mirror of
https://github.com/certd/certd.git
synced 2026-04-23 11:37:23 +08:00
pref: 调整插件目录，增加一些帮助说明
This commit is contained in:
xiaojunnuo
@@ -0,0 +1,130 @@
|
||||
import {
|
||||
AbstractTaskPlugin,
|
||||
IAccessService,
|
||||
ILogger,
|
||||
IsTaskPlugin,
|
||||
RunStrategy,
|
||||
TaskInput,
|
||||
} from '@certd/pipeline';
|
||||
import tencentcloud from 'tencentcloud-sdk-nodejs/index';
|
||||
import { TencentAccess } from '../../access';
|
||||
import { CertInfo } from '@certd/plugin-cert';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToTencentCDN',
|
||||
title: '部署到腾讯云CDN',
|
||||
default: {
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.SkipWhenSucceed,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class DeployToCdnPlugin extends AbstractTaskPlugin {
|
||||
@TaskInput({
|
||||
title: '域名证书',
|
||||
helper: '请选择前置任务输出的域名证书',
|
||||
component: {
|
||||
name: 'pi-output-selector',
|
||||
from: 'CertApply',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
cert!: CertInfo;
|
||||
|
||||
@TaskInput({
|
||||
title: 'Access提供者',
|
||||
helper: 'access 授权',
|
||||
component: {
|
||||
name: 'pi-access-selector',
|
||||
type: 'tencent',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
accessId!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '证书名称',
|
||||
helper: '证书上传后将以此参数作为名称前缀',
|
||||
})
|
||||
certName!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: 'cdn加速域名',
|
||||
rules: [{ required: true, message: '该项必填' }],
|
||||
})
|
||||
domainName!: string;
|
||||
|
||||
// @TaskInput({
|
||||
// title: "CDN接口",
|
||||
// helper: "CDN接口端点",
|
||||
// component: {
|
||||
// name: "a-select",
|
||||
// type: "tencent",
|
||||
// },
|
||||
// required: true,
|
||||
// })
|
||||
// endpoint!: string;
|
||||
|
||||
accessService!: IAccessService;
|
||||
|
||||
logger!: ILogger;
|
||||
|
||||
async onInstance() {
|
||||
this.accessService = this.ctx.accessService;
|
||||
this.logger = this.ctx.logger;
|
||||
}
|
||||
|
||||
async execute(): Promise<void> {
|
||||
const accessProvider: TencentAccess = (await this.accessService.getById(
|
||||
this.accessId
|
||||
)) as TencentAccess;
|
||||
const client = this.getClient(accessProvider);
|
||||
const params = this.buildParams();
|
||||
await this.doRequest(client, params);
|
||||
}
|
||||
|
||||
getClient(accessProvider: TencentAccess) {
|
||||
const CdnClient = tencentcloud.cdn.v20180606.Client;
|
||||
|
||||
const clientConfig = {
|
||||
credential: {
|
||||
secretId: accessProvider.secretId,
|
||||
secretKey: accessProvider.secretKey,
|
||||
},
|
||||
region: '',
|
||||
profile: {
|
||||
httpProfile: {
|
||||
endpoint: 'cdn.tencentcloudapi.com',
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
return new CdnClient(clientConfig);
|
||||
}
|
||||
|
||||
buildParams() {
|
||||
return {
|
||||
Https: {
|
||||
Switch: 'on',
|
||||
CertInfo: {
|
||||
Certificate: this.cert.crt,
|
||||
PrivateKey: this.cert.key,
|
||||
},
|
||||
},
|
||||
Domain: this.domainName,
|
||||
};
|
||||
}
|
||||
|
||||
async doRequest(client: any, params: any) {
|
||||
const ret = await client.UpdateDomainConfig(params);
|
||||
this.checkRet(ret);
|
||||
this.logger.info('设置腾讯云CDN证书成功:', ret.RequestId);
|
||||
return ret.RequestId;
|
||||
}
|
||||
|
||||
checkRet(ret: any) {
|
||||
if (!ret || ret.Error) {
|
||||
throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,250 @@
|
||||
import {
|
||||
AbstractTaskPlugin,
|
||||
IAccessService,
|
||||
ILogger,
|
||||
IsTaskPlugin,
|
||||
