mirror of https://github.com/certd/certd
perf: 优化部署到腾讯TKE插件,支持Opaque类型选择,优化填写说明
parent
0f1129e19b
commit
144532530a
|
@ -1,101 +1,77 @@
|
||||||
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from "@certd/pipeline";
|
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from "@certd/pipeline";
|
||||||
import { utils } from "@certd/basic";
|
import { utils } from "@certd/basic";
|
||||||
|
|
||||||
import dayjs from "dayjs";
|
|
||||||
import { CertApplyPluginNames } from "@certd/plugin-cert";
|
import { CertApplyPluginNames } from "@certd/plugin-cert";
|
||||||
|
import yaml from "js-yaml";
|
||||||
|
|
||||||
@IsTaskPlugin({
|
@IsTaskPlugin({
|
||||||
name: 'DeployCertToTencentTKEIngress',
|
name: "DeployCertToTencentTKEIngress",
|
||||||
title: '腾讯云-部署到TKE-ingress',
|
title: "腾讯云-部署到TKE",
|
||||||
needPlus: false,
|
needPlus: false,
|
||||||
icon: 'svg:icon-tencentcloud',
|
icon: "svg:icon-tencentcloud",
|
||||||
group: pluginGroups.tencent.key,
|
group: pluginGroups.tencent.key,
|
||||||
desc: 'serverless集群请使用K8S部署插件;Qcloud类型需要【上传到腾讯云】作为前置任务;ApiServer未开启外网访问则需要做域名的内网IP映射',
|
desc: "修改TKE集群密钥配置,支持Opaque和TLS证书类型。注意:\n1. serverless集群请使用K8S部署插件;\n2. Opaque类型需要【上传到腾讯云】作为前置任务;\n3. ApiServer需要开通公网访问(或者certd可访问),实际上底层仍然是通过KubeClient进行部署",
|
||||||
default: {
|
default: {
|
||||||
strategy: {
|
strategy: {
|
||||||
runStrategy: RunStrategy.SkipWhenSucceed,
|
runStrategy: RunStrategy.SkipWhenSucceed
|
||||||
},
|
}
|
||||||
},
|
}
|
||||||
})
|
})
|
||||||
export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||||
@TaskInput({ title: '大区', value: 'ap-guangzhou', required: true })
|
|
||||||
region!: string;
|
|
||||||
|
|
||||||
@TaskInput({
|
@TaskInput({
|
||||||
title: '集群ID',
|
title: "ingress证书类型",
|
||||||
required: true,
|
|
||||||
desc: '例如:cls-6lbj1vee',
|
|
||||||
request: true,
|
|
||||||
})
|
|
||||||
clusterId!: string;
|
|
||||||
|
|
||||||
@TaskInput({ title: '集群namespace', value: 'default', required: true })
|
|
||||||
namespace!: string;
|
|
||||||
|
|
||||||
@TaskInput({ title: '证书的secret名称', required: true })
|
|
||||||
secretName!: string | string[];
|
|
||||||
|
|
||||||
@TaskInput({ title: 'ingress名称', required: true })
|
|
||||||
ingressName!: string | string[];
|
|
||||||
|
|
||||||
@TaskInput({
|
|
||||||
title: 'ingress类型',
|
|
||||||
component: {
|
component: {
|
||||||
name: 'a-auto-complete',
|
name: "a-select",
|
||||||
vModel: 'value',
|
vModel: "value",
|
||||||
options: [{ value: 'qcloud' }, { value: 'nginx' }],
|
options: [{ value: "nginx", label: "TLS证书格式(Nginx可用)" }, {
|
||||||
|
value: "qcloud",
|
||||||
|
label: "Opaque格式(CLB可用,原qcloud)"
|
||||||
|
}]
|
||||||
},
|
},
|
||||||
helper: '可选 qcloud / nginx',
|
helper: "clb将部署Opaque类型的证书,nginx类型将部署TLS证书格式",
|
||||||
|
required: true
|
||||||
})
|
})
|
||||||
ingressClass!: string;
|
ingressClass!: string;
|
||||||
|
|
||||||
// @TaskInput({ title: "集群内网ip", helper: "如果开启了外网的话,无需设置" })
|
|
||||||
// clusterIp!: string;
|
|
||||||
|
|
||||||
@TaskInput({
|
|
||||||
title: '集群域名',
|
|
||||||
helper: '可不填,默认为:[clusterId].ccs.tencent-cloud.com',
|
|
||||||
})
|
|
||||||
clusterDomain!: string;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* AccessProvider的key,或者一个包含access的具体的对象
