weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Add support for pulling Route53/AWS access key IDs out of secrets

Browse Source 
Signed-off-by: Compy <hello@86pixels.com>
This commit is contained in:
Compy 2022-06-08 16:33:00 -05:00
parent 7dd918b475
commit 153e5420cf
18 changed files with 104 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
deploy/crds/crd-challenges.yaml
View File

@ -329,6 +329,18 @@ spec:
accessKeyID:
description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
type: string
accessKeyIDSecretRef:
description: The SecretAccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
type: object
required:
- name
properties:
key:
description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
hostedZoneID:
description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
type: string

12
deploy/crds/crd-clusterissuers.yaml
View File

@ -364,6 +364,18 @@ spec:
accessKeyID:
description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
type: string
accessKeyIDSecretRef:
description: The SecretAccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
type: object
required:
- name
properties:
key:
description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
hostedZoneID:
description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
type: string

12
deploy/crds/crd-issuers.yaml
View File

@ -364,6 +364,18 @@ spec:
accessKeyID:
description: 'The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
type: string
accessKeyIDSecretRef:
description: The SecretAccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
type: object
required:
- name
properties:
key:
description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required.
type: string
name:
description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type: string
hostedZoneID:
description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
type: string

4
internal/apis/acme/types_issuer.go
View File

@ -403,6 +403,10 @@ type ACMEIssuerDNS01ProviderRoute53 struct {
// see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
AccessKeyID string
// The SecretAccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
SecretAccessKeyID cmmeta.SecretKeySelector
// The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
SecretAccessKey cmmeta.SecretKeySelector

6
internal/apis/acme/v1/zz_generated.conversion.go
View File

@ -1205,6 +1205,9 @@ func Convert_acme_ACMEIssuerDNS01ProviderRFC2136_To_v1_ACMEIssuerDNS01ProviderRF
func autoConvert_v1_ACMEIssuerDNS01ProviderRoute53_To_acme_ACMEIssuerDNS01ProviderRoute53(in *v1.ACMEIssuerDNS01ProviderRoute53, out *acme.ACMEIssuerDNS01ProviderRoute53, s conversion.Scope) error {
out.AccessKeyID = in.AccessKeyID
if err := metav1.Convert_v1_SecretKeySelector_To_meta_SecretKeySelector(&in.SecretAccessKeyID, &out.SecretAccessKeyID, s); err != nil {
return err
}
if err := metav1.Convert_v1_SecretKeySelector_To_meta_SecretKeySelector(&in.SecretAccessKey, &out.SecretAccessKey, s); err != nil {
return err
}
@ -1221,6 +1224,9 @@ func Convert_v1_ACMEIssuerDNS01ProviderRoute53_To_acme_ACMEIssuerDNS01ProviderRo
func autoConvert_acme_ACMEIssuerDNS01ProviderRoute53_To_v1_ACMEIssuerDNS01ProviderRoute53(in *acme.ACMEIssuerDNS01ProviderRoute53, out *v1.ACMEIssuerDNS01ProviderRoute53, s conversion.Scope) error {
out.AccessKeyID = in.AccessKeyID
if err := metav1.Convert_meta_SecretKeySelector_To_v1_SecretKeySelector(&in.SecretAccessKeyID, &out.SecretAccessKeyID, s); err != nil {
return err
}
if err := metav1.Convert_meta_SecretKeySelector_To_v1_SecretKeySelector(&in.SecretAccessKey, &out.SecretAccessKey, s); err != nil {
return err
}

5
internal/apis/acme/v1alpha2/types_issuer.go
View File

@ -457,6 +457,11 @@ type ACMEIssuerDNS01ProviderRoute53 struct {
// +optional
AccessKeyID string `json:"accessKeyID,omitempty"`
// The SecretAccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional
SecretAccessKeyID cmmeta.SecretKeySelector `json:"accessKeyIDSecretRef"`
// The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional

6
internal/apis/acme/v1alpha2/zz_generated.conversion.go
View File

@ -1204,6 +1204,9 @@ func Convert_acme_ACMEIssuerDNS01ProviderRFC2136_To_v1alpha2_ACMEIssuerDNS01Prov
func autoConvert_v1alpha2_ACMEIssuerDNS01ProviderRoute53_To_acme_ACMEIssuerDNS01ProviderRoute53(in *ACMEIssuerDNS01ProviderRoute53, out *acme.ACMEIssuerDNS01ProviderRoute53, s conversion.Scope) error {
out.AccessKeyID = in.AccessKeyID
if err := metav1.Convert_v1_SecretKeySelector_To_meta_SecretKeySelector(&in.SecretAccessKeyID, &out.SecretAccessKeyID, s); err != nil {
return err
}
if err := metav1.Convert_v1_SecretKeySelector_To_meta_SecretKeySelector(&in.SecretAccessKey, &out.SecretAccessKey, s); err != nil {
return err
}
@ -1220,6 +1223,9 @@ func Convert_v1alpha2_ACMEIssuerDNS01ProviderRoute53_To_acme_ACMEIssuerDNS01Prov
func autoConvert_acme_ACMEIssuerDNS01ProviderRoute53_To_v1alpha2_ACMEIssuerDNS01ProviderRoute53(in *acme.ACMEIssuerDNS01ProviderRoute53, out *ACMEIssuerDNS01ProviderRoute53, s conversion.Scope) error {
out.AccessKeyID = in.AccessKeyID
if err := metav1.Convert_meta_SecretKeySelector_To_v1_SecretKeySelector(&in.SecretAccessKeyID, &out.SecretAccessKeyID, s); err != nil {
return err
}
if err := metav1.Convert_meta_SecretKeySelector_To_v1_SecretKeySelector(&in.SecretAccessKey, &out.SecretAccessKey, s); err != nil {
return err
}