RunStrategy,
|
||||
TaskInput,
|
||||
utils,
|
||||
} from '@certd/pipeline';
|
||||
import tencentcloud from 'tencentcloud-sdk-nodejs/index';
|
||||
import { TencentAccess } from '../../access';
|
||||
import dayjs from 'dayjs';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToTencentCLB',
|
||||
title: '部署到腾讯云CLB',
|
||||
desc: '暂时只支持单向认证证书，暂时只支持通用负载均衡',
|
||||
default: {
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.SkipWhenSucceed,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class DeployToClbPlugin extends AbstractTaskPlugin {
|
||||
@TaskInput({
|
||||
title: '大区',
|
||||
value: 'ap-guangzhou',
|
||||
component: {
|
||||
name: 'a-select',
|
||||
options: [{ value: 'ap-guangzhou' }],
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
region!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '证书名称前缀',
|
||||
})
|
||||
certName!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '负载均衡ID',
|
||||
helper:
|
||||
'如果没有配置，则根据域名匹配负载均衡下的监听器（根据域名匹配时暂时只支持前100个）',
|
||||
required: true,
|
||||
})
|
||||
loadBalancerId!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '监听器ID',
|
||||
helper: '如果没有配置，则根据域名或负载均衡id匹配监听器',
|
||||
})
|
||||
listenerId!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '域名',
|
||||
required: true,
|
||||
helper: '要更新的支持https的负载均衡的域名',
|
||||
})
|
||||
domain!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '域名证书',
|
||||
helper: '请选择前置任务输出的域名证书',
|
||||
component: {
|
||||
name: 'pi-output-selector',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
cert!: any;
|
||||
|
||||
@TaskInput({
|
||||
title: 'Access提供者',
|
||||
helper: 'access授权',
|
||||
component: {
|
||||
name: 'pi-access-selector',
|
||||
type: 'tencent',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
accessId!: string;
|
||||
|
||||
accessService!: IAccessService;
|
||||
logger!: ILogger;
|
||||
|
||||
async onInstance() {
|
||||
this.accessService = this.ctx.accessService;
|
||||
this.logger = this.ctx.logger;
|
||||
}
|
||||
async execute(): Promise<void> {
|
||||
const accessProvider = (await this.accessService.getById(
|
||||
this.accessId
|
||||
)) as TencentAccess;
|
||||
const client = this.getClient(accessProvider, this.region);
|
||||
|
||||
const lastCertId = await this.getCertIdFromProps(client);
|
||||
if (!this.domain) {
|
||||
await this.updateListener(client);
|
||||
} else {
|
||||
await this.updateByDomainAttr(client);
|
||||
}
|
||||
|
||||
try {
|
||||
await utils.sleep(2000);
|
||||
let newCertId = await this.getCertIdFromProps(client);
|
||||
if (
|
||||
(lastCertId && newCertId === lastCertId) ||
|
||||
(!lastCertId && !newCertId)
|
||||
) {
|
||||
await utils.sleep(2000);
|
||||
newCertId = await this.getCertIdFromProps(client);
|
||||
}
|
||||
if (newCertId === lastCertId) {
|
||||
return;
|
||||
}
|
||||
this.logger.info('腾讯云证书ID:', newCertId);
|
||||
} catch (e) {
|
||||
this.logger.warn('查询腾讯云证书失败', e);
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
async getCertIdFromProps(client: any) {
|
||||
const listenerRet = await this.getListenerList(
|
||||
client,
|
||||
this.loadBalancerId,
|
||||
[this.listenerId]
|
||||
);
|
||||
return this.getCertIdFromListener(listenerRet[0], this.domain);
|
||||
}
|
||||
|
||||
getCertIdFromListener(listener: any, domain: string) {
|
||||
let certId;
|
||||
if (!domain) {
|
||||
certId = listener.Certificate.CertId;
|
||||
} else {
|
||||
if (listener.Rules && listener.Rules.length > 0) {
|
||||
for (const rule of listener.Rules) {
|
||||
if (rule.Domain === domain) {
|
||||
if (rule.Certificate != null) {
|
||||
certId = rule.Certificate.CertId;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return certId;
|
||||
}
|
||||
|
||||
async updateListener(client: any) {
|
||||
const params = this.buildProps();
|
||||
const ret = await client.ModifyListener(params);
|
||||
this.checkRet(ret);
|
||||
this.logger.info(
|
||||
'设置腾讯云CLB证书成功:',
|
||||
ret.RequestId,
|
||||
'->loadBalancerId:',
|
||||
this.loadBalancerId,
|
||||
'listenerId',
|
||||
this.listenerId
|
||||
);
|
||||
return ret;
|
||||
}
|
||||
|
||||
async updateByDomainAttr(client: any) {
|
||||
const params: any = this.buildProps();
|
||||
params.Domain = this.domain;
|
||||
const ret = await client.ModifyDomainAttributes(params);
|
||||
this.checkRet(ret);
|
||||
this.logger.info(
|
||||
'设置腾讯云CLB证书(sni)成功:',
|
||||
ret.RequestId,
|
||||
'->loadBalancerId:',
|
||||
this.loadBalancerId,
|
||||
'listenerId',
|
||||
this.listenerId,
|
||||
'domain:',
|
||||
this.domain
|
||||
);
|
||||
return ret;
|
||||
}
|
||||
appendTimeSuffix(name: string) {
|
||||
if (name == null) {
|
||||
name = 'certd';
|
||||
}
|
||||
return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
|
||||
}
|
||||
buildProps() {
|
||||
return {
|
||||
Certificate: {
|
||||
SSLMode: 'UNIDIRECTIONAL', // 单向认证
|
||||
CertName: this.appendTimeSuffix(this.certName || this.cert.domain),
|
||||
CertKey: this.cert.key,
|
||||
CertContent: this.cert.crt,
|
||||
},
|
||||
LoadBalancerId: this.loadBalancerId,
|
||||
ListenerId: this.listenerId,
|
||||
};
|
||||
}
|
||||
|
||||
async getCLBList(client: any) {
|
||||
const params = {
|
||||
Limit: 100, // 最大暂时只支持100个，暂时没做翻页
|
||||
OrderBy: 'CreateTime',
|
||||
OrderType: 0,
|
||||
// ...this.DescribeLoadBalancers,
|
||||
};
|
||||
const ret = await client.DescribeLoadBalancers(params);
|
||||
this.checkRet(ret);
|
||||
return ret.LoadBalancerSet;
|
||||
}
|
||||
|
||||
async getListenerList(client: any, balancerId: any, listenerIds: any) {
|
||||
// HTTPS
|
||||
const params = {
|
||||
LoadBalancerId: balancerId,
|
||||
Protocol: 'HTTPS',
|
||||
ListenerIds: listenerIds,
|
||||
};
|
||||
const ret = await client.DescribeListeners(params);
|
||||
this.checkRet(ret);
|
||||
return ret.Listeners;
|
||||
}
|
||||
|
||||
getClient(accessProvider: TencentAccess, region: string) {
|
||||
const ClbClient = tencentcloud.clb.v20180317.Client;
|
||||
|
||||
const clientConfig = {
|
||||
credential: {
|
||||
secretId: accessProvider.secretId,
|
||||
secretKey: accessProvider.secretKey,
|
||||
},
|
||||
region: region,
|
||||
profile: {
|
||||
httpProfile: {
|
||||
endpoint: 'clb.tencentcloudapi.com',
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
return new ClbClient(clientConfig);
|
||||
}
|
||||
|
||||
checkRet(ret: any) {
|
||||
if (!ret || ret.Error) {
|
||||
throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message);
|
||||
}
|
||||
}
|
||||
}
|
||||
+259
@@ -0,0 +1,259 @@
|
||||
import {
|
||||
AbstractTaskPlugin,
|
||||
IAccessService,
|
||||
IsTaskPlugin,
|
||||
RunStrategy,
|
||||
TaskInput,
|
||||
utils,
|
||||
} from '@certd/pipeline';
|
||||
import tencentcloud from 'tencentcloud-sdk-nodejs/index';
|
||||
import { K8sClient } from '@certd/plugin-util';
|
||||
import dayjs from 'dayjs';
|
||||
import { Logger } from 'log4js';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToTencentTKEIngress',
|
||||
title: '部署到腾讯云TKE-ingress',
|
||||
desc: '需要【上传到腾讯云】作为前置任务',
|
||||
default: {
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.SkipWhenSucceed,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||
@TaskInput({ title: '大区', value: 'ap-guangzhou', required: true })
|
||||
region!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '集群ID',
|
||||
required: true,
|
||||
desc: '例如：cls-6lbj1vee',
|
||||
request: true,
|
||||
})
|
||||
clusterId!: string;
|
||||
|
||||
@TaskInput({ title: '集群namespace', value: 'default', required: true })
|
||||
namespace!: string;
|
||||
|
||||
@TaskInput({ title: '证书的secret名称', required: true })
|
||||
secretName!: string | string[];
|
||||
|
||||
@TaskInput({ title: 'ingress名称', required: true })
|
||||
ingressName!: string | string[];
|
||||
|
||||
@TaskInput({
|
||||
title: 'ingress类型',
|
||||
component: {
|
||||
name: 'a-select',
|
||||
options: [{ value: 'qcloud' }, { value: 'nginx' }],
|
||||
},
|
||||
helper: '可选 qcloud / nginx',
|
||||
})
|
||||
ingressClass!: string;
|
||||
|
||||
@TaskInput({ title: '集群内网ip', helper: '如果开启了外网的话，无需设置' })
|
||||
clusterIp!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '集群域名',
|
||||
helper: '可不填，默认为:[clusterId].ccs.tencent-cloud.com',
|
||||
})
|
||||
clusterDomain!: string;
|
||||
@TaskInput({
|
||||
title: '腾讯云证书id',
|
||||
helper: '请选择“上传证书到腾讯云”前置任务的输出',
|
||||
component: {
|
||||
name: 'pi-output-selector',
|
||||
from: 'UploadCertToTencent',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
tencentCertId!: string;
|
||||
|
||||
/**
|
||||
* AccessProvider的key,或者一个包含access的具体的对象
|
||||
*/
|
||||
@TaskInput({
|
||||
title: 'Access授权',
|
||||
helper: 'access授权',
|
||||
component: {
|
||||
name: 'pi-access-selector',
|
||||
type: 'tencent',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
accessId!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '域名证书',
|
||||
helper: '请选择前置任务输出的域名证书',
|
||||
component: {
|
||||
name: 'pi-output-selector',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
cert!: any;
|
||||
|
||||
logger!: Logger;
|
||||
accessService!: IAccessService;
|
||||
async onInstance() {
|
||||
this.accessService = this.ctx.accessService;
|
||||
this.logger = this.ctx.logger;
|
||||
}
|
||||
async execute(): Promise<void> {
|
||||
const accessProvider = await this.accessService.getById(this.accessId);
|
||||
const tkeClient = this.getTkeClient(accessProvider, this.region);
|
||||
const kubeConfigStr = await this.getTkeKubeConfig(
|
||||
tkeClient,
|
||||
this.clusterId
|
||||
);
|
||||
|
||||
this.logger.info('kubeconfig已成功获取');
|
||||
const k8sClient = new K8sClient(kubeConfigStr);
|
||||
if (this.clusterIp != null) {
|
||||
if (!this.clusterDomain) {
|
||||
this.clusterDomain = `${this.clusterId}.ccs.tencent-cloud.com`;
|
||||
}
|
||||
// 修改内网解析ip地址
|
||||
k8sClient.setLookup({ [this.clusterDomain]: { ip: this.clusterIp } });
|
||||
}
|
||||
const ingressType = this.ingressClass || 'qcloud';
|
||||
if (ingressType === 'qcloud') {
|
||||
await this.patchQcloudCertSecret({ k8sClient });
|
||||
} else {
|
||||
await this.patchNginxCertSecret({ k8sClient });
|
||||
}
|
||||
|
||||
await utils.sleep(2000); // 停留2秒，等待secret部署完成
|
||||
await this.restartIngress({ k8sClient });
|
||||
}
|
||||
|
||||
getTkeClient(accessProvider: any, region = 'ap-guangzhou') {
|
||||
const TkeClient = tencentcloud.tke.v20180525.Client;
|
||||
const clientConfig = {
|
||||
credential: {
|
||||
secretId: accessProvider.secretId,
|
||||
secretKey: accessProvider.secretKey,
|
||||
},
|
||||
region,
|
||||
profile: {
|
||||
httpProfile: {
|
||||
endpoint: 'tke.tencentcloudapi.com',
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
return new TkeClient(clientConfig);
|
||||
}
|
||||
|
||||
async getTkeKubeConfig(client: any, clusterId: string) {
|
||||
// Depends on tencentcloud-sdk-nodejs version 4.0.3 or higher
|
||||
const params = {
|
||||
ClusterId: clusterId,
|
||||
};
|
||||
const ret = await client.DescribeClusterKubeconfig(params);
|
||||
this.checkRet(ret);
|
||||
this.logger.info(
|
||||
'注意：后续操作需要在【集群->基本信息】中开启外网或内网访问,https://console.cloud.tencent.com/tke2/cluster'
|
||||
);
|
||||
return ret.Kubeconfig;
|
||||
}
|
||||
|
||||
appendTimeSuffix(name: string) {
|
||||
if (name == null) {
|
||||
name = 'certd';
|
||||
}
|
||||
return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
|
||||
}
|
||||
|
||||
async patchQcloudCertSecret(options: { k8sClient: any }) {
|
||||
if (this.tencentCertId == null) {
|
||||
throw new Error('请先将【上传证书到腾讯云】作为前置任务');
|
||||
}
|
||||
this.logger.info('腾讯云证书ID:', this.tencentCertId);
|
||||
const certIdBase64 = Buffer.from(this.tencentCertId).toString('base64');
|
||||
|
||||
const { namespace, secretName } = this;
|
||||
|
||||
const body = {
|
||||
data: {
|
||||
qcloud_cert_id: certIdBase64,
|
||||
},
|
||||
metadata: {
|
||||
labels: {
|
||||
certd: this.appendTimeSuffix('certd'),
|
||||
},
|
||||
},
|
||||
};
|
||||
let secretNames: any = secretName;
|
||||
if (typeof secretName === 'string') {
|
||||
secretNames = [secretName];
|
||||
}
|
||||
for (const secret of secretNames) {
|
||||
await options.k8sClient.patchSecret({
|
||||
namespace,
|
||||
secretName: secret,
|
||||
body,
|
||||
});
|
||||
this.logger.info(`CertSecret已更新:${secret}`);
|
||||
}
|
||||
}
|
||||
|
||||
async patchNginxCertSecret(options: { k8sClient: any }) {
|
||||
const { k8sClient } = options;
|
||||
const { cert } = this;
|
||||
const crt = cert.crt;
|
||||
const key = cert.key;
|
||||
const crtBase64 = Buffer.from(crt).toString('base64');
|
||||
const keyBase64 = Buffer.from(key).toString('base64');
|
||||
|
||||
const { namespace, secretName } = this;
|
||||
|
||||
const body = {
|
||||
data: {
|
||||
'tls.crt': crtBase64,
|
||||
'tls.key': keyBase64,
|
||||
},
|
||||
metadata: {
|
||||
labels: {
|
||||
certd: this.appendTimeSuffix('certd'),
|
||||
},
|
||||
},
|
||||
};
|
||||
let secretNames = secretName;
|
||||
if (typeof secretName === 'string') {
|
||||
secretNames = [secretName];
|
||||
}
|
||||
for (const secret of secretNames) {
|
||||
await k8sClient.patchSecret({ namespace, secretName: secret, body });
|
||||
this.logger.info(`CertSecret已更新:${secret}`);
|
||||
}
|
||||
}
|
||||
|
||||
async restartIngress(options: { k8sClient: any }) {
|
||||
const { k8sClient } = options;
|
||||
const { namespace, ingressName } = this;
|
||||
|
||||
const body = {
|
||||
metadata: {
|
||||
labels: {
|
||||
certd: this.appendTimeSuffix('certd'),
|
||||
},
|
||||
},
|
||||
};
|
||||
let ingressNames = this.ingressName;
|
||||
if (typeof ingressName === 'string') {
|
||||
ingressNames = [ingressName];
|
||||
}
|
||||
for (const ingress of ingressNames) {
|
||||
await k8sClient.patchIngress({ namespace, ingressName: ingress, body });
|
||||
this.logger.info(`ingress已重启:${ingress}`);
|
||||
}
|
||||
}
|
||||
checkRet(ret: any) {
|
||||
if (!ret || ret.Error) {
|
||||
throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,4 @@
|
||||
export * from './deploy-to-clb';
|
||||
export * from './deploy-to-tke-ingress';
|
||||
export * from './deploy-to-cdn';
|
||||
export * from './upload-to-tencent';
|
||||
+124
@@ -0,0 +1,124 @@
|
||||
import {
|
||||
AbstractTaskPlugin,
|
||||
IAccessService,
|
||||
ILogger,
|
||||
IsTaskPlugin,
|
||||
RunStrategy,
|
||||
TaskInput,
|
||||
TaskOutput,
|
||||
} from '@certd/pipeline';
|
||||
import tencentcloud from 'tencentcloud-sdk-nodejs/index';
|
||||
import dayjs from 'dayjs';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'UploadCertToTencent',
|
||||
title: '上传证书到腾讯云',
|
||||
desc: '上传成功后输出：tencentCertId',
|
||||
default: {
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.SkipWhenSucceed,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class UploadToTencentPlugin extends AbstractTaskPlugin {
|
||||
@TaskInput({ title: '证书名称' })
|
||||
name!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: 'Access授权',
|
||||
helper: 'access授权',
|
||||
component: {
|
||||
name: 'pi-access-selector',
|
||||
type: 'tencent',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
accessId!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '域名证书',
|
||||
helper: '请选择前置任务输出的域名证书',
|
||||
component: {
|
||||
name: 'pi-output-selector',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
cert!: any;
|
||||
|
||||
@TaskOutput({
|
||||
title: '上传成功后的腾讯云CertId',
|
||||
})
|
||||
tencentCertId?: string;
|
||||
|
||||
accessService!: IAccessService;
|
||||
logger!: ILogger;
|
||||
|
||||
async onInstance() {
|
||||
this.accessService = this.ctx.accessService;
|
||||
this.logger = this.ctx.logger;
|
||||
}
|
||||
|
||||
async execute(): Promise<void> {
|
||||
const { accessId, name, cert } = this;
|
||||
const accessProvider = await this.accessService.getById(accessId);
|
||||
const certName = this.appendTimeSuffix(name || cert.domain);
|
||||
const client = this.getClient(accessProvider);
|
||||
|
||||
const params = {
|
||||
CertificatePublicKey: cert.crt,
|
||||
CertificatePrivateKey: cert.key,
|
||||
Alias: certName,
|
||||
};
|
||||
const ret = await client.UploadCertificate(params);
|
||||
this.checkRet(ret);
|
||||
this.logger.info('证书上传成功：tencentCertId=', ret.CertificateId);
|
||||
|
||||
this.tencentCertId = ret.CertificateId;
|
||||
}
|
||||
|
||||
appendTimeSuffix(name: string) {
|
||||
if (name == null) {
|
||||
name = 'certd';
|
||||
}
|
||||
return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
|
||||
}
|
||||
|
||||
getClient(accessProvider: any) {
|
||||
const SslClient = tencentcloud.ssl.v20191205.Client;
|
||||
|
||||
const clientConfig = {
|
||||
credential: {
|
||||
secretId: accessProvider.secretId,
|
||||
secretKey: accessProvider.secretKey,
|
||||
},
|
||||
region: '',
|
||||
profile: {
|
||||
httpProfile: {
|
||||
endpoint: 'ssl.tencentcloudapi.com',
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
return new SslClient(clientConfig);
|
||||
}
|
||||
|
||||
// async rollback({ input }) {
|
||||
// const { accessId } = input;
|
||||
// const accessProvider = await this.accessService.getById(accessId);
|
||||
// const client = this.getClient(accessProvider);
|
||||
//
|
||||
// const { tencentCertId } = context;
|
||||
// const params = {
|
||||
// CertificateId: tencentCertId,
|
||||
// };
|
||||
// const ret = await client.DeleteCertificate(params);
|
||||
// this.checkRet(ret);
|
||||
// this.logger.info("证书删除成功：DeleteResult=", ret.DeleteResult);
|
||||
// delete context.tencentCertId;
|
||||
// }
|
||||
checkRet(ret: any) {
|
||||
if (!ret || ret.Error) {
|
||||
throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message);
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user