Merge 2.0.0 to main - #30
Merged
Merged
Conversation
Brings in upstream fixes from main while preserving the dnsplugins branch architecture (inline DNS providers removed in favor of external plugins resolved via IDomainValidatorFactory). Resolutions: - Kept deletion of inline Cloudflare/Google/Factory providers (moved to plugin projects on this branch). - Dropped provider-specific config fields/annotations re-added by main; those configs now belong to each DNS plugin. - Added main's new Enabled disable-switch: cached AcmeClientConfig in Initialize, early-return in Initialize, and FAILED enrollment when the connector is disabled. - Added main's DnsVerificationServer config (with annotation) for private DNS zones, and wired it into the DnsVerificationHelper constructor call in Enroll. - Kept dnsplugins' AcmeCaPlugin.csproj state (newer IAnyCAPlugin prerelease, Google package removed, other provider packages pending cleanup). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ports the FlowLogger pattern from Keyfactor/barracuda-wafasaas-orchestrator and adapts it for an IAnyCAPlugin. The accumulated step breadcrumb is appended to EnrollmentResult.StatusMessage on both success and failure, so operators see a scannable per-step summary in the Command UI instead of just a single exception message. Changes: - FlowLogger.cs: ported verbatim from barracuda with namespace changed to Keyfactor.Extensions.CAPlugin.Acme. Added StepAsync<T> overload for async methods that return a value. - Enroll: wraps each stage (ValidateInput, FormatCsr, LoadConfig, CreateHttpClient, InitAcmeAccount, CreateAcmeClient, DecodeCsr, ExtractDomainsFromCsr, CreateOrder, ExtractOrderIdentifier, FinalizeOrder, DownloadCertificate, EncodeCertificateToPem) as a timed flow.Step. Success returns include flow.GetSummary(); failure paths include DescribeException(ex) + flow.GetSummary(). - ProcessAuthorizations: takes the flow and records per-domain work in three branches (StageDnsRecords / VerifyAndSubmit / CleanupDnsRecords), so the breadcrumb shows which specific domain failed when a challenge breaks. - DescribeException helper: unwraps AggregateException/TargetInvocation wrappers, surfaces HttpRequestException context, and truncates overlong messages so the summary stays readable. - Initialize: added ValidateConfigForEnrollment — fails fast (at save time, not first enroll) on missing DirectoryUrl/Email, non-absolute or non-http(s) DirectoryUrl, mismatched EAB key pair, or negative DnsPropagationDelaySeconds. Build: net6.0 / net8.0 / net10.0 — 0 errors, pre-existing warnings only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removed specific root/intermediate names (ISRG Root X1, R3) that go stale when Let's Encrypt rotates their chain. Users are now directed to the official Let's Encrypt certificates page to identify the currently active root and intermediate certificates. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolve the ACME challenge record name through any chain of CNAME delegations to its terminal target before staging validation. The resolved name now drives DNS provider plugin selection, record creation, propagation verification, and cleanup, so challenges delegated into a zone on a different provider are routed to the plugin that owns that zone. Non-delegated domains are unaffected.
Add multi-level CNAME delegation support for DNS-01 challenges
* Update CHANGELOG.md * Fix validator resolution regression for non-delegated challenges The framework's ResolveDomainValidator matches configured provider domain patterns (e.g. *.zone.com) against the certificate/zone name, not the _acme-challenge record name. Resolving on the raw resolved record name broke the non-delegated path because the _acme-challenge prefix fails the one-level wildcard match. Resolve the validator on the cert domain when no CNAME delegation exists, and on the resolved terminal target when it does, so both the direct and cross-zone delegated cases select the correct provider. * docs: document CNAME delegation (proxy) lookup Add a CNAME Delegation section to docsource/configuration.md describing why challenge names are delegated to an isolated validation zone, how the CnameResolver follows a multi-level CNAME chain to its terminus, how the DNS provider plugin is selected against the resolved target (enabling cross-provider delegation), the loop/depth safety guards, and private-zone resolution via DnsVerificationServer. Update the enrollment flow summary to include the CNAME resolution step. * docs: auto-generate README and documentation [skip ci] * docs: replace bundled DNS provider lists with pluggable model DNS providers are now standalone, pluggable plugins deployed alongside the AnyCA Gateway rather than built into this ACME plugin. Remove the hardcoded "supported DNS providers" lists, per-provider credential/config tables, RFC 2136 setup, and the obsolete IDnsProvider/DnsProviderFactory "adding new providers" guidance. Point instead to the Keyfactor -dnsplugin repositories query as the authoritative source, and document that providers are configured via the Gateway's Domain Validation config and resolved per domain (including CNAME-delegated targets). * docs: auto-generate README and documentation [skip ci] * Remove externalized DNS provider config and unused SDK dependencies DNS providers are now separate plugins, so the ACME plugin no longer needs their SDKs or per-provider config fields. Drop the AWS, Azure, ARSoft (RFC2136), and Nager.PublicSuffix package references (all unused in code) and remove the DnsProvider selector plus every per-provider config entry from the integration manifest. Keep the ACME-level fields, AccountStoragePath (still used for account storage), and DnsVerificationServer (used for propagation checks and CNAME resolution). DnsClient is retained for CNAME delegation and TXT propagation. * docs: auto-generate README and documentation [skip ci] * Set gateway framework compatibility to 26.2 * docs: auto-generate README and documentation [skip ci] * Update AcmeCaPlugin.csproj * docs: auto-generate README and documentation [skip ci] --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR merges the 2.0.0 release line into main, shifting DNS-01 automation from embedded DNS-provider implementations to a plugin-based model resolved at runtime via IDomainValidatorFactory, and updating documentation/metadata accordingly.
