add return value and using secret

Infinity-Server · Nov 15, 2022 · fed5e96 · fed5e96
1 parent 8fe5c8e
commit fed5e96
Show file tree

Hide file tree

Showing 5 changed files with 87 additions and 34 deletions.
diff --git a/.github/workflows/acmesh.yml b/.github/workflows/acmesh.yml
@@ -29,7 +29,7 @@ jobs:
           push: true
           context: ${{ github.job }}
           file: ${{ github.job }}/Dockerfile
-          platforms: linux/amd64,linux/arm64/v8
+          platforms: linux/amd64
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/${{ github.job }}:latest
           cache-from: type=registry,ref=${{ secrets.DOCKER_HUB_USERNAME }}/${{ github.job }}:buildcache
           cache-to: type=registry,ref=${{ secrets.DOCKER_HUB_USERNAME }}/${{ github.job }}:buildcache,mode=max

diff --git a/acmesh/acme_delegate b/acmesh/acme_delegate
@@ -1,18 +1,23 @@
 #!/bin/bash
 
-echo '__________________________ acme.sh environments __________________________'
+echo '__________________________ acme_delegate initialize __________________________'
 export HOME=/root
 export DEBUG=3
 cd /root
 export
 
+echo '__________________________ acme.sh environments __________________________'
 dosk_dnsapi="$1"
 dosk_action="$2"
 dosk_fulldomain="$3"
 dosk_txtvalue="$4"
+dosk_lasterror=""
 
 echo '__________________________ acme.sh delegate __________________________'
 source /root/.acme.sh/acme.sh --info
 source /root/.acme.sh/dnsapi/${dosk_dnsapi}.sh
 ${dosk_dnsapi}_${dosk_action} "$dosk_fulldomain" "$dosk_txtvalue"
+retval=$?
+
 echo '__________________________ acme.sh finish __________________________'
+echo "ACME_RETVAL${retval}ACME_RETVAL"
diff --git a/acmesh/go.mod b/acmesh/go.mod
@@ -3,8 +3,10 @@ module github.com/infinity-server/dockerset
 go 1.13
 
 require (
+	github.com/google/uuid v1.1.1
 	github.com/jetstack/cert-manager v1.2.0
 	k8s.io/apiextensions-apiserver v0.19.0
+	k8s.io/apimachinery v0.19.0
 	k8s.io/client-go v0.19.0
 	k8s.io/klog v1.0.0
 )
diff --git a/acmesh/main.go b/acmesh/main.go
@@ -1,23 +1,29 @@
 package main
 
 import (
-  "encoding/json"
+  "os"
   "fmt"
-  "github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util"
+  "context"
+  "strings"
+  "encoding/json"
   "k8s.io/client-go/kubernetes"
-  "os"
 
-  extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
-  "k8s.io/client-go/rest"
   "k8s.io/klog"
+  "k8s.io/client-go/rest"
+  metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+  extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
 
-  "github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
   "github.com/jetstack/cert-manager/pkg/acme/webhook/cmd"
+  "github.com/jetstack/cert-manager/pkg/issuer/acme/dns/util"
+  "github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
+
+  "github.com/google/uuid"
 )
 
 const (
   defaultTTL = 600
   acmeDelegate = "/root/acme_delegate"
+  acmeReturnValue = "ACME_RETVAL"
 )
 
 var GroupName = os.Getenv("GROUP_NAME")
@@ -27,67 +33,107 @@ func main() {
     panic("GROUP_NAME must be specified")
   }
 
-  cmd.RunWebhookServer(GroupName,
-  &customDNSProviderSolver{},
-)
+  cmd.RunWebhookServer(GroupName, &customDNSProviderSolver{})
 }
 
 type customDNSProviderSolver struct {
   client *kubernetes.Clientset
 }
 
+type envSecretRef struct {
+  Name          string                  `json:"name"`
+  Namespace     string                  `json:"namespace"`
+}
+
 type customDNSProviderConfig struct {
-  TTL          *uint64                  `json:"ttl"`
-  DNSAPI       string                   `json:"dnsapi"`
-  Env          []string                 `json:"env"`
+  TTL           *uint64                 `json:"ttl"`
+  DNSAPI        string                  `json:"dnsapi"`
+  EnvSecretRef  envSecretRef            `json:"env"`
 }
 
