Skip to content

Commit 61ba4d2

Browse files
crazygitcrazygit
committed
init cert-manager-alidns-webhook
1 parent 3aa7996 commit 61ba4d2

35 files changed

Lines changed: 2344 additions & 682 deletions

‎.github/workflows/ci.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
tags:
8+
- "v*.*.*"
9+
pull_request:
10+
branches:
11+
- master
12+
13+
permissions:
14+
contents: read
15+
packages: read
16+
17+
jobs:
18+
test:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
24+
- name: Set up Go
25+
uses: actions/setup-go@v5
26+
with:
27+
go-version: "1.25"
28+
cache: true
29+
30+
- name: Run go vet
31+
run: go vet ./...
32+
33+
- name: Run tests
34+
run: go test -race -coverprofile=coverage.txt -covermode=atomic ./...
35+
36+
- name: Upload coverage to Codecov
37+
uses: codecov/codecov-action@v4
38+
with:
39+
file: ./coverage.txt
40+
fail_ci_if_error: false
41+
verbose: true
42+
43+
helm-lint:
44+
runs-on: ubuntu-latest
45+
steps:
46+
- name: Checkout
47+
uses: actions/checkout@v4
48+
49+
- name: Set up Helm
50+
uses: azure/setup-helm@v4
51+
with:
52+
version: v3.16.0
53+
54+
- name: Lint Helm Chart
55+
run: |
56+
helm lint deploy/cert-manager-alidns-webhook
57+
58+
docker-release:
59+
if: startsWith(github.ref, 'refs/tags/v')
60+
needs: [test, helm-lint]
61+
uses: ./.github/workflows/docker-release.yaml
62+
secrets: inherit
63+
permissions:
64+
contents: write
65+
packages: write
66+
id-token: write
67+
68+
helm-release:
69+
if: startsWith(github.ref, 'refs/tags/v')
70+
needs: [test, helm-lint]
71+
uses: ./.github/workflows/helm-release.yaml
72+
secrets: inherit
73+
permissions:
74+
contents: write
75+
packages: write
76+
id-token: write
77+
78+
create-release:
79+
if: startsWith(github.ref, 'refs/tags/v')
80+
needs: [docker-release, helm-release]
81+
runs-on: ubuntu-latest
82+
permissions:
83+
contents: write
84+
steps:
85+
- name: Create GitHub Release
86+
uses: softprops/action-gh-release@v2
87+
with:
88+
body: |
89+
## Docker Image
90+
91+
```bash
92+
docker pull ghcr.io/crazygit/cert-manager-alidns-webhook:${{ github.ref_name }}
93+
```
94+
95+
## Helm Chart
96+
97+
```bash
98+
helm install cert-manager-alidns-webhook oci://ghcr.io/crazygit/helm-charts/cert-manager-alidns-webhook --version ${{ github.ref_name }}
99+
```
100+
env:
101+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/docker-release.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Docker Release
2+
3+
on:
4+
workflow_call:
5+
workflow_dispatch:
6+
7+
permissions:
8+
contents: read
9+
packages: write
10+
id-token: write
11+
12+
jobs:
13+
build-and-push:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v4
18+
19+
- name: Set up Docker Buildx
20+
uses: docker/setup-buildx-action@v3
21+
22+
- name: Login to GitHub Container Registry
23+
uses: docker/login-action@v3
24+
with:
25+
registry: ghcr.io
26+
username: ${{ github.actor }}
27+
password: ${{ secrets.GITHUB_TOKEN }}
28+
29+
- name: Extract metadata
30+
id: meta
31+
uses: docker/metadata-action@v5
32+
with:
33+
images: ghcr.io/crazygit/cert-manager-alidns-webhook
34+
tags: |
35+
type=semver,pattern={{version}}
36+
type=semver,pattern={{major}}.{{minor}}
37+
type=semver,pattern={{major}}
38+
type=sha
39+
40+
- name: Build and push
41+
uses: docker/build-push-action@v6
42+
with:
43+
context: .
44+
platforms: linux/amd64,linux/arm64
45+
push: true
46+
tags: ${{ steps.meta.outputs.tags }}
47+
labels: ${{ steps.meta.outputs.labels }}
48+
cache-from: type=gha
49+
cache-to: type=gha,mode=max
50+
provenance: true
51+
sbom: true

‎.github/workflows/helm-release.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Helm Release
2+
3+
on:
4+
workflow_call:
5+
workflow_dispatch:
6+
7+
permissions:
8+
contents: read
9+
packages: write
10+
id-token: write
11+
12+
jobs:
13+
package-and-push:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v4
18+
19+
- name: Set up Helm
20+
uses: azure/setup-helm@v4
21+
with:
22+
version: v3.16.0
23+
24+
- name: Package Helm Chart
25+
run: |
26+
cd deploy/cert-manager-alidns-webhook
27+
helm package .
28+
29+
- name: Login to GitHub Container Registry
30+
uses: docker/login-action@v3
31+
with:
32+
registry: ghcr.io
33+
username: ${{ github.actor }}
34+
password: ${{ secrets.GITHUB_TOKEN }}
35+
36+
- name: Push Helm Chart to GHCR
37+
run: |
38+
helm push deploy/cert-manager-alidns-webhook/*.tgz oci://ghcr.io/crazygit/helm-charts

