pref: 调整插件目录，增加一些帮助说明

2026-04-23 19:57:27 +08:00 · 2024-05-27 18:38:41 +08:00
parent dd730f6beb
commit 20bc5aa6c7
164 changed files with 1160 additions and 3573 deletions
@@ -0,0 +1,43 @@
+import { IsAccess, AccessInput } from '@certd/pipeline';
+
+@IsAccess({
+  name: 'dnspod',
+  title: 'dnspod',
+  desc: '腾讯云的域名解析接口已迁移到dnspod',
+})
+export class DnspodAccess {
+  @AccessInput({
+    title: '端点',
+    component: {
+      placeholder: 'endpoint',
+      name: 'a-select',
+      vModel: 'value',
+      options: [
+        { value: 'https://dnsapi.cn', label: '中国站' },
+        { value: 'https://api.dnspod.com', label: '国际站' },
+      ],
+    },
+    rules: [{ required: true, message: '该项必填' }],
+  })
+  endpoint = '';
+
+  @AccessInput({
+    title: '账户id',
+    component: {
+      placeholder: 'dnspod接口账户id',
+    },
+    rules: [{ required: true, message: '该项必填' }],
+  })
+  id = '';
+
+  @AccessInput({
+    title: 'token',
+    component: {
+      placeholder: '开放接口token',
+    },
+    rules: [{ required: true, message: '该项必填' }],
+  })
+  token = '';
+}
+
+new DnspodAccess();
@@ -0,0 +1,2 @@
+export * from './dnspod-access';
+export * from './tencent-access';
@@ -0,0 +1,26 @@
+import { IsAccess, AccessInput } from '@certd/pipeline';
+
+@IsAccess({
+  name: 'tencent',
+  title: '腾讯云',
+})
+export class TencentAccess {
+  @AccessInput({
+    title: 'secretId',
+    helper:
+      '使用对应的插件需要有对应的权限，比如上传证书，需要证书管理权限;部署到clb需要clb相关权限',
+    component: {
+      placeholder: 'secretId',
+    },
+    rules: [{ required: true, message: '该项必填' }],
+  })
+  secretId = '';
+  @AccessInput({
+    title: 'secretKey',
+    component: {
+      placeholder: 'secretKey',
+    },
+    rules: [{ required: true, message: '该项必填' }],
+  })
+  secretKey = '';
+}
@@ -0,0 +1,132 @@
+import { Autowire, HttpClient, ILogger } from '@certd/pipeline';
+import {
+  CreateRecordOptions,
+  IDnsProvider,
+  IsDnsProvider,
+  RemoveRecordOptions,
+} from '@certd/plugin-cert';
+import _ from 'lodash';
+import { DnspodAccess } from '../access';
+
+@IsDnsProvider({
+  name: 'dnspod',
+  title: 'dnspod(腾讯云)',
+  desc: '腾讯云的域名解析接口已迁移到dnspod',
+  accessType: 'dnspod',
+})
+export class DnspodDnsProvider implements IDnsProvider {
+  @Autowire()
+  http!: HttpClient;
+
+  @Autowire()
+  access!: DnspodAccess;
+  @Autowire()
+  logger!: ILogger;
+
+  loginToken: any;
+
+  endpoint = '';
+  async onInstance() {
+    const access: DnspodAccess = this.access as DnspodAccess;
+    this.loginToken = access.id + ',' + access.token;
+    this.endpoint = access.endpoint || 'https://dnsapi.cn';
+  }
+
+  async doRequest(options: any, successCodes: string[] = []) {
+    const config: any = {
+      // @ts-ignore
+      method: 'post',
+      formData: {
+        login_token: this.loginToken,
+        format: 'json',
+        lang: 'cn',
+        error_on_empty: 'no',
+      },
+      timeout: 5000,
+    };
+    _.merge(config, options);
+
+    const ret: any = await this.http.request(config);
+    if (!ret || !ret.status) {
+      const code = ret.status.code;
+      if (code !== '1' || !successCodes.includes(code)) {
+        throw new Error(
+          '请求失败：' + ret.status.message + ',api=' + config.url
+        );
+      }
+    }
+    return ret;
+  }
+
+  async getDomainList() {
+    const ret = await this.doRequest({
+      url: this.access.endpoint + '/Domain.List',
+    });
+    this.logger.info('dnspod 域名列表：', ret.domains);
+    return ret.domains;
+  }
+
