cert-manager Linode webhook

cert-manager DNS-01 webhook solver for Linode DNS Manager. Apache-2.0. linux/amd64.

Pin this image by digest.

published Latest tag v0.4.1-tpio.1. Pin by digest. Usage is on this page.

Pin by digest

oci.thepeoples.io/hardened/cert-manager-webhook-linode@sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32

Pull:

podman pull oci.thepeoples.io/hardened/cert-manager-webhook-linode@sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/cert-manager-webhook-linode@sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32

Published 2026-10-20T17:20:43Z22.6 MiB compressed

Usage

Validated against this published digest: official-chart install, runtime digest, actual nonroot UID 65532, HTTPS /healthz, APIService availability, SelfSigned->CA serving certificate, solver group discovery, and DNS-01 Challenge dispatch. Functional evidence.

cert-manager-webhook-linode runs as UID/GID 65532:65532. The official chart constructs the image as {{ repository }}:{{ tag }} with no registry split; production values set repository: oci.thepeoples.io/hardened/cert-manager-webhook-linode. The chart is a GitHub release tarball, not a Helm index. Chart values omit replicaCount; production sets 1. The chart has no securityContext or extraArgs, and containerPort 443 is privileged, so after helm template overlay --secure-port=8443, containerPort 8443, and UID/GID 65532. helm --wait on the un-overlaid chart fails for nonroot. Solver groupName stays acme.slicen.me. Install published hardened cert-manager v1.21.2 first. Serving TLS is the chart SelfSigned->CA path. Do not create an ACME Issuer or ClusterIssuer that points at a public ACME directory. Set linode-credentials (token) before install. Do not commit the token.

Production Helm values (image pinned by digest):

# Official cert-manager-webhook-linode chart v0.4.1. Replace both image
# placeholders with the tag/digest from the published catalog; a pending
# recipe is not a release.
# The chart image helper concatenates repository:tag with no registry split.
# Chart has no securityContext or extraArgs. After helm template, overlay
# --secure-port=8443, containerPort 8443, and UID/GID 65532. Serving TLS
# is the chart SelfSigned->CA path. Do not point any Issuer at Let's Encrypt
# or another external ACME endpoint.
fullnameOverride: cert-manager-webhook-linode
replicaCount: 1  # Chart values omit this key; the template requires it.
nodeSelector: {kubernetes.io/arch: amd64, kubernetes.io/os: linux}
api:
  groupName: acme.slicen.me
certManager:
  namespace: cert-manager
  serviceAccountName: cert-manager
deployment:
  secretName: linode-credentials
  secretKey: token
  logLevel: 6
image:
  repository: oci.thepeoples.io/hardened/cert-manager-webhook-linode
  tag: "v0.4.1-tpio.1@sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32"
  pullPolicy: IfNotPresent
service:
  type: ClusterIP
  port: 443
resources:
  requests: {cpu: 50m, memory: 64Mi}
  limits: {cpu: "1", memory: 256Mi}

curl -fsSL -o cert-manager-webhook-linode-v0.4.1.tgz \
  https://github.com/linode/cert-manager-webhook-linode/releases/download/v0.4.1/cert-manager-webhook-linode-v0.4.1.tgz
helm template cert-manager-webhook-linode cert-manager-webhook-linode-v0.4.1.tgz \
  --namespace cert-manager \
  -f values-hardened.yaml \
  > cert-manager-webhook-linode-rendered.yaml
# Overlay UID 65532, --secure-port=8443, and containerPort 8443, then:
kubectl apply -f cert-manager-webhook-linode-rendered.yaml

The example Service is cert-manager-webhook-linode.cert-manager.svc:443 targeting container port 8443. Forward the Service in a separate terminal:

kubectl -n cert-manager port-forward service/cert-manager-webhook-linode 8443:443

Then check liveness over HTTPS (the serving certificate is the in-cluster CA):

curl -kfsS https://127.0.0.1:8443/healthz

/healthz or pod Ready alone is not a functional pass. A working webhook registers APIService v1alpha1.acme.slicen.me and handles a DNS-01 Challenge dispatched to solver linode. Issuer dns01.webhook stanzas must use groupName: acme.slicen.me and solverName: linode.

For existing Kustomize manifests that use the upstream image, pin this replacement in images:

images:
  - name: docker.io/linode/cert-manager-webhook-linode
    newName: oci.thepeoples.io/hardened/cert-manager-webhook-linode
    digest: sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32   # v0.4.1-tpio.1

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/cert-manager-webhook-linode@sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/cert-manager-webhook-linode@sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the cert-manager ACME DNS-01 webhook solver for Linode DNS Manager. Depends on cert-manager (dependency), cert-manager cainjector (dependency).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/cert-manager-webhook-linode@sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32

Rebuild and licence

The recipe rebuilds the binary from the pinned release with a digest-pinned Go toolchain, the standard golang.org/x/net@v0.60.0 and golang.org/x/crypto@v0.57.0 bumps, and a scratch runtime under UID 65532. Publication requires fresh unsuppressed 0 CRITICAL / 0 HIGH scans and functional validation for the exact digest. Production overlays --secure-port=8443 because the official chart binds 443.

Licence: Apache-2.0.

cert-manager-webhook-linode is Apache-2.0. Corresponding source is the official v0.4.1 tag tarball plus the Containerfile and recorded module changes. The archive license file is LICENSE.

Upstream source