From ba0df1c4843b2847d3975937cdb40aa9cfcac4d2 Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Fri, 10 Jul 2026 00:12:21 +0200 Subject: [PATCH] semery.fr: add OVH-specific webhook solver --- .github/dependabot.yml | 1 + kubernetes/system/caddy/kustomization.yaml | 1 + .../system/caddy/ovh-credentials-secret.yaml | 45 +++++++++++++++++++ .../cert-manager-issuer/clusterissuer.yaml | 27 ++++++----- .../kustomization.yaml | 12 +++++ .../kustomizeconfig.yaml | 11 +++++ .../cert-manager-webhook-ovh/release.yaml | 19 ++++++++ .../cert-manager-webhook-ovh/repository.yaml | 8 ++++ .../cert-manager-webhook-ovh/values.yaml | 37 +++++++++++++++ .../system/cert-manager/kustomization.yaml | 1 - .../cert-manager/ovh-credentials-secret.yaml | 45 ------------------- .../system/flux/cert-manager-webhook-ovh.yaml | 20 +++++++++ 12 files changed, 169 insertions(+), 58 deletions(-) create mode 100644 kubernetes/system/caddy/ovh-credentials-secret.yaml create mode 100644 kubernetes/system/cert-manager-webhook-ovh/kustomization.yaml create mode 100644 kubernetes/system/cert-manager-webhook-ovh/kustomizeconfig.yaml create mode 100644 kubernetes/system/cert-manager-webhook-ovh/release.yaml create mode 100644 kubernetes/system/cert-manager-webhook-ovh/repository.yaml create mode 100644 kubernetes/system/cert-manager-webhook-ovh/values.yaml delete mode 100644 kubernetes/system/cert-manager/ovh-credentials-secret.yaml create mode 100644 kubernetes/system/flux/cert-manager-webhook-ovh.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f732af0..b40640a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -55,6 +55,7 @@ updates: - "/kubernetes/system/blocky" - "/kubernetes/system/caddy" - "/kubernetes/system/cert-manager" + - "/kubernetes/system/cert-manager-webhook-ovh" - "/kubernetes/system/coredns" - "/kubernetes/system/csi-driver-nfs" - "/kubernetes/system/external-dns" diff --git a/kubernetes/system/caddy/kustomization.yaml b/kubernetes/system/caddy/kustomization.yaml index 7fe53d7..9f8c9a4 100644 --- a/kubernetes/system/caddy/kustomization.yaml +++ b/kubernetes/system/caddy/kustomization.yaml @@ -6,6 +6,7 @@ resources: - repository.yaml - release.yaml - certificates.yaml + - ovh-credentials-secret.yaml - caddyfile.yaml secretGenerator: - name: caddy-values diff --git a/kubernetes/system/caddy/ovh-credentials-secret.yaml b/kubernetes/system/caddy/ovh-credentials-secret.yaml new file mode 100644 index 0000000..05131ce --- /dev/null +++ b/kubernetes/system/caddy/ovh-credentials-secret.yaml @@ -0,0 +1,45 @@ +# OVH API Credentials for DNS-01 Challenges +# +# OVH API credentials with the following permissions: +# - GET, POST, PUT, DELETE on /domain/zone/* +# +# SOPS will encrypt them on pre-commit. +apiVersion: v1 +kind: Secret +metadata: + name: ovh-credentials + namespace: caddy + labels: + app.kubernetes.io/name: caddy + app.kubernetes.io/component: ovh-credentials +type: Opaque +stringData: + applicationKey: ENC[AES256_GCM,data:kBPCJRdm3VeoFKsmig+l8g==,iv:Y21zRzFpA7tqjNFruHCIIZV8hsSGhypZhcWgh7AcUus=,tag:8F0160EP0ELVFe4bp2AarA==,type:str] + applicationSecret: ENC[AES256_GCM,data:0r9bolcuWfbgQ993L+wPZaqfLB4TXcptCFw+/D9t9LI=,iv:j1pdJI4DrAzQxP8W/qJ0UBg/2rZQn/Z3aY0qZcqJqQ8=,tag:wNk8FxsUXBUiiYEayl3c1g==,type:str] + consumerKey: ENC[AES256_GCM,data:79prnqUwFgpc6peVWYtkp+L66HuB7bcXHNljSdVkpqU=,iv:sxNGszLobl7/uK6HpXhuUlA9BiURS9j9bLjeY+iwrxw=,tag:JoOKkvK+y5k45U9M6TC1cA==,type:str] +sops: + lastmodified: "2026-07-09T22:12:21Z" + mac: ENC[AES256_GCM,data:xPUFPlXWHWY/c/EzhfQhWc0JsRZ6qvuB7amxksqkotSbIIYuw90YheKHNwj9ZEqlE2gSmZYI0Cog03KCZlijeX7qKOWDgiLSf4zFT/X0uxcUoOuWvrj2nISjqT+mUJFjzPPHwBgtObH+N0LEYGhURdeJgIvbKh15kZRNqxKlCQw=,iv:E9xOdeiX+lbLR8Lz3APEYudOeF5mQk0Nvq2byzXiSxg=,tag:shDwlpvDfzacKiPuqzQzrg==,type:str] + pgp: + - created_at: "2026-07-09T22:12:21Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ//b7KcKq2BXfSU8DynNDo/QlZ77lfCYHsPMutbNh5ckpCi + JPoy06kZ9JtwET86lnv8awUuztA1CPN6uarrGqokZW4zaATHmQ0M5qHHOXClnI+X + VIL3/mcCH/sTN+/RO0vmnPcah8XnETzy/51GDvoMAeFIndVz/t/uKbAErwch1+Ol + Ds51d0MrdZxCAXxYcWr9WcLK7rLCyFd0r+TFb4buHswNIRNQvzJti0rkPac7wFNE + vjb05wr3ejdes5P9drQF5sUhZXZHAWOoZUKGBm4hUBLaQqSfqFnskKeSuyVXR+di + xiqrkuvOydNSPVpO9M+qCyZqiiE+cPL1t8wwqXiNPUhibeKsdUKOibI/XGO4QvCr + wDZt/Dcj8JfVw6SFEUP/TVaP+SW4T8tEoxIScR17DEn/eKiFp/dFQZ9pokaKM2kd + uhxrO7/FbA5KDMK2IZncV40IioAG/caFswM944ShMbJ5IJlFQv7OASPjwtauGnuY + 9O/7XMAZas7u+PhBuxqdQ/3YVrCVyYnvxsQ/+TbX6pIY1w9rgwh+XamVln083P+c + 4gcBfL/1vv2RzVKhkAQ9k5++Af3Vn6JpkKu1FqUHVmOf3nH9vUxqQTwSwAu6Pi2W + 6BZKq0UdbYi6v6Ozi06V1z4qa0t2IC+LOA5dILpReE7M2EM+b/tRRpp514NAmUzS + XAEAAY0b6IKDlwAqHQVAg2TuTDGHm7rHSpxtllsXx+902zYttisRZKjQgJuWLdST + kb4WPMRUq1y97BMJddXjf6L6ganzRSpDV/1cq832S8x+7Qe2aiQ6/nnLxP0I + =8mxw + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(data|stringData|.*.key|.*.crt)$ + version: 3.10.2 diff --git a/kubernetes/system/cert-manager-issuer/clusterissuer.yaml b/kubernetes/system/cert-manager-issuer/clusterissuer.yaml index 06c0b64..b1bd624 100644 --- a/kubernetes/system/cert-manager-issuer/clusterissuer.yaml +++ b/kubernetes/system/cert-manager-issuer/clusterissuer.yaml @@ -22,19 +22,22 @@ spec: dnsZones: - vhaudiquet.fr - buildpath.win - # OVH solver for semery.fr + # OVH solver for semery.fr (via cert-manager-webhook-ovh) - dns01: - ovh: - endpoint: ovh-eu - applicationKeyRef: - name: ovh-credentials - key: applicationKey - applicationSecretRef: - name: ovh-credentials - key: applicationSecret - consumerKeyRef: - name: ovh-credentials - key: consumerKey + webhook: + groupName: acme.aureq.com + solverName: ovh + config: + endpoint: ovh-eu + applicationKeyRef: + name: ovh-credentials + key: applicationKey + applicationSecretRef: + name: ovh-credentials + key: applicationSecret + consumerKeyRef: + name: ovh-credentials + key: consumerKey selector: dnsZones: - semery.fr diff --git a/kubernetes/system/cert-manager-webhook-ovh/kustomization.yaml b/kubernetes/system/cert-manager-webhook-ovh/kustomization.yaml new file mode 100644 index 0000000..de922b9 --- /dev/null +++ b/kubernetes/system/cert-manager-webhook-ovh/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: cert-manager +resources: + - repository.yaml + - release.yaml +secretGenerator: + - name: cert-manager-webhook-ovh-values + files: + - values.yaml=values.yaml +configurations: + - kustomizeconfig.yaml diff --git a/kubernetes/system/cert-manager-webhook-ovh/kustomizeconfig.yaml b/kubernetes/system/cert-manager-webhook-ovh/kustomizeconfig.yaml new file mode 100644 index 0000000..5b4399c --- /dev/null +++ b/kubernetes/system/cert-manager-webhook-ovh/kustomizeconfig.yaml @@ -0,0 +1,11 @@ +nameReference: + - kind: HelmRepository + version: v1 + fieldSpecs: + - path: spec/chart/spec/sourceRef/name + kind: HelmRelease + - kind: Secret + version: v1 + fieldSpecs: + - path: spec/valuesFrom/name + kind: HelmRelease diff --git a/kubernetes/system/cert-manager-webhook-ovh/release.yaml b/kubernetes/system/cert-manager-webhook-ovh/release.yaml new file mode 100644 index 0000000..7734434 --- /dev/null +++ b/kubernetes/system/cert-manager-webhook-ovh/release.yaml @@ -0,0 +1,19 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cert-manager-webhook-ovh + namespace: cert-manager +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: cert-manager-webhook-ovh + namespace: cert-manager + chart: cert-manager-webhook-ovh + version: "v0.9.13" + interval: 1m + valuesFrom: + - kind: Secret + name: cert-manager-webhook-ovh-values diff --git a/kubernetes/system/cert-manager-webhook-ovh/repository.yaml b/kubernetes/system/cert-manager-webhook-ovh/repository.yaml new file mode 100644 index 0000000..b4eed8d --- /dev/null +++ b/kubernetes/system/cert-manager-webhook-ovh/repository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: cert-manager-webhook-ovh + namespace: cert-manager +spec: + interval: 1m + url: https://aureq.github.io/cert-manager-webhook-ovh diff --git a/kubernetes/system/cert-manager-webhook-ovh/values.yaml b/kubernetes/system/cert-manager-webhook-ovh/values.yaml new file mode 100644 index 0000000..d74caa1 --- /dev/null +++ b/kubernetes/system/cert-manager-webhook-ovh/values.yaml @@ -0,0 +1,37 @@ +# cert-manager-webhook-ovh Values +# Replicas +replicaCount: 1 +# Resource settings +resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi +sops: + lastmodified: "2026-07-09T22:12:21Z" + mac: ENC[AES256_GCM,data:WC6VezA/Ks5BxalXRBWIGwBt9k0pTUY8etW33aBT7PrWFqQVC6XlHs4z6KHU0ka6uMc1JSaprw5QdvrOr1kKQUqgIJn9v/qELT8alOd9qzJkyLImEyH7NdI8N5hzgeEpFT1O0B+tFJ4IVxcQAQusr30dZo1AUE8JV2EUEE0OaJI=,iv:KuzSPwYaYm6cf0FBRKRXlK6m9lNVKtdhxnQryGRGtlw=,tag:ES71sI0rUctXhHXtFJ0nQg==,type:str] + pgp: + - created_at: "2026-07-09T22:12:21Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ//bXWkHjGoQhrI1yEwJSAi3j68wFOdO/GdGhX3ADZw8njM + b0fQdk+3WI7IDXV9l+Ii2PHP2gMZs8S+ejKXdhMrd28xefxwuJ5dtuOjhxdAPA7M + 2jc8gitEpQW/TKHlyDfgaWIqLeJ/O/kuhYRfl0hQ3gYMjoHwZl/rrYlbSTT6jRLH + pbjILIIo3BAXQQJgthd+y7YL6G4QjVB96wgmPEoD7FBjarNZPlPpG7EzcPj6WB9a + rs3o7uudhjWZIKrJm0qbABxnkd1IPwwNvc/bvVMeXFPP3w8ZAD6spvBMPzrfGfSb + 45SWw4lhwR57hrsK/cGVlQSwkJxhopndvk/apb2oE4q6dUbHSX21bRmjR+HO6E5A + eZgb8mcWFLgWmjrrAgZWvOSABV18s2d3EF6Vi8gAn8iLr6FjJcb3cfptbNOp26bT + 2nGW5Ws3UZQEzcDveUJACJRhz7pir0Cn8kZ2xsdYX0KThJ62q9b13X05nisnPVVy + Q/NFPDTOBWIjh/TxaaOe2CXJxnKHSnxmLbfIFFOimc/P8HyBwFRT2L7MRKosTqI/ + 9zKyppxoi0Cu0KPG/0hF6FN7sQ32oPQwuzuaxhuIYIzyXoohrZ1QvlV7ZsFneHcl + 0izl8HdM6+1CBy4Oiok6dWr1tGKuQVucWUUUDyvUg4h19LLNMT5eJe0/w1wsis/S + XgEE7DsaGavusuoEfkfx2y11mMHl6qnMNQgcRBLfq2vEpPgA4U3FB0lNrgMc5oHe + PdiBa789boiYQ13+XJIfgDkUrF9Isznkak7PYiCRgpp3LhlKVSqLasTdSKYm93g= + =0cB0 + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$ + version: 3.10.2 diff --git a/kubernetes/system/cert-manager/kustomization.yaml b/kubernetes/system/cert-manager/kustomization.yaml index 48443f0..d2d7287 100644 --- a/kubernetes/system/cert-manager/kustomization.yaml +++ b/kubernetes/system/cert-manager/kustomization.yaml @@ -6,7 +6,6 @@ resources: - repository.yaml - release.yaml - cloudflare-api-token-secret.yaml - - ovh-credentials-secret.yaml secretGenerator: - name: cert-manager-values files: diff --git a/kubernetes/system/cert-manager/ovh-credentials-secret.yaml b/kubernetes/system/cert-manager/ovh-credentials-secret.yaml deleted file mode 100644 index a0281c9..0000000 --- a/kubernetes/system/cert-manager/ovh-credentials-secret.yaml +++ /dev/null @@ -1,45 +0,0 @@ -# OVH API Credentials for DNS-01 Challenges -# -# OVH API credentials with the following permissions: -# - GET, POST, PUT, DELETE on /domain/zone/* -# -# SOPS will encrypt them on pre-commit. -apiVersion: v1 -kind: Secret -metadata: - name: ovh-credentials - namespace: cert-manager - labels: - app.kubernetes.io/name: cert-manager - app.kubernetes.io/component: ovh-credentials -type: Opaque -stringData: - applicationKey: ENC[AES256_GCM,data:YhH6Ty+JJOelaq7G975wLw==,iv:zbwPRv1tdsyoN+rFoOIItzYC7wmv20zMX/ij6RnC8cI=,tag:n+NIrIp9IgunK9ZD15cULA==,type:str] - applicationSecret: ENC[AES256_GCM,data:5jxfV5a0jyCtXQKZJjxNmNTiyZ71nLoP0A/KYm+oQ9k=,iv:77SewJ13vouMbEey2oZav32bHsi/cvyKgE1VQapdzhw=,tag:Be58t/rpZrbHun3mMzrWww==,type:str] - consumerKey: ENC[AES256_GCM,data:zYTI4cHz36Is5pwUObL9XPDi6XEftonrjz+32jsNkEM=,iv:saNZrLThBa0b+D7S37IO2WpUmnm7ixshMbJaryZzYuE=,tag:v/BhwdJVlxDaeBi570b3Ig==,type:str] -sops: - lastmodified: "2026-07-09T21:17:10Z" - mac: ENC[AES256_GCM,data:pakPqwigSb9Q1nuAcT4w4VumqQ1f1AGGx3WqNASs04eN/RxhWE+LQbY8BgNQ/YUx6HveypU6UH+ppMgPDwCZS7tUwTR/tXpDp/r3WIlhoQghtNGVp/eCpj9Tu91rnjc9Prv9wH8AWaJESeuK5dhZm+LAIvUczP3a+mUhQkXTtok=,iv:WQPfvLOODtvv88+vcTHMfiYcskS394mw+xBPacgCEgw=,tag:l5VMpNnInaeTXWWfkVonrw==,type:str] - pgp: - - created_at: "2026-07-09T21:17:10Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA7uy4qQr71wiARAAn1Wjcdq7Asc920TamGFdlQiDJa4T5iZKJohtXWbJXMSK - fqdDgMGWb5OdiCFprRkysckxsY0sWBzc/lOXlj2rw0UV2q66Rxrq19esvUDTfGfK - K1cKJ/tegcQ4heQsC+QUgC9SBZlqiA88yDGSO9j9hyBcaSWgkeTUWvrEBFeyLHDn - Yha0gxJibNSqmv+B6d5HepkwW6tpESXNX1NFJbYCx46nA6nrttbZCOxzQbS/oBKC - pmG4NzU6rQE57zcGpZOGYX8sQWjas0mhPiSAgFOdCdINuWFnONC1jUj5EnBM4LZH - +pkZtVmEl7D2SpPNtslTqJKCUbyIHGabblM76p2NKVL8vrTR3k2AM+aL5jS4536d - fRRWiWZihsn9PUHsSVLGZPkFe2ceHtM1JjGaX/M+0ZDag3gDUSCR8GdVbDd/95Xs - GeGGcVzmuTP16bYsTkXOMixvx7/q3yqAWP2FDvgJqJ3oataRlYwpVZBWDQo50eSb - w1fzARbMRz+OWNd+uFgWiHddFR12Xow1tfCSog9WAFjZQ++yjrRsqMH/x8NgWb0l - oq/vkHAg4WDqlKUa47vW56c8pZqsiWP8d8V/7b8avhHDdCb+SNOSe5QxO2AA8EAr - bjdwSpsErZNFWasYKqfs5ye4ct2tpCI5llRoR6WwnmM3mJflZAt983TPiZC8QLLS - XAHLR9ap5zx2shcdyyGOV5+7VmkDaSeB1baxeiORaQKK7CvVblhuIz0ZS097KUI5 - HBTYvvIdEdXMn3hRalYzyuayKCiC6WEl/UKzXLiCiu94ijbaKqlOtW07anP/ - =B+/W - -----END PGP MESSAGE----- - fp: DC6910268E657FF70BA7EC289974494E76938DDC - encrypted_regex: ^(data|stringData|.*.key|.*.crt)$ - version: 3.10.2 diff --git a/kubernetes/system/flux/cert-manager-webhook-ovh.yaml b/kubernetes/system/flux/cert-manager-webhook-ovh.yaml new file mode 100644 index 0000000..8d7840f --- /dev/null +++ b/kubernetes/system/flux/cert-manager-webhook-ovh.yaml @@ -0,0 +1,20 @@ +# Flux Kustomization for cert-manager-webhook-ovh +# Depends on cert-manager being fully operational (CRDs installed) +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cert-manager-webhook-ovh + namespace: flux-system +spec: + interval: 10m + prune: true + sourceRef: + kind: GitRepository + name: homeprod + path: ./kubernetes/system/cert-manager-webhook-ovh + dependsOn: + - name: cert-manager + decryption: + provider: sops + secretRef: + name: flux-sops