OpScaleHub
v1.0.2 Production-ready Open Source Apache-2.0

Enterprise-Grade ArvanCloud DNS-01 Webhook for Cert-Manager

Secure, resilient, multi-architecture (amd64 / arm64) webhook solver built for Kubernetes. Zero reliance on unmaintained community scripts.

View on GitHub Install via Helm
Quick start

Install in two commands

Add the OpScaleHub Helm repository and deploy the webhook into your cert-manager namespace.

shell — add repo & install 
# 1. Add the OpScaleHub chart repository
helm repo add opscalehub https://opscalehub.github.io/cert-manager-webhook-arvancloud
helm repo update

# 2. Install the webhook alongside cert-manager (add --version to pin)
helm install arvancloud-webhook opscalehub/arvancloud-webhook \
  --namespace cert-manager

# 3. Provide your ArvanCloud Machine User API key
kubectl -n cert-manager create secret generic arvancloud-credentials \
  --from-literal=api-key=<YOUR_MACHINE_USER_KEY>
Why choose the OpScaleHub version?

Built for production clusters, not weekend demos

Every layer — API client, secret handling, container image — is designed for unattended operation at scale.

Robust REST v4 Integration

Direct mapping to ArvanCloud's modern napi.arvancloud.ir API v4, with Authorization: Apikey token-header security, hard 15 s timeouts and bounded retries.

Multi-Architecture Builds

First-class images for both linux/amd64 and linux/arm64 edge worker nodes — cosign keyless-signed, with an SBOM and build-provenance attestation on every tagged release.

Zero-Trust Secrets

Credentials are parsed dynamically from namespaced Kubernetes Secret objects at request time — never baked into ConfigMaps, Helm values, or log output.

Configuration

Point a ClusterIssuer at the webhook

The groupName acme.arvancloud.ir routes DNS-01 challenges through the solver. That's the entire integration.

clusterissuer.yaml 
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-arvancloud
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: platform@example.com
    privateKeySecretRef:
      name: letsencrypt-arvancloud-account
    solvers:
      - dns01:
          webhook:
            groupName: acme.arvancloud.ir
            solverName: arvancloud
            config:
              apiKeySecretRef:
                name: arvancloud-credentials
                key: api-key
              ttl: 120
  • Idempotent lifecycle. Present reuses an identical existing TXT record; CleanUp treats a missing record as success — no error loops.
  • Multi-level subdomains. Correctly resolves the zone apex for names like *.apps.cluster.example.com.
  • Optional propagation gate. propagationCheck: true makes Present block until 1.1.1.1 and 8.8.8.8 serve the record — off by default, since cert-manager already self-checks DNS before validation.
  • Locked-down pod. Runs as non-root 10001, read-only root filesystem, all capabilities dropped, RuntimeDefault seccomp.
  • Prometheus metrics. API latency & error-rate histograms and challenge success/failure counters on :8081/metrics, with an optional ServiceMonitor.
  • Schema-validated chart. values.schema.json catches missing secret bindings and invalid replica counts at helm install time.