github
/
certd
mirror of https://github.com/certd/certd
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

perf: 优化部署到腾讯TKE插件，支持Opaque类型选择，优化填写说明

pull/453/head
xiaojunnuo 2025-07-07 21:30:45 +08:00
parent 0f1129e19b
commit 144532530a
1 changed files with 141 additions and 103 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

244
packages/ui/certd-server/src/plugins/plugin-tencent/plugin/deploy-to-tke-ingress/index.ts
View File

@ -1,101 +1,77 @@
import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from "@certd/pipeline"; import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from "@certd/pipeline";
import { utils } from "@certd/basic"; import { utils } from "@certd/basic";
import dayjs from "dayjs";
import { CertApplyPluginNames } from "@certd/plugin-cert"; import { CertApplyPluginNames } from "@certd/plugin-cert";
import yaml from "js-yaml";
@IsTaskPlugin({ @IsTaskPlugin({
name: 'DeployCertToTencentTKEIngress', name: "DeployCertToTencentTKEIngress",
title: '腾讯云-部署到TKE-ingress', title: "腾讯云-部署到TKE",
needPlus: false, needPlus: false,
icon: 'svg:icon-tencentcloud', icon: "svg:icon-tencentcloud",
group: pluginGroups.tencent.key, group: pluginGroups.tencent.key,
desc: 'serverless集群请使用K8S部署插件；Qcloud类型需要【上传到腾讯云】作为前置任务；ApiServer未开启外网访问则需要做域名的内网IP映射', desc: "修改TKE集群密钥配置，支持Opaque和TLS证书类型。注意：\n1. serverless集群请使用K8S部署插件；\n2. Opaque类型需要【上传到腾讯云】作为前置任务；\n3. ApiServer需要开通公网访问（或者certd可访问），实际上底层仍然是通过KubeClient进行部署",
default: { default: {
strategy: { strategy: {
runStrategy: RunStrategy.SkipWhenSucceed, runStrategy: RunStrategy.SkipWhenSucceed
}, }
}, }
}) })
export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin { export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
@TaskInput({ title: '大区', value: 'ap-guangzhou', required: true })
region!: string;
@TaskInput({ @TaskInput({
title: '集群ID', title: "ingress证书类型",
required: true,
desc: '例如：cls-6lbj1vee',
request: true,
})
clusterId!: string;
@TaskInput({ title: '集群namespace', value: 'default', required: true })
namespace!: string;
@TaskInput({ title: '证书的secret名称', required: true })
secretName!: string | string[];
@TaskInput({ title: 'ingress名称', required: true })
ingressName!: string | string[];
@TaskInput({
title: 'ingress类型',
component: { component: {
name: 'a-auto-complete', name: "a-select",
vModel: 'value', vModel: "value",
options: [{ value: 'qcloud' }, { value: 'nginx' }], options: [{ value: "nginx", label: "TLS证书格式（Nginx可用）" }, {
value: "qcloud",
label: "Opaque格式（CLB可用，原qcloud）"
}]
}, },
helper: '可选 qcloud / nginx', helper: "clb将部署Opaque类型的证书，nginx类型将部署TLS证书格式",
required: true
}) })
ingressClass!: string; ingressClass!: string;
// @TaskInput({ title: "集群内网ip", helper: "如果开启了外网的话，无需设置" })
// clusterIp!: string;
@TaskInput({
title: '集群域名',
helper: '可不填，默认为:[clusterId].ccs.tencent-cloud.com',
})
clusterDomain!: string;
/** /**
* AccessProvider的key,或者一个包含access的具体的对象 * AccessProvider的key,或者一个包含access的具体的对象
*/ */
@TaskInput({ @TaskInput({
title: 'Access授权', title: "Access授权",
helper: 'access授权', helper: "access授权",
component: { component: {
name: 'access-selector', name: "access-selector",
type: 'tencent', type: "tencent"
}, },
required: true, required: true
}) })
accessId!: string; accessId!: string;
@TaskInput({ @TaskInput({
title: '腾讯云证书id', title: "腾讯云证书id",
helper: '请选择“上传证书到腾讯云”前置任务的输出', helper: "请选择“上传证书到腾讯云”前置任务的输出",
component: { component: {
name: 'output-selector', name: "output-selector",
from: 'UploadCertToTencent', from: "UploadCertToTencent"
}, },
mergeScript: ` mergeScript: `
return { return {
show: ctx.compute(({form})=>{ show: ctx.compute(({form})=>{
return form.ingressClass === "qcloud" return form.ingressClass === "qcloud"|| form.ingressClass === "clb"
}) })
} }
`, `,
required: true, required: true
}) })
tencentCertId!: string; tencentCertId!: string;
@TaskInput({ @TaskInput({
title: '域名证书', title: "域名证书",
helper: '请选择前置任务输出的域名证书', helper: "请选择前置任务输出的域名证书",
component: { component: {
name: 'output-selector', name: "output-selector",
from: [...CertApplyPluginNames], from: [...CertApplyPluginNames]
}, },
mergeScript: ` mergeScript: `
return { return {
@ -104,26 +80,90 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
}) })
} }
`, `,
required: true, required: true
}) })
