cert-manager-webhook-porkbun

cert-manager-webhook-porkbun

Wildcard certificates for domains at Porkbun.

cert-manager ships no solver for Porkbun. This webhook adds one, so Let's Encrypt can answer DNS-01 challenges against your zones — the only challenge type that issues a wildcard.

Helm chart DNS-01 solver cosign-signed images Apache-2.0
Install → Why this fork GitHub
cert-manager this webhook Porkbun API _acme-challenge TXT Let's Encrypt reads it

Install

helm repo add octabits https://octabits-io.github.io/cert-manager-webhook-porkbun
helm repo update

helm install cert-manager-webhook-porkbun octabits/cert-manager-webhook-porkbun \
  --namespace cert-manager \
  --set groupName=acme.example.com \
  --set 'rbac.secretAccess.secretNames={porkbun-api-credentials}'

Also published as an OCI artifact at oci://ghcr.io/octabits-io/charts/cert-manager-webhook-porkbun. Credentials, the ClusterIssuer and Certificate examples, the solver options and every chart value are in the README.

The one that catches everybody: Porkbun disables API access per domain by default. Enable it under Domain Management → Details → API Access, or the API returns an error that never mentions the setting.

Why this fork

No cluster-wide Secret access

Upstream bound a ClusterRole granting get,watch,list on every Secret in the cluster. Access here is a namespaced Role, get only, optionally restricted to named Secrets.

It stops falling over

A malformed response used to panic the pod, requests had no timeout at all, and API errors surfaced with Porkbun's message field stripped out. All fixed, each with a test.

Delegated sub-zones work

The Porkbun API is addressed by registered domain, not by DNS zone. The solver derives one from the other using the public suffix list, so a challenge in a delegated sub-zone resolves correctly.

Hardened by default

Distroless, uid 65532, read-only root filesystem, all capabilities dropped — compatible with the restricted Pod Security Standard. Images are signed with cosign and carry SBOM and provenance attestations.

Links