From 474d9a3fb38c3dca9a30a5c5aa42d540f3cb9034 Mon Sep 17 00:00:00 2001 From: Fu Diwei Date: Wed, 1 Jul 2026 10:51:27 +0800 Subject: [PATCH] refactor: improve sdk error handling --- pkg/core/certmgr/providers/aliyun-cas/aliyun_cas.go | 9 ++++++++- pkg/core/certmgr/providers/aws-acm/aws_acm.go | 9 +++++++++ pkg/core/certmgr/providers/aws-iam/aws_iam.go | 9 +++++++++ .../providers/azure-keyvault/azure_keyvault.go | 11 +++++++++-- .../providers/baiducloud-cert/baiducloud_cert.go | 9 +++++++++ .../providers/huaweicloud-scm/huaweicloud_scm.go | 1 + .../providers/tencentcloud-gaap/tencentcloud_gaap.go | 7 +++++++ pkg/core/deployer/providers/aliyun-alb/aliyun_alb.go | 4 ++-- pkg/core/deployer/providers/aliyun-esa/aliyun_esa.go | 9 ++++----- .../providers/tencentcloud-ga2/tencentcloud_ga2.go | 4 ++-- 10 files changed, 60 insertions(+), 12 deletions(-) diff --git a/pkg/core/certmgr/providers/aliyun-cas/aliyun_cas.go b/pkg/core/certmgr/providers/aliyun-cas/aliyun_cas.go index c25bccda..10dac505 100644 --- a/pkg/core/certmgr/providers/aliyun-cas/aliyun_cas.go +++ b/pkg/core/certmgr/providers/aliyun-cas/aliyun_cas.go @@ -119,11 +119,18 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo // 对比证书内容 getUserCertificateDetailReq := &alicas.GetUserCertificateDetailRequest{ - CertId: certItem.CertificateId, + CertId: certItem.CertificateId, + CertFilter: tea.Bool(true), } getUserCertificateDetailResp, err := c.sdkClient.GetUserCertificateDetailWithContext(ctx, getUserCertificateDetailReq, &dara.RuntimeOptions{}) c.logger.Debug("sdk request 'cas.GetUserCertificateDetail'", slog.Any("request", getUserCertificateDetailReq), slog.Any("response", getUserCertificateDetailResp)) if err != nil { + if sdkErr, ok := err.(*tea.SDKError); ok { + if sdkErrCode := tea.StringValue(sdkErr.Code); strings.HasPrefix(sdkErrCode, "NotFound") { + continue + } + } + return nil, fmt.Errorf("failed to execute sdk request 'cas.GetUserCertificateDetail': %w", err) } else { if !xcert.EqualCertificatesFromPEM(certPEM, tea.StringValue(getUserCertificateDetailResp.Body.Cert)) { diff --git a/pkg/core/certmgr/providers/aws-acm/aws_acm.go b/pkg/core/certmgr/providers/aws-acm/aws_acm.go index b2078600..5ca7cddf 100644 --- a/pkg/core/certmgr/providers/aws-acm/aws_acm.go +++ b/pkg/core/certmgr/providers/aws-acm/aws_acm.go @@ -2,6 +2,7 @@ package awsacm import ( "context" + "errors" "fmt" "log/slog" "strings" @@ -10,6 +11,7 @@ import ( awscfg "github.com/aws/aws-sdk-go-v2/config" awscred "github.com/aws/aws-sdk-go-v2/credentials" awsacm "github.com/aws/aws-sdk-go-v2/service/acm" + "github.com/aws/smithy-go" "github.com/certimate-go/certimate/pkg/core" xcert "github.com/certimate-go/certimate/pkg/utils/cert" @@ -116,6 +118,13 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo } getCertificateResp, err := c.sdkClient.GetCertificate(ctx, getCertificateReq) if err != nil { + var sdkErr smithy.APIError + if errors.As(err, &sdkErr) { + if sdkErrCode := sdkErr.ErrorCode(); sdkErrCode == "NoSuchEntity" { + continue + } + } + return nil, fmt.Errorf("failed to execute sdk request 'acm.GetCertificate': %w", err) } else { if !xcert.EqualCertificatesFromPEM(certPEM, aws.ToString(getCertificateResp.Certificate)) { diff --git a/pkg/core/certmgr/providers/aws-iam/aws_iam.go b/pkg/core/certmgr/providers/aws-iam/aws_iam.go index 2d4d79a9..b4c7ca7a 100644 --- a/pkg/core/certmgr/providers/aws-iam/aws_iam.go +++ b/pkg/core/certmgr/providers/aws-iam/aws_iam.go @@ -3,6 +3,7 @@ package awsiam import ( "cmp" "context" + "errors" "fmt" "log/slog" "time" @@ -11,6 +12,7 @@ import ( awscfg "github.com/aws/aws-sdk-go-v2/config" awscred "github.com/aws/aws-sdk-go-v2/credentials" awsiam "github.com/aws/aws-sdk-go-v2/service/iam" + "github.com/aws/smithy-go" "github.com/samber/lo" "github.com/certimate-go/certimate/pkg/core" @@ -120,6 +122,13 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo } getServerCertificateResp, err := c.sdkClient.GetServerCertificate(ctx, getServerCertificateReq) if err != nil { + var sdkErr smithy.APIError + if errors.As(err, &sdkErr) { + if sdkErrCode := sdkErr.ErrorCode(); sdkErrCode == "InvalidArnException" || sdkErrCode == "ResourceNotFoundException" { + continue + } + } + return nil, fmt.Errorf("failed to execute sdk request 'iam.GetServerCertificate': %w", err) } else { if !xcert.EqualCertificatesFromPEM(certPEM, aws.ToString(getServerCertificateResp.ServerCertificate.CertificateBody)) { diff --git a/pkg/core/certmgr/providers/azure-keyvault/azure_keyvault.go b/pkg/core/certmgr/providers/azure-keyvault/azure_keyvault.go index caff2991..39e3ae09 100644 --- a/pkg/core/certmgr/providers/azure-keyvault/azure_keyvault.go +++ b/pkg/core/certmgr/providers/azure-keyvault/azure_keyvault.go @@ -119,6 +119,13 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo getCertificateResp, err := c.sdkClient.GetCertificate(ctx, certItem.ID.Name(), certItem.ID.Version(), nil) c.logger.Debug("sdk request 'keyvault.GetCertificate'", slog.String("params.certificateName", certItem.ID.Name()), slog.String("params.certificateVersion", certItem.ID.Version()), slog.Any("response", getCertificateResp)) if err != nil { + var sdkErr *azcore.ResponseError + if errors.As(err, &sdkErr) { + if sdkErrCode := sdkErr.ErrorCode; sdkErrCode == "ResourceNotFound" || sdkErrCode == "CertificateNotFound" { + continue + } + } + return nil, fmt.Errorf("failed to execute sdk request 'keyvault.GetCertificate': %w", err) } else { if !xcert.EqualCertificatesFromPEM(certPEM, string(getCertificateResp.CER)) { @@ -190,8 +197,8 @@ func (c *Certmgr) Replace(ctx context.Context, certIdOrName string, certPEM, pri getCertificateResp, err := c.sdkClient.GetCertificate(ctx, certIdOrName, "", nil) c.logger.Debug("sdk request 'keyvault.GetCertificate'", slog.String("params.certificateName", certIdOrName), slog.Any("response", getCertificateResp)) if err != nil { - var respErr *azcore.ResponseError - if !errors.As(err, &respErr) || (respErr.ErrorCode != "ResourceNotFound" && respErr.ErrorCode != "CertificateNotFound") { + var sdkErr *azcore.ResponseError + if !errors.As(err, &sdkErr) || (sdkErr.ErrorCode != "ResourceNotFound" && sdkErr.ErrorCode != "CertificateNotFound") { return nil, fmt.Errorf("failed to execute sdk request 'keyvault.GetCertificate': %w", err) } } else { diff --git a/pkg/core/certmgr/providers/baiducloud-cert/baiducloud_cert.go b/pkg/core/certmgr/providers/baiducloud-cert/baiducloud_cert.go index cc2554f0..da068343 100644 --- a/pkg/core/certmgr/providers/baiducloud-cert/baiducloud_cert.go +++ b/pkg/core/certmgr/providers/baiducloud-cert/baiducloud_cert.go @@ -7,6 +7,8 @@ import ( "strings" "time" + "github.com/baidubce/bce-sdk-go/bce" + "github.com/certimate-go/certimate/pkg/core" baiducert "github.com/certimate-go/certimate/pkg/sdk3rd/baiducloud/cert" xcert "github.com/certimate-go/certimate/pkg/utils/cert" @@ -66,6 +68,7 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo } // 查看证书列表 + // REF: https://cloud.baidu.com/doc/Reference/s/Gjwvz27xu#34-%E6%9F%A5%E7%9C%8B%E8%AF%81%E4%B9%A6%E5%88%97%E8%A1%A8 // REF: https://cloud.baidu.com/doc/Reference/s/Gjwvz27xu#35-%E6%9F%A5%E7%9C%8B%E8%AF%81%E4%B9%A6%E5%88%97%E8%A1%A8%E8%AF%A6%E6%83%85 listCertDetail, err := c.sdkClient.ListCertDetail() c.logger.Debug("sdk request 'cert.ListCertDetail'", slog.Any("response", listCertDetail)) @@ -94,6 +97,12 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo getCertDetailResp, err := c.sdkClient.GetCertRawData(certItem.CertId) c.logger.Debug("sdk request 'cert.GetCertRawData'", slog.String("params.certId", certItem.CertId), slog.Any("response", getCertDetailResp)) if err != nil { + if sdkErr, ok := err.(*bce.BceServiceError); ok { + if sdkErrCode := sdkErr.Code; sdkErrCode == "ResourceNotFoundException" { + continue + } + } + return nil, fmt.Errorf("failed to execute sdk request 'cert.GetCertRawData': %w", err) } else { if !xcert.EqualCertificatesFromPEM(certPEM, getCertDetailResp.CertServerData) { diff --git a/pkg/core/certmgr/providers/huaweicloud-scm/huaweicloud_scm.go b/pkg/core/certmgr/providers/huaweicloud-scm/huaweicloud_scm.go index 6b901b62..2450fb6b 100644 --- a/pkg/core/certmgr/providers/huaweicloud-scm/huaweicloud_scm.go +++ b/pkg/core/certmgr/providers/huaweicloud-scm/huaweicloud_scm.go @@ -125,6 +125,7 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo if exportCertificateResp != nil && exportCertificateResp.HttpStatusCode == 404 { continue } + return nil, fmt.Errorf("failed to execute sdk request 'scm.ExportCertificate': %w", err) } else { if !xcert.EqualCertificatesFromPEM(certPEM, lo.FromPtr(exportCertificateResp.Certificate)) { diff --git a/pkg/core/certmgr/providers/tencentcloud-gaap/tencentcloud_gaap.go b/pkg/core/certmgr/providers/tencentcloud-gaap/tencentcloud_gaap.go index 75fa0ad4..0c547230 100644 --- a/pkg/core/certmgr/providers/tencentcloud-gaap/tencentcloud_gaap.go +++ b/pkg/core/certmgr/providers/tencentcloud-gaap/tencentcloud_gaap.go @@ -9,6 +9,7 @@ import ( "github.com/samber/lo" "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common" + tcerrors "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/errors" "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile" tcgaap "github.com/certimate-go/certimate/pkg/sdk3rd-trimmed/github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/gaap/v20180529" @@ -114,6 +115,12 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo describeCertificateDetailResp, err := c.sdkClient.DescribeCertificateDetailWithContext(ctx, describeCertificateDetailReq) c.logger.Debug("sdk request 'gaap.DescribeCertificateDetail'", slog.Any("request", describeCertificateDetailReq), slog.Any("response", describeCertificateDetailResp)) if err != nil { + if sdkErr, ok := err.(*tcerrors.TencentCloudSDKError); ok { + if sdkErrCode := sdkErr.Code; sdkErrCode == "ResourceNotFound" { + continue + } + } + return nil, fmt.Errorf("failed to execute sdk request 'gaap.DescribeCertificateDetail': %w", err) } else { if !xcert.EqualCertificatesFromPEM(certPEM, lo.FromPtr(describeCertificateDetailResp.Response.CertificateDetail.CertificateContent)) { diff --git a/pkg/core/deployer/providers/aliyun-alb/aliyun_alb.go b/pkg/core/deployer/providers/aliyun-alb/aliyun_alb.go index 570d0014..7a07ae25 100644 --- a/pkg/core/deployer/providers/aliyun-alb/aliyun_alb.go +++ b/pkg/core/deployer/providers/aliyun-alb/aliyun_alb.go @@ -371,8 +371,8 @@ func (d *Deployer) updateListenerCertificate(ctx context.Context, cloudListenerI getCertificateDetailResp, err := d.sdkClients.CAS.GetCertificateDetailWithContext(ctx, getCertificateDetailReq, &dara.RuntimeOptions{}) d.logger.Debug("sdk request 'cas.GetCertificateDetail'", slog.Any("request", getCertificateDetailReq), slog.Any("response", getCertificateDetailResp)) if err != nil { - if sdkerr, ok := err.(*tea.SDKError); ok { - if tea.IntValue(sdkerr.StatusCode) == 404 && strings.HasPrefix(tea.StringValue(sdkerr.Code), "NotFound") { + if sdkErr, ok := err.(*tea.SDKError); ok { + if sdkErrCode := tea.StringValue(sdkErr.Code); strings.HasPrefix(sdkErrCode, "NotFound") { continue } } diff --git a/pkg/core/deployer/providers/aliyun-esa/aliyun_esa.go b/pkg/core/deployer/providers/aliyun-esa/aliyun_esa.go index e8ea7269..93b09f5e 100644 --- a/pkg/core/deployer/providers/aliyun-esa/aliyun_esa.go +++ b/pkg/core/deployer/providers/aliyun-esa/aliyun_esa.go @@ -2,7 +2,6 @@ package aliyunesa import ( "context" - "errors" "fmt" "log/slog" "strconv" @@ -103,20 +102,20 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*Dep // REF: https://help.aliyun.com/zh/edge-security-acceleration/esa/api-esa-2024-09-10-setcertificate certId, _ := strconv.ParseInt(upres.CertId, 10, 64) setCertificateReq := &aliesa.SetCertificateRequest{ + Region: tea.String(d.config.Region), SiteId: tea.Int64(d.config.SiteId), Type: tea.String("cas"), CasId: tea.Int64(certId), - Region: tea.String(d.config.Region), } setCertificateResp, err := d.sdkClient.SetCertificateWithContext(ctx, setCertificateReq, &dara.RuntimeOptions{}) d.logger.Debug("sdk request 'esa.SetCertificate'", slog.Any("request", setCertificateReq), slog.Any("response", setCertificateResp)) if err != nil { - var sdkError *tea.SDKError - if errors.As(err, &sdkError) { - if tea.StringValue(sdkError.Code) == "Certificate.Duplicated" { + if sdkErr, ok := err.(*tea.SDKError); ok { + if sdkErrCode := tea.StringValue(sdkErr.Code); sdkErrCode == "Certificate.Duplicated" { return &DeployResult{}, nil } } + return nil, fmt.Errorf("failed to execute sdk request 'esa.SetCertificate': %w", err) } diff --git a/pkg/core/deployer/providers/tencentcloud-ga2/tencentcloud_ga2.go b/pkg/core/deployer/providers/tencentcloud-ga2/tencentcloud_ga2.go index 34a8e3ad..630d25ce 100644 --- a/pkg/core/deployer/providers/tencentcloud-ga2/tencentcloud_ga2.go +++ b/pkg/core/deployer/providers/tencentcloud-ga2/tencentcloud_ga2.go @@ -176,8 +176,8 @@ func (d *Deployer) updateListenerCertificate(ctx context.Context, cloudAccelerat describeCertificateResp, err := d.sdkClients.SSL.DescribeCertificateWithContext(ctx, describeCertificateReq) d.logger.Debug("sdk request 'ssl.DescribeCertificate'", slog.Any("request", describeCertificateReq), slog.Any("response", describeCertificateResp)) if err != nil { - if sdkerr, ok := err.(*tcerrors.TencentCloudSDKError); ok { - if sdkerr.Code == "FailedOperation.CertificateNotFound" { + if sdkErr, ok := err.(*tcerrors.TencentCloudSDKError); ok { + if sdkErrCode := sdkErr.Code; sdkErrCode == "FailedOperation.CertificateNotFound" { continue } }