cert-manager Webhook for OpenStack Designate

Note: This project is 100% vibes by Claude.

Note: This project is heavily inspired by (stolen from?) and based on syseleven/designate-certmanager-webhook. That project is no longer maintained and does not work with recent Kubernetes versions. This is a modernized rewrite using gophercloud/v2, with fixes for Kubernetes 1.28+ compatibility and improved handling of concurrent DNS validations.

A cert-manager ACME DNS01 webhook solver for OpenStack Designate.

This webhook allows cert-manager to use OpenStack Designate DNS as a DNS01 challenge solver, enabling automatic certificate issuance for domains managed by Designate.

Prerequisites

Kubernetes 1.28+
cert-manager 1.14+
Access to an OpenStack project with Designate DNS service

Installation

Helm

helm install designate-webhook ./deploy/example-webhook \
  --namespace cert-manager \
  --set groupName=acme.example.com \
  --set openstack.authURL=https://keystone.example.com:5000/v3 \
  --set openstack.region=RegionOne \
  --set openstack.username=myuser \
  --set openstack.password=mypassword \
  --set openstack.projectName=myproject \
  --set openstack.userDomainName=Default \
  --set openstack.projectDomainName=Default

Using Application Credentials (recommended)

helm install designate-webhook ./deploy/example-webhook \
  --namespace cert-manager \
  --set groupName=acme.example.com \
  --set openstack.authURL=https://keystone.example.com:5000/v3 \
  --set openstack.region=RegionOne \
  --set openstack.applicationCredentialID=<id> \
  --set openstack.applicationCredentialSecret=<secret>

Using an Existing Secret

Create a secret with OpenStack environment variables:

apiVersion: v1
kind: Secret
metadata:
  name: openstack-credentials
  namespace: cert-manager
type: Opaque
stringData:
  OS_AUTH_URL: https://keystone.example.com:5000/v3
  OS_REGION_NAME: RegionOne
  OS_APPLICATION_CREDENTIAL_ID: <id>
  OS_APPLICATION_CREDENTIAL_SECRET: <secret>

Then install with:

helm install designate-webhook ./deploy/example-webhook \
  --namespace cert-manager \
  --set groupName=acme.example.com \
  --set openstack.existingSecret=openstack-credentials

Configuration

Issuer Configuration

Create a ClusterIssuer (or Issuer) that references this webhook:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: your-email@example.com
    privateKeySecretRef:
      name: letsencrypt-account-key
    solvers:
      - dns01:
          webhook:
            groupName: acme.example.com
            solverName: designate

Certificate Example

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-cert
spec:
  secretName: example-cert-tls
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - '*.example.com'
    - example.com

Environment Variables

The webhook reads the following environment variables for OpenStack authentication:

Variable	Description
`GROUP_NAME`	The API group name for the webhook (required)
`OS_AUTH_URL`	OpenStack Keystone authentication URL
`OS_REGION_NAME`	OpenStack region
`OS_USERNAME`	OpenStack username
`OS_PASSWORD`	OpenStack password
`OS_PROJECT_NAME`	OpenStack project name
`OS_USER_DOMAIN_NAME`	User domain name (default: "Default")
`OS_PROJECT_DOMAIN_NAME`	Project domain name (default: "Default")
`OS_APPLICATION_CREDENTIAL_ID`	Application credential ID
`OS_APPLICATION_CREDENTIAL_NAME`	Application credential name
`OS_APPLICATION_CREDENTIAL_SECRET`	Application credential secret
`OS_CACERT`	Path to custom CA certificate file

Building

# Build binary
go build -o webhook .

# Build Docker image
docker build -t your-registry/designate-webhook:latest .

Development

# Run tests
go test ./...

# Run vet
go vet ./...

License

forskit-rse/claude-vs-designate

About

Resources

License

Stars

Watchers

Forks

Releases

Packages 0

Languages

Packages