opensource/certimate
3
0
Fork 0
mirror of https://github.com/certimate-go/certimate.git synced 2026-10-29 17:58:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add support for aws imds credentials

Browse Source
This commit is contained in:
Fu Diwei
2026-07-30 16:37:17 +08:00
committed by RHQYZ
parent bd6d1266b5
commit 4e7b1a0758
44 changed files with 551 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/certacme/certifiers/sp_aws_lightsail.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := chlgimpl.NewChallenger(&chlgimpl.ChallengerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certacme/certifiers/sp_aws_route53.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := chlgimpl.NewChallenger(&chlgimpl.ChallengerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certmgmt/deployers/sp_aws_acm.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := dplyimpl.NewDeployer(&dplyimpl.DeployerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certmgmt/deployers/sp_aws_alb.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := dplyimpl.NewDeployer(&dplyimpl.DeployerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certmgmt/deployers/sp_aws_amplify.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := dplyimpl.NewDeployer(&dplyimpl.DeployerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certmgmt/deployers/sp_aws_apigateway.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := dplyimpl.NewDeployer(&dplyimpl.DeployerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certmgmt/deployers/sp_aws_clb.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := dplyimpl.NewDeployer(&dplyimpl.DeployerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certmgmt/deployers/sp_aws_cloudfront.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := dplyimpl.NewDeployer(&dplyimpl.DeployerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certmgmt/deployers/sp_aws_iam.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := dplyimpl.NewDeployer(&dplyimpl.DeployerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/certmgmt/deployers/sp_aws_nlb.go
+1
View File
@@ -17,6 +17,7 @@ func init() {
}
provider, err := dplyimpl.NewDeployer(&dplyimpl.DeployerConfig{
AuthMethod: credentials.AuthMethod,
AccessKeyId: credentials.AccessKeyId,
SecretAccessKey: credentials.SecretAccessKey,
Region: xmaps.GetString(options.ProviderExtendedConfig, "region"),
internal/domain/access.go
+1
View File
@@ -82,6 +82,7 @@ type AccessConfigForArvanCloud struct {
}
type AccessConfigForAWS struct {
AuthMethod string `json:"authMethod"`
AccessKeyId string `json:"accessKeyId"`
SecretAccessKey string `json:"secretAccessKey"`
}
migrations/1785384000_upgrade_v0.4.29.go
+63
View File
@@ -0,0 +1,63 @@
package migrations
import (
"errors"
"github.com/pocketbase/pocketbase/core"
m "github.com/pocketbase/pocketbase/migrations"
)
func init() {
m.Register(func(app core.App) error {
tracer := NewTracer("v0.4.29")
tracer.Printf("go ...")
// update collection `access`
// - modify field `config` schema
{
collection, err := app.FindCollectionByNameOrId("4yzbv8urny5ja1e")
if err != nil {
return err
}
records, err := app.FindAllRecords(collection)
if err != nil {
return err
}
for _, record := range records {
changed := false
provider := record.GetString("provider")
config := make(map[string]any)
if err := record.UnmarshalJSONField("config", &config); err != nil {
return err
}
switch provider {
case "aws":
{
if _, ok := config["authMethod"]; !ok {
config["authMethod"] = "accesskey"
record.Set("config", config)
changed = true
}
}
}
if changed {
if err := app.Save(record); err != nil {
return err
}
tracer.Printf("record #%s in collection '%s' updated", record.Id, collection.Name)
}
}
}
tracer.Printf("done")
return nil
}, func(app core.App) error {
return errors.ErrUnsupported
})
}
pkg/core/certifier/challengers/dns01/aws-lightsail/aws_lightsail.go
+17 -2
View File
@@ -4,11 +4,16 @@ import (
"fmt"
"time"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/certimate-go/certimate/pkg/core"
"github.com/certimate-go/certimate/pkg/core/certifier/challengers/dns01/aws-lightsail/internal"
)
type ChallengerConfig struct {
AuthMethod string `json:"authMethod"`
AccessKeyId string `json:"accessKeyId"`
SecretAccessKey string `json:"secretAccessKey"`
Region string `json:"region"`
@@ -22,8 +27,18 @@ func NewChallenger(config *ChallengerConfig) (core.ACMEChallenger, error) {
}
providerConfig := internal.NewDefaultConfig()
providerConfig.AccessKeyID = config.AccessKeyId
providerConfig.SecretAccessKey = config.SecretAccessKey
switch config.AuthMethod {
case "":
if config.AccessKeyId != "" && config.SecretAccessKey != "" {
providerConfig.AWSCredentialsProvider = credentials.NewStaticCredentialsProvider(config.AccessKeyId, config.SecretAccessKey, "")
}
case AUTH_METHOD_ACCESSKEY:
providerConfig.AWSCredentialsProvider = credentials.NewStaticCredentialsProvider(config.AccessKeyId, config.SecretAccessKey, "")
case AUTH_METHOD_IMDS:
providerConfig.AWSCredentialsProvider = aws.NewCredentialsCache(ec2rolecreds.New())
default:
return nil, fmt.Errorf("unsupported auth method '%s'", config.AuthMethod)
}
providerConfig.Region = config.Region
if config.DnsPropagationTimeout != 0 {
providerConfig.PropagationTimeout = time.Duration(config.DnsPropagationTimeout) * time.Second
pkg/core/certifier/challengers/dns01/aws-lightsail/consts.go
+10
View File
@@ -0,0 +1,10 @@
package awslightsail
import (
route53 "github.com/certimate-go/certimate/pkg/core/certifier/challengers/dns01/aws-route53"
)
const (
AUTH_METHOD_ACCESSKEY = route53.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = route53.AUTH_METHOD_IMDS
)
pkg/core/certifier/challengers/dns01/aws-lightsail/internal/lego.go
+9 -11
View File
@@ -8,7 +8,6 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/service/lightsail"
"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
"github.com/go-acme/lego/v5/challenge"
@@ -25,15 +24,11 @@ const (
EnvPollingInterval = envNamespace + "POLLING_INTERVAL"
)
const maxRetries = 5
var _ challenge.ProviderTimeout = (*DNSProvider)(nil)
type Config struct {
AccessKeyID string
SecretAccessKey string
SessionToken string
Region string
AWSCredentialsProvider aws.CredentialsProvider
Region string
PropagationTimeout time.Duration
PollingInterval time.Duration
@@ -65,11 +60,14 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
return nil, fmt.Errorf("lightsail: the configuration of the DNS provider is nil")
}
ctx := context.Background()
cfg, err := awscfg.LoadDefaultConfig(ctx,
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(config.AccessKeyID, config.SecretAccessKey, config.SessionToken)),
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(config.Region),
)
}
if config.AWSCredentialsProvider != nil {
opts = append(opts, awscfg.WithCredentialsProvider(config.AWSCredentialsProvider))
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/certifier/challengers/dns01/aws-route53/aws_route53.go
+1
View File
@@ -10,6 +10,7 @@ import (
)
type ChallengerConfig struct {
AuthMethod string `json:"authMethod"` // not used for now
AccessKeyId string `json:"accessKeyId"`
SecretAccessKey string `json:"secretAccessKey"`
Region string `json:"region"`
pkg/core/certifier/challengers/dns01/aws-route53/consts.go
+6
View File
@@ -0,0 +1,6 @@
package awsroute53
const (
AUTH_METHOD_ACCESSKEY = "accesskey"
AUTH_METHOD_IMDS = "imds"
)
pkg/core/certifier/challengers/dns01/oraclecloud/oraclecloud.go
+1 -1
View File
@@ -32,7 +32,7 @@ func NewChallenger(config *ChallengerConfig) (core.ACMEChallenger, error) {
providerConfig := oraclecloud.NewDefaultConfig()
providerConfig.CompartmentID = config.CompartmentOcid
switch config.AuthMethod {
case AUTH_METHOD_APIKEY:
case "", AUTH_METHOD_APIKEY:
pkpwd := (*string)(nil)
if config.PrivateKeyPassphrase != "" {
pkpwd = &config.PrivateKeyPassphrase
pkg/core/certmgr/providers/aws-acm/aws_acm.go
+26 -5
View File
@@ -10,6 +10,7 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go-v2/service/acm"
"github.com/aws/smithy-go"
@@ -24,6 +25,10 @@ type (
)
type CertmgrConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -45,7 +50,7 @@ func NewCertmgr(config *CertmgrConfig) (*Certmgr, error) {
return nil, fmt.Errorf("the configuration of the certmgr provider is nil")
}
client, err := createSDKClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
client, err := createSDKClient(config.AuthMethod, config.AccessKeyId, config.SecretAccessKey, config.Region)
if err != nil {
return nil, fmt.Errorf("could not create client: %w", err)
}
@@ -194,11 +199,27 @@ func (c *Certmgr) Replace(ctx context.Context, certIdOrName string, certPEM, pri
return &ReplaceResult{}, nil
}
func createSDKClient(accessKeyId, secretAccessKey, region string) (*acm.Client, error) {
cfg, err := awscfg.LoadDefaultConfig(context.Background(),
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")),
func createSDKClient(authMethod, accessKeyId, secretAccessKey, region string) (*acm.Client, error) {
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(region),
)
}
staticCredsProvider := awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")
imdsCredsProvider := aws.NewCredentialsCache(ec2rolecreds.New())
switch authMethod {
case "":
if accessKeyId != "" && secretAccessKey != "" {
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
}
case AUTH_METHOD_ACCESSKEY:
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
case AUTH_METHOD_IMDS:
opts = append(opts, awscfg.WithCredentialsProvider(imdsCredsProvider))
default:
return nil, fmt.Errorf("unsupported auth method '%s'", authMethod)
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/certmgr/providers/aws-acm/consts.go
+10
View File
@@ -0,0 +1,10 @@
package awsacm
import (
iam "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-iam"
)
const (
AUTH_METHOD_ACCESSKEY = iam.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = iam.AUTH_METHOD_IMDS
)
pkg/core/certmgr/providers/aws-iam/aws_iam.go
+26 -5
View File
@@ -11,6 +11,7 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/smithy-go"
"github.com/samber/lo"
@@ -26,6 +27,10 @@ type (
)
type CertmgrConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -50,7 +55,7 @@ func NewCertmgr(config *CertmgrConfig) (*Certmgr, error) {
return nil, fmt.Errorf("the configuration of the certmgr provider is nil")
}
client, err := createSDKClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
client, err := createSDKClient(config.AuthMethod, config.AccessKeyId, config.SecretAccessKey, config.Region)
if err != nil {
return nil, fmt.Errorf("could not create client: %w", err)
}
@@ -187,11 +192,27 @@ func (c *Certmgr) Replace(ctx context.Context, certIdOrName string, certPEM, pri
return nil, core.ErrUnsupported
}
func createSDKClient(accessKeyId, secretAccessKey, region string) (*iam.Client, error) {
cfg, err := awscfg.LoadDefaultConfig(context.Background(),
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")),
func createSDKClient(authMethod, accessKeyId, secretAccessKey, region string) (*iam.Client, error) {
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(region),
)
}
staticCredsProvider := awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")
imdsCredsProvider := aws.NewCredentialsCache(ec2rolecreds.New())
switch authMethod {
case "":
if accessKeyId != "" && secretAccessKey != "" {
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
}
case AUTH_METHOD_ACCESSKEY:
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
case AUTH_METHOD_IMDS:
opts = append(opts, awscfg.WithCredentialsProvider(imdsCredsProvider))
default:
return nil, fmt.Errorf("unsupported auth method '%s'", authMethod)
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/certmgr/providers/aws-iam/consts.go
+6
View File
@@ -0,0 +1,6 @@
package awsiam
const (
AUTH_METHOD_ACCESSKEY = "accesskey"
AUTH_METHOD_IMDS = "imds"
)
pkg/core/deployer/providers/aws-acm/aws_acm.go
+5
View File
@@ -15,6 +15,10 @@ type (
)
type DeployerConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -40,6 +44,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
}
pcertmgr, err := cmgrimpl.NewCertmgr(&cmgrimpl.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
pkg/core/deployer/providers/aws-acm/consts.go
+10
View File
@@ -0,0 +1,10 @@
package awsacm
import (
cmgrimpl "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-acm"
)
const (
AUTH_METHOD_ACCESSKEY = cmgrimpl.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = cmgrimpl.AUTH_METHOD_IMDS
)
pkg/core/deployer/providers/aws-alb/aws_alb.go
+28 -5
View File
@@ -8,6 +8,7 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2"
"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2/types"
@@ -22,6 +23,10 @@ type (
)
type DeployerConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -53,7 +58,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
return nil, fmt.Errorf("the configuration of the deployer provider is nil")
}
client, err := createSDKClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
client, err := createSDKClient(config.AuthMethod, config.AccessKeyId, config.SecretAccessKey, config.Region)
if err != nil {
return nil, fmt.Errorf("could not create client: %w", err)
}
@@ -62,6 +67,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
switch config.CertificateSource {
case CERTIFICATE_SOURCE_ACM:
pcertmgr, err = cmgrimplacm.NewCertmgr(&cmgrimplacm.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -72,6 +78,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
case CERTIFICATE_SOURCE_IAM:
pcertmgr, err = cmgrimpliam.NewCertmgr(&cmgrimpliam.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -220,11 +227,27 @@ func (d *Deployer) updateListenerSniCertificate(ctx context.Context, cloudListen
return nil
}
func createSDKClient(accessKeyId, secretAccessKey, region string) (*elasticloadbalancingv2.Client, error) {
cfg, err := awscfg.LoadDefaultConfig(context.Background(),
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")),
func createSDKClient(authMethod, accessKeyId, secretAccessKey, region string) (*elasticloadbalancingv2.Client, error) {
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(region),
)
}
staticCredsProvider := awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")
imdsCredsProvider := aws.NewCredentialsCache(ec2rolecreds.New())
switch authMethod {
case "":
if accessKeyId != "" && secretAccessKey != "" {
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
}
case AUTH_METHOD_ACCESSKEY:
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
case AUTH_METHOD_IMDS:
opts = append(opts, awscfg.WithCredentialsProvider(imdsCredsProvider))
default:
return nil, fmt.Errorf("unsupported auth method '%s'", authMethod)
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/deployer/providers/aws-alb/consts.go
+9
View File
@@ -1,5 +1,14 @@
package awsalb
import (
cmgrimplacm "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-acm"
)
const (
AUTH_METHOD_ACCESSKEY = cmgrimplacm.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = cmgrimplacm.AUTH_METHOD_IMDS
)
const (
CERTIFICATE_SOURCE_ACM = "ACM"
CERTIFICATE_SOURCE_IAM = "IAM"
pkg/core/deployer/providers/aws-amplify/aws_amplify.go
+27 -5
View File
@@ -8,6 +8,7 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go-v2/service/amplify"
"github.com/aws/aws-sdk-go-v2/service/amplify/types"
@@ -21,6 +22,10 @@ type (
)
type DeployerConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -50,7 +55,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
return nil, fmt.Errorf("the configuration of the deployer provider is nil")
}
client, err := createSDKClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
client, err := createSDKClient(config.AuthMethod, config.AccessKeyId, config.SecretAccessKey, config.Region)
if err != nil {
return nil, fmt.Errorf("could not create client: %w", err)
}
@@ -59,6 +64,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
switch config.CertificateSource {
case CERTIFICATE_SOURCE_ACM:
pcertmgr, err = cmgrimplacm.NewCertmgr(&cmgrimplacm.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -124,11 +130,27 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*Dep
return &DeployResult{}, nil
}
func createSDKClient(accessKeyId, secretAccessKey, region string) (*amplify.Client, error) {
cfg, err := awscfg.LoadDefaultConfig(context.Background(),
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")),
func createSDKClient(authMethod, accessKeyId, secretAccessKey, region string) (*amplify.Client, error) {
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(region),
)
}
staticCredsProvider := awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")
imdsCredsProvider := aws.NewCredentialsCache(ec2rolecreds.New())
switch authMethod {
case "":
if accessKeyId != "" && secretAccessKey != "" {
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
}
case AUTH_METHOD_ACCESSKEY:
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
case AUTH_METHOD_IMDS:
opts = append(opts, awscfg.WithCredentialsProvider(imdsCredsProvider))
default:
return nil, fmt.Errorf("unsupported auth method '%s'", authMethod)
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/deployer/providers/aws-amplify/consts.go
+9
View File
@@ -1,5 +1,14 @@
package awsamplify
import (
cmgrimplacm "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-acm"
)
const (
AUTH_METHOD_ACCESSKEY = cmgrimplacm.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = cmgrimplacm.AUTH_METHOD_IMDS
)
const (
CERTIFICATE_SOURCE_ACM = "ACM"
)
pkg/core/deployer/providers/aws-apigateway/aws_apigateway.go
+27 -5
View File
@@ -8,6 +8,7 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go-v2/service/apigatewayv2"
"github.com/aws/aws-sdk-go-v2/service/apigatewayv2/types"
@@ -21,6 +22,10 @@ type (
)
type DeployerConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -48,7 +53,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
return nil, fmt.Errorf("the configuration of the deployer provider is nil")
}
client, err := createSDKClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
client, err := createSDKClient(config.AuthMethod, config.AccessKeyId, config.SecretAccessKey, config.Region)
if err != nil {
return nil, fmt.Errorf("could not create client: %w", err)
}
@@ -57,6 +62,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
switch config.CertificateSource {
case CERTIFICATE_SOURCE_ACM:
pcertmgr, err = cmgrimplacm.NewCertmgr(&cmgrimplacm.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -119,11 +125,27 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*Dep
return &DeployResult{}, nil
}
func createSDKClient(accessKeyId, secretAccessKey, region string) (*apigatewayv2.Client, error) {
cfg, err := awscfg.LoadDefaultConfig(context.Background(),
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")),
func createSDKClient(authMethod, accessKeyId, secretAccessKey, region string) (*apigatewayv2.Client, error) {
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(region),
)
}
