ACME webhook for InfoBlox WAPI
An InfoBlox WAPI webhook for cert-manager.
This project provides a custom ACME DNS01 Challenge Provider as a webhook for cert-manager. This webhook integrates cert-manager with InfoBlox WAPI is a REST API. You can learn more about WAPI in this PDF.
This implementation is based on infoblox-go-client library.
This project is a fork of https://github.com/cert-manager/webhook-example.
Requirements
- InfoBlox GRID installation with WAPI 2.5 or above
- helm v3
- kubernetes 1.21+
- cert-manager 1.5+
Note that other versions might work, but have not been tested.
Installation
- Cert-manager
- Infoblox-wapi webhook
- Issuer
Install Cert-manager
Follow instructions to install cert-manager.
Install infoblox-wapi webhook
At a minimum you will need to customize groupName
with your own group name. See deploy/cert-manager-webhook-infoblox-wapi/values.yaml for an in-depth explanation and other values that might require tweaking. With either method below, follow helm instructions to customize your deployment.
Docker images are stored in GitHub's ghcr.io registry, specifically at ghcr.io/luisico/cert-manager-webhook-infoblox-wapi.
Using the public helm chart
helm repo add cert-manager-webhook-infoblox-wapi https://luisico.github.io/cert-manager-webhook-infoblox-wapi
helm -n cert-manager install cert-manager-webhook-infoblox-wapi
From source
Check out this repository and run the following command:
helm -n cert-manager install webhook-infoblox-wapi deploy/cert-manager-webhook-infoblox-wapi
Values
Name | Description | Value |
---|---|---|
nameOverride | String to partially override chart name. | "" |
fullNameOverride | String to fully override chart fullname. | "" |
groupName | The GroupName here is used to identify your company or business unit that created this webhook. This name will need to be referenced in each Issuer's webhook stanza to inform cert-manager of where to send ChallengePayload resources in order to solve the DNS01 challenge. This group name should be unique, hence using your own company's domain # here is recommended. |
acme.mycompany.com |
certManager.namespace | Namespace where cert-manager is deployed. | cert-manager |
certManager.serviceAccountName | Service account name of cert-manager. | cert-manager |
rootCACertificate.duration | Duration of root CA certificate | 43800h |
servingCertificate.duration | Duration of serving certificate | 8760h |
image.repository | Deployment image repository | ghcr.io/luisico/cert-manager-webhook-infoblox-wapi |
image.tag | Deployment image tag | 1.5 |
image.pullPolicy | Image pull policy | IfNotPresent |
service.type | Service type to expose | ClusterIP |
service.port | Service port to expose | 443 |
resources | Deployment resource limits | {} |
nodeSelector | Deployment node selector object | {} |
tolerations | Deployment tolerations | [] |
affinity | Deployment affinity | {} |
Install a Issuer
To install your issuer you will need the following resources:
Issuer
orClusterIssuer
Secret
to store infoblox credentials.username
andpassword
can be defined in the same or different secrets.Role
andRoleBinding
to allow the webhook to access the secret
An example follows:
---
apiVersion: v1
kind: Secret
metadata:
name: infoblox-credentials
namespace: cert-manager
type: Opaque
data:
username: dXNlcm5hbWUK # base64 decoded: "username"
password: cGFzc3dvcmQK # base64 decoded: "password"
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt
spec:
acme:
email: your.email@example.com
server: https://acme-staging-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: letsencrypt-account-key
solvers:
- dns01:
webhook:
groupName: acme.mycompany.com
solverName: infoblox-wapi
config:
host: infoblox.fqdn
view: "InfoBlox View"
usernameSecretRef:
name: infoblox-credentials
key: username
passwordSecretRef:
name: infoblox-credentials
key: password
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: webhook-infoblox-wapi:secret-reader
namespace: cert-manager
rules:
- apiGroups: [""]
resources:
- secrets
resourceNames:
- infoblox-credentials
verbs:
- get
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: webhook-infoblox-wapi:secret-reader
namespace: cert-manager
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: webhook-infoblox-wapi:secret-reader
subjects:
- apiGroup: ""
kind: ServiceAccount
name: webhook-infoblox-wapi
namespace: cert-manager
Remember to adjust the previous snippet:
- For the
Secret
: change username and password. - For the
ClusterIssuer
:email
with your email address.server
with LE's production server when ready.groupName
with the same group name selected while installing the webhook earlier.config.host
with the FQDN or IP address of your InfoBlox WAPI server.config.view
with the DNS View you want to manipulate in your InfoBlox server.
This is the full list of webhook configuration options:
host
: FQDN or IP address of the InfoBlox server.port
: Port of the InfoBlox server (default: 443).version
: Version of the InfoBlox server (default: 2.5).usernameSecretRef
: Reference to the secret name holding the username for the InfoBlox serverpasswordSecretRef
: Reference to the secret name holding the password for the InfoBlox serverview
: DNS View in the InfoBlox server to manipulate TXT records in.sslVerify
: Verify SSL connection (default: false).httpRequestTimeout
: Timeout for HTTP request to the InfoBlox server, in seconds (default: 60).httpPoolConnections
: Maximum number of connections to the InfoBlox server (default: 10).
Now you can create a certificate, for example:
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: infoblox-wapi-test
namespace: cert-manager
spec:
commonName: example.com
dnsNames:
- example.com
issuerRef:
name: letsencrypt
kind: ClusterIssuer
secretName: infoblox-wapi-test-tls
Running the test suite
Requirements:
- go >= 1.16
First create you own config.json
and credentials.yaml
inside testdata/infoblox-wapi/
based on the corresponding .sample
files. The values in config.json
correspond to the webhook config
section in the example ClusterIssuer
above, while credentials.yaml
will create a secret. Ensure that you fill in the values for the test to connect to an InfoBlox instance.
You can then run the test suite with:
TEST_ZONE_NAME=example.com. make test
Contributions
I you would like to contribute to this projects, please, open a PR via GitHub. Thanks.
License
This project inherits the Apache 2.0 license from https://github.com/cert-manager/webhook-example.
Modifications to files are listed in NOTICE.
Author
Luis Gracia while at The Rockefeller University:
- lgracia [at] rockefeller.edu
- lgracia [at] gmail.com
- GitHub at luisico