+type envFromSecret []string
+
 func (c *customDNSProviderSolver) Name() string {
   return "acmesh"
 }
 
-func (c *customDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error {
+func (c *customDNSProviderSolver) DoDNSAPI(action string, ch *v1alpha1.ChallengeRequest) error {
   cfg, err := loadConfig(ch.Config)
   if err != nil {
     klog.Errorf("Failed to log config %v: %v", ch.Config, err)
     return err
   }
 
+  envSecret, err := c.client.CoreV1().Secrets(cfg.EnvSecretRef.Namespace).Get(context.TODO(), cfg.EnvSecretRef.Name, metav1.GetOptions{})
+  if err != nil {
+    return err
+  }
+
+  envData, ok := envSecret.Data["env"]
+  if !ok {
+    return fmt.Errorf("no env in secret")
+  }
+
+  env := envFromSecret{}
+  if err := json.Unmarshal(envData, &env); err != nil {
+    return err
+  }
+
+  uuid := uuid.New()
+  stdoutFile, err := os.CreateTemp("/tmp", uuid.String())
+  defer os.Remove(stdoutFile.Name())
+
   procAttr := &os.ProcAttr{
-    Files: []*os.File{os.Stdin, os.Stdout, os.Stderr},
-    Env: cfg.Env,
+    Files: []*os.File{os.Stdin, stdoutFile, os.Stderr},
+    Env: env,
   }
+
   process, err := os.StartProcess(acmeDelegate, []string{
-    acmeDelegate, cfg.DNSAPI, "add", util.UnFqdn(ch.ResolvedFQDN), ch.Key,
+    acmeDelegate, cfg.DNSAPI, action, util.UnFqdn(ch.ResolvedFQDN), ch.Key,
   }, procAttr)
   if err != nil {
     return err
   }
 
   process.Wait()
-  return nil
-}
+  stdoutFile.Sync()
 
-func (c *customDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
-  cfg, err := loadConfig(ch.Config)
+  outFile, err := os.Open(stdoutFile.Name())
   if err != nil {
-    klog.Errorf("Failed to log config %v: %v", ch.Config, err)
     return err
   }
 
-  procAttr := &os.ProcAttr{
-    Files: []*os.File{os.Stdin, os.Stdout, os.Stderr},
-    Env: cfg.Env,
-  }
-  process, err := os.StartProcess(acmeDelegate, []string{
-    acmeDelegate, cfg.DNSAPI, "rm", util.UnFqdn(ch.ResolvedFQDN), ch.Key,
-  }, procAttr)
+  output := make([]byte, 1048576)
+  count, err := outFile.Read(output)
   if err != nil {
     return err
   }
 
-  process.Wait()
-  return nil
+  os.Stdout.WriteString(string(output) + "\n")
+  os.Stdout.WriteString("[ACME] read output count=" + fmt.Sprint(count) + "\n")
+  lines := strings.Split(string(output), "\n")
+
+  retval := "0"
+  for _, line := range lines {
+    if strings.HasPrefix(line, acmeReturnValue) {
+      items := strings.Split(line, acmeReturnValue)
+      retval = items[1]
+    }
+  }
+
+  if retval == "0" {
+    return nil
+  }
+
+  return fmt.Errorf("Failed to run acme.sh, error=%s ...", retval)
+}
+
+func (c *customDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error {
+  return c.DoDNSAPI("add", ch)
+}
+
+func (c *customDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
+  return c.DoDNSAPI("rm", ch)
 }
 
 func (c *customDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {

diff --git a/charts/cert-manager-webhook-acmesh/Chart.yaml b/charts/cert-manager-webhook-acmesh/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: 1.2.0
+appVersion: 1.3.0
 description: cert-manager webhook solver for acmesh
 name: cert-manager-webhook-acmesh
-version: 1.3.0
+version: 1.4.0
 type: application
 maintainers:
 - name: springhack