|
* AccessProvider的key,或者一个包含access的具体的对象
|
||||||
*/
|
*/
|
||||||
@TaskInput({
|
@TaskInput({
|
||||||
title: 'Access授权',
|
title: "Access授权",
|
||||||
helper: 'access授权',
|
helper: "access授权",
|
||||||
component: {
|
component: {
|
||||||
name: 'access-selector',
|
name: "access-selector",
|
||||||
type: 'tencent',
|
type: "tencent"
|
||||||
},
|
},
|
||||||
required: true,
|
required: true
|
||||||
})
|
})
|
||||||
accessId!: string;
|
accessId!: string;
|
||||||
|
|
||||||
@TaskInput({
|
@TaskInput({
|
||||||
title: '腾讯云证书id',
|
title: "腾讯云证书id",
|
||||||
helper: '请选择“上传证书到腾讯云”前置任务的输出',
|
helper: "请选择“上传证书到腾讯云”前置任务的输出",
|
||||||
component: {
|
component: {
|
||||||
name: 'output-selector',
|
name: "output-selector",
|
||||||
from: 'UploadCertToTencent',
|
from: "UploadCertToTencent"
|
||||||
},
|
},
|
||||||
mergeScript: `
|
mergeScript: `
|
||||||
return {
|
return {
|
||||||
show: ctx.compute(({form})=>{
|
show: ctx.compute(({form})=>{
|
||||||
return form.ingressClass === "qcloud"
|
return form.ingressClass === "qcloud"|| form.ingressClass === "clb"
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
`,
|
`,
|
||||||
required: true,
|
required: true
|
||||||
})
|
})
|
||||||
tencentCertId!: string;
|
tencentCertId!: string;
|
||||||
|
|
||||||
@TaskInput({
|
@TaskInput({
|
||||||
title: '域名证书',
|
title: "域名证书",
|
||||||
helper: '请选择前置任务输出的域名证书',
|
helper: "请选择前置任务输出的域名证书",
|
||||||
component: {
|
component: {
|
||||||
name: 'output-selector',
|
name: "output-selector",
|
||||||
from: [...CertApplyPluginNames],
|
from: [...CertApplyPluginNames]
|
||||||
},
|
},
|
||||||
mergeScript: `
|
mergeScript: `
|
||||||
return {
|
return {
|
||||||
|
@ -104,26 +80,90 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
`,
|
`,
|
||||||
required: true,
|
required: true
|
||||||
})
|
})
|
||||||
cert!: any;
|
cert!: any;
|
||||||
|
|
||||||
|
|
||||||
|
@TaskInput({ title: "大区", value: "ap-guangzhou", required: true })
|
||||||
|
region!: string;
|
||||||
|
|
||||||
|
@TaskInput({
|
||||||
|
title: "集群ID",
|
||||||
|
required: true,
|
||||||
|
desc: "例如:cls-6lbj1vee",
|
||||||
|
request: true
|
||||||
|
})
|
||||||
|
clusterId!: string;
|
||||||
|
|
||||||
|
@TaskInput({ title: "集群namespace", value: "default", required: true })
|
||||||
|
namespace!: string;
|
||||||
|
|
||||||
|
@TaskInput({
|
||||||
|
title: "证书的secret名称",
|
||||||
|
helper: "集群->配置管理->Secret,复制名称",
|
||||||
|
required: true,
|
||||||
|
component: {
|
||||||
|
name: "a-select",
|
||||||
|
vModel: "value",
|
||||||
|
mode: "tags",
|
||||||
|
open: false
|
||||||
|
}
|
||||||
|
})
|
||||||
|
secretName!: string | string[];
|
||||||
|
|
||||||
|
@TaskInput({
|
||||||
|
title: "集群域名",
|
||||||
|
helper: "ApiServer需要开通公网访问,填写`ApiServer公网IP:443`\n默认为:[clusterId].ccs.tencent-cloud.com,可能访问不通",
|
||||||
|
component: {
|
||||||
|
placeholder: "xx.xxx.xx.xx:443"
|
||||||
|
}
|
||||||
|
})
|
||||||
|
clusterDomain!: string;
|
||||||
|
|
||||||
|
|
||||||
|
@TaskInput({
|
||||||
|
title: "ingress名称",
|
||||||
|
required: false,
|
||||||
|
helper: "填写之后会自动重启ingress",
|
||||||
|
component: {
|
||||||
|
name: "a-select",
|
||||||
