feat: support tencentcloud remote store

.env-sample

@@ -6,5 +6,4 @@ OPERATOR_NAME=cert-manager-sync.lestak.sh
 LOG_LEVEL=info
 CACHE_DISABLE=false
 METRICS_PORT=9090
-ENABLE_METRICS=true
-LOG_FORMAT=json
+LOG_FORMAT=json

.github/workflows/docker-image.yml

@@ -0,0 +1,50 @@
+name: Build and Push Docker Images
+
+on:
+  push:
+    branches:
+      - main
+      - test
+    tags: ["v*.*.*"]
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Get current date
+        id: date
+        run: echo "::set-output name=date::$(date +'%Y-%m-%d')"
+
+      - name: Build and push Docker image
+        id: docker_build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            LDFLAGS=-s -X github.com/prometheus/common/version.Version=${{ github.ref_name }} -X github.com/prometheus/common/version.Revision=${{ github.sha }} -X github.com/prometheus/common/version.Branch=${{ github.ref_name }} -X github.com/prometheus/common/version.BuildUser=${{ github.triggering_actor }} -X github.com/prometheus/common/version.BuildDate=${{ steps.date.outputs.date }}
+          tags: |
+            ghcr.io/${{ github.repository }}:${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
+            ghcr.io/${{ github.repository }}:latest

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.22.5 as builder
+FROM golang:1.24 as builder
 
 WORKDIR /app
 
@@ -10,7 +10,7 @@ RUN go mod download && go mod verify
 
 RUN CGO_ENABLED=0 go build -o /app/cert-manager-sync cmd/cert-manager-sync/*.go
 
-FROM alpine:3.21 as alpine
+FROM alpine:3 as alpine
 
 RUN apk add -U --no-cache ca-certificates
 

README.md

@@ -17,6 +17,7 @@ Enable Kubernetes `cert-manager` to sync TLS certificates to AWS ACM, GCP, Hashi
     - [Heroku](#heroku)
     - [Incapsula](#incapsula)
     - [ThreatX](#threatx)
+    - [Tencent Cloud](#tencent-cloud)
   - [Multiple Sync Destinations](#multiple-sync-destinations)
   - [Exponential backoff after a failed sync](#exponential-backoff-after-a-failed-sync)
   - [Forcing an immediate sync](#forcing-an-immediate-sync)
@@ -37,7 +38,7 @@ In containerized environments, we use `cert-manager` to automatically provision,
 
 These certificates are managed entirely through code using git ops, and developers / operators never need to touch / see the actual plain-text certificate as it is automatically provisioned and attached to gateway.
 
-However for applications that sit behind the Incapsula WAF, or have components in both EKS and CloudFront, there was not a seamless and secure process to attach certificates without operators manually passing DNS01 challenge records back and forth or worse, passing TLS certs back and forth. 
+However for applications that sit behind the Incapsula WAF, or have components in both EKS and CloudFront, there was not a seamless and secure process to attach certificates without operators manually passing DNS01 challenge records back and forth or worse, passing TLS certs back and forth.
 
 In addition to the security risk this poses, it also introduces a level of human error and manual tracking of expiry / renewals.
 
@@ -235,6 +236,29 @@ Annotations:
     cert-manager-sync.lestak.sh/threatx-secret-name: "example-threatx-api-secret" # secret in same namespace which contains the threatx api key. If provided in format "namespace/secret-name", will look in that namespace for the secret
 ```
 
+### Tencent Cloud
+
+Create a TencentCloud API Key and create a kube secret in whatever namespace you want.
+
+```bash
+kubectl -n cert-manager \
+	create secret generic tencentcloud-api-secret \
+	--from-literal TENCENTCLOUD_SECRET_ID=XXXXX --from-literal TENCENTCLOUD_SECRET_KEY=XXXXX
+```
+
+You will then annotate your k8s TLS secret with this secret name to tell the operator to retrieve the TencentCloud API secret from this location.
+
+Annotations:
+
+```yaml
+    cert-manager-sync.lestak.sh/tencentcloud-secret-name: "tencentcloud-api-secret" # namespace/name of the secret which contains the api key. If provided in format "namespace/secret-name", will look in that namespace for the secret
+    cert-manager-sync.lestak.sh/tencentcloud-secretIdKeyName: "TENCENTCLOUD_SECRET_ID" # keyname of the secret id in k8s secret
+    cert-manager-sync.lestak.sh/tencentcloud-secretKeyKeyName: "TENCENTCLOUD_SECRET_KEY" # keyname of the secret key in k8s secret
+    cert-manager-sync.lestak.sh/tencentcloud-alias: "xxx" # alias of the uploaded cert
+    cert-manager-sync.lestak.sh/tencentcloud-projectId: "1" # project id of the uploaded cert, must be a uint64
+    cert-manager-sync.lestak.sh/tencentcloud-resources: "cdn,waf,teo" # resource type that will be deployed with the cert
+```
+
 ## Multiple Sync Destinations
 
 You are able to sync to multiple destinations from a single source secret by suffixing your config keys with a common index.
@@ -398,9 +422,8 @@ ENABLED_NAMESPACES= # csv of namespaces to watch. default is empty (all namespac
 SECRETS_NAMESPACE= # DEPRECATED, replaced by ENABLED_NAMESPACES. Namespace to look for secrets in. overrides ENABLED_NAMESPACES if set
 OPERATOR_NAME=cert-manager-sync.lestak.sh # Operator name. use for white-labeling
 LOG_LEVEL=info # Log level. trace, debug, info, warn, error, fatal
-CACHE_DISABLE=false # Disable cache
+CACHE_DISABLED=false # Disable cache
 METRICS_PORT=9090 # Metrics port
-ENABLE_METRICS=true # Enable metrics server
 ```
 