+  async createRecord(options: CreateRecordOptions): Promise<any> {
+    const { fullRecord, value, type } = options;
+    this.logger.info('添加域名解析：', fullRecord, value);
+    const domainItem = await this.matchDomain(fullRecord);
+    const domain = domainItem.name;
+    const rr = fullRecord.replace('.' + domain, '');
+
+    const ret = await this.doRequest(
+      {
+        url: this.access.endpoint + '/Record.Create',
+        formData: {
+          domain,
+          sub_domain: rr,
+          record_type: type,
+          record_line: '默认',
+          value: value,
+          mx: 1,
+        },
+      },
+      ['104']
+    ); // 104错误码为记录已存在，无需再次添加
+    this.logger.info(
+      '添加域名解析成功:',
+      fullRecord,
+      value,
+      JSON.stringify(ret.record)
+    );
+    return ret.record;
+  }
+
+  async removeRecord(options: RemoveRecordOptions) {
+    const { fullRecord, value, record } = options;
+    const domain = await this.matchDomain(fullRecord);
+
+    const ret = await this.doRequest({
+      url: this.access.endpoint + '/Record.Remove',
+      formData: {
+        domain,
+        record_id: record.id,
+      },
+    });
+    this.logger.info('删除域名解析成功:', fullRecord, value);
+    return ret.RecordId;
+  }
+
+  async matchDomain(dnsRecord: any) {
+    const list = await this.getDomainList();
+    if (list == null) {
+      throw new Error('域名列表不能为空');
+    }
+    let domain = null;
+    for (const item of list) {
+      if (_.endsWith(dnsRecord, '.' + item.name)) {
+        domain = item;
+        break;
+      }
+    }
+    if (!domain) {
+      throw new Error('找不到域名,请检查域名是否正确：' + dnsRecord);
+    }
+    return domain;
+  }
+}
+new DnspodDnsProvider();
@@ -0,0 +1 @@
+import './dnspod-dns-provider';
@@ -0,0 +1,130 @@
+import {
+  AbstractTaskPlugin,
+  IAccessService,
+  ILogger,
+  IsTaskPlugin,
+  RunStrategy,
+  TaskInput,
+} from '@certd/pipeline';
+import tencentcloud from 'tencentcloud-sdk-nodejs/index';
+import { TencentAccess } from '../../access';
+import { CertInfo } from '@certd/plugin-cert';
+
+@IsTaskPlugin({
+  name: 'DeployCertToTencentCDN',
+  title: '部署到腾讯云CDN',
+  default: {
+    strategy: {
+      runStrategy: RunStrategy.SkipWhenSucceed,
+    },
+  },
+})
+export class DeployToCdnPlugin extends AbstractTaskPlugin {
+  @TaskInput({
+    title: '域名证书',
+    helper: '请选择前置任务输出的域名证书',
+    component: {
+      name: 'pi-output-selector',
+      from: 'CertApply',
+    },
+    required: true,
+  })
+  cert!: CertInfo;
+
+  @TaskInput({
+    title: 'Access提供者',
+    helper: 'access 授权',
+    component: {
+      name: 'pi-access-selector',
+      type: 'tencent',
+    },
+    required: true,
+  })
+  accessId!: string;
+
+  @TaskInput({
+    title: '证书名称',
+    helper: '证书上传后将以此参数作为名称前缀',
+  })
+  certName!: string;
+
+  @TaskInput({
+    title: 'cdn加速域名',
+    rules: [{ required: true, message: '该项必填' }],
+  })
+  domainName!: string;
+
+  // @TaskInput({
+  //   title: "CDN接口",
+  //   helper: "CDN接口端点",
+  //   component: {
+  //     name: "a-select",
+  //     type: "tencent",
+  //   },
+  //   required: true,
+  // })
+  // endpoint!: string;
+
+  accessService!: IAccessService;
+
+  logger!: ILogger;
+
+  async onInstance() {
+    this.accessService = this.ctx.accessService;
+    this.logger = this.ctx.logger;
+  }
+
+  async execute(): Promise<void> {
+    const accessProvider: TencentAccess = (await this.accessService.getById(
+      this.accessId
+    )) as TencentAccess;