|
vModel: "value",
|
||||||
|
mode: "tags",
|
||||||
|
open: false
|
||||||
|
}
|
||||||
|
})
|
||||||
|
ingressName!: string | string[];
|
||||||
|
|
||||||
|
|
||||||
|
// @TaskInput({ title: "集群内网ip", helper: "如果开启了外网的话,无需设置" })
|
||||||
|
// clusterIp!: string;
|
||||||
|
|
||||||
|
|
||||||
K8sClient: any;
|
K8sClient: any;
|
||||||
|
|
||||||
async onInstance() {
|
async onInstance() {
|
||||||
// const TkeClient = this.tencentcloud.tke.v20180525.Client;
|
// const TkeClient = this.tencentcloud.tke.v20180525.Client;
|
||||||
const k8sSdk = await import('@certd/lib-k8s');
|
const k8sSdk = await import("@certd/lib-k8s");
|
||||||
this.K8sClient = k8sSdk.K8sClient;
|
this.K8sClient = k8sSdk.K8sClient;
|
||||||
}
|
}
|
||||||
|
|
||||||
async execute(): Promise<void> {
|
async execute(): Promise<void> {
|
||||||
const accessProvider = await this.getAccess(this.accessId);
|
const accessProvider = await this.getAccess(this.accessId);
|
||||||
const tkeClient = await this.getTkeClient(accessProvider, this.region);
|
const tkeClient = await this.getTkeClient(accessProvider, this.region);
|
||||||
const kubeConfigStr = await this.getTkeKubeConfig(tkeClient, this.clusterId);
|
let kubeConfigStr = await this.getTkeKubeConfig(tkeClient, this.clusterId);
|
||||||
|
|
||||||
this.logger.info('kubeconfig已成功获取');
|
|
||||||
|
if (this.clusterDomain) {
|
||||||
|
const kubeConfig = yaml.load(kubeConfigStr);
|
||||||
|
kubeConfig.clusters[0].cluster.server = `https://${this.clusterDomain}`;
|
||||||
|
kubeConfigStr = yaml.dump(kubeConfig);
|
||||||
|
}
|
||||||
|
|
||||||
|
this.logger.info("kubeconfig已成功获取");
|
||||||
const k8sClient = new this.K8sClient({
|
const k8sClient = new this.K8sClient({
|
||||||
kubeConfigStr,
|
kubeConfigStr,
|
||||||
logger: this.logger,
|
logger: this.logger
|
||||||
});
|
});
|
||||||
// if (this.clusterIp != null) {
|
// if (this.clusterIp != null) {
|
||||||
// if (!this.clusterDomain) {
|
// if (!this.clusterDomain) {
|
||||||
|
@ -132,31 +172,34 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||||
// // 修改内网解析ip地址
|
// // 修改内网解析ip地址
|
||||||
// k8sClient.setLookup({ [this.clusterDomain]: { ip: this.clusterIp } });
|
// k8sClient.setLookup({ [this.clusterDomain]: { ip: this.clusterIp } });
|
||||||
// }
|
// }
|
||||||
const ingressType = this.ingressClass || 'qcloud';
|
const ingressType = this.ingressClass || "qcloud";
|
||||||
if (ingressType === 'qcloud') {
|
if (ingressType === "qcloud" || ingressType === "clb") {
|
||||||
await this.patchQcloudCertSecret({ k8sClient });
|
await this.patchQcloudCertSecret({ k8sClient });
|
||||||
} else {
|
} else {
|
||||||
await this.patchNginxCertSecret({ k8sClient });
|
await this.patchNginxCertSecret({ k8sClient });
|
||||||
}
|
}
|
||||||
|
|
||||||
await utils.sleep(5000); // 停留2秒,等待secret部署完成
|
await utils.sleep(5000); // 停留2秒,等待secret部署完成
|
||||||
await this.restartIngress({ k8sClient });
|
if (this.ingressName) {
|
||||||
|
this.logger.info("正在重启ingress:", this.ingressName);
|
||||||
|
await this.restartIngress({ k8sClient });
|
||||||
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
async getTkeClient(accessProvider: any, region = 'ap-guangzhou') {
