acmesh-official / acmesh-official/acme.sh

Add AK & SK based Huawei Cloud DNS API

Aperta
#7,221 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Shell
Stelle
47.6k
Fork
5.7k
Merge medio
7g 1h
PR unite (30g)
16

Descrizione

## Summary

[This PR](https://github.com/acmesh-official/acme.sh/pull/7220) adds `dns_hw.sh`, a Huawei Cloud DNS API integration authenticated with [IAM Access Key (AK) and Secret Access Key (SK)](https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html).

The existing `dns_huaweicloud.sh` plugin remains unchanged to avoid disrupting users who already rely on username/password authentication. Its Huawei Cloud documentation link is no longer available, while the new implementation follows the current AK/SK request-signing authentication model.

## API Comparison

Both plugins use the same Huawei Cloud DNS v2 API endpoints for DNS record management:

- `GET /v2/zones`
- `GET /v2/zones/{zone_id}/recordsets`
- `POST /v2/zones/{zone_id}/recordsets`
- `PUT /v2/zones/{zone_id}/recordsets/{recordset_id}`
- `DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}`

The difference is the authentication mechanism:

| Plugin | Credentials | Authentication |
| --- | --- | --- |
| dns_huaweicloud.sh | Username, password, and account domain name | Obtains an IAM `X-Auth-Token` through `/v3/auth/tokens` |
| dns_hw.sh | IAM AK and SK | Signs each DNS request with `SDK-HMAC-SHA256` |

## Why AK/SK Authentication

AK/SK authentication is better suited for automated certificate issuance and renewal:

- It supports least-privilege IAM policies without exposing an account password.
- Credentials can be independently rotated, disabled, or replaced.
- It avoids an interactive login/token acquisition flow.
- It uses Huawei Cloud's standard request-signing mechanism for API access.

Relevant Huawei Cloud documentation:

- [DNS API Reference](https://support.huaweicloud.com/intl/en-us/api-dns/dns_api_60000.html)

## Backward Compatibility

The old plugin is intentionally retained. Existing users may have stored credentials and renewal jobs configured with `HUAWEICLOUD_Username`, `HUAWEICLOUD_Password`, and `HUAWEICLOUD_DomainName`; replacing it would break those deployments.

Although both authentication methods could technically be placed in one plugin, doing so would require maintaining two credential models, authentication flows, configuration precedence rules, and test paths. The plugins also have different defaults and record-cleanup behavior, which would make a combined implementation harder to understand and maintain.

Keeping the integrations separate provides a clean migration path:

- Existing users can continue using dns_huaweicloud.sh without changes.
- New users can use dns_hw.sh with the recommended AK/SK authentication method.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.