+    const client = this.getClient(accessProvider);
+    const params = this.buildParams();
+    await this.doRequest(client, params);
+  }
+
+  getClient(accessProvider: TencentAccess) {
+    const CdnClient = tencentcloud.cdn.v20180606.Client;
+
+    const clientConfig = {
+      credential: {
+        secretId: accessProvider.secretId,
+        secretKey: accessProvider.secretKey,
+      },
+      region: '',
+      profile: {
+        httpProfile: {
+          endpoint: 'cdn.tencentcloudapi.com',
+        },
+      },
+    };
+
+    return new CdnClient(clientConfig);
+  }
+
+  buildParams() {
+    return {
+      Https: {
+        Switch: 'on',
+        CertInfo: {
+          Certificate: this.cert.crt,
+          PrivateKey: this.cert.key,
+        },
+      },
+      Domain: this.domainName,
+    };
+  }
+
+  async doRequest(client: any, params: any) {
+    const ret = await client.UpdateDomainConfig(params);
+    this.checkRet(ret);
+    this.logger.info('设置腾讯云CDN证书成功:', ret.RequestId);
+    return ret.RequestId;
+  }
+
+  checkRet(ret: any) {
+    if (!ret || ret.Error) {
+      throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message);
+    }
+  }
+}
@@ -0,0 +1,250 @@
+import {
+  AbstractTaskPlugin,
+  IAccessService,
+  ILogger,
+  IsTaskPlugin,
+  RunStrategy,
+  TaskInput,
+  utils,
+} from '@certd/pipeline';
+import tencentcloud from 'tencentcloud-sdk-nodejs/index';
+import { TencentAccess } from '../../access';
+import dayjs from 'dayjs';
+
+@IsTaskPlugin({
+  name: 'DeployCertToTencentCLB',
+  title: '部署到腾讯云CLB',
+  desc: '暂时只支持单向认证证书，暂时只支持通用负载均衡',
+  default: {
+    strategy: {
+      runStrategy: RunStrategy.SkipWhenSucceed,
+    },
+  },
+})
+export class DeployToClbPlugin extends AbstractTaskPlugin {
+  @TaskInput({
+    title: '大区',
+    value: 'ap-guangzhou',
+    component: {
+      name: 'a-select',
+      options: [{ value: 'ap-guangzhou' }],
+    },
+    required: true,
+  })
+  region!: string;
+
+  @TaskInput({
+    title: '证书名称前缀',
+  })
+  certName!: string;
+
+  @TaskInput({
+    title: '负载均衡ID',
+    helper:
+      '如果没有配置，则根据域名匹配负载均衡下的监听器（根据域名匹配时暂时只支持前100个）',
+    required: true,
+  })
+  loadBalancerId!: string;
+
+  @TaskInput({
+    title: '监听器ID',
+    helper: '如果没有配置，则根据域名或负载均衡id匹配监听器',
+  })
+  listenerId!: string;
+
+  @TaskInput({
+    title: '域名',
+    required: true,
+    helper: '要更新的支持https的负载均衡的域名',
+  })
+  domain!: string;
+
+  @TaskInput({
+    title: '域名证书',
+    helper: '请选择前置任务输出的域名证书',
+    component: {
+      name: 'pi-output-selector',
+    },
+    required: true,
+  })
+  cert!: any;
+
+  @TaskInput({
+    title: 'Access提供者',
+    helper: 'access授权',
+    component: {
+      name: 'pi-access-selector',
+      type: 'tencent',
+    },
+    required: true,
+  })
+  accessId!: string;
+
+  accessService!: IAccessService;
+  logger!: ILogger;
+
+  async onInstance() {
+    this.accessService = this.ctx.accessService;
+    this.logger = this.ctx.logger;
+  }
+  async execute(): Promise<void> {
+    const accessProvider = (await this.accessService.getById(
+      this.accessId
+    )) as TencentAccess;
+    const client = this.getClient(accessProvider, this.region);
+
+    const lastCertId = await this.getCertIdFromProps(client);
+    if (!this.domain) {
+      await this.updateListener(client);
+    } else {
+      await this.updateByDomainAttr(client);
+    }
+
+    try {
+      await utils.sleep(2000);
+      let newCertId = await this.getCertIdFromProps(client);
+      if (
+        (lastCertId && newCertId === lastCertId) ||
+        (!lastCertId && !newCertId)
+      ) {
+        await utils.sleep(2000);
+        newCertId = await this.getCertIdFromProps(client);
+      }
+      if (newCertId === lastCertId) {
+        return;
+      }
+      this.logger.info('腾讯云证书ID:', newCertId);
+    } catch (e) {
+      this.logger.warn('查询腾讯云证书失败', e);
+    }
+    return;
+  }
+
+  async getCertIdFromProps(client: any) {
+    const listenerRet = await this.getListenerList(
+      client,
+      this.loadBalancerId,
+      [this.listenerId]
+    );
+    return this.getCertIdFromListener(listenerRet[0], this.domain);
+  }
+
+  getCertIdFromListener(listener: any, domain: string) {
+    let certId;
+    if (!domain) {
+      certId = listener.Certificate.CertId;
+    } else {
+      if (listener.Rules && listener.Rules.length > 0) {
+        for (const rule of listener.Rules) {
+          if (rule.Domain === domain) {
+            if (rule.Certificate != null) {
+              certId = rule.Certificate.CertId;
+            }
+            break;
+          }
+        }
+      }
+    }
+    return certId;
+  }
+
+  async updateListener(client: any) {
+    const params = this.buildProps();
+    const ret = await client.ModifyListener(params);
+    this.checkRet(ret);
+    this.logger.info(
+      '设置腾讯云CLB证书成功:',
+      ret.RequestId,
+      '->loadBalancerId:',
+      this.loadBalancerId,
+      'listenerId',
+      this.listenerId
+    );
+    return ret;
+  }
+
+  async updateByDomainAttr(client: any) {
+    const params: any = this.buildProps();
+    params.Domain = this.domain;
+    const ret = await client.ModifyDomainAttributes(params);
+    this.checkRet(ret);
+    this.logger.info(
+      '设置腾讯云CLB证书(sni)成功:',
+      ret.RequestId,
+      '->loadBalancerId:',
+      this.loadBalancerId,
+      'listenerId',
+      this.listenerId,
+      'domain:',
+      this.domain
+    );
+    return ret;
+  }
+  appendTimeSuffix(name: string) {
+    if (name == null) {
+      name = 'certd';
+    }
+    return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
+  }
+  buildProps() {
+    return {
+      Certificate: {
+        SSLMode: 'UNIDIRECTIONAL', // 单向认证
+        CertName: this.appendTimeSuffix(this.certName || this.cert.domain),
+        CertKey: this.cert.key,
+        CertContent: this.cert.crt,
+      },
+      LoadBalancerId: this.loadBalancerId,
+      ListenerId: this.listenerId,
+    };
+  }
+
+  async getCLBList(client: any) {
+    const params = {
+      Limit: 100, // 最大暂时只支持100个，暂时没做翻页
+      OrderBy: 'CreateTime',
+      OrderType: 0,
+      // ...this.DescribeLoadBalancers,
+    };
+    const ret = await client.DescribeLoadBalancers(params);
+    this.checkRet(ret);
+    return ret.LoadBalancerSet;
+  }
+
+  async getListenerList(client: any, balancerId: any, listenerIds: any) {
+    // HTTPS
+    const params = {
+      LoadBalancerId: balancerId,
+      Protocol: 'HTTPS',
+      ListenerIds: listenerIds,
+    };
+    const ret = await client.DescribeListeners(params);
+    this.checkRet(ret);
+    return ret.Listeners;
+  }
+
+  getClient(accessProvider: TencentAccess, region: string) {
+    const ClbClient = tencentcloud.clb.v20180317.Client;
+
+    const clientConfig = {
+      credential: {
+        secretId: accessProvider.secretId,
+        secretKey: accessProvider.secretKey,
+      },
+      region: region,
+      profile: {
+        httpProfile: {