 If deploying with helm, these are exposed as values in the `values.yaml` file.
@@ -444,4 +467,4 @@ The following fields are included in the sync error log message:
 
 ```bash
 level=error action=SyncSecretToStore namespace=cert-manager secret=example store=acm error="error message"
-```
+```

cmd/cert-manager-sync/main.go

@@ -2,27 +2,51 @@ package main
 
 import (
 	"cmp"
+	"flag"
+	"fmt"
 	"os"
+	"path/filepath"
 	"time"
 
-	"github.com/robertlestak/cert-manager-sync/internal/metrics"
-	"github.com/robertlestak/cert-manager-sync/pkg/certmanagersync"
-	"github.com/robertlestak/cert-manager-sync/pkg/state"
+	"github.com/prometheus/common/version"
 	log "github.com/sirupsen/logrus"
+	"github.com/spf13/pflag"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/tools/cache"
+
+	"github.com/robertlestak/cert-manager-sync/internal/metrics"
+	"github.com/robertlestak/cert-manager-sync/pkg/certmanagersync"
+	"github.com/robertlestak/cert-manager-sync/pkg/flags"
+	"github.com/robertlestak/cert-manager-sync/pkg/state"
 )
 
+var metricsPort int
+
 func init() {
-	ll, lerr := log.ParseLevel(cmp.Or(os.Getenv("LOG_LEVEL"), "info"))
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	logLevel := pflag.String("log.level", "info", "log level")
+	logFmt := pflag.String("log.format", "console", "log format")
+	printVersion := pflag.BoolP("version", "v", false, "print version info")
+	pflag.IntVar(&metricsPort, "metrics.port", 9090, "http port for metrics handler, 0 means disable")
+
+	flags.SetFromEnv(pflag.CommandLine)
+	pflag.Parse()
+
+	if *printVersion {
+		fmt.Println(version.Print(filepath.Base(os.Args[0])))
+		os.Exit(0)
+	}
+
+	ll, lerr := log.ParseLevel(*logLevel)
 	if lerr != nil {
 		ll = log.InfoLevel
 	}
 	log.SetLevel(ll)
-	if os.Getenv("LOG_FORMAT") == "json" {
+	if *logFmt == "json" {
 		log.SetFormatter(&log.JSONFormatter{})
 	}
+
 	l := log.WithFields(
 		log.Fields{
 			"action": "init",
@@ -42,8 +66,8 @@ func main() {
 		},
 	)
 	l.Info("starting cert-manager-sync")
-	if os.Getenv("ENABLE_METRICS") != "false" {
-		go metrics.Serve()
+	if metricsPort > 0 {
+		go metrics.Serve(metricsPort, "/metrics")
 	}
 	factory := informers.NewSharedInformerFactory(state.KubeClient, 30*time.Second)
 	secretInformer := factory.Core().V1().Secrets().Informer()

deploy/cert-manager-sync/templates/deployment.yaml

@@ -52,10 +52,8 @@ spec:
             value: "{{ .Values.config.logLevel }}"
           - name: LOG_FORMAT
             value: "{{ .Values.config.logFormat }}"
-          - name: CACHE_DISABLE
+          - name: CACHE_DISABLED
             value: "{{ .Values.config.disableCache }}"
-          - name: ENABLE_METRICS
-            value: "{{ .Values.metrics.enabled }}"
           - name: METRICS_PORT
             value: "{{ .Values.metrics.port }}"
           {{- with .Values.env }}

go.mod

@@ -1,58 +1,65 @@
 module github.com/robertlestak/cert-manager-sync
 
-go 1.22.5
+go 1.23.0
+
+toolchain go1.23.6
 
 require (
-	cloud.google.com/go/certificatemanager v1.6.0
+	cloud.google.com/go/certificatemanager v1.7.4
 	github.com/aws/aws-sdk-go v1.44.13
+	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/cloudflare/cloudflare-go v0.83.0
 	github.com/digitalocean/godo v1.106.0
-	github.com/google/uuid v1.3.0
+	github.com/google/uuid v1.6.0
 	github.com/hashicorp/vault/api v1.5.0
 	github.com/heroku/heroku-go/v5 v5.5.0
-	github.com/prometheus/client_golang v1.11.1
-	github.com/sirupsen/logrus v1.9.0
-	github.com/stretchr/testify v1.8.4
-	golang.org/x/oauth2 v0.8.0
-	google.golang.org/api v0.128.0
-	google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc
-	k8s.io/api v0.24.0
-	k8s.io/apimachinery v0.24.0
-	k8s.io/client-go v0.24.0
+	github.com/prometheus/client_golang v1.19.1
+	github.com/prometheus/common v0.55.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/pflag v1.0.5
+	github.com/stretchr/testify v1.9.0
+	github.com/tencentcloud/tencentcloud-sdk-go-intl-en v3.0.1133+incompatible
+	golang.org/x/oauth2 v0.23.0
+	google.golang.org/api v0.155.0
+	google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80
+	k8s.io/api v0.32.0
+	k8s.io/apimachinery v0.32.0
+	k8s.io/client-go v0.32.0
+	sigs.k8s.io/controller-runtime v0.20.1
 )
 
 require (
-	cloud.google.com/go v0.110.0 // indirect
-	cloud.google.com/go/compute v1.19.3 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/longrunning v0.4.1 // indirect
-	github.com/PuerkitoBio/purell v1.1.1 // indirect
-	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
+	cloud.google.com/go v0.112.0 // indirect
+	cloud.google.com/go/compute/metadata v0.3.0 // indirect
+	cloud.google.com/go/longrunning v0.5.4 // indirect
 	github.com/armon/go-metrics v0.3.9 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff v2.1.1+incompatible // indirect
 	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful v2.16.0+incompatible // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/fatih/color v1.16.0 // indirect
-	github.com/go-logr/logr v1.2.0 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.19.5 // indirect
-	github.com/go-openapi/swag v0.19.14 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/gnostic v0.5.7-v3refs // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/gofuzz v1.1.0 // indirect
-	github.com/google/s2a-go v0.1.4 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.4 // indirect
-	github.com/googleapis/gax-go/v2 v2.10.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
@@ -71,14 +78,12 @@ require (
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hashicorp/vault/sdk v0.4.1 // indirect
 	github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb // indirect
-	github.com/imdario/mergo v0.3.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.7.6 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
 	github.com/mitchellh/copystructure v1.0.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.0.0 // indirect
@@ -90,34 +95,38 @@ require (
 	github.com/oklog/run v1.0.0 // indirect
 	github.com/pborman/uuid v1.2.0 // indirect
 	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.26.0 // indirect
-	github.com/prometheus/procfs v0.6.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
+	go.opentelemetry.io/otel v1.28.0 // indirect
+	go.opentelemetry.io/otel/metric v1.28.0 // indirect
+	go.opentelemetry.io/otel/trace v1.28.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/crypto v0.21.0 // indirect
-	golang.org/x/net v0.23.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.20.0 // indirect
-	golang.org/x/term v0.18.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/grpc v1.56.3 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	golang.org/x/crypto v0.28.0 // indirect
+	golang.org/x/net v0.30.0 // indirect
+	golang.org/x/sync v0.8.0 // indirect
+	golang.org/x/sys v0.26.0 // indirect
+	golang.org/x/term v0.25.0 // indirect
+	golang.org/x/text v0.19.0 // indirect
+	golang.org/x/time v0.7.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7 // indirect
+	google.golang.org/grpc v1.65.0 // indirect
+	google.golang.org/protobuf v1.35.1 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/klog/v2 v2.60.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20220328201542-3ee0da9b0b42 // indirect
-	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
-	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
-	sigs.k8s.io/yaml v1.2.0 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )