mirrors/traefik
1
0
Fork 0
mirror of https://github.com/traefik/traefik.git synced 2025-12-01 07:31:41 +01:00
Code Issues Projects Releases Wiki Activity

Update letsencrypt/pebble to use ghcr image

Browse Source
This commit is contained in:
Kevin Pollet 2025-11-07 11:58:04 +01:00 committed by GitHub
parent 998868450f
commit effca0a603
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 68 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
integration/acme_test.go
View File

@ -21,6 +21,7 @@ import (
"github.com/traefik/traefik/v2/pkg/provider/acme" "github.com/traefik/traefik/v2/pkg/provider/acme"
"github.com/traefik/traefik/v2/pkg/testhelpers" "github.com/traefik/traefik/v2/pkg/testhelpers"
"github.com/traefik/traefik/v2/pkg/types" "github.com/traefik/traefik/v2/pkg/types"
"k8s.io/utils/strings/slices"
) )
// ACME test suites. // ACME test suites.
@ -36,7 +37,7 @@ func TestAcmeSuite(t *testing.T) {
type subCases struct { type subCases struct {
host string host string
expectedCommonName string expectedDomain string
expectedAlgorithm x509.PublicKeyAlgorithm expectedAlgorithm x509.PublicKeyAlgorithm
} }
@ -143,7 +144,7 @@ func (s *AcmeSuite) TestHTTP01Domains() {
traefikConfFilePath: "fixtures/acme/acme_domains.toml", traefikConfFilePath: "fixtures/acme/acme_domains.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -166,7 +167,7 @@ func (s *AcmeSuite) TestHTTP01StoreDomains() {
traefikConfFilePath: "fixtures/acme/acme_store_domains.toml", traefikConfFilePath: "fixtures/acme/acme_store_domains.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -189,7 +190,7 @@ func (s *AcmeSuite) TestHTTP01DomainsInSAN() {
traefikConfFilePath: "fixtures/acme/acme_domains.toml", traefikConfFilePath: "fixtures/acme/acme_domains.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: "acme.wtf", expectedDomain: "acme.wtf",
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -213,7 +214,7 @@ func (s *AcmeSuite) TestHTTP01OnHostRule() {
traefikConfFilePath: "fixtures/acme/acme_base.toml", traefikConfFilePath: "fixtures/acme/acme_base.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -234,12 +235,12 @@ func (s *AcmeSuite) TestMultipleResolver() {
subCases: []subCases{ subCases: []subCases{
{ {
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}, },
{ {
host: "tchouk.acme.wtf", host: "tchouk.acme.wtf",
expectedCommonName: "tchouk.acme.wtf", expectedDomain: "tchouk.acme.wtf",
expectedAlgorithm: x509.ECDSA, expectedAlgorithm: x509.ECDSA,
}, },
}, },
@ -264,7 +265,7 @@ func (s *AcmeSuite) TestHTTP01OnHostRuleECDSA() {
traefikConfFilePath: "fixtures/acme/acme_base.toml", traefikConfFilePath: "fixtures/acme/acme_base.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.ECDSA, expectedAlgorithm: x509.ECDSA,
}}, }},
template: templateModel{ template: templateModel{
@ -285,7 +286,7 @@ func (s *AcmeSuite) TestHTTP01OnHostRuleInvalidAlgo() {
traefikConfFilePath: "fixtures/acme/acme_base.toml", traefikConfFilePath: "fixtures/acme/acme_base.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -301,12 +302,13 @@ func (s *AcmeSuite) TestHTTP01OnHostRuleInvalidAlgo() {
s.retrieveAcmeCertificate(testCase) s.retrieveAcmeCertificate(testCase)
} }
// TODO: check why this test do not use the ACME cert resolver.
func (s *AcmeSuite) TestHTTP01OnHostRuleDefaultDynamicCertificatesWithWildcard() { func (s *AcmeSuite) TestHTTP01OnHostRuleDefaultDynamicCertificatesWithWildcard() {
testCase := acmeTestCase{ testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_tls.toml", traefikConfFilePath: "fixtures/acme/acme_tls.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: wildcardDomain, expectedDomain: wildcardDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -321,12 +323,13 @@ func (s *AcmeSuite) TestHTTP01OnHostRuleDefaultDynamicCertificatesWithWildcard()
s.retrieveAcmeCertificate(testCase) s.retrieveAcmeCertificate(testCase)
} }
// TODO: check why this test do not use the ACME cert resolver.
