especially useful until it becomes clear how to inject secrets in kubebuilder.
	SecretKey string `json:"secretKey"`
	// Location of the access key secret. The access key will be loaded from this secret reference.
	AccessKeySecretRef cmmeta1.SecretKeySelector `json:"accessKeySecretRef"`
	// Location of the secret key secret.  The secret key will be loaded from this secret reference.
	SecretKeySecretRef cmmeta1.SecretKeySelector `json:"secretKeySecretRef"`
	//
	Region string `json:"region"`
	//
	AuthURL string `json:"authURL"`
}

OtcDnsConfig is a structure that is used to decode into when solving a DNS01 challenge.

This information is provided by cert-manager, and may be a reference to additional configuration that's needed to solve the challenge for this particular certificate or issuer.

This typically includes references to Secret resources containing DNS provider credentials, in cases where a 'multi-tenant' DNS solver is being created.

If you do *not* require per-issuer or per-certificate configuration to be provided to your webhook, you can skip decoding altogether in favour of using CLI flags or similar to provide configuration.

You should not include sensitive information here. If credentials need to be used by your provider here, you should reference a Kubernetes Secret resource and fetch these credentials using a Kubernetes clientset.

type OtcDnsSolver

type OtcDnsSolver struct {
	// contains filtered or unexported fields
}

Solver implements the provider-specific logic needed to 'present' an ACME challenge TXT record for your own DNS provider. To do so, it must implement the `github.com/jetstack/cert-manager/pkg/acme/webhook.Solver` interface.

func (*OtcDnsSolver) CleanUp

func (s *OtcDnsSolver) CleanUp(challengeRequest *v1alpha1.ChallengeRequest) error

CleanUp should delete the relevant TXT record from the DNS provider console. If multiple TXT records exist with the same record name (e.g. _acme-challenge.example.com) then **only** the record with the same `key` value provided on the ChallengeRequest should be cleaned up. This is in order to facilitate multiple DNS validations for the same domain concurrently.

func (*OtcDnsSolver) Initialize

func (s *OtcDnsSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error

Initialize will be called when the webhook first starts. This method can be used to instantiate the webhook, i.e. initialising connections or warming up caches. Typically, the kubeClientConfig parameter is used to build a Kubernetes client that can be used to fetch resources from the Kubernetes API, e.g. Secret resources containing credentials used to authenticate with DNS provider accounts. The stopCh can be used to handle early termination of the webhook, in cases where a SIGTERM or similar signal is sent to the webhook process.

func (*OtcDnsSolver) Name

func (s *OtcDnsSolver) Name() string

Name is used as the name for this DNS solver when referencing it on the ACME Issuer resource. This should be unique **within the group name**, i.e. you can have two solvers configured with the same Name() **so long as they do not co-exist within a single webhook deployment**. For example, `cloudflare` may be used as the name of a solver.

func (*OtcDnsSolver) Present

func (s *OtcDnsSolver) Present(challengeRequest *v1alpha1.ChallengeRequest) error

Present is responsible for actually presenting the DNS record with the DNS provider. This method should tolerate being called multiple times with the same value. cert-manager itself will later perform a self check to ensure that the solver has correctly configured the DNS provider.

challengeRequest: The challenge request to resolve. The challenge request contains the configuration, that is defined in

the webhook sections of the ClusterIssuer solver configuration.