1
internal/apis/acme/v1alpha2/zz_generated.deepcopy.go
View File

@ -573,6 +573,7 @@ func (in *ACMEIssuerDNS01ProviderRFC2136) DeepCopy() *ACMEIssuerDNS01ProviderRFC
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ACMEIssuerDNS01ProviderRoute53) DeepCopyInto(out *ACMEIssuerDNS01ProviderRoute53) {
*out = *in
out.SecretAccessKeyID = in.SecretAccessKeyID
out.SecretAccessKey = in.SecretAccessKey
return
}

5
internal/apis/acme/v1alpha3/types_issuer.go
View File

@ -457,6 +457,11 @@ type ACMEIssuerDNS01ProviderRoute53 struct {
// +optional
AccessKeyID string `json:"accessKeyID,omitempty"`
// The SecretAccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional
SecretAccessKeyID cmmeta.SecretKeySelector `json:"accessKeyIDSecretRef"`
// The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional

6
internal/apis/acme/v1alpha3/zz_generated.conversion.go
View File

@ -1204,6 +1204,9 @@ func Convert_acme_ACMEIssuerDNS01ProviderRFC2136_To_v1alpha3_ACMEIssuerDNS01Prov
func autoConvert_v1alpha3_ACMEIssuerDNS01ProviderRoute53_To_acme_ACMEIssuerDNS01ProviderRoute53(in *ACMEIssuerDNS01ProviderRoute53, out *acme.ACMEIssuerDNS01ProviderRoute53, s conversion.Scope) error {
out.AccessKeyID = in.AccessKeyID
if err := metav1.Convert_v1_SecretKeySelector_To_meta_SecretKeySelector(&in.SecretAccessKeyID, &out.SecretAccessKeyID, s); err != nil {
return err
}
if err := metav1.Convert_v1_SecretKeySelector_To_meta_SecretKeySelector(&in.SecretAccessKey, &out.SecretAccessKey, s); err != nil {
return err
}
@ -1220,6 +1223,9 @@ func Convert_v1alpha3_ACMEIssuerDNS01ProviderRoute53_To_acme_ACMEIssuerDNS01Prov
func autoConvert_acme_ACMEIssuerDNS01ProviderRoute53_To_v1alpha3_ACMEIssuerDNS01ProviderRoute53(in *acme.ACMEIssuerDNS01ProviderRoute53, out *ACMEIssuerDNS01ProviderRoute53, s conversion.Scope) error {
out.AccessKeyID = in.AccessKeyID
if err := metav1.Convert_meta_SecretKeySelector_To_v1_SecretKeySelector(&in.SecretAccessKeyID, &out.SecretAccessKeyID, s); err != nil {
return err
}
if err := metav1.Convert_meta_SecretKeySelector_To_v1_SecretKeySelector(&in.SecretAccessKey, &out.SecretAccessKey, s); err != nil {
return err
}

1
internal/apis/acme/v1alpha3/zz_generated.deepcopy.go
View File

@ -573,6 +573,7 @@ func (in *ACMEIssuerDNS01ProviderRFC2136) DeepCopy() *ACMEIssuerDNS01ProviderRFC
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ACMEIssuerDNS01ProviderRoute53) DeepCopyInto(out *ACMEIssuerDNS01ProviderRoute53) {
*out = *in
out.SecretAccessKeyID = in.SecretAccessKeyID
out.SecretAccessKey = in.SecretAccessKey
return
}

5
internal/apis/acme/v1beta1/types_issuer.go
View File

@ -456,6 +456,11 @@ type ACMEIssuerDNS01ProviderRoute53 struct {
// +optional
AccessKeyID string `json:"accessKeyID,omitempty"`
// The SecretAccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional
SecretAccessKeyID cmmeta.SecretKeySelector `json:"accessKeyIDSecretRef"`
// The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional

6
internal/apis/acme/v1beta1/zz_generated.conversion.go
View File

@ -1204,6 +1204,9 @@ func Convert_acme_ACMEIssuerDNS01ProviderRFC2136_To_v1beta1_ACMEIssuerDNS01Provi
func autoConvert_v1beta1_ACMEIssuerDNS01ProviderRoute53_To_acme_ACMEIssuerDNS01ProviderRoute53(in *ACMEIssuerDNS01ProviderRoute53, out *acme.ACMEIssuerDNS01ProviderRoute53, s conversion.Scope) error {
out.AccessKeyID = in.AccessKeyID
if err := metav1.Convert_v1_SecretKeySelector_To_meta_SecretKeySelector(&in.SecretAccessKeyID, &out.SecretAccessKeyID, s); err != nil {
return err
}
if err := metav1.Convert_v1_SecretKeySelector_To_meta_SecretKeySelector(&in.SecretAccessKey, &out.SecretAccessKey, s); err != nil {
return err
}
@ -1220,6 +1223,9 @@ func Convert_v1beta1_ACMEIssuerDNS01ProviderRoute53_To_acme_ACMEIssuerDNS01Provi
func autoConvert_acme_ACMEIssuerDNS01ProviderRoute53_To_v1beta1_ACMEIssuerDNS01ProviderRoute53(in *acme.ACMEIssuerDNS01ProviderRoute53, out *ACMEIssuerDNS01ProviderRoute53, s conversion.Scope) error {
out.AccessKeyID = in.AccessKeyID
if err := metav1.Convert_meta_SecretKeySelector_To_v1_SecretKeySelector(&in.SecretAccessKeyID, &out.SecretAccessKeyID, s); err != nil {
return err
}
if err := metav1.Convert_meta_SecretKeySelector_To_v1_SecretKeySelector(&in.SecretAccessKey, &out.SecretAccessKey, s); err != nil {
return err
}

1
internal/apis/acme/v1beta1/zz_generated.deepcopy.go
View File

@ -573,6 +573,7 @@ func (in *ACMEIssuerDNS01ProviderRFC2136) DeepCopy() *ACMEIssuerDNS01ProviderRFC
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ACMEIssuerDNS01ProviderRoute53) DeepCopyInto(out *ACMEIssuerDNS01ProviderRoute53) {
*out = *in
out.SecretAccessKeyID = in.SecretAccessKeyID
out.SecretAccessKey = in.SecretAccessKey
return
}

1
internal/apis/acme/zz_generated.deepcopy.go
View File

@ -573,6 +573,7 @@ func (in *ACMEIssuerDNS01ProviderRFC2136) DeepCopy() *ACMEIssuerDNS01ProviderRFC
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ACMEIssuerDNS01ProviderRoute53) DeepCopyInto(out *ACMEIssuerDNS01ProviderRoute53) {
*out = *in
out.SecretAccessKeyID = in.SecretAccessKeyID
out.SecretAccessKey = in.SecretAccessKey
return
}

5
pkg/apis/acme/v1/types_issuer.go
View File

@ -460,6 +460,11 @@ type ACMEIssuerDNS01ProviderRoute53 struct {
// +optional
AccessKeyID string `json:"accessKeyID,omitempty"`
// The SecretAccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional
SecretAccessKeyID cmmeta.SecretKeySelector `json:"accessKeyIDSecretRef"`
// The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional

1
pkg/apis/acme/v1/zz_generated.deepcopy.go
View File

@ -573,6 +573,7 @@ func (in *ACMEIssuerDNS01ProviderRFC2136) DeepCopy() *ACMEIssuerDNS01ProviderRFC
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ACMEIssuerDNS01ProviderRoute53) DeepCopyInto(out *ACMEIssuerDNS01ProviderRoute53) {
*out = *in
out.SecretAccessKeyID = in.SecretAccessKeyID
out.SecretAccessKey = in.SecretAccessKey
return
}

16
pkg/issuer/acme/dns/dns.go
View File

@ -292,6 +292,20 @@ func (s *Solver) solverForChallenge(ctx context.Context, issuer v1.GenericIssuer
}
case providerConfig.Route53 != nil:
dbg.Info("preparing to create Route53 provider")
secretAccessKeyID := strings.TrimSpace(providerConfig.Route53.AccessKeyID)
if providerConfig.Route53.SecretAccessKeyID.Name != "" {
secretAccessKeyIDSecret, err := s.secretLister.Secrets(resourceNamespace).Get(providerConfig.Route53.SecretAccessKeyID.Name)
if err != nil {
return nil, nil, fmt.Errorf("error getting route53 secret access key id: %s", err)
}
secretAccessKeyIDBytes, ok := secretAccessKeyIDSecret.Data[providerConfig.Route53.SecretAccessKeyID.Key]
if !ok {
return nil, nil, fmt.Errorf("error getting route53 secret access key id: key '%s' not found in secret", providerConfig.Route53.SecretAccessKeyID.Key)
}
secretAccessKeyID = string(secretAccessKeyIDBytes)
}
secretAccessKey := ""
if providerConfig.Route53.SecretAccessKey.Name != "" {
secretAccessKeySecret, err := s.secretLister.Secrets(resourceNamespace).Get(providerConfig.Route53.SecretAccessKey.Name)
@ -307,7 +321,7 @@ func (s *Solver) solverForChallenge(ctx context.Context, issuer v1.GenericIssuer
}
impl, err = s.dnsProviderConstructors.route53(
strings.TrimSpace(providerConfig.Route53.AccessKeyID),
secretAccessKeyID,
strings.TrimSpace(secretAccessKey),
providerConfig.Route53.HostedZoneID,
providerConfig.Route53.Region,