+          endpoint: 'clb.tencentcloudapi.com',
+        },
+      },
+    };
+
+    return new ClbClient(clientConfig);
+  }
+
+  checkRet(ret: any) {
+    if (!ret || ret.Error) {
+      throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message);
+    }
+  }
+}
@@ -0,0 +1,259 @@
+import {
+  AbstractTaskPlugin,
+  IAccessService,
+  IsTaskPlugin,
+  RunStrategy,
+  TaskInput,
+  utils,
+} from '@certd/pipeline';
+import tencentcloud from 'tencentcloud-sdk-nodejs/index';
+import { K8sClient } from '@certd/plugin-util';
+import dayjs from 'dayjs';
+import { Logger } from 'log4js';
+
+@IsTaskPlugin({
+  name: 'DeployCertToTencentTKEIngress',
+  title: '部署到腾讯云TKE-ingress',
+  desc: '需要【上传到腾讯云】作为前置任务',
+  default: {
+    strategy: {
+      runStrategy: RunStrategy.SkipWhenSucceed,
+    },
+  },
+})
+export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
+  @TaskInput({ title: '大区', value: 'ap-guangzhou', required: true })
+  region!: string;
+
+  @TaskInput({
+    title: '集群ID',
+    required: true,
+    desc: '例如：cls-6lbj1vee',
+    request: true,
+  })
+  clusterId!: string;
+
+  @TaskInput({ title: '集群namespace', value: 'default', required: true })
+  namespace!: string;
+
+  @TaskInput({ title: '证书的secret名称', required: true })
+  secretName!: string | string[];
+
+  @TaskInput({ title: 'ingress名称', required: true })
+  ingressName!: string | string[];
+
+  @TaskInput({
+    title: 'ingress类型',
+    component: {
+      name: 'a-select',
+      options: [{ value: 'qcloud' }, { value: 'nginx' }],
+    },
+    helper: '可选 qcloud / nginx',
+  })
+  ingressClass!: string;
+
+  @TaskInput({ title: '集群内网ip', helper: '如果开启了外网的话，无需设置' })
+  clusterIp!: string;
+
+  @TaskInput({
+    title: '集群域名',
+    helper: '可不填，默认为:[clusterId].ccs.tencent-cloud.com',
+  })
+  clusterDomain!: string;
+  @TaskInput({
+    title: '腾讯云证书id',
+    helper: '请选择“上传证书到腾讯云”前置任务的输出',
+    component: {
+      name: 'pi-output-selector',
+      from: 'UploadCertToTencent',
+    },
+    required: true,
+  })
+  tencentCertId!: string;
+
+  /**
+   * AccessProvider的key,或者一个包含access的具体的对象
+   */
+  @TaskInput({
+    title: 'Access授权',
+    helper: 'access授权',
+    component: {
+      name: 'pi-access-selector',
+      type: 'tencent',
+    },
+    required: true,
+  })
+  accessId!: string;
+
+  @TaskInput({
+    title: '域名证书',
+    helper: '请选择前置任务输出的域名证书',
+    component: {
+      name: 'pi-output-selector',
+    },
+    required: true,
+  })
+  cert!: any;
+
+  logger!: Logger;
+  accessService!: IAccessService;
+  async onInstance() {
+    this.accessService = this.ctx.accessService;
+    this.logger = this.ctx.logger;
+  }
+  async execute(): Promise<void> {
+    const accessProvider = await this.accessService.getById(this.accessId);
+    const tkeClient = this.getTkeClient(accessProvider, this.region);
+    const kubeConfigStr = await this.getTkeKubeConfig(
+      tkeClient,
+      this.clusterId
+    );
+
+    this.logger.info('kubeconfig已成功获取');
+    const k8sClient = new K8sClient(kubeConfigStr);
+    if (this.clusterIp != null) {
+      if (!this.clusterDomain) {
+        this.clusterDomain = `${this.clusterId}.ccs.tencent-cloud.com`;
+      }
+      // 修改内网解析ip地址
+      k8sClient.setLookup({ [this.clusterDomain]: { ip: this.clusterIp } });
+    }
+    const ingressType = this.ingressClass || 'qcloud';
+    if (ingressType === 'qcloud') {
+      await this.patchQcloudCertSecret({ k8sClient });
+    } else {
+      await this.patchNginxCertSecret({ k8sClient });
+    }
+
+    await utils.sleep(2000); // 停留2秒，等待secret部署完成
+    await this.restartIngress({ k8sClient });
+  }
+
+  getTkeClient(accessProvider: any, region = 'ap-guangzhou') {
+    const TkeClient = tencentcloud.tke.v20180525.Client;
+    const clientConfig = {
+      credential: {
+        secretId: accessProvider.secretId,
+        secretKey: accessProvider.secretKey,
+      },
+      region,
+      profile: {
+        httpProfile: {
+          endpoint: 'tke.tencentcloudapi.com',
+        },
+      },
+    };
+
+    return new TkeClient(clientConfig);
+  }
+
+  async getTkeKubeConfig(client: any, clusterId: string) {
+    // Depends on tencentcloud-sdk-nodejs version 4.0.3 or higher
+    const params = {
+      ClusterId: clusterId,
+    };
+    const ret = await client.DescribeClusterKubeconfig(params);
+    this.checkRet(ret);
+    this.logger.info(
+      '注意：后续操作需要在【集群->基本信息】中开启外网或内网访问,https://console.cloud.tencent.com/tke2/cluster'
+    );
+    return ret.Kubeconfig;
+  }
+
+  appendTimeSuffix(name: string) {
+    if (name == null) {
+      name = 'certd';
+    }
+    return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
+  }
+
+  async patchQcloudCertSecret(options: { k8sClient: any }) {
+    if (this.tencentCertId == null) {
+      throw new Error('请先将【上传证书到腾讯云】作为前置任务');
+    }
+    this.logger.info('腾讯云证书ID:', this.tencentCertId);
+    const certIdBase64 = Buffer.from(this.tencentCertId).toString('base64');
+
+    const { namespace, secretName } = this;
+
+    const body = {
+      data: {
+        qcloud_cert_id: certIdBase64,
+      },
+      metadata: {
+        labels: {
+          certd: this.appendTimeSuffix('certd'),
+        },
+      },
+    };
+    let secretNames: any = secretName;
+    if (typeof secretName === 'string') {
+      secretNames = [secretName];
+    }
+    for (const secret of secretNames) {
+      await options.k8sClient.patchSecret({
+        namespace,
+        secretName: secret,
+        body,
+      });
+      this.logger.info(`CertSecret已更新:${secret}`);
+    }
+  }
+
+  async patchNginxCertSecret(options: { k8sClient: any }) {
+    const { k8sClient } = options;
+    const { cert } = this;
+    const crt = cert.crt;
+    const key = cert.key;
+    const crtBase64 = Buffer.from(crt).toString('base64');
+    const keyBase64 = Buffer.from(key).toString('base64');
+
+    const { namespace, secretName } = this;
+
+    const body = {
+      data: {
+        'tls.crt': crtBase64,
+        'tls.key': keyBase64,
+      },
+      metadata: {
+        labels: {
+          certd: this.appendTimeSuffix('certd'),
+        },
+      },
+    };
+    let secretNames = secretName;
+    if (typeof secretName === 'string') {
+      secretNames = [secretName];
+    }
+    for (const secret of secretNames) {
+      await k8sClient.patchSecret({ namespace, secretName: secret, body });
+      this.logger.info(`CertSecret已更新:${secret}`);
+    }
+  }
+
+  async restartIngress(options: { k8sClient: any }) {
+    const { k8sClient } = options;
+    const { namespace, ingressName } = this;
+
+    const body = {
+      metadata: {
+        labels: {
+          certd: this.appendTimeSuffix('certd'),
+        },
+      },
+    };
+    let ingressNames = this.ingressName;
+    if (typeof ingressName === 'string') {
+      ingressNames = [ingressName];
+    }
+    for (const ingress of ingressNames) {
+      await k8sClient.patchIngress({ namespace, ingressName: ingress, body });