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,4 @@ cert-manager-webhook-example
1717
# Make artifacts
1818
_out
1919
_test
20+
*.tgz

‎DEVELOPMENT.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# 开发指南
2+
3+
## 📋 项目概述
4+
5+
基于 [cert-manager/webhook-example](https://github.com/cert-manager/webhook-example) 模板，开发适用于阿里云 DNS (AliDNS) 的 cert-manager webhook。
6+
7+
### 核心特性
8+
9+
- ✅ 支持 **RRSA** (RAM Roles for Service Accounts) - 生产环境推荐
10+
- ✅ 支持 **AccessKey/SecretKey** - 开发/测试环境
11+
- ✅ 支持 **ECS 实例 RAM 角色** - ACK 自动支持
12+
- ✅ 使用 **V2.0 Tea SDK** - 官方推荐版本
13+
- ✅ **幂等性** DNS 记录管理
14+
- ✅ **Helm Chart** 一键部署
15+
16+
## 运行测试用例
17+
18+
### 单元测试
19+
20+
```
21+
$ go test -v ./pkg/alidns/...
22+
```
23+
24+
### 集成测试
25+
26+
⚠️ **注意**：
27+
28+
集成测试会通过 API 操作阿里云解析的域名记录，运行时最好使用一个**非生产环境**的域名测试。
29+
30+
前提条件：
31+
32+
- 已经有域名托管在阿里云解析
33+
- 参考[管理访问凭证](https://help.aliyun.com/zh/sdk/developer-reference/v2-manage-go-access-credentials), 在本地配置好了访问凭证的环境变量或`config.json`文件
34+
35+
```shell
36+
TEST_ZONE_NAME=example.com. make test
37+
```
38+
39+
替换上面命令中 `example.com.` 为你当前托管在阿里云用于测试的域名（不要忘记域名后面的 `.`）
40+
41+
## 🔗 参考资源
42+
43+
- [阿里云 Golang SDK 配置](https://next.api.aliyun.com/api-tools/sdk/Alidns?version=2015-01-09&language=go-tea&tab=primer-doc)
44+
- [管理访问凭证](https://help.aliyun.com/zh/sdk/developer-reference/v2-manage-go-access-credentials)
45+
- [Endpoint 设置](https://api.aliyun.com/product/Alidns)
46+
- [Cert-Manager Creating DNS Providers](https://cert-manager.io/docs/contributing/dns-providers/)
47+
- [Cert-Manager webhook-example](https://github.com/cert-manager/webhook-example)

‎Dockerfile‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,29 @@
1-
FROM golang:1.23-alpine3.19@sha256:5f3336882ad15d10ac1b59fbaba7cb84c35d4623774198b36ae60edeba45fd84 AS build_deps
2-
3-
RUN apk add --no-cache git
1+
# Build stage
2+
FROM golang:1.25.3 AS build
43

54
WORKDIR /workspace
65

7-
COPY go.mod .
8-
COPY go.sum .
9-
6+
# Download dependencies
7+
COPY go.mod go.sum ./
108
RUN go mod download
119

12-
FROM build_deps AS build
13-
10+
# Build the webhook binary
1411
COPY . .
12+
RUN CGO_ENABLED=0 go build \
13+
-ldflags '-w -extldflags "-static"' \
14+
-o cert-manager-alidns-webhook .
1515

16-
RUN CGO_ENABLED=0 go build -o webhook -ldflags '-w -extldflags "-static"' .
17-
18-
FROM alpine:3.23@sha256:865b95f46d98cf867a156fe4a135ad3fe50d2056aa3f25ed31662dff6da4eb62
16+
# Final stage
17+
FROM alpine:3.23
1918

2019
RUN apk add --no-cache ca-certificates
2120

22-
COPY --from=build /workspace/webhook /usr/local/bin/webhook
21+
# Non-root user
22+
RUN addgroup -g 1000 cert-manager && \
23+
adduser -u 1000 -G cert-manager -D -h /home/cert-manager cert-manager
24+
25+
USER cert-manager
26+
27+
COPY --from=build /workspace/cert-manager-alidns-webhook /usr/local/bin/cert-manager-alidns-webhook
2328

24-
ENTRYPOINT ["webhook"]
29+
ENTRYPOINT ["/usr/local/bin/cert-manager-alidns-webhook"]

‎Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ OUT := $(shell pwd)/_out
99

1010
KUBEBUILDER_VERSION=1.28.0
1111

12-
HELM_FILES := $(shell find deploy/example-webhook)
12+
HELM_FILES := $(shell find deploy/cert-manager-alidns-webhook)
1313

1414
test: _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kube-apiserver _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kubectl
1515
TEST_ASSET_ETCD=_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd \
@@ -36,10 +36,10 @@ rendered-manifest.yaml: $(OUT)/rendered-manifest.yaml
3636

3737
$(OUT)/rendered-manifest.yaml: $(HELM_FILES) | $(OUT)
3838
helm template \
39-
--name example-webhook \
39+
--name cert-manager-alidns-webhook \
4040
--set image.repository=$(IMAGE_NAME) \
4141
--set image.tag=$(IMAGE_TAG) \
42-
deploy/example-webhook > $@
42+
deploy/cert-manager-alidns-webhook > $@
4343

4444
_test $(OUT) _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH):
4545
mkdir -p $@

‎OWNERS‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

0 commit comments

Comments
 (0)