func (s *AcmeSuite) TestHTTP01OnHostRuleDynamicCertificatesWithWildcard() { func (s *AcmeSuite) TestHTTP01OnHostRuleDynamicCertificatesWithWildcard() {
testCase := acmeTestCase{ testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_tls_dynamic.toml", traefikConfFilePath: "fixtures/acme/acme_tls_dynamic.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: wildcardDomain, expectedDomain: wildcardDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -346,7 +349,7 @@ func (s *AcmeSuite) TestTLSALPN01OnHostRuleTCP() {
traefikConfFilePath: "fixtures/acme/acme_tcp.toml", traefikConfFilePath: "fixtures/acme/acme_tcp.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -366,7 +369,7 @@ func (s *AcmeSuite) TestTLSALPN01OnHostRule() {
traefikConfFilePath: "fixtures/acme/acme_base.toml", traefikConfFilePath: "fixtures/acme/acme_base.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -386,7 +389,7 @@ func (s *AcmeSuite) TestTLSALPN01Domains() {
traefikConfFilePath: "fixtures/acme/acme_domains.toml", traefikConfFilePath: "fixtures/acme/acme_domains.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: acmeDomain, expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -409,7 +412,7 @@ func (s *AcmeSuite) TestTLSALPN01DomainsInSAN() {
traefikConfFilePath: "fixtures/acme/acme_domains.toml", traefikConfFilePath: "fixtures/acme/acme_domains.toml",
subCases: []subCases{{ subCases: []subCases{{
host: acmeDomain, host: acmeDomain,
expectedCommonName: "acme.wtf", expectedDomain: "acme.wtf",
expectedAlgorithm: x509.RSA, expectedAlgorithm: x509.RSA,
}}, }},
template: templateModel{ template: templateModel{
@ -502,27 +505,38 @@ func (s *AcmeSuite) retrieveAcmeCertificate(testCase acmeTestCase) {
req.Header.Set("Host", sub.host) req.Header.Set("Host", sub.host)
req.Header.Set("Accept", "*/*") req.Header.Set("Accept", "*/*")
var resp *http.Response var (
gotStatusCode int
gotDomains []string
gotPublicKeyAlgorithm x509.PublicKeyAlgorithm
)
// Retry to send a Request which uses the LE generated certificate // Retry to send a Request which uses the LE generated certificate
err := try.Do(60*time.Second, func() error { err := try.Do(60*time.Second, func() error {
resp, err = client.Do(req) resp, err := client.Do(req)
if err != nil { if err != nil {
return err return err
} }
cn := resp.TLS.PeerCertificates[0].Subject.CommonName gotStatusCode = resp.StatusCode
if cn != sub.expectedCommonName { gotPublicKeyAlgorithm = resp.TLS.PeerCertificates[0].PublicKeyAlgorithm
return fmt.Errorf("domain %s found instead of %s", cn, sub.expectedCommonName)
// Here we are collecting the common name as it is used in wildcard tests.
gotDomains = append(gotDomains, resp.TLS.PeerCertificates[0].Subject.CommonName)
gotDomains = append(gotDomains, resp.TLS.PeerCertificates[0].DNSNames...)
if !slices.Contains(gotDomains, sub.expectedDomain) {
return fmt.Errorf("domain name %s not found in domain names: %v", sub.expectedDomain, gotDomains)
} }
return nil return nil
}) })
require.NoError(s.T(), err) require.NoError(s.T(), err)
assert.Equal(s.T(), http.StatusOK, resp.StatusCode) assert.Equal(s.T(), http.StatusOK, gotStatusCode)
// Check Domain into response certificate // Check Domain into response certificate
assert.Equal(s.T(), sub.expectedCommonName, resp.TLS.PeerCertificates[0].Subject.CommonName) assert.Contains(s.T(), gotDomains, sub.expectedDomain)
assert.Equal(s.T(), sub.expectedAlgorithm, resp.TLS.PeerCertificates[0].PublicKeyAlgorithm) assert.Equal(s.T(), sub.expectedAlgorithm, gotPublicKeyAlgorithm)
} }
} }

3
integration/resources/compose/pebble.yml
View File

@ -1,9 +1,8 @@
version: "3.8" version: "3.8"
services: services:
pebble: pebble:
image: letsencrypt/pebble:v2.3.1 image: ghcr.io/letsencrypt/pebble:2.8.0
command: command:
- pebble
- --dnsserver - --dnsserver
- host.docker.internal:5053 - host.docker.internal:5053
environment: environment: