CodeCow/certimate
1
0
Fork 0
mirror of https://github.com/certimate-go/certimate.git synced 2026-06-22 21:05:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(provider): supoprt wildcard and certsan match pattern in deployment to baiducloud cdn

Browse Source
This commit is contained in:
Fu Diwei 2025-11-12 21:57:53 +08:00
parent a812f8748e
commit 5639820bda
8 changed files with 234 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
internal/certdeploy/deployers/sp_baiducloud_cdn.go
View File

@ -17,9 +17,10 @@ func init() {
}
provider, err := baiducloudcdn.NewSSLDeployerProvider(&baiducloudcdn.SSLDeployerProviderConfig{
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Domain: xmaps.GetString(options.ProviderExtendedConfig, "domain"),
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
DomainMatchPattern: xmaps.GetString(options.ProviderExtendedConfig, "domainMatchPattern"),
Domain: xmaps.GetString(options.ProviderExtendedConfig, "domain"),
})
return provider, err
})

22
pkg/core/ssl-deployer/providers/aliyun-cdn/aliyun_cdn.go
View File

@ -113,16 +113,20 @@ func (d *SSLDeployerProvider) Deploy(ctx context.Context, certPEM string, privke
return nil, errors.New("config `domain` is required")
}
domainCandidates, err := d.getAllDomains(ctx)
if err != nil {
return nil, err
}
if strings.HasPrefix(d.config.Domain, "*.") {
domainCandidates, err := d.getAllDomains(ctx)
if err != nil {
return nil, err
}
domains = lo.Filter(domainCandidates, func(domain string, _ int) bool {
return xcerthostname.IsMatch(d.config.Domain, domain)
})
if len(domains) == 0 {
return nil, errors.New("no domains matched by wildcard")
domains = lo.Filter(domainCandidates, func(domain string, _ int) bool {
return xcerthostname.IsMatch(d.config.Domain, domain)
})
if len(domains) == 0 {
return nil, errors.New("no domains matched by wildcard")
}
} else {
domains = []string{d.config.Domain}
}
}

137
pkg/core/ssl-deployer/providers/baiducloud-cdn/baiducloud_cdn.go
View File

@ -5,11 +5,16 @@ import (
"errors"
"fmt"
"log/slog"
"strings"
"time"
bcecdn "github.com/baidubce/bce-sdk-go/services/cdn"
bcecdnapi "github.com/baidubce/bce-sdk-go/services/cdn/api"
"github.com/certimate-go/certimate/pkg/core"
"github.com/samber/lo"
xcert "github.com/certimate-go/certimate/pkg/utils/cert"
xcerthostname "github.com/certimate-go/certimate/pkg/utils/cert/hostname"
)
type SSLDeployerProviderConfig struct {
@ -17,6 +22,9 @@ type SSLDeployerProviderConfig struct {
AccessKeyId string `json:"accessKeyId"`
// 百度智能云 SecretAccessKey。
SecretAccessKey string `json:"secretAccessKey"`
// 域名匹配模式。
// 零值时默认值 [DOMAIN_MATCH_PATTERN_EXACT]。
DomainMatchPattern string `json:"domainMatchPattern,omitempty"`
// 加速域名（支持泛域名）。
Domain string `json:"domain"`
}
@ -55,14 +63,131 @@ func (d *SSLDeployerProvider) SetLogger(logger *slog.Logger) {
}
func (d *SSLDeployerProvider) Deploy(ctx context.Context, certPEM string, privkeyPEM string) (*core.SSLDeployResult, error) {
if d.config.Domain == "" {
return nil, errors.New("config `domain` is required")
// 获取待部署的域名列表
var domains []string
switch d.config.DomainMatchPattern {
case "", DOMAIN_MATCH_PATTERN_EXACT:
{
if d.config.Domain == "" {
return nil, errors.New("config `domain` is required")
}
domains = []string{d.config.Domain}
}
case DOMAIN_MATCH_PATTERN_WILDCARD:
{
if d.config.Domain == "" {
return nil, errors.New("config `domain` is required")
}
if strings.HasPrefix(d.config.Domain, "*.") {
domainCandidates, err := d.getAllDomains(ctx)
if err != nil {
return nil, err
}
domains = lo.Filter(domainCandidates, func(domain string, _ int) bool {
return xcerthostname.IsMatch(d.config.Domain, domain)
})
if len(domains) == 0 {
return nil, errors.New("no domains matched by wildcard")
}
} else {
domains = []string{d.config.Domain}
}
}
case DOMAIN_MATCH_PATTERN_CERTSAN:
{
certX509, err := xcert.ParseCertificateFromPEM(certPEM)
if err != nil {
return nil, err
}
domainCandidates, err := d.getAllDomains(ctx)
if err != nil {
return nil, err
}
domains = lo.Filter(domainCandidates, func(domain string, _ int) bool {
return certX509.VerifyHostname(domain) == nil
})
if len(domains) == 0 {
return nil, errors.New("no domains matched by certificate")
}
}
default:
return nil, fmt.Errorf("unsupported domain match pattern: '%s'", d.config.DomainMatchPattern)
}
// 遍历更新域名证书
if len(domains) == 0 {
d.logger.Info("no cdn domains to deploy")
} else {
d.logger.Info("found cdn domains to deploy", slog.Any("domains", domains))
var errs []error
for _, domain := range domains {
select {
case <-ctx.Done():
return nil, ctx.Err()
default:
if err := d.updateDomainCertificate(ctx, domain, certPEM, privkeyPEM); err != nil {
errs = append(errs, err)
}
}
}
if len(errs) > 0 {
return nil, errors.Join(errs...)
}
}
return &core.SSLDeployResult{}, nil
}
func (d *SSLDeployerProvider) getAllDomains(ctx context.Context) ([]string, error) {
domains := make([]string, 0)
// 遍历查询域名列表
// REF: https://cloud.baidu.com/doc/CDN/s/sjwvyewt1
listDomainsMarker := ""
for {
select {
case <-ctx.Done():
return nil, ctx.Err()
default:
}
listDomainsRespDomains, listDomainsNextMarker, err := d.sdkClient.ListDomains(listDomainsMarker)
d.logger.Debug("sdk request 'cdn.ListDomains'", slog.String("request.marker", listDomainsMarker), slog.Any("response.domains", listDomainsRespDomains))
if err != nil {
return nil, fmt.Errorf("failed to execute sdk request 'cdn.ListDomains': %w", err)
}
domains = append(domains, listDomainsRespDomains...)
if listDomainsNextMarker == "" {
break
} else {
listDomainsMarker = listDomainsNextMarker
}
}
if len(domains) == 0 {
return nil, errors.New("no domains matched by wildcard")
}
return domains, nil
}
func (d *SSLDeployerProvider) updateDomainCertificate(ctx context.Context, domain string, certPEM, privkeyPEM string) error {
// 修改域名证书
// REF: https://cloud.baidu.com/doc/CDN/s/qjzuz2hp8
putCertResp, err := d.sdkClient.PutCert(
d.config.Domain,
domain,
&bcecdnapi.UserCertificate{
CertName: fmt.Sprintf("certimate-%d", time.Now().UnixMilli()),
ServerData: certPEM,
@ -70,12 +195,12 @@ func (d *SSLDeployerProvider) Deploy(ctx context.Context, certPEM string, privke
},
"ON",
)
d.logger.Debug("sdk request 'cdn.PutCert'", slog.String("request.domain", d.config.Domain), slog.Any("response", putCertResp))
d.logger.Debug("sdk request 'cdn.PutCert'", slog.String("request.domain", domain), slog.Any("response", putCertResp))
if err != nil {
return nil, fmt.Errorf("failed to execute sdk request 'cdn.PutCert': %w", err)
return fmt.Errorf("failed to execute sdk request 'cdn.PutCert': %w", err)
}
return &core.SSLDeployResult{}, nil
return nil
}
func createSDKClient(accessKeyId, secretAccessKey string) (*bcecdn.Client, error) {

7
pkg/core/ssl-deployer/providers/baiducloud-cdn/baiducloud_cdn_test.go
View File

@ -53,9 +53,10 @@ func TestDeploy(t *testing.T) {
}, "\n"))
deployer, err := provider.NewSSLDeployerProvider(&provider.SSLDeployerProviderConfig{
AccessKeyId: fAccessKeyId,
SecretAccessKey: fSecretAccessKey,
Domain: fDomain,
AccessKeyId: fAccessKeyId,
SecretAccessKey: fSecretAccessKey,
DomainMatchPattern: provider.DOMAIN_MATCH_PATTERN_EXACT,
Domain: fDomain,
})
if err != nil {
t.Errorf("err: %+v", err)

10
pkg/core/ssl-deployer/providers/baiducloud-cdn/consts.go Normal file
View File

@ -0,0 +1,10 @@
package baiducloudcdn
const (
// 匹配模式：精确匹配。
DOMAIN_MATCH_PATTERN_EXACT = "exact"
// 匹配模式：通配符匹配。
DOMAIN_MATCH_PATTERN_WILDCARD = "wildcard"
// 匹配模式：证书 SAN 匹配。
DOMAIN_MATCH_PATTERN_CERTSAN = "certsan"
)

12
pkg/core/ssl-deployer/providers/tencentcloud-cdn/tencentcloud_cdn.go
View File

@ -98,7 +98,7 @@ func (d *SSLDeployerProvider) Deploy(ctx context.Context, certPEM string, privke
return nil, errors.New("config `domain` is required")
}
domains = append(domains, d.config.Domain)
domains = []string{d.config.Domain}
}
case DOMAIN_MATCH_PATTERN_WILDCARD:
@ -108,25 +108,25 @@ func (d *SSLDeployerProvider) Deploy(ctx context.Context, certPEM string, privke
}
if strings.HasPrefix(d.config.Domain, "*.") {
temp, err := d.getMatchedDomainsByWildcard(ctx, d.config.Domain)
domainCandidates, err := d.getMatchedDomainsByWildcard(ctx, d.config.Domain)
if err != nil {
return nil, err
}
domains = temp
domains = domainCandidates
} else {
domains = append(domains, d.config.Domain)
domains = []string{d.config.Domain}
}
}
case DOMAIN_MATCH_PATTERN_CERTSAN:
{
temp, err := d.getMatchedDomainsByCertId(ctx, upres.CertId)
domainCandidates, err := d.getMatchedDomainsByCertId(ctx, upres.CertId)
if err != nil {
return nil, err
}
domains = temp
domains = domainCandidates
}
default:

8
pkg/core/ssl-deployer/providers/tencentcloud-ecdn/tencentcloud_ecdn.go
View File

@ -98,7 +98,7 @@ func (d *SSLDeployerProvider) Deploy(ctx context.Context, certPEM string, privke
return nil, errors.New("config `domain` is required")
}
domains = append(domains, d.config.Domain)
domains = []string{d.config.Domain}
}
case DOMAIN_MATCH_PATTERN_WILDCARD:
@ -108,14 +108,14 @@ func (d *SSLDeployerProvider) Deploy(ctx context.Context, certPEM string, privke
}
if strings.HasPrefix(d.config.Domain, "*.") {
temp, err := d.getMatchedDomainsByWildcard(ctx, d.config.Domain)
domainCandidates, err := d.getMatchedDomainsByWildcard(ctx, d.config.Domain)
if err != nil {
return nil, err
}
domains = temp
domains = domainCandidates
} else {
domains = append(domains, d.config.Domain)
domains = []string{d.config.Domain}
}
}

70
ui/src/components/workflow/designer/forms/BizDeployNodeConfigFieldsProviderBaiduCloudCDN.tsx
View File

@ -1,12 +1,17 @@
import { getI18n, useTranslation } from "react-i18next";
import { Form, Input } from "antd";
import { Form, Input, Radio } from "antd";
import { createSchemaFieldRule } from "antd-zod";
import { z } from "zod";
import Show from "@/components/Show";
import { validDomainName } from "@/utils/validators";
import { useFormNestedFieldsContext } from "./_context";
const DOMAIN_MATCH_PATTERN_EXACT = "exact" as const;
const DOMAIN_MATCH_PATTERN_WILDCARD = "wildcard" as const;
const DOMAIN_MATCH_PATTERN_CERTSAN = "certsan" as const;
const BizDeployNodeConfigFieldsProviderBaiduCloudCDN = () => {
const { i18n, t } = useTranslation();
@ -15,24 +20,52 @@ const BizDeployNodeConfigFieldsProviderBaiduCloudCDN = () => {
[parentNamePath]: getSchema({ i18n }),
});
const formRule = createSchemaFieldRule(formSchema);
const formInst = Form.useFormInstance();
const initialValues = getInitialValues();
const fieldDomainMatchPattern = Form.useWatch([parentNamePath, "domainMatchPattern"], { form: formInst, preserve: true });
return (
<>
<Form.Item
name={[parentNamePath, "domain"]}
initialValue={initialValues.domain}
label={t("workflow_node.deploy.form.baiducloud_cdn_domain.label")}
name={[parentNamePath, "domainMatchPattern"]}
initialValue={initialValues.domainMatchPattern}
label={t("workflow_node.deploy.form.shared_domain_match_pattern.label")}
extra={
fieldDomainMatchPattern === DOMAIN_MATCH_PATTERN_EXACT ? (
<span dangerouslySetInnerHTML={{ __html: t("workflow_node.deploy.form.shared_domain_match_pattern.help_wildcard") }}></span>
) : (
void 0
)
}
rules={[formRule]}
>
<Input placeholder={t("workflow_node.deploy.form.baiducloud_cdn_domain.placeholder")} />
<Radio.Group
options={[DOMAIN_MATCH_PATTERN_EXACT, DOMAIN_MATCH_PATTERN_WILDCARD, DOMAIN_MATCH_PATTERN_CERTSAN].map((s) => ({
key: s,
label: t(`workflow_node.deploy.form.shared_domain_match_pattern.option.${s}.label`),
value: s,
}))}
/>
</Form.Item>
<Show when={fieldDomainMatchPattern !== DOMAIN_MATCH_PATTERN_CERTSAN}>
<Form.Item
name={[parentNamePath, "domain"]}
initialValue={initialValues.domain}
label={t("workflow_node.deploy.form.baiducloud_cdn_domain.label")}
rules={[formRule]}
>
<Input placeholder={t("workflow_node.deploy.form.baiducloud_cdn_domain.placeholder")} />
</Form.Item>
</Show>
</>
);
};
const getInitialValues = (): Nullish<z.infer<ReturnType<typeof getSchema>>> => {
return {
domainMatchPattern: DOMAIN_MATCH_PATTERN_EXACT,
domain: "",
};
};
@ -40,9 +73,30 @@ const getInitialValues = (): Nullish<z.infer<ReturnType<typeof getSchema>>> => {
const getSchema = ({ i18n = getI18n() }: { i18n?: ReturnType<typeof getI18n> }) => {
const { t } = i18n;
return z.object({
domain: z.string().refine((v) => validDomainName(v, { allowWildcard: true }), t("common.errmsg.domain_invalid")),
});
return z
.object({
region: z.string().nullish(),
domainMatchPattern: z.string().nonempty(t("workflow_node.deploy.form.shared_domain_match_pattern.placeholder")).default(DOMAIN_MATCH_PATTERN_EXACT),
domain: z.string().nullish(),
})
.superRefine((values, ctx) => {
if (values.domainMatchPattern) {
switch (values.domainMatchPattern) {
case DOMAIN_MATCH_PATTERN_EXACT:
case DOMAIN_MATCH_PATTERN_WILDCARD:
{
if (!validDomainName(values.domain!, { allowWildcard: true })) {
ctx.addIssue({
code: "custom",
message: t("common.errmsg.domain_invalid"),
path: ["domain"],
});
}
}
break;
}
}
});
};
const _default = Object.assign(BizDeployNodeConfigFieldsProviderBaiduCloudCDN, {