README.md

cert-manager-webhook-bunny

cert-manager webhook implementation for use with Bunny provider for solving ACME DNS-01 challenges.

This fork takes a much simpler approach to the verification process to ensure compatibility with future DNS format changes at Bunny.

The container images are signed since v1.1.1, and the signatures can be verified using cosign.

Usage

For the bunny-specific configuration, you will need a Kubernetes secret containing the API key. Ideally, you should provision this secret using an external secret manager.

If you need to create it manually for testing, use the following command:

 kubectl create secret generic bunny-api -n cert-manager --from-literal=api-key=<api-key-from-bunny-dashboard>

After creating the secret, configure your ClusterIssuer to have the following configuration (assuming the secret is called "bunny-api" and located in namespace "cert-manager"):

apiVersion: cert-manager.io/v1
kind: ClusterIssuer # Or Issuer
metadata:
  name: letsencrypt-prod-dns
spec:
  acme:
    email: your@email.pm
    privateKeySecretRef:
      name: letsencrypt-prod
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - dns01:
        webhook:
          groupName: bunny.aardbol.dev
          solverName: bunny
          config:
            secretRef: bunny-api
            secretNamespace: cert-manager

For more details, please refer to https://cert-manager.io/docs/configuration/acme/dns01/webhook/

Now, the actual webhook can be installed directly from the GitHub Container Registry (OCI) via Helm:

helm install my-cert-manager-webhook-bunny oci://ghcr.io/aardbol/charts/cert-manager-webhook-bunny --version <CHART_VERSION> --namespace cert-manager

From that point, the issuer configured above should be able to solve the DNS01 challenges using cert-manager-webhook-bunny.

Disclaimer

I am in no way affiliated or associated with Bunny.

(c) David Hidvegi, Leonardo a.k.a. github.com/aardbol, and contributors.

License

Apache 2 License