+      this.logger.info(`ingress已重启:${ingress}`);
+    }
+  }
+  checkRet(ret: any) {
+    if (!ret || ret.Error) {
+      throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message);
+    }
+  }
+}
@@ -0,0 +1,4 @@
+export * from './deploy-to-clb';
+export * from './deploy-to-tke-ingress';
+export * from './deploy-to-cdn';
+export * from './upload-to-tencent';
@@ -0,0 +1,124 @@
+import {
+  AbstractTaskPlugin,
+  IAccessService,
+  ILogger,
+  IsTaskPlugin,
+  RunStrategy,
+  TaskInput,
+  TaskOutput,
+} from '@certd/pipeline';
+import tencentcloud from 'tencentcloud-sdk-nodejs/index';
+import dayjs from 'dayjs';
+
+@IsTaskPlugin({
+  name: 'UploadCertToTencent',
+  title: '上传证书到腾讯云',
+  desc: '上传成功后输出：tencentCertId',
+  default: {
+    strategy: {
+      runStrategy: RunStrategy.SkipWhenSucceed,
+    },
+  },
+})
+export class UploadToTencentPlugin extends AbstractTaskPlugin {
+  @TaskInput({ title: '证书名称' })
+  name!: string;
+
+  @TaskInput({
+    title: 'Access授权',
+    helper: 'access授权',
+    component: {
+      name: 'pi-access-selector',
+      type: 'tencent',
+    },
+    required: true,
+  })
+  accessId!: string;
+
+  @TaskInput({
+    title: '域名证书',
+    helper: '请选择前置任务输出的域名证书',
+    component: {
+      name: 'pi-output-selector',
+    },
+    required: true,
+  })
+  cert!: any;
+
+  @TaskOutput({
+    title: '上传成功后的腾讯云CertId',
+  })
+  tencentCertId?: string;
+
+  accessService!: IAccessService;
+  logger!: ILogger;
+
+  async onInstance() {
+    this.accessService = this.ctx.accessService;
+    this.logger = this.ctx.logger;
+  }
+
+  async execute(): Promise<void> {
+    const { accessId, name, cert } = this;
+    const accessProvider = await this.accessService.getById(accessId);
+    const certName = this.appendTimeSuffix(name || cert.domain);
+    const client = this.getClient(accessProvider);
+
+    const params = {
+      CertificatePublicKey: cert.crt,
+      CertificatePrivateKey: cert.key,
+      Alias: certName,
+    };
+    const ret = await client.UploadCertificate(params);
+    this.checkRet(ret);
+    this.logger.info('证书上传成功：tencentCertId=', ret.CertificateId);
+
+    this.tencentCertId = ret.CertificateId;
+  }
+
+  appendTimeSuffix(name: string) {
+    if (name == null) {
+      name = 'certd';
+    }
+    return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
+  }
+
+  getClient(accessProvider: any) {
+    const SslClient = tencentcloud.ssl.v20191205.Client;
+
+    const clientConfig = {
+      credential: {
+        secretId: accessProvider.secretId,
+        secretKey: accessProvider.secretKey,
+      },
+      region: '',
+      profile: {
+        httpProfile: {
+          endpoint: 'ssl.tencentcloudapi.com',
+        },
+      },
+    };
+
+    return new SslClient(clientConfig);
+  }
+
+  // async rollback({ input }) {
+  //   const { accessId } = input;
+  //   const accessProvider = await this.accessService.getById(accessId);
+  //   const client = this.getClient(accessProvider);
+  //
+  //   const { tencentCertId } = context;
+  //   const params = {
+  //     CertificateId: tencentCertId,
+  //   };
+  //   const ret = await client.DeleteCertificate(params);
+  //   this.checkRet(ret);
+  //   this.logger.info("证书删除成功：DeleteResult=", ret.DeleteResult);
+  //   delete context.tencentCertId;
+  // }
+  checkRet(ret: any) {
+    if (!ret || ret.Error) {
+      throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message);
+    }
+  }
+}