Changes:
- Externalize DNS providers into separate “domain validator” plugins and add CNAME-delegation support for
_acme-challengeresolution. - Add step-oriented enrollment tracing (
FlowLogger) and improve ACME challenge failure logging. - Update target frameworks/dependencies and bump declared Gateway framework compatibility to 26.2+.
Reviewed changes
Copilot reviewed 26 out of 26 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| TestProgram/TestProgram.csproj | Updates TFM to net10.0 and bumps/adds package references for the test harness. |
| TestProgram/Program.cs | Updates test harness to construct AcmeCaPlugin with an IDomainValidatorFactory and improves initialization handling. |
| README.md | Refreshes docs to reflect pluggable DNS provider plugins and CNAME delegation behavior; updates compatibility text. |
| integration-manifest.json | Updates declared gateway_framework compatibility to 26.2 and removes embedded DNS-provider config surface. |
| docsource/configuration.md | Mirrors README changes for pluggable DNS provider plugins and CNAME delegation behavior. |
| DNS-PLUGINS-COMPLETE.md | Adds migration/deployment documentation for external DNS provider plugins. |
| dns-plugin-developer-guide.html | Adds developer-facing documentation for the DNS plugin architecture and contract. |
| CHANGELOG.md | Adds v2.0.0 release notes. |
| AcmeCaPlugin/FlowLogger.cs | Introduces step/timing trace logging to attach a single summarized flow to enrollment outcomes. |
| AcmeCaPlugin/Clients/DNS/CnameResolver.cs | Adds resolver to follow CNAME chains and determine the terminal TXT record target for DNS-01. |
| AcmeCaPlugin/Clients/Acme/AcmeClient.cs | Logs ACME server error details when a challenge becomes invalid. |
| AcmeCaPlugin/AcmeClientConfig.cs | Removes embedded DNS-provider configuration and adds DNS propagation delay configuration. |
| AcmeCaPlugin/AcmeCaPluginConfig.cs | Updates plugin annotations to remove embedded DNS-provider config and add propagation delay config. |
| AcmeCaPlugin/AcmeCaPlugin.csproj | Drops embedded DNS-provider SDK dependencies and targets net10.0 only. |
| AcmeCaPlugin/AcmeCaPlugin.cs | Refactors enrollment to resolve per-domain validators via IDomainValidatorFactory, adds CNAME delegation and FlowLogger instrumentation. |
| AcmeCaPlugin.sln | Adds additional solution configuration platforms (x64/x86) for Debug/Prerelease/Release. |
| .github/workflows/keyfactor-bootstrap-workflow.yml | Updates CI workflow to keyfactor/actions v5 and adjusts inputs/secrets. |
| AcmeCaPlugin/Clients/DNS/* (deleted) | Removes embedded DNS provider implementations and factory (Google/Azure/AWS/Cloudflare/NS1/RFC2136/Infoblox). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+162
to
+166
| /// <summary> | ||
| /// Simple implementation of IDomainValidatorConfigProvider to pass configuration to plugins | ||
| /// </summary> | ||
| private class DomainValidatorConfigProvider : IDomainValidatorConfigProvider | ||
| { |
Comment on lines
+755
to
757
| var validatorTypeName = validator.GetType().Name.ToLowerInvariant(); | ||
| bool isPrivateDnsProvider = validatorTypeName.Contains("rfc2136") || validatorTypeName.Contains("infoblox"); | ||
|
|
Comment on lines
+766
to
+767
| var authServers = await flow.StepAsync($"GetAuthoritativeDns:{domain}", | ||
| async () => await dnsVerifier.GetAuthoritativeDnsServersAsync(recordName)); |
Comment on lines
+74
to
+80
| catch (Exception ex) | ||
| { | ||
| logger.LogError($"❌ Failed to initialize plugin: {ex.Message}"); | ||
| logger.LogInformation("📌 Note: The plugin now requires DNS provider plugins to be deployed separately."); | ||
| logger.LogInformation("📌 See DNS-PLUGINS-COMPLETE.md for deployment instructions."); | ||
| return; | ||
| } |
Comment on lines
+416
to
+426
| // === Mock domain validator factory for testing === | ||
| // NOTE: In production, the framework provides the factory that loads plugins from disk. | ||
| // This is a simple mock that returns null, requiring DNS provider plugins to be loaded separately. | ||
| private class MockDomainValidatorFactory : IDomainValidatorFactory | ||
| { | ||
| public IDomainValidator ResolveDomainValidator(string domain, string validationType) | ||
| { | ||
| // In a real test scenario, you would load the actual plugin assemblies here | ||
| // For now, this returns null which will cause the plugin to fail initialization | ||
| // TODO: Load actual DNS provider plugin assemblies for testing | ||
| Console.WriteLine($"⚠️ MockDomainValidatorFactory: Cannot resolve validator for domain '{domain}', type '{validationType}'"); |
Comment on lines
+1
to
+4
| # v2.0.0 | ||
| * Dns Plugin Support | ||
| * Cname Proxy Support | ||
|
|
Comment on lines
630
to
636
| /// <summary> | ||
| /// Processes ACME authorizations for domain validation | ||
| /// Currently hardcoded to use DNS-01 challenge with Google DNS provider | ||
| /// </summary> | ||
| /// <summary> | ||
| /// Processes ACME authorizations with DNS verification before challenge submission | ||
| /// </summary> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge release-2.0 to main - Automated PR