|
async getTkeClient(accessProvider: any, region = "ap-guangzhou") {
|
||||||
const sdk = await import('tencentcloud-sdk-nodejs/tencentcloud/services/tke/v20180525/index.js');
|
const sdk = await import("tencentcloud-sdk-nodejs/tencentcloud/services/tke/v20180525/index.js");
|
||||||
const TkeClient = sdk.v20180525.Client;
|
const TkeClient = sdk.v20180525.Client;
|
||||||
const clientConfig = {
|
const clientConfig = {
|
||||||
credential: {
|
credential: {
|
||||||
secretId: accessProvider.secretId,
|
secretId: accessProvider.secretId,
|
||||||
secretKey: accessProvider.secretKey,
|
secretKey: accessProvider.secretKey
|
||||||
},
|
},
|
||||||
region,
|
region,
|
||||||
profile: {
|
profile: {
|
||||||
httpProfile: {
|
httpProfile: {
|
||||||
endpoint: 'tke.tencentcloudapi.com',
|
endpoint: "tke.tencentcloudapi.com"
|
||||||
},
|
}
|
||||||
},
|
}
|
||||||
};
|
};
|
||||||
|
|
||||||
return new TkeClient(clientConfig);
|
return new TkeClient(clientConfig);
|
||||||
|
@ -165,49 +208,42 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||||
async getTkeKubeConfig(client: any, clusterId: string) {
|
async getTkeKubeConfig(client: any, clusterId: string) {
|
||||||
// Depends on tencentcloud-sdk-nodejs version 4.0.3 or higher
|
// Depends on tencentcloud-sdk-nodejs version 4.0.3 or higher
|
||||||
const params = {
|
const params = {
|
||||||
ClusterId: clusterId,
|
ClusterId: clusterId
|
||||||
};
|
};
|
||||||
const ret = await client.DescribeClusterKubeconfig(params);
|
const ret = await client.DescribeClusterKubeconfig(params);
|
||||||
this.checkRet(ret);
|
this.checkRet(ret);
|
||||||
this.logger.info('注意:后续操作需要在【集群->基本信息】中开启外网或内网访问,https://console.cloud.tencent.com/tke2/cluster');
|
this.logger.info("注意:后续操作需要在【集群->基本信息】中开启外网或内网访问,https://console.cloud.tencent.com/tke2/cluster");
|
||||||
return ret.Kubeconfig;
|
return ret.Kubeconfig;
|
||||||
}
|
}
|
||||||
|
|
||||||
appendTimeSuffix(name: string) {
|
|
||||||
if (name == null) {
|
|
||||||
name = 'certd';
|
|
||||||
}
|
|
||||||
return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
|
|
||||||
}
|
|
||||||
|
|
||||||
async patchQcloudCertSecret(options: { k8sClient: any }) {
|
async patchQcloudCertSecret(options: { k8sClient: any }) {
|
||||||
if (this.tencentCertId == null) {
|
if (this.tencentCertId == null) {
|
||||||
throw new Error('请先将【上传证书到腾讯云】作为前置任务');
|
throw new Error("请先将【上传证书到腾讯云】作为前置任务");
|
||||||
}
|
}
|
||||||
this.logger.info('腾讯云证书ID:', this.tencentCertId);
|
this.logger.info("腾讯云证书ID:", this.tencentCertId);
|
||||||
const certIdBase64 = Buffer.from(this.tencentCertId).toString('base64');
|
const certIdBase64 = Buffer.from(this.tencentCertId).toString("base64");
|
||||||
|
|
||||||
const { namespace, secretName } = this;
|
const { namespace, secretName } = this;
|
||||||
|
|
||||||
const body = {
|
const body = {
|
||||||
data: {
|
data: {
|
||||||
qcloud_cert_id: certIdBase64,
|
qcloud_cert_id: certIdBase64
|
||||||
},
|
},
|
||||||
metadata: {
|
metadata: {
|
||||||
labels: {
|
labels: {
|
||||||
certd: this.appendTimeSuffix('certd'),
|
certd: this.appendTimeSuffix("certd")
|
||||||
},
|
}
|
||||||
},
|
}
|
||||||
};
|
};
|
||||||
let secretNames: any = secretName;
|
let secretNames: any = secretName;
|
||||||
if (typeof secretName === 'string') {
|
if (typeof secretName === "string") {
|
||||||
secretNames = [secretName];
|
secretNames = [secretName];
|
||||||
}
|
}
|
||||||
for (const secret of secretNames) {
|
for (const secret of secretNames) {
|
||||||
await options.k8sClient.patchSecret({
|
await options.k8sClient.patchSecret({
|
||||||
namespace,
|
namespace,
|
||||||
secretName: secret,
|
secretName: secret,
|
||||||
body,
|
body
|
||||||
});
|
});
|
||||||
this.logger.info(`CertSecret已更新:${secret}`);
|
this.logger.info(`CertSecret已更新:${secret}`);
|
||||||
}
|
}
|
||||||
|
@ -218,24 +254,24 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||||
const { cert } = this;
|
const { cert } = this;
|
||||||
const crt = cert.crt;
|
const crt = cert.crt;
|
||||||
const key = cert.key;
|
const key = cert.key;
|
||||||
const crtBase64 = Buffer.from(crt).toString('base64');
|
const crtBase64 = Buffer.from(crt).toString("base64");
|
||||||
const keyBase64 = Buffer.from(key).toString('base64');
|
const keyBase64 = Buffer.from(key).toString("base64");
|
||||||
|
|
||||||
const { namespace, secretName } = this;
|
const { namespace, secretName } = this;
|
||||||
|
|
||||||
const body = {
|
const body = {
|
||||||
data: {
|
data: {
|
||||||
'tls.crt': crtBase64,
|
"tls.crt": crtBase64,
|
||||||
'tls.key': keyBase64,
|
"tls.key": keyBase64
|
||||||
},
|
},
|
||||||
metadata: {
|
metadata: {
|
||||||
labels: {
|
labels: {
|
||||||
certd: this.appendTimeSuffix('certd'),
|
certd: this.appendTimeSuffix("certd")
|
||||||
},
|
}
|
||||||
},
|
}
|
||||||
};
|
};
|
||||||
let secretNames = secretName;
|
let secretNames = secretName;
|
||||||
if (typeof secretName === 'string') {
|
if (typeof secretName === "string") {
|
||||||
secretNames = [secretName];
|
secretNames = [secretName];
|
||||||
}
|
}
|
||||||
for (const secret of secretNames) {
|
for (const secret of secretNames) {
|
||||||
|
@ -251,12 +287,12 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||||
const body = {
|
const body = {
|
||||||
metadata: {
|
metadata: {
|
||||||
labels: {
|
labels: {
|
||||||
certd: this.appendTimeSuffix('certd'),
|
certd: this.appendTimeSuffix("certd")
|
||||||
},
|
}
|
||||||
},
|
}
|
||||||
};
|
};
|
||||||
let ingressNames = this.ingressName;
|
let ingressNames = this.ingressName || [];
|
||||||
if (typeof ingressName === 'string') {
|
if (typeof ingressName === "string") {
|
||||||
ingressNames = [ingressName];
|
ingressNames = [ingressName];
|
||||||
}
|
}
|
||||||
for (const ingress of ingressNames) {
|
for (const ingress of ingressNames) {
|
||||||
|
@ -264,9 +300,11 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
|
||||||
this.logger.info(`ingress已重启:${ingress}`);
|
this.logger.info(`ingress已重启:${ingress}`);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
checkRet(ret: any) {
|
checkRet(ret: any) {
|
||||||
if (!ret || ret.Error) {
|
if (!ret || ret.Error) {
|
||||||
throw new Error('执行失败:' + ret.Error.Code + ',' + ret.Error.Message);
|
throw new Error("执行失败:" + ret.Error.Code + "," + ret.Error.Message);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue