Merge 2.0.0 to main - #28
Merged
Merged
Conversation
Brings in upstream fixes from main while preserving the dnsplugins branch architecture (inline DNS providers removed in favor of external plugins resolved via IDomainValidatorFactory). Resolutions: - Kept deletion of inline Cloudflare/Google/Factory providers (moved to plugin projects on this branch). - Dropped provider-specific config fields/annotations re-added by main; those configs now belong to each DNS plugin. - Added main's new Enabled disable-switch: cached AcmeClientConfig in Initialize, early-return in Initialize, and FAILED enrollment when the connector is disabled. - Added main's DnsVerificationServer config (with annotation) for private DNS zones, and wired it into the DnsVerificationHelper constructor call in Enroll. - Kept dnsplugins' AcmeCaPlugin.csproj state (newer IAnyCAPlugin prerelease, Google package removed, other provider packages pending cleanup). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ports the FlowLogger pattern from Keyfactor/barracuda-wafasaas-orchestrator and adapts it for an IAnyCAPlugin. The accumulated step breadcrumb is appended to EnrollmentResult.StatusMessage on both success and failure, so operators see a scannable per-step summary in the Command UI instead of just a single exception message. Changes: - FlowLogger.cs: ported verbatim from barracuda with namespace changed to Keyfactor.Extensions.CAPlugin.Acme. Added StepAsync<T> overload for async methods that return a value. - Enroll: wraps each stage (ValidateInput, FormatCsr, LoadConfig, CreateHttpClient, InitAcmeAccount, CreateAcmeClient, DecodeCsr, ExtractDomainsFromCsr, CreateOrder, ExtractOrderIdentifier, FinalizeOrder, DownloadCertificate, EncodeCertificateToPem) as a timed flow.Step. Success returns include flow.GetSummary(); failure paths include DescribeException(ex) + flow.GetSummary(). - ProcessAuthorizations: takes the flow and records per-domain work in three branches (StageDnsRecords / VerifyAndSubmit / CleanupDnsRecords), so the breadcrumb shows which specific domain failed when a challenge breaks. - DescribeException helper: unwraps AggregateException/TargetInvocation wrappers, surfaces HttpRequestException context, and truncates overlong messages so the summary stays readable. - Initialize: added ValidateConfigForEnrollment — fails fast (at save time, not first enroll) on missing DirectoryUrl/Email, non-absolute or non-http(s) DirectoryUrl, mismatched EAB key pair, or negative DnsPropagationDelaySeconds. Build: net6.0 / net8.0 / net10.0 — 0 errors, pre-existing warnings only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removed specific root/intermediate names (ISRG Root X1, R3) that go stale when Let's Encrypt rotates their chain. Users are now directed to the official Let's Encrypt certificates page to identify the currently active root and intermediate certificates. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolve the ACME challenge record name through any chain of CNAME delegations to its terminal target before staging validation. The resolved name now drives DNS provider plugin selection, record creation, propagation verification, and cleanup, so challenges delegated into a zone on a different provider are routed to the plugin that owns that zone. Non-delegated domains are unaffected.
Add multi-level CNAME delegation support for DNS-01 challenges
* Update CHANGELOG.md * Fix validator resolution regression for non-delegated challenges The framework's ResolveDomainValidator matches configured provider domain patterns (e.g. *.zone.com) against the certificate/zone name, not the _acme-challenge record name. Resolving on the raw resolved record name broke the non-delegated path because the _acme-challenge prefix fails the one-level wildcard match. Resolve the validator on the cert domain when no CNAME delegation exists, and on the resolved terminal target when it does, so both the direct and cross-zone delegated cases select the correct provider. * docs: document CNAME delegation (proxy) lookup Add a CNAME Delegation section to docsource/configuration.md describing why challenge names are delegated to an isolated validation zone, how the CnameResolver follows a multi-level CNAME chain to its terminus, how the DNS provider plugin is selected against the resolved target (enabling cross-provider delegation), the loop/depth safety guards, and private-zone resolution via DnsVerificationServer. Update the enrollment flow summary to include the CNAME resolution step. * docs: auto-generate README and documentation [skip ci] * docs: replace bundled DNS provider lists with pluggable model DNS providers are now standalone, pluggable plugins deployed alongside the AnyCA Gateway rather than built into this ACME plugin. Remove the hardcoded "supported DNS providers" lists, per-provider credential/config tables, RFC 2136 setup, and the obsolete IDnsProvider/DnsProviderFactory "adding new providers" guidance. Point instead to the Keyfactor -dnsplugin repositories query as the authoritative source, and document that providers are configured via the Gateway's Domain Validation config and resolved per domain (including CNAME-delegated targets). * docs: auto-generate README and documentation [skip ci] * Remove externalized DNS provider config and unused SDK dependencies DNS providers are now separate plugins, so the ACME plugin no longer needs their SDKs or per-provider config fields. Drop the AWS, Azure, ARSoft (RFC2136), and Nager.PublicSuffix package references (all unused in code) and remove the DnsProvider selector plus every per-provider config entry from the integration manifest. Keep the ACME-level fields, AccountStoragePath (still used for account storage), and DnsVerificationServer (used for propagation checks and CNAME resolution). DnsClient is retained for CNAME delegation and TXT propagation. * docs: auto-generate README and documentation [skip ci] * Set gateway framework compatibility to 26.2 * docs: auto-generate README and documentation [skip ci] * Update AcmeCaPlugin.csproj * docs: auto-generate README and documentation [skip ci] --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR merges the 2.0.0 release line into main, updating the ACME AnyCA Gateway plugin to use pluggable DNS provider “domain validator” plugins (instead of embedded DNS provider implementations) and adding CNAME delegation support for DNS-01 challenge placement.
Changes:
- Externalizes DNS providers into separate Domain Validator plugins and removes embedded provider implementations/config keys from the core plugin.
- Adds CNAME delegation chain resolution and enhanced step-by-step flow logging during enrollments.
- Updates target frameworks/dependencies and refreshes docs/metadata/CI for Gateway framework 26.2+ and net10.0 deployments.
Reviewed changes
Copilot reviewed 26 out of 26 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| TestProgram/TestProgram.csproj | Updates TFMs/dependencies for the test harness (net8/net10) and adds Azure.Identity. |
| TestProgram/Program.cs | Updates the test harness to construct AcmeCaPlugin with an IDomainValidatorFactory and adds initialization error handling + a mock factory. |
| README.md | Re-documents DNS provider support as pluggable plugins, documents CNAME delegation behavior, and updates compatibility/deployment guidance. |
| integration-manifest.json | Updates framework compatibility to 26.2 and removes DNS-provider-specific config fields from the integration metadata. |
| docsource/configuration.md | Aligns configuration documentation to the new pluggable DNS plugin model and documents CNAME delegation. |
| DNS-PLUGINS-COMPLETE.md | Adds a migration/deployment summary doc for the standalone DNS provider plugins. |
| dns-plugin-developer-guide.html | Adds a developer-facing guide describing the Domain Validator plugin architecture and manifests. |
| CHANGELOG.md | Adds v2.0.0 release notes for DNS plugins + CNAME proxy support. |
| AcmeCaPlugin/FlowLogger.cs | Introduces a step-oriented trace logger to produce an operator-friendly enrollment flow summary. |
| AcmeCaPlugin/Clients/DNS/CnameResolver.cs | Adds CNAME-chain resolution to determine the correct TXT record target for delegated DNS-01 challenges. |
| AcmeCaPlugin/Clients/Acme/AcmeClient.cs | Improves logging for failed ACME challenge responses by emitting server error details. |
| AcmeCaPlugin/AcmeClientConfig.cs | Removes embedded DNS provider config surface and adds propagation delay configuration. |
| AcmeCaPlugin/AcmeCaPluginConfig.cs | Removes embedded DNS provider UI fields and adds propagation delay/verification settings in plugin annotations. |
| AcmeCaPlugin/AcmeCaPlugin.csproj | Drops embedded DNS provider SDK dependencies; targets net10.0 only; updates Keyfactor package versions. |
| AcmeCaPlugin/AcmeCaPlugin.cs | Refactors enrollment flow to resolve per-domain validators via IDomainValidatorFactory, adds CNAME delegation logic, and integrates FlowLogger. |
| AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs | Removes embedded DNS provider factory (legacy model). |
| AcmeCaPlugin/Clients/DNS/IDnsProvider.cs | Removes the legacy embedded DNS provider abstraction. |
| AcmeCaPlugin/Clients/DNS/GoogleDnsProvider.cs | Removes embedded Google DNS provider implementation. |
| AcmeCaPlugin/Clients/DNS/CloudflareDnsProvider.cs | Removes embedded Cloudflare DNS provider implementation. |
| AcmeCaPlugin/Clients/DNS/AzureDnsProvider.cs | Removes embedded Azure DNS provider implementation. |
| AcmeCaPlugin/Clients/DNS/AwsRoute53DnsProvider.cs | Removes embedded AWS Route53 provider implementation. |
| AcmeCaPlugin/Clients/DNS/Ns1DnsProvider.cs | Removes embedded NS1 provider implementation. |
| AcmeCaPlugin/Clients/DNS/Rfc2136DnsProvider.cs | Removes embedded RFC2136 provider implementation. |
| AcmeCaPlugin/Clients/DNS/InfobloxDnsProvider.cs | Removes embedded Infoblox provider implementation. |
| AcmeCaPlugin.sln | Adds additional solution build configurations/platform mappings. |
| .github/workflows/keyfactor-bootstrap-workflow.yml | Updates workflow to use keyfactor/actions v5 and adds new inputs/secrets wiring. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| var domainValidator = flow.Step($"ResolveValidator:{domain}", | ||
| () => | ||
| { | ||
| var v = _validatorFactory.ResolveDomainValidator(validatorLookupName, DNS_CHALLENGE_TYPE); |
| @@ -71,13 +71,24 @@ public class AcmeCaPlugin : IAnyCAPlugin | |||
| private const int DNS_PROPAGATION_DELAY_SECONDS = 30; | |||
Comment on lines
72
to
79
| @@ -206,54 +78,6 @@ public static Dictionary<string, PropertyConfigInfo> GetPluginAnnotations() | |||
| Type = "String" | |||
| } | |||
Comment on lines
+18
to
19
| // DNS Verification Settings - DNS server IP for verification (for private zones) | ||
| public string DnsVerificationServer { get; set; } = null; |
Comment on lines
+76
to
+80
| logger.LogError($"❌ Failed to initialize plugin: {ex.Message}"); | ||
| logger.LogInformation("📌 Note: The plugin now requires DNS provider plugins to be deployed separately."); | ||
| logger.LogInformation("📌 See DNS-PLUGINS-COMPLETE.md for deployment instructions."); | ||
| return; | ||
| } |
Comment on lines
+423
to
+425
| // In a real test scenario, you would load the actual plugin assemblies here | ||
| // For now, this returns null which will cause the plugin to fail initialization | ||
| // TODO: Load actual DNS provider plugin assemblies for testing |
Comment on lines
+1
to
+3
| # v2.0.0 | ||
| * Dns Plugin Support | ||
| * Cname Proxy Support |
Comment on lines
40
to
47
| { | ||
| "name": "AccountStoragePath", | ||
| "description": "Path for ACME account storage. Defaults to %APPDATA%\\AcmeAccounts on Windows or ./AcmeAccounts in containers." | ||
| }, | ||
| { | ||
| "name": "Cloudflare_ApiToken", | ||
| "description": "Cloudflare DNS: API Token only if using Cloudflare DNS (Optional)" | ||
| }, | ||
| { | ||
| "name": "Azure_ClientId", | ||
| "description": "Azure DNS: ClientId only if using Azure DNS and Not Managed Itentity in Azure (Optional)" | ||
| }, | ||
| { | ||
| "name": "Azure_ClientSecret", | ||
| "description": "Azure DNS: ClientSecret only if using Azure DNS and Not Managed Itentity in Azure (Optional)" | ||
| }, | ||
| { | ||
| "name": "Azure_SubscriptionId", | ||
| "description": "Azure DNS: SubscriptionId only if using Azure DNS and Not Managed Itentity in Azure (Optional)" | ||
| }, | ||
| { | ||
| "name": "Azure_TenantId", | ||
| "description": "Azure DNS: TenantId only if using Azure DNS and Not Managed Itentity in Azure (Optional)" | ||
| }, | ||
| { | ||
| "name": "AwsRoute53_AccessKey", | ||
| "description": "Aws DNS: Access Key only if not using AWS DNS and default AWS Chain Creds on AWS (Optional)" | ||
| }, | ||
| { | ||
| "name": "AwsRoute53_SecretKey", | ||
| "description": "Aws DNS: Secret Key only if using AWS DNS and not using default AWS Chain Creds on AWS (Optional)" | ||
| }, | ||
| { | ||
| "name": "Ns1_ApiKey", | ||
| "description": "Ns1 DNS: Api Key only if Using Ns1 DNS (Optional)" | ||
| }, | ||
| { | ||
| "name": "Rfc2136_Server", | ||
| "description": "RFC 2136 DNS: Server hostname or IP address (Optional)" | ||
| }, | ||
| { | ||
| "name": "Rfc2136_Port", | ||
| "description": "RFC 2136 DNS: Server port (default 53) (Optional)" | ||
| }, | ||
| { | ||
| "name": "Rfc2136_Zone", | ||
| "description": "RFC 2136 DNS: Zone name (e.g., example.com) (Optional)" | ||
| }, | ||
| { | ||
| "name": "Rfc2136_TsigKeyName", | ||
| "description": "RFC 2136 DNS: TSIG key name for authentication (Optional)" | ||
| }, | ||
| { | ||
| "name": "Rfc2136_TsigKey", | ||
| "description": "RFC 2136 DNS: TSIG key (base64 encoded) for authentication (Optional)" | ||
| }, | ||
| { | ||
| "name": "Rfc2136_TsigAlgorithm", | ||
| "description": "RFC 2136 DNS: TSIG algorithm (default hmac-sha256) (Optional)" | ||
| }, | ||
| { | ||
| "name": "DnsVerificationServer", | ||
| "description": "DNS server to use for verifying TXT record propagation. For private/local DNS zones, set this to your authoritative DNS server IP (e.g., 10.3.10.37). Leave empty to use public DNS servers (Google, Cloudflare, etc.)." | ||
| }, | ||
| { | ||
| "name": "Infoblox_Host", | ||
| "description": "Infoblox DNS: API URL (e.g., https://infoblox.example.com/wapi/v2.12) only if using Infoblox DNS (Optional)" | ||
| }, | ||
| { | ||
| "name": "Infoblox_Username", | ||
| "description": "Infoblox DNS: Username for authentication only if using Infoblox DNS (Optional)" | ||
| }, | ||
| { | ||
| "name": "Infoblox_Password", | ||
| "description": "Infoblox DNS: Password for authentication only if using Infoblox DNS (Optional)" | ||
| "description": "DNS server used to verify TXT record propagation and to resolve CNAME delegation chains. For private/local DNS zones, set this to your authoritative DNS server IP (e.g., 10.3.10.37). Leave empty to use public DNS servers (Google, Cloudflare, etc.)." | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge release-2.0 to main - Automated PR