HDUHelp AliDNS webhook for cert-manager

This repository contains HDUHelp's audited fork of crazygit/cert-manager-alidns-webhook. It provides the AliDNS DNS-01 solver used by cert-manager in the HDUHelp cluster.

The fork remains licensed under Apache-2.0. Upstream authorship and history are preserved in Git.

简体中文

Security model

• Authentication is accepted only through the two mandatory environment variables ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET.
• The Helm chart can populate those variables only from an existing Kubernetes Secret. It never accepts or creates plaintext AccessKeys.
• The process fails closed if either credential is absent or blank. It never falls back to a CLI profile, RRSA, ECS instance metadata, or another default credential provider.
• ALIDNS_ALLOWED_ZONES is mandatory. DNS writes outside the configured authoritative zones are rejected.
• The chart requires an image digest and applies a non-root, read-only container security context with all Linux capabilities dropped.
• AliDNS record lookup, creation, and deletion match the exact RR name, TXT type, and value.

The sample minimum-permission RAM policy is in deploy/cert-manager-alidns-webhook/ram-policy.template.json. Review the resource scope against the current AliDNS API before applying it.

Prerequisites

• cert-manager installed in the cluster
• an image built from a reviewed commit and pinned by sha256 digest
• a dedicated RAM AccessKey with only the required AliDNS permissions
• an existing Secret in the webhook release namespace with keys accessKeyID and accessKeySecret

Do not commit credentials, pass them through Helm values, or place them in an Issuer.

Install

helm upgrade --install cert-manager-alidns-webhook \
  deploy/cert-manager-alidns-webhook \
  --namespace cert-manager \
  --set image.repository=REGISTRY/PROJECT/cert-manager-alidns-webhook \
  --set image.digest=sha256:REVIEWED_DIGEST \
  --set aliyunAuth.existingSecret=EXISTING_SECRET_NAME \
  --set-json 'aliyunAuth.allowedZones=["hduhelp.com","hduhelp.net"]'

The default webhook API group is alidns.acme.hduhelp.com. A cert-manager solver references it without carrying credentials:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod-dns01
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod-dns01-account
    solvers:
      - dns01:
          webhook:
            groupName: alidns.acme.hduhelp.com
            solverName: alidns

Start with a staging ACME issuer and a disposable test hostname. Promote to production only after issuance, renewal, TXT cleanup, and rollback have been verified.

Uninstall

helm uninstall cert-manager-alidns-webhook --namespace cert-manager

Uninstalling the chart does not delete the externally managed credential Secret, RAM identity, DNS zones, certificates, or Issuers.

Development

go test ./...
go test -race ./...
go vet ./...
helm lint deploy/cert-manager-alidns-webhook \
  --set image.repository=example.invalid/cert-manager-alidns-webhook \
  --set image.digest=sha256:0000000000000000000000000000000000000000000000000000000000000000 \
  --set aliyunAuth.existingSecret=test-only

See DEVELOPMENT.md for release and review requirements.