mirror of
https://github.com/certd/certd.git
synced 2026-04-23 19:57:27 +08:00
perf: plugins增加图标
This commit is contained in:
@@ -20,8 +20,7 @@ export class AutoRegisterCron {
|
||||
async init() {
|
||||
logger.info('加载定时trigger开始');
|
||||
await this.pipelineService.onStartup(this.immediateTriggerOnce, this.onlyAdminUser);
|
||||
// logger.info(this.echoPlugin, this.echoPlugin.test);
|
||||
// logger.info('加载定时trigger完成');
|
||||
logger.info('加载定时trigger完成');
|
||||
//
|
||||
// const meta = getClassMetadata(CLASS_KEY, this.echoPlugin);
|
||||
// console.log('meta', meta);
|
||||
|
||||
@@ -180,7 +180,6 @@ export class PipelineService extends BaseService<PipelineEntity> {
|
||||
* 应用启动后初始加载记录
|
||||
*/
|
||||
async onStartup(immediateTriggerOnce: boolean, onlyAdminUser: boolean) {
|
||||
logger.info('加载定时trigger开始');
|
||||
await this.foreachPipeline(async entity => {
|
||||
if (onlyAdminUser && entity.userId !== 1) {
|
||||
return;
|
||||
|
||||
-236
@@ -1,236 +0,0 @@
|
||||
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput, utils } from '@certd/pipeline';
|
||||
import { AliyunAccess, AliyunClient } from '@certd/plugin-plus';
|
||||
import { appendTimeSuffix } from '../../utils/index.js';
|
||||
import { CertInfo } from '@certd/plugin-cert';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToAliyunAckIngress',
|
||||
title: '部署到阿里云AckIngress',
|
||||
group: pluginGroups.aliyun.key,
|
||||
input: {},
|
||||
output: {},
|
||||
default: {
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.SkipWhenSucceed,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class DeployCertToAliyunAckIngressPlugin extends AbstractTaskPlugin {
|
||||
@TaskInput({
|
||||
title: '集群id',
|
||||
component: {
|
||||
placeholder: '集群id',
|
||||
},
|
||||
})
|
||||
clusterId!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '保密字典Id',
|
||||
component: {
|
||||
placeholder: '保密字典Id',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
secretName!: string | string[];
|
||||
|
||||
@TaskInput({
|
||||
title: '大区',
|
||||
value: 'cn-shanghai',
|
||||
component: {
|
||||
placeholder: '集群所属大区',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
regionId!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '命名空间',
|
||||
value: 'default',
|
||||
component: {
|
||||
placeholder: '命名空间',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
namespace: string = 'default';
|
||||
@TaskInput({
|
||||
title: 'ingress名称',
|
||||
value: '',
|
||||
component: {
|
||||
placeholder: 'ingress名称',
|
||||
},
|
||||
required: true,
|
||||
helper: '可以传入一个数组',
|
||||
})
|
||||
ingressName!: string;
|
||||
@TaskInput({
|
||||
title: 'ingress类型',
|
||||
value: 'nginx',
|
||||
component: {
|
||||
placeholder: '暂时只支持nginx类型',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
ingressClass!: string;
|
||||
@TaskInput({
|
||||
title: '是否私网ip',
|
||||
value: false,
|
||||
component: {
|
||||
name: 'a-switch',
|
||||
vModel: 'checked',
|
||||
placeholder: '集群连接端点是否是私网ip',
|
||||
},
|
||||
helper: '如果您当前certd运行在同一个私网下,可以选择是。',
|
||||
required: true,
|
||||
})
|
||||
isPrivateIpAddress!: boolean;
|
||||
@TaskInput({
|
||||
title: '域名证书',
|
||||
helper: '请选择前置任务输出的域名证书',
|
||||
component: {
|
||||
name: 'pi-output-selector',
|
||||
from: ['CertApply', 'CertApplyLego'],
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
cert!: CertInfo;
|
||||
@TaskInput({
|
||||
title: 'Access授权',
|
||||
helper: '阿里云授权AccessKeyId、AccessKeySecret',
|
||||
component: {
|
||||
name: 'pi-access-selector',
|
||||
type: 'aliyun',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
accessId!: string;
|
||||
K8sClient: any;
|
||||
async onInstance() {
|
||||
const sdk = await import('@certd/lib-k8s');
|
||||
this.K8sClient = sdk.K8sClient;
|
||||
}
|
||||
async execute(): Promise<void> {
|
||||
this.logger.info('开始部署证书到阿里云cdn');
|
||||
const { regionId, ingressClass, clusterId, isPrivateIpAddress, cert } = this;
|
||||
const access = (await this.accessService.getById(this.accessId)) as AliyunAccess;
|
||||
const client = await this.getClient(access, regionId);
|
||||
const kubeConfigStr = await this.getKubeConfig(client, clusterId, isPrivateIpAddress);
|
||||
|
||||
this.logger.info('kubeconfig已成功获取');
|
||||
const k8sClient = new this.K8sClient({
|
||||
kubeConfigStr,
|
||||
logger: this.logger,
|
||||
});
|
||||
const ingressType = ingressClass || 'qcloud';
|
||||
if (ingressType === 'qcloud') {
|
||||
throw new Error('暂未实现');
|
||||
// await this.patchQcloudCertSecret({ k8sClient, props, context })
|
||||
} else {
|
||||
await this.patchNginxCertSecret({ cert, k8sClient });
|
||||
}
|
||||
|
||||
await utils.sleep(3000); // 停留2秒,等待secret部署完成
|
||||
// await this.restartIngress({ k8sClient, props })
|
||||
}
|
||||
|
||||
async restartIngress(options: { k8sClient: any }) {
|
||||
const { k8sClient } = options;
|
||||
const { namespace } = this;
|
||||
|
||||
const body = {
|
||||
metadata: {
|
||||
labels: {
|
||||
certd: appendTimeSuffix('certd'),
|
||||
},
|
||||
},
|
||||
};
|
||||
const ingressList = await k8sClient.getIngressList({ namespace });
|
||||
this.logger.info('ingressList:', ingressList);
|
||||
if (!ingressList || !ingressList.items) {
|
||||
return;
|
||||
}
|
||||
const ingressNames = ingressList.items
|
||||
.filter((item: any) => {
|
||||
if (!item.spec.tls) {
|
||||
return false;
|
||||
}
|
||||
for (const tls of item.spec.tls) {
|
||||
if (tls.secretName === this.secretName) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
})
|
||||
.map((item: any) => {
|
||||
return item.metadata.name;
|
||||
});
|
||||
for (const ingress of ingressNames) {
|
||||
await k8sClient.patchIngress({ namespace, ingressName: ingress, body });
|
||||
this.logger.info(`ingress已重启:${ingress}`);
|
||||
}
|
||||
}
|
||||
|
||||
async patchNginxCertSecret(options: { cert: CertInfo; k8sClient: any }) {
|
||||
const { cert, k8sClient } = options;
|
||||
const crt = cert.crt;
|
||||
const key = cert.key;
|
||||
const crtBase64 = Buffer.from(crt).toString('base64');
|
||||
const keyBase64 = Buffer.from(key).toString('base64');
|
||||
|
||||
const { namespace, secretName } = this;
|
||||
|
||||
const body = {
|
||||
data: {
|
||||
'tls.crt': crtBase64,
|
||||
'tls.key': keyBase64,
|
||||
},
|
||||
metadata: {
|
||||
labels: {
|
||||
certd: appendTimeSuffix('certd'),
|
||||
},
|
||||
},
|
||||
};
|
||||
let secretNames: any = secretName;
|
||||
if (typeof secretName === 'string') {
|
||||
secretNames = [secretName];
|
||||
}
|
||||
for (const secret of secretNames) {
|
||||
await k8sClient.patchSecret({ namespace, secretName: secret, body });
|
||||
this.logger.info(`CertSecret已更新:${secret}`);
|
||||
}
|
||||
}
|
||||
|
||||
async getClient(aliyunProvider: any, regionId: string) {
|
||||
|
||||
const client = new AliyunClient({logger:this.logger})
|
||||
await client.init({
|
||||
accessKeyId: aliyunProvider.accessKeyId,
|
||||
accessKeySecret: aliyunProvider.accessKeySecret,
|
||||
endpoint: `https://cs.${regionId}.aliyuncs.com`,
|
||||
apiVersion: '2015-12-15',
|
||||
})
|
||||
return client
|
||||
}
|
||||
|
||||
async getKubeConfig(client: any, clusterId: string, isPrivateIpAddress = false) {
|
||||
const httpMethod = 'GET';
|
||||
const uriPath = `/k8s/${clusterId}/user_config`;
|
||||
const queries = {
|
||||
PrivateIpAddress: isPrivateIpAddress,
|
||||
};
|
||||
const body = '{}';
|
||||
const headers = {
|
||||
'Content-Type': 'application/json',
|
||||
};
|
||||
const requestOption = {};
|
||||
|
||||
try {
|
||||
const res = await client.request(httpMethod, uriPath, queries, body, headers, requestOption);
|
||||
return res.config;
|
||||
} catch (e) {
|
||||
console.error('请求出错:', e);
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
new DeployCertToAliyunAckIngressPlugin();
|
||||
@@ -4,6 +4,7 @@ import { AliyunAccess, AliyunClient } from "@certd/plugin-plus";
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToAliyunCDN',
|
||||
title: '部署证书至阿里云CDN',
|
||||
icon: 'ant-design:aliyun-outlined',
|
||||
group: pluginGroups.aliyun.key,
|
||||
desc: '自动部署域名证书至阿里云CDN',
|
||||
default: {
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from '@certd/pipeline';
|
||||
import dayjs from 'dayjs';
|
||||
import { AliyunAccess, AliyunClient } from "@certd/plugin-plus";
|
||||
import { AliyunAccess, AliyunClient } from '@certd/plugin-plus';
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToAliyunDCDN',
|
||||
title: '部署证书至阿里云DCDN',
|
||||
icon: 'ant-design:aliyun-outlined',
|
||||
group: pluginGroups.aliyun.key,
|
||||
desc: '依赖证书申请前置任务,自动部署域名证书至阿里云DCDN',
|
||||
default: {
|
||||
@@ -59,14 +60,14 @@ export class DeployCertToAliyunDCDN extends AbstractTaskPlugin {
|
||||
}
|
||||
|
||||
async getClient(access: AliyunAccess) {
|
||||
const client = new AliyunClient({logger:this.logger})
|
||||
const client = new AliyunClient({ logger: this.logger });
|
||||
await client.init({
|
||||
accessKeyId: access.accessKeyId,
|
||||
accessKeySecret: access.accessKeySecret,
|
||||
endpoint: 'https://dcdn.aliyuncs.com',
|
||||
apiVersion: '2018-01-15',
|
||||
})
|
||||
return client
|
||||
});
|
||||
return client;
|
||||
}
|
||||
|
||||
async buildParams() {
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
export * from './deploy-to-cdn/index.js';
|
||||
export * from './deploy-to-dcdn/index.js';
|
||||
export * from './deploy-to-ack-ingress/index.js';
|
||||
export * from './upload-to-aliyun/index.js';
|
||||
|
||||
@@ -5,6 +5,7 @@ import { AliyunAccess, AliyunClient } from '@certd/plugin-plus';
|
||||
@IsTaskPlugin({
|
||||
name: 'uploadCertToAliyun',
|
||||
title: '上传证书到阿里云',
|
||||
icon: 'ant-design:aliyun-outlined',
|
||||
group: pluginGroups.aliyun.key,
|
||||
desc: '',
|
||||
default: {
|
||||
|
||||
@@ -4,6 +4,7 @@ import { CertInfo, CertReader } from '@certd/plugin-cert';
|
||||
@IsTaskPlugin({
|
||||
name: 'CloudflareDeployToCDN',
|
||||
title: '部署证书到CF CDN',
|
||||
icon: 'simple-icons:cloudflare',
|
||||
group: pluginGroups.other.key,
|
||||
desc: '暂未实现,不可用',
|
||||
default: {
|
||||
|
||||
@@ -4,6 +4,7 @@ import { CertInfo, CertReader } from '@certd/plugin-cert';
|
||||
@IsTaskPlugin({
|
||||
name: 'demoTest',
|
||||
title: 'Demo测试插件',
|
||||
icon: 'clarity:plugin-line',
|
||||
group: pluginGroups.other.key,
|
||||
default: {
|
||||
strategy: {
|
||||
|
||||
@@ -6,6 +6,7 @@ import dayjs from 'dayjs';
|
||||
@IsTaskPlugin({
|
||||
name: 'DogeCloudDeployToCDN',
|
||||
title: '部署证书到多吉云CDN',
|
||||
icon: 'svg:icon-dogecloud',
|
||||
group: pluginGroups.cdn.key,
|
||||
default: {
|
||||
strategy: {
|
||||
|
||||
@@ -7,6 +7,7 @@ import path from 'path';
|
||||
@IsTaskPlugin({
|
||||
name: 'CopyToLocal',
|
||||
title: '复制到本机',
|
||||
icon: 'solar:copy-bold-duotone',
|
||||
group: pluginGroups.host.key,
|
||||
default: {
|
||||
strategy: {
|
||||
|
||||
@@ -4,6 +4,7 @@ import { SshClient } from '../../lib/ssh.js';
|
||||
@IsTaskPlugin({
|
||||
name: 'hostShellExecute',
|
||||
title: '执行远程主机脚本命令',
|
||||
icon:"tabler:brand-powershell",
|
||||
group: pluginGroups.host.key,
|
||||
input: {},
|
||||
default: {
|
||||
|
||||
@@ -7,6 +7,7 @@ import { SshAccess } from '../../access/index.js';
|
||||
@IsTaskPlugin({
|
||||
name: 'uploadCertToHost',
|
||||
title: '上传证书到主机',
|
||||
icon:"line-md:uploading-loop",
|
||||
group: pluginGroups.host.key,
|
||||
desc: '也支持复制证书到本机',
|
||||
default: {
|
||||
|
||||
@@ -3,6 +3,7 @@ import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput
|
||||
@IsTaskPlugin({
|
||||
name: 'RestartCertd',
|
||||
title: '重启Certd',
|
||||
icon: 'mdi:restart',
|
||||
desc: '延迟一定时间后自动杀死自己,然后通过Docker来自动重启',
|
||||
group: pluginGroups.other.key,
|
||||
default: {
|
||||
@@ -24,6 +25,7 @@ export class RestartCertdPlugin extends AbstractTaskPlugin {
|
||||
delay = 30;
|
||||
async onInstance() {}
|
||||
async execute(): Promise<void> {
|
||||
this.logger.info(`Certd 将在 ${this.delay} 秒后关闭`);
|
||||
setTimeout(() => {
|
||||
process.exit(1);
|
||||
}, this.delay * 1000);
|
||||
|
||||
@@ -9,6 +9,7 @@ export type CustomScriptContext = {
|
||||
@IsTaskPlugin({
|
||||
name: 'CustomScript',
|
||||
title: '自定义js脚本',
|
||||
icon:"ri:javascript-line",
|
||||
desc: '测试',
|
||||
group: pluginGroups.other.key,
|
||||
default: {
|
||||
|
||||
@@ -1,2 +1 @@
|
||||
export * from './dnspod-access.js';
|
||||
export * from './tencent-access.js';
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
import { IsAccess, AccessInput } from '@certd/pipeline';
|
||||
|
||||
@IsAccess({
|
||||
name: 'tencent',
|
||||
title: '腾讯云',
|
||||
})
|
||||
export class TencentAccess {
|
||||
@AccessInput({
|
||||
title: 'secretId',
|
||||
helper: '使用对应的插件需要有对应的权限,比如上传证书,需要证书管理权限;部署到clb需要clb相关权限',
|
||||
component: {
|
||||
placeholder: 'secretId',
|
||||
},
|
||||
rules: [{ required: true, message: '该项必填' }],
|
||||
})
|
||||
secretId = '';
|
||||
@AccessInput({
|
||||
title: 'secretKey',
|
||||
component: {
|
||||
placeholder: 'secretKey',
|
||||
},
|
||||
encrypt: true,
|
||||
rules: [{ required: true, message: '该项必填' }],
|
||||
})
|
||||
secretKey = '';
|
||||
}
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
import { Autowire, HttpClient, ILogger } from '@certd/pipeline';
|
||||
import { AbstractDnsProvider, CreateRecordOptions, IsDnsProvider, RemoveRecordOptions } from '@certd/plugin-cert';
|
||||
import { TencentAccess } from '../access/index.js';
|
||||
import { TencentAccess } from '@certd/plugin-plus';
|
||||
|
||||
@IsDnsProvider({
|
||||
name: 'tencent',
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from '@certd/pipeline';
|
||||
import { TencentAccess } from '../../access/index.js';
|
||||
import { TencentAccess } from '@certd/plugin-plus';
|
||||
import { CertInfo } from '@certd/plugin-cert';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToTencentCDN',
|
||||
title: '部署到腾讯云CDN',
|
||||
icon: 'svg:icon-tencentcloud',
|
||||
group: pluginGroups.tencent.key,
|
||||
default: {
|
||||
strategy: {
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput, utils } from '@certd/pipeline';
|
||||
import { TencentAccess } from '../../access/index.js';
|
||||
import { TencentAccess } from '@certd/plugin-plus';
|
||||
import dayjs from 'dayjs';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToTencentCLB',
|
||||
title: '部署到腾讯云CLB',
|
||||
icon: 'svg:icon-tencentcloud',
|
||||
group: pluginGroups.tencent.key,
|
||||
desc: '暂时只支持单向认证证书,暂时只支持通用负载均衡,必须开启sni',
|
||||
default: {
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from '@certd/pipeline';
|
||||
import { TencentAccess } from '../../access/index.js';
|
||||
import { TencentAccess } from '@certd/plugin-plus';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToTencentEO',
|
||||
title: '部署到腾讯云EO',
|
||||
icon: 'svg:icon-tencentcloud',
|
||||
desc: '腾讯云边缘安全加速平台EO,必须配置上传证书到腾讯云任务',
|
||||
group: pluginGroups.tencent.key,
|
||||
default: {
|
||||
|
||||
-253
@@ -1,253 +0,0 @@
|
||||
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput, utils } from '@certd/pipeline';
|
||||
import dayjs from 'dayjs';
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: 'DeployCertToTencentTKEIngress',
|
||||
title: '部署到腾讯云TKE-ingress',
|
||||
group: pluginGroups.tencent.key,
|
||||
desc: '需要【上传到腾讯云】作为前置任务',
|
||||
default: {
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.SkipWhenSucceed,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||
@TaskInput({ title: '大区', value: 'ap-guangzhou', required: true })
|
||||
region!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '集群ID',
|
||||
required: true,
|
||||
desc: '例如:cls-6lbj1vee',
|
||||
request: true,
|
||||
})
|
||||
clusterId!: string;
|
||||
|
||||
@TaskInput({ title: '集群namespace', value: 'default', required: true })
|
||||
namespace!: string;
|
||||
|
||||
@TaskInput({ title: '证书的secret名称', required: true })
|
||||
secretName!: string | string[];
|
||||
|
||||
@TaskInput({ title: 'ingress名称', required: true })
|
||||
ingressName!: string | string[];
|
||||
|
||||
@TaskInput({
|
||||
title: 'ingress类型',
|
||||
value: 'qcloud',
|
||||
component: {
|
||||
name: 'a-auto-complete',
|
||||
vModel: 'value',
|
||||
options: [{ value: 'qcloud' }, { value: 'nginx' }],
|
||||
},
|
||||
helper: '可选 qcloud / nginx',
|
||||
})
|
||||
ingressClass!: string;
|
||||
|
||||
@TaskInput({ title: '集群内网ip', helper: '如果开启了外网的话,无需设置' })
|
||||
clusterIp!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '集群域名',
|
||||
helper: '可不填,默认为:[clusterId].ccs.tencent-cloud.com',
|
||||
})
|
||||
clusterDomain!: string;
|
||||
@TaskInput({
|
||||
title: '腾讯云证书id',
|
||||
helper: '请选择“上传证书到腾讯云”前置任务的输出',
|
||||
component: {
|
||||
name: 'pi-output-selector',
|
||||
from: 'UploadCertToTencent',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
tencentCertId!: string;
|
||||
|
||||
/**
|
||||
* AccessProvider的key,或者一个包含access的具体的对象
|
||||
*/
|
||||
@TaskInput({
|
||||
title: 'Access授权',
|
||||
helper: 'access授权',
|
||||
component: {
|
||||
name: 'pi-access-selector',
|
||||
type: 'tencent',
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
accessId!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: '域名证书',
|
||||
helper: '请选择前置任务输出的域名证书',
|
||||
component: {
|
||||
name: 'pi-output-selector',
|
||||
from: ['CertApply', 'CertApplyLego'],
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
cert!: any;
|
||||
|
||||
K8sClient: any;
|
||||
|
||||
async onInstance() {
|
||||
// const TkeClient = this.tencentcloud.tke.v20180525.Client;
|
||||
const k8sSdk = await import('@certd/lib-k8s');
|
||||
this.K8sClient = k8sSdk.K8sClient;
|
||||
}
|
||||
async execute(): Promise<void> {
|
||||
const accessProvider = await this.accessService.getById(this.accessId);
|
||||
const tkeClient = await this.getTkeClient(accessProvider, this.region);
|
||||
const kubeConfigStr = await this.getTkeKubeConfig(tkeClient, this.clusterId);
|
||||
|
||||
this.logger.info('kubeconfig已成功获取');
|
||||
const k8sClient = new this.K8sClient({
|
||||
kubeConfigStr,
|
||||
logger: this.logger,
|
||||
});
|
||||
if (this.clusterIp != null) {
|
||||
if (!this.clusterDomain) {
|
||||
this.clusterDomain = `${this.clusterId}.ccs.tencent-cloud.com`;
|
||||
}
|
||||
// 修改内网解析ip地址
|
||||
k8sClient.setLookup({ [this.clusterDomain]: { ip: this.clusterIp } });
|
||||
}
|
||||
const ingressType = this.ingressClass || 'qcloud';
|
||||
if (ingressType === 'qcloud') {
|
||||
await this.patchQcloudCertSecret({ k8sClient });
|
||||
} else {
|
||||
await this.patchNginxCertSecret({ k8sClient });
|
||||
}
|
||||
|
||||
await utils.sleep(2000); // 停留2秒,等待secret部署完成
|
||||
await this.restartIngress({ k8sClient });
|
||||
}
|
||||
|
||||
async getTkeClient(accessProvider: any, region = 'ap-guangzhou') {
|
||||
const sdk = await import('tencentcloud-sdk-nodejs/tencentcloud/services/tke/v20180525/index.js');
|
||||
const TkeClient = sdk.v20180525.Client;
|
||||
const clientConfig = {
|
||||
credential: {
|
||||
secretId: accessProvider.secretId,
|
||||
secretKey: accessProvider.secretKey,
|
||||
},
|
||||
region,
|
||||
profile: {
|
||||
httpProfile: {
|
||||
endpoint: 'tke.tencentcloudapi.com',
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
return new TkeClient(clientConfig);
|
||||
}
|
||||
|
||||
async getTkeKubeConfig(client: any, clusterId: string) {
|
||||
// Depends on tencentcloud-sdk-nodejs version 4.0.3 or higher
|
||||
const params = {
|
||||
ClusterId: clusterId,
|
||||
};
|
||||
const ret = await client.DescribeClusterKubeconfig(params);
|
||||
this.checkRet(ret);
|
||||
this.logger.info('注意:后续操作需要在【集群->基本信息】中开启外网或内网访问,https://console.cloud.tencent.com/tke2/cluster');
|
||||
return ret.Kubeconfig;
|
||||
}
|
||||
|
||||
appendTimeSuffix(name: string) {
|
||||
if (name == null) {
|
||||
name = 'certd';
|
||||
}
|
||||
return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
|
||||
}
|
||||
|
||||
async patchQcloudCertSecret(options: { k8sClient: any }) {
|
||||
if (this.tencentCertId == null) {
|
||||
throw new Error('请先将【上传证书到腾讯云】作为前置任务');
|
||||
}
|
||||
this.logger.info('腾讯云证书ID:', this.tencentCertId);
|
||||
const certIdBase64 = Buffer.from(this.tencentCertId).toString('base64');
|
||||
|
||||
const { namespace, secretName } = this;
|
||||
|
||||
const body = {
|
||||
data: {
|
||||
qcloud_cert_id: certIdBase64,
|
||||
},
|
||||
metadata: {
|
||||
labels: {
|
||||
certd: this.appendTimeSuffix('certd'),
|
||||
},
|
||||
},
|
||||
};
|
||||
let secretNames: any = secretName;
|
||||
if (typeof secretName === 'string') {
|
||||
secretNames = [secretName];
|
||||
}
|
||||
for (const secret of secretNames) {
|
||||
await options.k8sClient.patchSecret({
|
||||
namespace,
|
||||
secretName: secret,
|
||||
body,
|
||||
});
|
||||
this.logger.info(`CertSecret已更新:${secret}`);
|
||||
}
|
||||
}
|
||||
|
||||
async patchNginxCertSecret(options: { k8sClient: any }) {
|
||||
const { k8sClient } = options;
|
||||
const { cert } = this;
|
||||
const crt = cert.crt;
|
||||
const key = cert.key;
|
||||
const crtBase64 = Buffer.from(crt).toString('base64');
|
||||
const keyBase64 = Buffer.from(key).toString('base64');
|
||||
|
||||
const { namespace, secretName } = this;
|
||||
|
||||
const body = {
|
||||
data: {
|
||||
'tls.crt': crtBase64,
|
||||
'tls.key': keyBase64,
|
||||
},
|
||||
metadata: {
|
||||
labels: {
|
||||
certd: this.appendTimeSuffix('certd'),
|
||||
},
|
||||
},
|
||||
};
|
||||
let secretNames = secretName;
|
||||
if (typeof secretName === 'string') {
|
||||
secretNames = [secretName];
|
||||
}
|
||||
for (const secret of secretNames) {
|
||||
await k8sClient.patchSecret({ namespace, secretName: secret, body });
|
||||
this.logger.info(`CertSecret已更新:${secret}`);
|
||||
}
|
||||
}
|
||||
|
||||
async restartIngress(options: { k8sClient: any }) {
|
||||
const { k8sClient } = options;
|
||||
const { namespace, ingressName } = this;
|
||||
|
||||
const body = {
|
||||
metadata: {
|
||||
labels: {
|
||||
certd: this.appendTimeSuffix('certd'),
|
||||
},
|
||||
},
|
||||
};
|
||||
let ingressNames = this.ingressName;
|
||||
if (typeof ingressName === 'string') {
|
||||
ingressNames = [ingressName];
|
||||
}
|
||||
for (const ingress of ingressNames) {
|
||||
await k8sClient.patchIngress({ namespace, ingressName: ingress, body });
|
||||
this.logger.info(`ingress已重启:${ingress}`);
|
||||
}
|
||||
}
|
||||
checkRet(ret: any) {
|
||||
if (!ret || ret.Error) {
|
||||
throw new Error('执行失败:' + ret.Error.Code + ',' + ret.Error.Message);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,4 +1,3 @@
|
||||
export * from './deploy-to-clb/index.js';
|
||||
export * from './deploy-to-tke-ingress/index.js';
|
||||
export * from './deploy-to-cdn/index.js';
|
||||
export * from './upload-to-tencent/index.js';
|
||||
|
||||
@@ -4,6 +4,7 @@ import dayjs from 'dayjs';
|
||||
@IsTaskPlugin({
|
||||
name: 'UploadCertToTencent',
|
||||
title: '上传证书到腾讯云',
|
||||
icon: 'svg:icon-tencentcloud',
|
||||
desc: '上传成功后输出:tencentCertId',
|
||||
group: pluginGroups.tencent.key,
|
||||
default: {
|
||||
|
||||
Reference in New Issue
Block a user