cert!: any; cert!: any;
@TaskInput({ title: "大区", value: "ap-guangzhou", required: true })
region!: string;
@TaskInput({
title: "集群ID",
required: true,
desc: "例如：cls-6lbj1vee",
request: true
})
clusterId!: string;
@TaskInput({ title: "集群namespace", value: "default", required: true })
namespace!: string;
@TaskInput({
title: "证书的secret名称",
helper: "集群->配置管理->Secret,复制名称",
required: true,
component: {
name: "a-select",
vModel: "value",
mode: "tags",
open: false
}
})
secretName!: string | string[];
@TaskInput({
title: "集群域名",
helper: "ApiServer需要开通公网访问，填写`ApiServer公网IP:443`\n默认为:[clusterId].ccs.tencent-cloud.com，可能访问不通",
component: {
placeholder: "xx.xxx.xx.xx:443"
}
})
clusterDomain!: string;
@TaskInput({
title: "ingress名称",
required: false,
helper: "填写之后会自动重启ingress",
component: {
name: "a-select",
vModel: "value",
mode: "tags",
open: false
}
})
ingressName!: string | string[];
// @TaskInput({ title: "集群内网ip", helper: "如果开启了外网的话，无需设置" })
// clusterIp!: string;
K8sClient: any; K8sClient: any;
async onInstance() { async onInstance() {
// const TkeClient = this.tencentcloud.tke.v20180525.Client; // const TkeClient = this.tencentcloud.tke.v20180525.Client;
const k8sSdk = await import('@certd/lib-k8s'); const k8sSdk = await import("@certd/lib-k8s");
this.K8sClient = k8sSdk.K8sClient; this.K8sClient = k8sSdk.K8sClient;
} }
async execute(): Promise<void> { async execute(): Promise<void> {
const accessProvider = await this.getAccess(this.accessId); const accessProvider = await this.getAccess(this.accessId);
const tkeClient = await this.getTkeClient(accessProvider, this.region); const tkeClient = await this.getTkeClient(accessProvider, this.region);
const kubeConfigStr = await this.getTkeKubeConfig(tkeClient, this.clusterId); let kubeConfigStr = await this.getTkeKubeConfig(tkeClient, this.clusterId);
this.logger.info('kubeconfig已成功获取');
if (this.clusterDomain) {
const kubeConfig = yaml.load(kubeConfigStr);
kubeConfig.clusters[0].cluster.server = `https://${this.clusterDomain}`;
kubeConfigStr = yaml.dump(kubeConfig);
}
this.logger.info("kubeconfig已成功获取");
const k8sClient = new this.K8sClient({ const k8sClient = new this.K8sClient({
kubeConfigStr, kubeConfigStr,
logger: this.logger, logger: this.logger
}); });
// if (this.clusterIp != null) { // if (this.clusterIp != null) {
// if (!this.clusterDomain) { // if (!this.clusterDomain) {
@ -132,31 +172,34 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
// // 修改内网解析ip地址 // // 修改内网解析ip地址
// k8sClient.setLookup({ [this.clusterDomain]: { ip: this.clusterIp } }); // k8sClient.setLookup({ [this.clusterDomain]: { ip: this.clusterIp } });
// } // }
const ingressType = this.ingressClass || 'qcloud'; const ingressType = this.ingressClass || "qcloud";
if (ingressType === 'qcloud') { if (ingressType === "qcloud" || ingressType === "clb") {
await this.patchQcloudCertSecret({ k8sClient }); await this.patchQcloudCertSecret({ k8sClient });
} else { } else {
await this.patchNginxCertSecret({ k8sClient }); await this.patchNginxCertSecret({ k8sClient });
} }
await utils.sleep(5000); // 停留2秒，等待secret部署完成 await utils.sleep(5000); // 停留2秒，等待secret部署完成
await this.restartIngress({ k8sClient }); if (this.ingressName) {
this.logger.info("正在重启ingress:", this.ingressName);
await this.restartIngress({ k8sClient });
}
} }
async getTkeClient(accessProvider: any, region = 'ap-guangzhou') { async getTkeClient(accessProvider: any, region = "ap-guangzhou") {
const sdk = await import('tencentcloud-sdk-nodejs/tencentcloud/services/tke/v20180525/index.js'); const sdk = await import("tencentcloud-sdk-nodejs/tencentcloud/services/tke/v20180525/index.js");
const TkeClient = sdk.v20180525.Client; const TkeClient = sdk.v20180525.Client;
const clientConfig = { const clientConfig = {
credential: { credential: {
secretId: accessProvider.secretId, secretId: accessProvider.secretId,
secretKey: accessProvider.secretKey, secretKey: accessProvider.secretKey
}, },
region, region,
profile: { profile: {
httpProfile: { httpProfile: {
endpoint: 'tke.tencentcloudapi.com', endpoint: "tke.tencentcloudapi.com"
}, }
}, }
}; };
return new TkeClient(clientConfig); return new TkeClient(clientConfig);
@ -165,49 +208,42 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
async getTkeKubeConfig(client: any, clusterId: string) { async getTkeKubeConfig(client: any, clusterId: string) {
// Depends on tencentcloud-sdk-nodejs version 4.0.3 or higher // Depends on tencentcloud-sdk-nodejs version 4.0.3 or higher
const params = { const params = {
ClusterId: clusterId, ClusterId: clusterId
}; };
const ret = await client.DescribeClusterKubeconfig(params); const ret = await client.DescribeClusterKubeconfig(params);
this.checkRet(ret); this.checkRet(ret);
this.logger.info('注意：后续操作需要在【集群->基本信息】中开启外网或内网访问,https://console.cloud.tencent.com/tke2/cluster'); this.logger.info("注意：后续操作需要在【集群->基本信息】中开启外网或内网访问,https://console.cloud.tencent.com/tke2/cluster");
return ret.Kubeconfig; return ret.Kubeconfig;
} }
appendTimeSuffix(name: string) {
if (name == null) {
name = 'certd';
}
return name + '-' + dayjs().format('YYYYMMDD-HHmmss');
}
async patchQcloudCertSecret(options: { k8sClient: any }) { async patchQcloudCertSecret(options: { k8sClient: any }) {
if (this.tencentCertId == null) { if (this.tencentCertId == null) {
throw new Error('请先将【上传证书到腾讯云】作为前置任务'); throw new Error("请先将【上传证书到腾讯云】作为前置任务");
} }
this.logger.info('腾讯云证书ID:', this.tencentCertId); this.logger.info("腾讯云证书ID:", this.tencentCertId);
const certIdBase64 = Buffer.from(this.tencentCertId).toString('base64'); const certIdBase64 = Buffer.from(this.tencentCertId).toString("base64");
const { namespace, secretName } = this; const { namespace, secretName } = this;
const body = { const body = {
data: { data: {
qcloud_cert_id: certIdBase64, qcloud_cert_id: certIdBase64
}, },
metadata: { metadata: {
labels: { labels: {
certd: this.appendTimeSuffix('certd'), certd: this.appendTimeSuffix("certd")
}, }
}, }
}; };
let secretNames: any = secretName; let secretNames: any = secretName;
if (typeof secretName === 'string') { if (typeof secretName === "string") {
secretNames = [secretName]; secretNames = [secretName];
} }
for (const secret of secretNames) { for (const secret of secretNames) {
await options.k8sClient.patchSecret({ await options.k8sClient.patchSecret({
namespace, namespace,
secretName: secret, secretName: secret,
body, body
}); });
this.logger.info(`CertSecret已更新:${secret}`); this.logger.info(`CertSecret已更新:${secret}`);
} }
@ -218,24 +254,24 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
const { cert } = this; const { cert } = this;
const crt = cert.crt; const crt = cert.crt;
const key = cert.key; const key = cert.key;
const crtBase64 = Buffer.from(crt).toString('base64'); const crtBase64 = Buffer.from(crt).toString("base64");
const keyBase64 = Buffer.from(key).toString('base64'); const keyBase64 = Buffer.from(key).toString("base64");
const { namespace, secretName } = this; const { namespace, secretName } = this;
const body = { const body = {
data: { data: {
'tls.crt': crtBase64, "tls.crt": crtBase64,
'tls.key': keyBase64, "tls.key": keyBase64
}, },
metadata: { metadata: {
labels: { labels: {
certd: this.appendTimeSuffix('certd'), certd: this.appendTimeSuffix("certd")
}, }
}, }
}; };
let secretNames = secretName; let secretNames = secretName;
if (typeof secretName === 'string') { if (typeof secretName === "string") {
secretNames = [secretName]; secretNames = [secretName];
} }
for (const secret of secretNames) { for (const secret of secretNames) {
@ -251,12 +287,12 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
const body = { const body = {
metadata: { metadata: {
labels: { labels: {
certd: this.appendTimeSuffix('certd'), certd: this.appendTimeSuffix("certd")
}, }
}, }
}; };
let ingressNames = this.ingressName; let ingressNames = this.ingressName || [];
if (typeof ingressName === 'string') { if (typeof ingressName === "string") {
ingressNames = [ingressName]; ingressNames = [ingressName];
} }
for (const ingress of ingressNames) { for (const ingress of ingressNames) {
@ -264,9 +300,11 @@ export class DeployCertToTencentTKEIngressPlugin extends AbstractTaskPlugin {
this.logger.info(`ingress已重启:${ingress}`); this.logger.info(`ingress已重启:${ingress}`);
} }
} }
checkRet(ret: any) { checkRet(ret: any) {
if (!ret || ret.Error) { if (!ret || ret.Error) {
throw new Error('执行失败：' + ret.Error.Code + ',' + ret.Error.Message); throw new Error("执行失败：" + ret.Error.Code + "," + ret.Error.Message);
} }
} }
} }