staticCredsProvider := awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")
imdsCredsProvider := aws.NewCredentialsCache(ec2rolecreds.New())
switch authMethod {
case "":
if accessKeyId != "" && secretAccessKey != "" {
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
}
case AUTH_METHOD_ACCESSKEY:
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
case AUTH_METHOD_IMDS:
opts = append(opts, awscfg.WithCredentialsProvider(imdsCredsProvider))
default:
return nil, fmt.Errorf("unsupported auth method '%s'", authMethod)
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/deployer/providers/aws-apigateway/consts.go
+9
View File
@@ -1,5 +1,14 @@
package awsapigateway
import (
cmgrimplacm "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-acm"
)
const (
AUTH_METHOD_ACCESSKEY = cmgrimplacm.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = cmgrimplacm.AUTH_METHOD_IMDS
)
const (
CERTIFICATE_SOURCE_ACM = "ACM"
)
pkg/core/deployer/providers/aws-clb/aws_clb.go
+28 -5
View File
@@ -8,6 +8,7 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing"
"github.com/certimate-go/certimate/pkg/core"
@@ -21,6 +22,10 @@ type (
)
type DeployerConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -50,7 +55,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
return nil, fmt.Errorf("the configuration of the deployer provider is nil")
}
client, err := createSDKClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
client, err := createSDKClient(config.AuthMethod, config.AccessKeyId, config.SecretAccessKey, config.Region)
if err != nil {
return nil, fmt.Errorf("could not create client: %w", err)
}
@@ -59,6 +64,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
switch config.CertificateSource {
case CERTIFICATE_SOURCE_ACM:
pcertmgr, err = cmgrimplacm.NewCertmgr(&cmgrimplacm.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -69,6 +75,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
case CERTIFICATE_SOURCE_IAM:
pcertmgr, err = cmgrimpliam.NewCertmgr(&cmgrimpliam.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -132,11 +139,27 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*Dep
return &DeployResult{}, nil
}
func createSDKClient(accessKeyId, secretAccessKey, region string) (*elasticloadbalancing.Client, error) {
cfg, err := awscfg.LoadDefaultConfig(context.Background(),
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")),
func createSDKClient(authMethod, accessKeyId, secretAccessKey, region string) (*elasticloadbalancing.Client, error) {
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(region),
)
}
staticCredsProvider := awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")
imdsCredsProvider := aws.NewCredentialsCache(ec2rolecreds.New())
switch authMethod {
case "":
if accessKeyId != "" && secretAccessKey != "" {
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
}
case AUTH_METHOD_ACCESSKEY:
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
case AUTH_METHOD_IMDS:
opts = append(opts, awscfg.WithCredentialsProvider(imdsCredsProvider))
default:
return nil, fmt.Errorf("unsupported auth method '%s'", authMethod)
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/deployer/providers/aws-clb/consts.go
+9
View File
@@ -1,5 +1,14 @@
package awsclb
import (
cmgrimplacm "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-acm"
)
const (
AUTH_METHOD_ACCESSKEY = cmgrimplacm.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = cmgrimplacm.AUTH_METHOD_IMDS
)
const (
CERTIFICATE_SOURCE_ACM = "ACM"
CERTIFICATE_SOURCE_IAM = "IAM"
pkg/core/deployer/providers/aws-cloudfront/aws_cloudfront.go
+28 -5
View File
@@ -8,6 +8,7 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go-v2/service/cloudfront"
"github.com/aws/aws-sdk-go-v2/service/cloudfront/types"
@@ -22,6 +23,10 @@ type (
)
type DeployerConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -49,7 +54,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
return nil, fmt.Errorf("the configuration of the deployer provider is nil")
}
client, err := createSDKClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
client, err := createSDKClient(config.AuthMethod, config.AccessKeyId, config.SecretAccessKey, config.Region)
if err != nil {
return nil, fmt.Errorf("could not create client: %w", err)
}
@@ -58,6 +63,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
switch config.CertificateSource {
case CERTIFICATE_SOURCE_ACM:
pcertmgr, err = cmgrimplacm.NewCertmgr(&cmgrimplacm.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -68,6 +74,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
case CERTIFICATE_SOURCE_IAM:
pcertmgr, err = cmgrimpliam.NewCertmgr(&cmgrimpliam.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -158,11 +165,27 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*Dep
return &DeployResult{}, nil
}
func createSDKClient(accessKeyId, secretAccessKey, region string) (*cloudfront.Client, error) {
cfg, err := awscfg.LoadDefaultConfig(context.Background(),
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")),
func createSDKClient(authMethod, accessKeyId, secretAccessKey, region string) (*cloudfront.Client, error) {
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(region),
)
}
staticCredsProvider := awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")
imdsCredsProvider := aws.NewCredentialsCache(ec2rolecreds.New())
switch authMethod {
case "":
if accessKeyId != "" && secretAccessKey != "" {
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
}
case AUTH_METHOD_ACCESSKEY:
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
case AUTH_METHOD_IMDS:
opts = append(opts, awscfg.WithCredentialsProvider(imdsCredsProvider))
default:
return nil, fmt.Errorf("unsupported auth method '%s'", authMethod)
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/deployer/providers/aws-cloudfront/consts.go
+9
View File
@@ -1,5 +1,14 @@
package awscloudfront
import (
cmgrimplacm "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-acm"
)
const (
AUTH_METHOD_ACCESSKEY = cmgrimplacm.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = cmgrimplacm.AUTH_METHOD_IMDS
)
const (
CERTIFICATE_SOURCE_ACM = "ACM"
CERTIFICATE_SOURCE_IAM = "IAM"
pkg/core/deployer/providers/aws-iam/aws_iam.go
+5
View File
@@ -15,6 +15,10 @@ type (
)
type DeployerConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -40,6 +44,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
}
pcertmgr, err := cmgrimpl.NewCertmgr(&cmgrimpl.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
pkg/core/deployer/providers/aws-iam/consts.go
+10
View File
@@ -0,0 +1,10 @@
package awsiam
import (
cmgrimpl "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-iam"
)
const (
AUTH_METHOD_ACCESSKEY = cmgrimpl.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = cmgrimpl.AUTH_METHOD_IMDS
)
pkg/core/deployer/providers/aws-nlb/aws_nlb.go
+28 -5
View File
@@ -8,6 +8,7 @@ import (
aws "github.com/aws/aws-sdk-go-v2/aws"
awscfg "github.com/aws/aws-sdk-go-v2/config"
awscred "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2"
"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2/types"
@@ -22,6 +23,10 @@ type (
)
type DeployerConfig struct {
// AWS API 认证方式。
// 可取值 "accesskey"、"imds"。
// 零值时默认值 [AUTH_METHOD_ACCESSKEY]。
AuthMethod string `json:"authMethod,omitempty"`
// AWS AccessKeyId。
AccessKeyId string `json:"accessKeyId"`
// AWS SecretAccessKey。
@@ -53,7 +58,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
return nil, fmt.Errorf("the configuration of the deployer provider is nil")
}
client, err := createSDKClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
client, err := createSDKClient(config.AuthMethod, config.AccessKeyId, config.SecretAccessKey, config.Region)
if err != nil {
return nil, fmt.Errorf("could not create client: %w", err)
}
@@ -62,6 +67,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
switch config.CertificateSource {
case CERTIFICATE_SOURCE_ACM:
pcertmgr, err = cmgrimplacm.NewCertmgr(&cmgrimplacm.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -72,6 +78,7 @@ func NewDeployer(config *DeployerConfig) (*Deployer, error) {
case CERTIFICATE_SOURCE_IAM:
pcertmgr, err = cmgrimpliam.NewCertmgr(&cmgrimpliam.CertmgrConfig{
AuthMethod: config.AuthMethod,
AccessKeyId: config.AccessKeyId,
SecretAccessKey: config.SecretAccessKey,
Region: config.Region,
@@ -220,11 +227,27 @@ func (d *Deployer) updateListenerSniCertificate(ctx context.Context, cloudListen
return nil
}
func createSDKClient(accessKeyId, secretAccessKey, region string) (*elasticloadbalancingv2.Client, error) {
cfg, err := awscfg.LoadDefaultConfig(context.Background(),
awscfg.WithCredentialsProvider(awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")),
func createSDKClient(authMethod, accessKeyId, secretAccessKey, region string) (*elasticloadbalancingv2.Client, error) {
opts := []func(options *awscfg.LoadOptions) error{
awscfg.WithRegion(region),
)
}
staticCredsProvider := awscred.NewStaticCredentialsProvider(accessKeyId, secretAccessKey, "")
imdsCredsProvider := aws.NewCredentialsCache(ec2rolecreds.New())
switch authMethod {
case "":
if accessKeyId != "" && secretAccessKey != "" {
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
}
case AUTH_METHOD_ACCESSKEY:
opts = append(opts, awscfg.WithCredentialsProvider(staticCredsProvider))
case AUTH_METHOD_IMDS:
opts = append(opts, awscfg.WithCredentialsProvider(imdsCredsProvider))
default:
return nil, fmt.Errorf("unsupported auth method '%s'", authMethod)
}
cfg, err := awscfg.LoadDefaultConfig(context.Background(), opts...)
if err != nil {
return nil, err
}
pkg/core/deployer/providers/aws-nlb/consts.go
+9
View File
@@ -1,5 +1,14 @@
package awsnlb
import (
cmgrimplacm "github.com/certimate-go/certimate/pkg/core/certmgr/providers/aws-acm"
)
const (
AUTH_METHOD_ACCESSKEY = cmgrimplacm.AUTH_METHOD_ACCESSKEY
AUTH_METHOD_IMDS = cmgrimplacm.AUTH_METHOD_IMDS
)
const (
CERTIFICATE_SOURCE_ACM = "ACM"
CERTIFICATE_SOURCE_IAM = "IAM"
pkg/core/deployer/providers/nginxproxymanager/consts.go
+6 -2
View File
@@ -1,8 +1,12 @@
package nginxproxymanager
import (
cmgrimpl "github.com/certimate-go/certimate/pkg/core/certmgr/providers/nginxproxymanager"
)
const (
AUTH_METHOD_PASSWORD = "password"
AUTH_METHOD_TOKEN = "token"
AUTH_METHOD_PASSWORD = cmgrimpl.AUTH_METHOD_PASSWORD
AUTH_METHOD_TOKEN = cmgrimpl.AUTH_METHOD_TOKEN
)
const (
pkg/core/deployer/providers/nginxproxymanager/nginxproxymanager.go
+4 -2
View File
@@ -383,14 +383,16 @@ func createSDKClient(serverUrl, authMethod, username, password, apiToken string,
switch authMethod {
case "", AUTH_METHOD_PASSWORD:
{
client, err = npmsdk.NewClient(serverUrl,
client, err = npmsdk.NewClient(
serverUrl,
npmsdk.WithLogins(username, password),
)
}
case AUTH_METHOD_TOKEN:
{
client, err = npmsdk.NewClient(serverUrl,
client, err = npmsdk.NewClient(
serverUrl,
npmsdk.WithJwtToken(apiToken),
)
}
ui/src/components/access/forms/AccessConfigFieldsProviderAWS.tsx
+78 -19
View File
@@ -1,10 +1,16 @@
import { getI18n, useTranslation } from "react-i18next";
import { Form, Input } from "antd";
import { Form, Input, Radio } from "antd";
import { createSchemaFieldRule } from "antd-zod";
import { z } from "zod";
import Show from "@/components/Show";
import Tips from "@/components/Tips";
import { useFormNestedFieldsContext } from "./_context";
const AUTH_METHOD_ACCESSKEY = "accesskey" as const;
const AUTH_METHOD_IMDS = "imds" as const;
const AccessConfigFormFieldsProviderAWS = () => {
const { i18n, t } = useTranslation();
@@ -13,35 +19,59 @@ const AccessConfigFormFieldsProviderAWS = () => {
[parentNamePath]: getSchema({ i18n }),
});
const formRule = createSchemaFieldRule(formSchema);
const formInst = Form.useFormInstance<z.infer<typeof formSchema>>();
const initialValues = getInitialValues();
const fieldAuthMethod = Form.useWatch<string>([parentNamePath, "authMethod"], formInst);
return (
<>
<Form.Item
name={[parentNamePath, "accessKeyId"]}
initialValue={initialValues.accessKeyId}
label={t("access.form.aws_access_key_id.label")}
name={[parentNamePath, "authMethod"]}
initialValue={initialValues.authMethod}
label={t("access.form.aws_auth_method.label")}
rules={[formRule]}
tooltip={<span dangerouslySetInnerHTML={{ __html: t("access.form.aws_access_key_id.tooltip") }}></span>}
>
<Input autoComplete="new-password" placeholder={t("access.form.aws_access_key_id.placeholder")} />
<Radio.Group block>
<Radio.Button value={AUTH_METHOD_ACCESSKEY}>{t("access.form.aws_auth_method.option.accesskey.label")}</Radio.Button>
<Radio.Button value={AUTH_METHOD_IMDS}>{t("access.form.aws_auth_method.option.imds.label")}</Radio.Button>
</Radio.Group>
</Form.Item>
<Form.Item
name={[parentNamePath, "secretAccessKey"]}
initialValue={initialValues.secretAccessKey}
label={t("access.form.aws_secret_access_key.label")}
rules={[formRule]}
tooltip={<span dangerouslySetInnerHTML={{ __html: t("access.form.aws_secret_access_key.tooltip") }}></span>}
>
<Input.Password autoComplete="new-password" placeholder={t("access.form.aws_secret_access_key.placeholder")} />
</Form.Item>
<Show when={fieldAuthMethod === AUTH_METHOD_ACCESSKEY}>
<Form.Item
name={[parentNamePath, "accessKeyId"]}
initialValue={initialValues.accessKeyId}
label={t("access.form.aws_access_key_id.label")}
rules={[formRule]}
tooltip={<span dangerouslySetInnerHTML={{ __html: t("access.form.aws_access_key_id.tooltip") }}></span>}
>
<Input autoComplete="new-password" placeholder={t("access.form.aws_access_key_id.placeholder")} />
</Form.Item>
<Form.Item
name={[parentNamePath, "secretAccessKey"]}
initialValue={initialValues.secretAccessKey}
label={t("access.form.aws_secret_access_key.label")}
rules={[formRule]}
tooltip={<span dangerouslySetInnerHTML={{ __html: t("access.form.aws_secret_access_key.tooltip") }}></span>}
>
<Input.Password autoComplete="new-password" placeholder={t("access.form.aws_secret_access_key.placeholder")} />
</Form.Item>
</Show>
<Show when={fieldAuthMethod === AUTH_METHOD_IMDS}>
<Form.Item>
<Tips message={<span dangerouslySetInnerHTML={{ __html: t("access.form.aws_auth_method.option.imds.guide") }}></span>} />
</Form.Item>
</Show>
</>
);
};
const getInitialValues = (): Nullish<z.infer<ReturnType<typeof getSchema>>> => {
return {
authMethod: AUTH_METHOD_ACCESSKEY,
accessKeyId: "",
secretAccessKey: "",
};
@@ -50,10 +80,39 @@ const getInitialValues = (): Nullish<z.infer<ReturnType<typeof getSchema>>> => {
const getSchema = ({ i18n = getI18n() }: { i18n: ReturnType<typeof getI18n> }) => {
const { t: _ } = i18n;
return z.object({
accessKeyId: z.string().nonempty(),
secretAccessKey: z.string().nonempty(),
});
return z
.object({
authMethod: z.enum([AUTH_METHOD_ACCESSKEY, AUTH_METHOD_IMDS]),
accessKeyId: z.string().nullish(),
secretAccessKey: z.string().nullish(),
})
.superRefine((values, ctx) => {
switch (values.authMethod) {
case AUTH_METHOD_ACCESSKEY:
{
const scAccessKeyId = z.string().nonempty();
const spAccessKeyId = scAccessKeyId.safeParse(values.accessKeyId);
if (!spAccessKeyId.success) {
ctx.addIssue({
code: "custom",
message: z.treeifyError(spAccessKeyId.error).errors.join(),
path: ["accessKeyId"],
});
}
const scSecretAccessKey = z.string().nonempty();
const spSecretAccessKey = scSecretAccessKey.safeParse(values.secretAccessKey);
if (!spSecretAccessKey.success) {
ctx.addIssue({
code: "custom",
message: z.treeifyError(spSecretAccessKey.error).errors.join(),
path: ["secretAccessKey"],
});
}
}
break;
}
});
};
const _default = Object.assign(AccessConfigFormFieldsProviderAWS, {
ui/src/i18n/resources/en/nls.access.json
+13
View File
@@ -220,6 +220,19 @@
"placeholder": "Please enter ArvanCloud API key",
"tooltip": "For more information, see <a href=\"https://docs.arvancloud.ir/en/developer-tools/api/api-key\" target=\"_blank\">https://docs.arvancloud.ir/en/developer-tools/api/api-key</a>"
},
"aws_auth_method": {
"label": "AWS API authentication method",
"placeholder": "Please select AWS API authentication method",
"option": {
"accesskey": {
"label": "Access key"
},
"imds": {
"label": "IMDS",
"guide": "If you are running Certimate in Docker, please ensure that the metadata option <em>http-put-response-hop-limit</em> is configured correctly for the EC2 instance. Learn more about this: <br><a href=\"https://docs.aws.amazon.com/en_us/AWSEC2/latest/UserGuide/ec2-instance-metadata.html\" target=\"_blank\">https://docs.aws.amazon.com/en_us/AWSEC2/latest/UserGuide/ec2-instance-metadata.html</a>"
}
}
},
"aws_access_key_id": {
"label": "AWS AccessKeyID",
"placeholder": "Please enter AWS AccessKeyID",
ui/src/i18n/resources/zh/nls.access.json
+13
View File
@@ -220,6 +220,19 @@
"placeholder": "请输入 ArvanCloud API 密钥",
"tooltip": "这是什么？请参阅 <a href=\"https://docs.arvancloud.ir/en/developer-tools/api/api-key\" target=\"_blank\">https://docs.arvancloud.ir/en/developer-tools/api/api-key</a>"
},
"aws_auth_method": {
"label": "AWS API 认证方式",
"placeholder": "请选择 AWS API 认证方式",
"option": {
"accesskey": {
"label": "访问密钥"
},
"imds": {
"label": "EC2 IMDS",
"guide": "如果你正在使用容器化运行 Certimate，请确保已为 EC2 实例配置了正确的 <em>http-put-response-hop-limit</em> 元数据。点击下方链接了解更多：<br><a href=\"https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/ec2-instance-metadata.html\" target=\"_blank\">https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/ec2-instance-metadata.html</a>"
}
}
},
"aws_access_key_id": {
"label": "AWS AccessKeyID",
"placeholder": "请输入 AWS AccessKeyID",
ui/src/i18n/resources/zh/nls.workflow.nodes.json
+1 -1
View File
@@ -1903,7 +1903,7 @@
"placeholder": "请输入 Linode 对象存储桶名"
},
"local": {
"guide": "如果你正在使用 Docker 运行 Certimate，「本地」指的是容器内而非宿主机。"
"guide": "如果你正在使用容器化运行 Certimate，「本地」指的是容器内而非宿主机。"
},
"local_shell_env": {
"label": "命令执行环境",