diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml new file mode 100644 index 0000000..eb2a365 --- /dev/null +++ b/.github/workflows/build-and-test.yml @@ -0,0 +1,35 @@ +run-name: Build and Test Solution - ${{ github.sha }} +name: Build and Test Solution + +on: + pull_request: + types: [opened, synchronize, reopened] + +jobs: + build-and-test-solution: + runs-on: ubuntu-latest + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Setup .NET 6 + uses: actions/setup-dotnet@v4 + with: + dotnet-version: '6.0.x' + + - name: Setup .NET 8 + uses: actions/setup-dotnet@v4 + with: + dotnet-version: '8.0.x' + + - name: Add Keyfactor NuGet Source + run: dotnet nuget add source https://nuget.pkg.github.com/Keyfactor/index.json -n github -u ${{ github.actor }} -p ${{ secrets.V2BUILDTOKEN }} --store-password-in-clear-text + + - name: Restore Dependencies + run: dotnet restore + + - name: Build solution + run: dotnet build --no-restore --configuration Release + + - name: Run Unit Tests + run: dotnet test --configuration Release --no-build --logger "console;verbosity=detailed" \ No newline at end of file diff --git a/.github/workflows/keyfactor-starter-workflow.yml b/.github/workflows/keyfactor-starter-workflow.yml new file mode 100644 index 0000000..a02fe1e --- /dev/null +++ b/.github/workflows/keyfactor-starter-workflow.yml @@ -0,0 +1,27 @@ +name: Keyfactor Bootstrap Workflow + +on: + workflow_dispatch: + pull_request: + types: [opened, closed, synchronize, edited, reopened] + push: + create: + branches: + - 'release-*.*' + +jobs: + call-starter-workflow: + uses: keyfactor/actions/.github/workflows/starter.yml@v4 + with: + command_token_url: ${{ vars.DOCTOOL_COMMAND_TOKEN_URL }} + command_hostname: ${{ vars.DOCTOOL_COMMAND_HOSTNAME }} + command_base_api_path: ${{ vars.DOCTOOL_COMMAND_BASE_API_PATH }} + secrets: + token: ${{ secrets.V2BUILDTOKEN}} + gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} + gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} + scan_token: ${{ secrets.SAST_TOKEN }} + entra_username: ${{ secrets.DOCTOOL_ENTRA_USERNAME }} + entra_password: ${{ secrets.DOCTOOL_ENTRA_PASSWD }} + command_client_id: ${{ secrets.DOCTOOL_COMMAND_CLIENT_ID }} + command_client_secret: ${{ secrets.DOCTOOL_COMMAND_CLIENT_SECRET }} \ No newline at end of file diff --git a/.gitignore b/.gitignore index 4ce6fdd..feb8043 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,9 @@ # User-specific files (MonoDevelop/Xamarin Studio) *.userprefs +# Mono auto generated files +mono_crash.* + # Build results [Dd]ebug/ [Dd]ebugPublic/ @@ -26,6 +29,7 @@ bld/ [Bb]in/ [Oo]bj/ [Ll]og/ +[Ll]ogs/ # Visual Studio 2015/2017 cache/options directory .vs/ @@ -39,9 +43,10 @@ Generated\ Files/ [Tt]est[Rr]esult*/ [Bb]uild[Ll]og.* -# NUNIT +# NUnit *.VisualState.xml TestResult.xml +nunit-*.xml # Build Results of an ATL Project [Dd]ebugPS/ @@ -122,9 +127,6 @@ _ReSharper*/ *.[Rr]e[Ss]harper *.DotSettings.user -# JustCode is a .NET coding add-in -.JustCode - # TeamCity is a build add-in _TeamCity* @@ -182,6 +184,8 @@ PublishScripts/ # NuGet Packages *.nupkg +# NuGet Symbol Packages +*.snupkg # The packages folder can be ignored because of Package Restore **/[Pp]ackages/* # except build/, which is used as an MSBuild target. @@ -206,6 +210,8 @@ BundleArtifacts/ Package.StoreAssociation.xml _pkginfo.txt *.appx +*.appxbundle +*.appxupload # Visual Studio cache files # files ending in .cache can be ignored @@ -255,7 +261,9 @@ ServiceFabricBackup/ *.bim.layout *.bim_*.settings *.rptproj.rsuser -*- Backup*.rdl +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl # Microsoft Fakes FakesAssemblies/ @@ -291,10 +299,6 @@ paket-files/ # FAKE - F# Make .fake/ -# JetBrains Rider -.idea/ -*.sln.iml - # CodeRush personal settings .cr/personal @@ -337,4 +341,15 @@ ASALocalRun/ .localhistory/ # BeatPulse healthcheck temp database -healthchecksdb \ No newline at end of file +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Ignore .env files +**/.env +**/.env.* +!**/.env.*.example \ No newline at end of file diff --git a/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj b/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj new file mode 100644 index 0000000..e07520f --- /dev/null +++ b/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj @@ -0,0 +1,35 @@ + + + + net6.0 + enable + enable + + false + + + + + + + + runtime; build; native; contentfiles; analyzers; buildtransitive + all + + + runtime; build; native; contentfiles; analyzers; buildtransitive + all + + + + + + + + + + Always + + + + diff --git a/Cloudflare.UnitTests/InventoryTests.cs b/Cloudflare.UnitTests/InventoryTests.cs new file mode 100644 index 0000000..5f62328 --- /dev/null +++ b/Cloudflare.UnitTests/InventoryTests.cs @@ -0,0 +1,464 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Security.Cryptography.X509Certificates; +using Cloudflare.Exceptions; +using Cloudflare.Models.Cloudflare; +using Cloudflare.Service; +using Keyfactor.Extensions.Orchestrator.Cloudflare.Client; +using Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs; +using Keyfactor.Orchestrators.Common.Enums; +using Keyfactor.Orchestrators.Extensions; +using Keyfactor.Orchestrators.Extensions.Interfaces; +using MartinCostello.Logging.XUnit; +using Microsoft.Extensions.Logging; +using Moq; +using Xunit; +using Xunit.Abstractions; +using Exception = System.Exception; + +namespace Cloudflare.UnitTests; + +public class InventoryTests +{ + private readonly Mock _mockCertificateRetrievalService = new (); + private readonly Mock _mockCloudflareClient = new (); + private readonly Mock _mockSubmitInventoryUpdate = new (); + private readonly Mock _mockPamSecretResolver = new (); + + private readonly Inventory _sut; + private readonly string _testCertificatePem; + + public InventoryTests(ITestOutputHelper output) + { + var loggerFactory = LoggerFactory.Create(builder => + builder.AddProvider(new XUnitLoggerProvider(output, new XUnitLoggerOptions())) + .SetMinimumLevel(LogLevel.Trace)); + var logger = loggerFactory.CreateLogger(); + + _sut = new Inventory(logger, _mockCloudflareClient.Object, _mockCertificateRetrievalService.Object, _mockPamSecretResolver.Object); + + // Load test certificate once for all tests + _testCertificatePem = LoadCertificate("example_certificate.crt"); + } + + [Fact] + public void ProcessJob_SuccessfulRun_ReturnsJobSuccess() + { + // Arrange + var config = CreateTestConfiguration(); + SetupSuccessfulCertificatePackResponse("test.example.com"); + SetupSuccessfulCertificateRetrieval(); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeSuccess("Successfully inventoried certificates from Cloudflare Edge."); + AssertInventoryContains("test.example.com", _testCertificatePem); + } + + [Fact] + public void ProcessJob_NoCertificatePacks_ReturnsJobSuccess() + { + // Arrange + var config = CreateTestConfiguration(); + SetupEmptyCertificatePackResponse(); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeSuccess("Successfully inventoried certificates from Cloudflare Edge."); + AssertInventoryCount(0); + } + + [Fact] + public void ProcessJob_MultiPagedResponses_ReturnsAllCertificates() + { + // Arrange + var config = CreateTestConfiguration(); + SetupPagedCertificatePackResponses( + new[] { "test.example.com" }, + new[] { "foo.example.com" } + ); + SetupSuccessfulCertificateRetrieval(); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeSuccess("Successfully inventoried certificates from Cloudflare Edge."); + AssertInventoryCount(2); + AssertInventoryContains("test.example.com", _testCertificatePem); + AssertInventoryContains("foo.example.com", _testCertificatePem); + } + + [Theory] + [InlineData("*.example.com")] + [InlineData("sni.cloudflaressl.com")] + public void ProcessJob_HostsIncludesExcludedDomain_DoesNotInventoryExcludedDomain(string excludedDomain) + { + // Arrange + var config = CreateTestConfiguration(); + SetupSuccessfulCertificatePackResponse("test.example.com", excludedDomain); + SetupSuccessfulCertificateRetrieval(); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeSuccess("Successfully inventoried certificates from Cloudflare Edge."); + AssertInventoryCount(1); + AssertInventoryContains("test.example.com", _testCertificatePem); + AssertInventoryDoesNotContain(excludedDomain); + } + + [Fact] + public void ProcessJob_OnlyWildcardAndSniDomains_ReturnsEmptyInventory() + { + // Arrange + var config = CreateTestConfiguration(); + + var certificatePack = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo { Count = 1, TotalCount = 1, PerPage = 1, TotalPages = 1 }, + Result = new List + { + new() { Hosts = new List { "*.example.com", "sni.cloudflaressl.com" } } + }, + }; + + _mockCloudflareClient + .Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(certificatePack); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + Assert.Equal(OrchestratorJobStatusJobResult.Success, result.Result); + AssertInventoryCount(0); + } + + [Fact] + public void ProcessJob_DuplicateHostsAcrossPages_InventoriesOnlyOnce() + { + // Arrange + var config = CreateTestConfiguration(); + + var page1 = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo { Count = 1, TotalCount = 2, PerPage = 1, TotalPages = 2 }, + Result = new List + { + new() { Hosts = new List { "test.example.com", "foo.example.com" } } + }, + }; + + var page2 = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo { Count = 1, TotalCount = 2, PerPage = 1, TotalPages = 2 }, + Result = new List + { + new() { Hosts = new List { "test.example.com", "bar.example.com" } } + }, + }; + + _mockCloudflareClient + .SetupSequence(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(page1) + .ReturnsAsync(page2); + + SetupSuccessfulCertificateRetrieval(); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + Assert.Equal(OrchestratorJobStatusJobResult.Success, result.Result); + AssertInventoryCount(3); // test.example.com (once), foo.example.com, bar.example.com + + // Verify GetHostCertificate was only called 3 times (not 4) + _mockCertificateRetrievalService.Verify( + x => x.GetHostCertificate(It.IsAny(), It.IsAny()), + Times.Exactly(3)); + } + + [Fact] + public void ProcessJob_CloudflareRequestExceptionThrown_ReturnsJobFailure() + { + // Arrange + var config = CreateTestConfiguration(); + var exception = new CloudflareRequestException("Whoops!"); + + _mockCloudflareClient + .Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ThrowsAsync(exception); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeFailure(exception.Message); + AssertInventoryNotSubmitted(); + } + + [Fact] + public void ProcessJob_CertificateRetrievalExceptionThrown_ReturnsJobFailure() + { + // Arrange + var config = CreateTestConfiguration(); + var exception = new CertificateRetrievalException("Whoops!"); + + SetupSuccessfulCertificatePackResponse("test.example.com"); + _mockCertificateRetrievalService + .Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ThrowsAsync(exception); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeFailure(exception.Message); + AssertInventoryNotSubmitted(); + } + + [Fact] + public void ProcessJob_UnexpectedExceptionThrown_ReturnsJobFailure() + { + // Arrange + var config = CreateTestConfiguration(); + var exception = new Exception("Did not expected that to happen!"); + + SetupSuccessfulCertificatePackResponse("test.example.com"); + _mockCertificateRetrievalService + .Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ThrowsAsync(exception); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeFailure($"An unexpected error occurred while inventorying certificates from Cloudflare Edge: {exception.Message}"); + AssertInventoryNotSubmitted(); + } + + #region Mock Setup Helpers + + private void SetupSuccessfulCertificatePackResponse(params string[] hosts) + { + var response = CertificatePackResponseBuilder.Create() + .WithHosts(hosts) + .Build(); + + _mockCloudflareClient + .Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(response); + } + + private void SetupEmptyCertificatePackResponse() + { + var response = CertificatePackResponseBuilder.CreateEmpty().Build(); + + _mockCloudflareClient + .Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(response); + } + + private void SetupPagedCertificatePackResponses(params string[][] hostsPerPage) + { + var sequence = _mockCloudflareClient + .SetupSequence(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())); + + foreach (var hosts in hostsPerPage) + { + var response = CertificatePackResponseBuilder.Create() + .WithPageInfo(totalPages: hostsPerPage.Length) + .WithHosts(hosts) + .Build(); + + sequence.ReturnsAsync(response); + } + } + + private void SetupSuccessfulCertificateRetrieval() + { + _mockCertificateRetrievalService + .Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ReturnsAsync(TestDataHelper.CreateX509Certificate(_testCertificatePem)); + } + + #endregion + + #region Assertions + + private void AssertInventoryNotSubmitted() + { + _mockSubmitInventoryUpdate.Verify( + x => x.Invoke(It.IsAny>()), + Times.Never); + } + + private void AssertInventoryCount(int expectedCount) + { + var inventory = GetSubmittedInventory(); + Assert.Equal(expectedCount, inventory.Count); + } + + private void AssertInventoryContains(string expectedAlias, string expectedCertificate) + { + var inventory = GetSubmittedInventory(); + + var certificate = inventory.SingleOrDefault(p => p.Alias == expectedAlias); + Assert.NotNull(certificate); + + Assert.Contains(expectedCertificate, certificate!.Certificates); + } + + private void AssertInventoryDoesNotContain(string alias) + { + var inventory = GetSubmittedInventory(); + Assert.DoesNotContain(inventory, p => p.Alias == alias); + } + + private List GetSubmittedInventory() + { + _mockSubmitInventoryUpdate.Verify( + x => x.Invoke(It.IsAny>()), + Times.Once); + + var invocation = _mockSubmitInventoryUpdate.Invocations.Single(); + return (List)invocation.Arguments[0]; + } + + #endregion + + #region Test Data Helpers + + private static string LoadCertificate(string filename) + { + var path = Path.Combine( + Directory.GetCurrentDirectory(), + "fixtures", + "example_responses", + filename); + + return File.ReadAllText(path); + } + + private static InventoryJobConfiguration CreateTestConfiguration() => + new() + { + CertificateStoreDetails = new CertificateStore + { + ClientMachine = "client-machine", + StorePath = "store-path" + }, + ServerPassword = "server-password" + }; + + #endregion +} + +#region Test Builders + +internal class CertificatePackResponseBuilder +{ + private int _count = 1; + private int _totalCount = 1; + private int _perPage = 1; + private int _totalPages = 1; + private List _hosts = new(); + + public static CertificatePackResponseBuilder Create() => new(); + + public static CertificatePackResponseBuilder CreateEmpty() + { + return new CertificatePackResponseBuilder + { + _count = 0, + _totalCount = 0, + _hosts = new List() + }; + } + + public CertificatePackResponseBuilder WithPageInfo(int count = 1, int totalCount = 1, int perPage = 1, int totalPages = 1) + { + _count = count; + _totalCount = totalCount; + _perPage = perPage; + _totalPages = totalPages; + return this; + } + + public CertificatePackResponseBuilder WithHosts(params string[] hosts) + { + _hosts = hosts.ToList(); + return this; + } + + public GetCertificatePacksResponse Build() + { + return new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo + { + Count = _count, + TotalCount = _totalCount, + PerPage = _perPage, + TotalPages = _totalPages, + }, + Result = _hosts.Any() + ? new List + { + new() { Hosts = _hosts } + } + : null + }; + } +} + +internal static class TestDataHelper +{ + public static X509Certificate2 CreateX509Certificate(string pem) + { + var base64 = pem + .Replace("-----BEGIN CERTIFICATE-----", "") + .Replace("-----END CERTIFICATE-----", "") + .Replace("\r", "") + .Replace("\n", ""); + + return new X509Certificate2(Convert.FromBase64String(base64)); + } +} + +internal static class JobResultAssertions +{ + public static void ShouldBeSuccess(this JobResult result, string expectedMessage) + { + Assert.NotNull(result); + Assert.Equal(OrchestratorJobStatusJobResult.Success, result.Result); + Assert.Equal(expectedMessage, result.FailureMessage); + } + + public static void ShouldBeFailure(this JobResult result, string expectedMessage) + { + Assert.NotNull(result); + Assert.Equal(OrchestratorJobStatusJobResult.Failure, result.Result); + Assert.Equal(expectedMessage, result.FailureMessage); + } +} + +#endregion \ No newline at end of file diff --git a/Cloudflare.UnitTests/fixtures/example_responses/example_certificate.crt b/Cloudflare.UnitTests/fixtures/example_responses/example_certificate.crt new file mode 100644 index 0000000..2bdf358 --- /dev/null +++ b/Cloudflare.UnitTests/fixtures/example_responses/example_certificate.crt @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIIDxjCCA22gAwIBAgIRAJgi/SMR6kXLEeLpfDQknT0wCgYIKoZIzj0EAwIwOzEL +MAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEMMAoG +A1UEAxMDV0UxMB4XDTI1MTAzMDIxNTgyM1oXDTI2MDEyODIyNTgyMFowITEfMB0G +A1UEAxMWa2V5ZmFjdG9yLnNzbDRzYWFzLmNvbTBZMBMGByqGSM49AgEGCCqGSM49 +AwEHA0IABNLOaE112+Bzpbs7CJizgWKJ03UGF8Rf61osd0L9vQOzqCuUi1V22aGh +Vhjasw6PdaVaTt245zuZ6ZuGI0QJ0JKjggJqMIICZjAOBgNVHQ8BAf8EBAMCB4Aw +EwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUB9yN +3Mot1zBLn0pzyLtfg5gFZHEwHwYDVR0jBBgwFoAUkHeSNWfE/6jMqeZ72YB5e8yT ++TgwXgYIKwYBBQUHAQEEUjBQMCcGCCsGAQUFBzABhhtodHRwOi8vby5wa2kuZ29v +Zy9zL3dlMS9tQ0kwJQYIKwYBBQUHMAKGGWh0dHA6Ly9pLnBraS5nb29nL3dlMS5j +cnQwOwYDVR0RBDQwMoIWa2V5ZmFjdG9yLnNzbDRzYWFzLmNvbYIYKi5rZXlmYWN0 +b3Iuc3NsNHNhYXMuY29tMBMGA1UdIAQMMAowCAYGZ4EMAQIBMDYGA1UdHwQvMC0w +K6ApoCeGJWh0dHA6Ly9jLnBraS5nb29nL3dlMS8tWWo3T1lMNURuZy5jcmwwggEF +BgorBgEEAdZ5AgQCBIH2BIHzAPEAdgDRbqmlaAd+ZjWgPzel3bwDpTxBEhTUiBj1 +6TGzI8uVBAAAAZo3V/z7AAAEAwBHMEUCIBav1CofH/KQ5JtJFFMBHvqtxVoPtU/j +dPS0G6K6d+2+AiEA5dxXGJHnBt1OholEN+oAo3QpNOP6vhLXtwQyrLZXszEAdwAO +V5S8866pPjMbLJkHs/eQ35vCPXEyJd0hqSWsYcVOIQAAAZo3V/wYAAAEAwBIMEYC +IQDphq7DYbb2jU+IPg0ew0I3GBPYlfJ8JkBktyVSIX/R6wIhANXUsBauQYbEmJxZ +3pKF3Z9lYzP2UZyYQevD+LJJwanKMAoGCCqGSM49BAMCA0cAMEQCIFKLouxEBTEF +XBJDjB+YewHuGd12c3Kd5lxAm6XUk9ZyAiB4TlVYwbwx/ZuQYcU/P3Y0TmQDuXVq +ESKvqYI8cdAbxQ== +-----END CERTIFICATE----- \ No newline at end of file diff --git a/Cloudflare.sln b/Cloudflare.sln index e98e272..5afec11 100644 --- a/Cloudflare.sln +++ b/Cloudflare.sln @@ -27,6 +27,10 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{630203 Images\Image9.png = Images\Image9.png EndProjectSection EndProject +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{F135EC22-CF6C-4D43-95BC-2E58755E7DE4}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cloudflare.UnitTests", "Cloudflare.UnitTests\Cloudflare.UnitTests.csproj", "{10FA1B6D-A9BE-443D-B166-F4363386A3E1}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|Any CPU = Debug|Any CPU @@ -37,12 +41,17 @@ Global {33FBC5A1-3466-4F10-B9A6-7186F804A65A}.Debug|Any CPU.Build.0 = Debug|Any CPU {33FBC5A1-3466-4F10-B9A6-7186F804A65A}.Release|Any CPU.ActiveCfg = Release|Any CPU {33FBC5A1-3466-4F10-B9A6-7186F804A65A}.Release|Any CPU.Build.0 = Release|Any CPU + {10FA1B6D-A9BE-443D-B166-F4363386A3E1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {10FA1B6D-A9BE-443D-B166-F4363386A3E1}.Debug|Any CPU.Build.0 = Debug|Any CPU + {10FA1B6D-A9BE-443D-B166-F4363386A3E1}.Release|Any CPU.ActiveCfg = Release|Any CPU + {10FA1B6D-A9BE-443D-B166-F4363386A3E1}.Release|Any CPU.Build.0 = Release|Any CPU EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(NestedProjects) = preSolution {6302034E-DF8C-4B65-AC36-CED24C068999} = {1A6C93E7-24FD-47FD-883D-EDABF5CEE4C6} + {10FA1B6D-A9BE-443D-B166-F4363386A3E1} = {F135EC22-CF6C-4D43-95BC-2E58755E7DE4} EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {E0FA12DA-6B82-4E64-928A-BB9965E636C1} diff --git a/Cloudflare.sln.DotSettings b/Cloudflare.sln.DotSettings deleted file mode 100644 index 0b77682..0000000 --- a/Cloudflare.sln.DotSettings +++ /dev/null @@ -1,2 +0,0 @@ - - True \ No newline at end of file diff --git a/Cloudflare/Client/CloudflareClient.cs b/Cloudflare/Client/CloudflareClient.cs index ef5674b..3f84810 100644 --- a/Cloudflare/Client/CloudflareClient.cs +++ b/Cloudflare/Client/CloudflareClient.cs @@ -1,10 +1,86 @@ -using System; -using System.Collections.Generic; -using System.Text; +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Net.Http.Headers; +using Cloudflare.Exceptions; +using Cloudflare.Models.Cloudflare; +using Keyfactor.Logging; +using Microsoft.Extensions.Logging; +using Newtonsoft.Json; namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Client { - public class CloudflareClient + public class CloudflareClient : ICloudflareClient { + private readonly ILogger _logger; + private readonly HttpClient _httpClient; + + public CloudflareClient(ILogger logger, string apiKey) + { + _logger = logger; + + _logger.MethodEntry(); + + _httpClient = new HttpClient(); + _httpClient.BaseAddress = new Uri("https://api.cloudflare.com"); + _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", apiKey); + + _logger.LogTrace($"Authorization header: Bearer {apiKey}"); + + _logger.LogDebug($"Cloudflare HTTP client initialized with base address {_httpClient.BaseAddress.AbsoluteUri}"); + + _logger.MethodExit(); + } + + public async Task GetCertificatePacks(string zoneId, int page) + { + _logger.MethodEntry(); + + string endpoint = $"client/v4/zones/{zoneId}/ssl/certificate_packs?page={page}"; + + _logger.LogDebug($"Getting certificate packs for zone {zoneId} from endpoint {endpoint}. Page: {page}"); + + string content = null; + + try + { + var request = new HttpRequestMessage(HttpMethod.Get, endpoint); + var response = await _httpClient.SendAsync(request); + + content = await response.Content.ReadAsStringAsync(); + + if (!response.IsSuccessStatusCode) + { + throw new CloudflareRequestException($"Failed to get certificate packs. Endpoint {endpoint} returned status code {response.StatusCode}. Error content: {content}"); + } + + _logger.LogTrace($"Endpoint {endpoint} returned status code {response.StatusCode}"); + } + catch (Exception ex) when (ex is not CloudflareRequestException) + { + throw new CloudflareRequestException(ex); + } + + _logger.LogTrace($"Response content returned: {content}"); + + var result = JsonConvert.DeserializeObject(content); + + _logger.LogDebug($"Successfully returned certificate packs for zone {zoneId}"); + + _logger.MethodExit(); + + return result; + } } } diff --git a/Cloudflare/Client/ICloudflareClient.cs b/Cloudflare/Client/ICloudflareClient.cs new file mode 100644 index 0000000..2f6fb80 --- /dev/null +++ b/Cloudflare/Client/ICloudflareClient.cs @@ -0,0 +1,22 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using Cloudflare.Models.Cloudflare; + +namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Client; + +public interface ICloudflareClient +{ + Task GetCertificatePacks(string zoneId, int page); +} diff --git a/Cloudflare/Cloudflare.csproj b/Cloudflare/Cloudflare.csproj index 812cbce..60aa3f7 100644 --- a/Cloudflare/Cloudflare.csproj +++ b/Cloudflare/Cloudflare.csproj @@ -1,9 +1,10 @@ - netcoreapp3.1 - Keyfactor.Extensions.Orchestrator.Cloudflare + true + net6.0;net8.0 true + enable @@ -12,9 +13,10 @@ - - - + + + + @@ -23,9 +25,4 @@ - - - - - diff --git a/Cloudflare/Exceptions/CertificateRetrievalException.cs b/Cloudflare/Exceptions/CertificateRetrievalException.cs new file mode 100644 index 0000000..d9d6da0 --- /dev/null +++ b/Cloudflare/Exceptions/CertificateRetrievalException.cs @@ -0,0 +1,27 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +namespace Cloudflare.Exceptions; + +public class CertificateRetrievalException : Exception +{ + public CertificateRetrievalException(string hostname) : base("Failed to retrieve the server certificate for host: " + hostname) + { + } + + public CertificateRetrievalException(string host, Exception innerException): base($"An error occurred while retrieving the server certificate for host {host}", innerException) + { + + } +} diff --git a/Cloudflare/Exceptions/CloudflareRequestException.cs b/Cloudflare/Exceptions/CloudflareRequestException.cs new file mode 100644 index 0000000..3a3467e --- /dev/null +++ b/Cloudflare/Exceptions/CloudflareRequestException.cs @@ -0,0 +1,27 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +namespace Cloudflare.Exceptions; + +public class CloudflareRequestException : Exception +{ + public CloudflareRequestException(string message) : base($"An error occurred sending request to Cloudflare: {message}") + { + } + + public CloudflareRequestException(Exception ex) : base("An error occurred sending request to Cloudflare", ex) + { + + } +} diff --git a/Cloudflare/Jobs/Inventory.cs b/Cloudflare/Jobs/Inventory.cs index 4e96f0e..393d6f0 100644 --- a/Cloudflare/Jobs/Inventory.cs +++ b/Cloudflare/Jobs/Inventory.cs @@ -1,33 +1,214 @@ -using System; -using System.Collections.Generic; -using System.Management.Automation; -using System.Management.Automation.Runspaces; -using System.Net; -using System.Security; +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Security.Cryptography; +using Cloudflare.Exceptions; +using Cloudflare.Service; +using Keyfactor.Extensions.Orchestrator.Cloudflare.Client; using Keyfactor.Logging; using Keyfactor.Orchestrators.Common.Enums; using Keyfactor.Orchestrators.Extensions; +using Keyfactor.Orchestrators.Extensions.Interfaces; using Microsoft.Extensions.Logging; -using Newtonsoft.Json; -namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Jobs +namespace Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs; + +public class Inventory : IInventoryJobExtension { - public class Inventory : IInventoryJobExtension + private readonly ILogger _logger; + private readonly ICertificateRetrievalService _certificateService; + private readonly IPAMSecretResolver _pamSecretResolver; + + private ICloudflareClient _cloudflareClient; + + private const string CloudflareHost = "www.cloudflare.com"; + + // Default constructor used by Universal Orchestrator + public Inventory(IPAMSecretResolver resolver) + { + _logger = LogHandler.GetClassLogger(); + _certificateService = new CertificateRetrievalService(_logger); + _pamSecretResolver = resolver; + } + + // Constructor for dependency injection (used by unit tests) + public Inventory(ILogger logger, ICloudflareClient cloudflareClient, ICertificateRetrievalService certificateRetrievalService, IPAMSecretResolver resolver) { - private readonly ILogger _logger; + _logger = logger; + _cloudflareClient = cloudflareClient; + _certificateService = certificateRetrievalService; + _pamSecretResolver = resolver; + } + + public string ExtensionName => "Keyfactor.Extensions.Orchestrator.CloudflareEdge.Inventory"; - public Inventory(ILogger logger) => - _logger = logger; + public JobResult ProcessJob(InventoryJobConfiguration jobConfiguration, SubmitInventoryUpdate submitInventoryUpdate) + { + ConfigureClient(jobConfiguration); + + return InventoryCertificateAsync(jobConfiguration, submitInventoryUpdate) + .GetAwaiter() + .GetResult(); + } - private JobResult PerformInventory(InventoryJobConfiguration config, SubmitInventoryUpdate submitInventory) + private async Task InventoryCertificateAsync(InventoryJobConfiguration jobConfiguration, + SubmitInventoryUpdate submitInventoryUpdate) + { + try { - return new JobResult(); + var zoneId = jobConfiguration.CertificateStoreDetails.StorePath; + + _logger.LogInformation($"Inventorying certificates for zone id {zoneId}"); + + int page = 1; + HashSet domains = new(); + List inventory = new(); + + while (true) + { + var result = await _cloudflareClient.GetCertificatePacks(zoneId, page); + + // Break out of loop if no results found + if (result.ResultInfo.Count == 0) + { + _logger.LogDebug($"No more certificate packs found after page {page - 1}"); + break; + } + + _logger.LogDebug($"Found {result.Result.Count} certificate packs on page {page}"); + + foreach (var certificatePack in result.Result) + { + foreach (var host in certificatePack.Hosts) + { + domains.Add(host); + } + } + + // Break out of loop if we've processed all pages + if (result.ResultInfo.TotalPages <= page) + { + _logger.LogDebug("All pages processed"); + break; + } + + + page++; + _logger.LogTrace($"Continuing to next page: {page}"); + } + + var filteredHosts = FilterDomains(domains); + + // Retrieve certificates for each filtered domain + foreach (var domain in filteredHosts) + { + _logger.LogDebug($"Retrieving certificate for domain: {domain}"); + + var cert = await _certificateService.GetHostCertificate(domain, CloudflareHost); + _logger.LogTrace($"Retrieved certificate: {cert.Subject}"); + + var certBytes = cert.RawData; + var pem = PemEncoding.Write("CERTIFICATE", certBytes); + + inventory.Add(new CurrentInventoryItem + { + ItemStatus = OrchestratorInventoryItemStatus.Unknown, + PrivateKeyEntry = false, + Alias = domain, + Certificates = new List() + { + new(pem), + }, + }); + } + + submitInventoryUpdate.Invoke(inventory); + + _logger.LogInformation($"Successfully completed inventory for zone id {zoneId}"); + + _logger.MethodExit(); + + return new JobResult + { + Result = OrchestratorJobStatusJobResult.Success, + FailureMessage = "Successfully inventoried certificates from Cloudflare Edge.", + JobHistoryId = jobConfiguration.JobHistoryId, + }; + } + catch (Exception ex) when (ex is CloudflareRequestException || ex is CertificateRetrievalException) + { + _logger.LogError(ex, ex.Message); + + return new JobResult + { + Result = OrchestratorJobStatusJobResult.Failure, + FailureMessage = ex.Message, + JobHistoryId = jobConfiguration.JobHistoryId, + }; + } + catch (Exception ex) + { + _logger.LogError(ex, "An unexpected error occurred while inventorying certificates from Cloudflare Edge."); + + return new JobResult() + { + Result = OrchestratorJobStatusJobResult.Failure, + FailureMessage = $"An unexpected error occurred while inventorying certificates from Cloudflare Edge: {ex.Message}", + JobHistoryId = jobConfiguration.JobHistoryId, + }; } + + } + + /// + /// Filters out unwanted domains from the list, including "sni.cloudflaressl.com" and wildcard domains. + /// + /// + /// + private List FilterDomains(ISet domains) + { + return domains + .Where(p => p != "sni.cloudflaressl.com" + && !p.StartsWith("*.")) + .ToList(); + } - public string ExtensionName => "Cloudflare"; - public JobResult ProcessJob(InventoryJobConfiguration jobConfiguration, SubmitInventoryUpdate submitInventoryUpdate) + private void ConfigureClient(InventoryJobConfiguration jobConfiguration) + { + _logger.MethodEntry(); + + if (_cloudflareClient == null) { - return PerformInventory(jobConfiguration, submitInventoryUpdate); + _logger.LogDebug($"Configuring Cloudflare client with provided API key."); + var apiKey = ResolvePamField(jobConfiguration.ServerPassword, "Server Password"); + _cloudflareClient = new CloudflareClient(_logger, apiKey); } + else + { + _logger.LogDebug($"Cloudflare client already configured."); + } + + _logger.MethodExit(); + } + + private string ResolvePamField(string key, string description) + { + _logger.MethodEntry(); + _logger.LogDebug($"Fetching {description} value from PAM"); + var value = _pamSecretResolver.Resolve(key); + _logger.LogDebug($"Successfully fetched {description} value from PAM"); + _logger.MethodExit(); + return value; } -} \ No newline at end of file +} diff --git a/Cloudflare/Jobs/Management.cs b/Cloudflare/Jobs/Management.cs deleted file mode 100644 index 7365b8f..0000000 --- a/Cloudflare/Jobs/Management.cs +++ /dev/null @@ -1,44 +0,0 @@ -using System; -using System.Linq; -using System.Management.Automation; -using System.Management.Automation.Runspaces; -using System.Net; -using System.Security.Cryptography.X509Certificates; -using Keyfactor.Logging; -using Keyfactor.Orchestrators.Common.Enums; -using Keyfactor.Orchestrators.Extensions; -using Microsoft.Extensions.Logging; -using Newtonsoft.Json; - -namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Jobs -{ - public class Management : IManagementJobExtension - { - private readonly ILogger _logger; - - private string _thumbprint = string.Empty; - - public Management(ILogger logger) - { - _logger = logger; - } - - public string ExtensionName => "Cloudflare"; - - public JobResult ProcessJob(ManagementJobConfiguration jobConfiguration) - { - return new JobResult(); - } - - private JobResult PerformRemoval(ManagementJobConfiguration config) - { - return new JobResult(); - - } - - private JobResult PerformAddition(ManagementJobConfiguration config,string thumpPrint) - { - return new JobResult(); - } - } -} \ No newline at end of file diff --git a/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs b/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs new file mode 100644 index 0000000..85ab4fb --- /dev/null +++ b/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs @@ -0,0 +1,51 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#nullable enable +using Newtonsoft.Json; + +namespace Cloudflare.Models.Cloudflare; + +public class GetCertificatePacksCertificateItem +{ + [JsonProperty("id")] + public Guid Id { get; set; } + + [JsonProperty("hosts")] + public List Hosts { get; set; } = new(); + + [JsonProperty("issuer")] + public string? Issuer { get; set; } + + [JsonProperty("signature")] + public string? Signature { get; set; } + + [JsonProperty("status")] + public string Status { get; set; } = string.Empty; + + [JsonProperty("bundle_method")] + public string? BundleMethod { get; set; } + + [JsonProperty("zone_id")] + public string? ZoneId { get; set; } + + [JsonProperty("uploaded_on")] + public DateTimeOffset? UploadedOn { get; set; } + + [JsonProperty("modified_on")] + public DateTimeOffset? ModifiedOn { get; set; } + + [JsonProperty("expires_on")] + public DateTimeOffset? ExpiresOn { get; set; } +} diff --git a/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs b/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs new file mode 100644 index 0000000..75e3ae1 --- /dev/null +++ b/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs @@ -0,0 +1,67 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#nullable enable +using Newtonsoft.Json; + +namespace Cloudflare.Models.Cloudflare; + +public class GetCertificatePacksResponse +{ + [JsonProperty("result")] + public List Result { get; set; } = new(); + + [JsonProperty("result_info")] + public ResultInfo ResultInfo { get; set; } = new(); + + [JsonProperty("success")] + public bool Success { get; set; } + + [JsonProperty("errors")] + public List Errors { get; set; } = new(); + + [JsonProperty("messages")] + public List Messages { get; set; } = new(); +} + +public class GetCertificatePackResultItem +{ + [JsonProperty("id")] + public Guid Id { get; set; } + + [JsonProperty("type")] + public string Type { get; set; } = string.Empty; + + [JsonProperty("hosts")] + public List Hosts { get; set; } = new(); + + [JsonProperty("primary_certificate")] + public Guid PrimaryCertificate { get; set; } + + [JsonProperty("status")] + public string Status { get; set; } = string.Empty; + + [JsonProperty("certificates")] + public List Certificates { get; set; } = new(); + + [JsonProperty("created_on")] + public DateTimeOffset CreatedOn { get; set; } + + [JsonProperty("validity_days")] + public int ValidityDays { get; set; } + + [JsonProperty("certificate_authority")] + public string CertificateAuthority { get; set; } = string.Empty; + +} diff --git a/Cloudflare/Models/Cloudflare/ResponseMetadata.cs b/Cloudflare/Models/Cloudflare/ResponseMetadata.cs new file mode 100644 index 0000000..57661e2 --- /dev/null +++ b/Cloudflare/Models/Cloudflare/ResponseMetadata.cs @@ -0,0 +1,30 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#nullable enable +using Newtonsoft.Json; + +namespace Cloudflare.Models.Cloudflare; + +public class ResponseMetadata +{ + [JsonProperty("code")] + public int Code { get; set; } + + [JsonProperty("message")] + public string Message { get; set; } = string.Empty; + + [JsonProperty("documentation_url")] + public string? DocumentationUrl { get; set; } +} diff --git a/Cloudflare/Models/Cloudflare/ResultInfo.cs b/Cloudflare/Models/Cloudflare/ResultInfo.cs new file mode 100644 index 0000000..1684754 --- /dev/null +++ b/Cloudflare/Models/Cloudflare/ResultInfo.cs @@ -0,0 +1,35 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using Newtonsoft.Json; + +namespace Cloudflare.Models.Cloudflare; + +public class ResultInfo +{ + [JsonProperty("page")] + public int Page { get; set; } + + [JsonProperty("per_page")] + public int PerPage { get; set; } + + [JsonProperty("total_pages")] + public int TotalPages { get; set; } + + [JsonProperty("count")] + public int Count { get; set; } + + [JsonProperty("total_count")] + public int TotalCount { get; set; } +} \ No newline at end of file diff --git a/Cloudflare/RequestManager.cs b/Cloudflare/RequestManager.cs deleted file mode 100644 index 799135c..0000000 --- a/Cloudflare/RequestManager.cs +++ /dev/null @@ -1,10 +0,0 @@ -using System; -using System.Collections.Generic; -using System.Text; - -namespace Keyfactor.Extensions.Orchestrator.Cloudflare -{ - public class RequestManager - { - } -} diff --git a/Cloudflare/Service/CertificateRetrievalService.cs b/Cloudflare/Service/CertificateRetrievalService.cs new file mode 100644 index 0000000..b717626 --- /dev/null +++ b/Cloudflare/Service/CertificateRetrievalService.cs @@ -0,0 +1,132 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#nullable enable +using System.Net; +using System.Net.Security; +using System.Net.Sockets; +using System.Security.Cryptography.X509Certificates; +using Cloudflare.Exceptions; +using Keyfactor.Logging; +using Microsoft.Extensions.Logging; + +namespace Cloudflare.Service; + +public class CertificateRetrievalService : ICertificateRetrievalService +{ + private readonly ILogger _logger; + + public CertificateRetrievalService(ILogger logger) + { + _logger = logger; + } + + public async Task GetHostCertificate( + string domain, + string cloudflareHost = "www.cloudflare.com") + { + try + { + _logger.MethodEntry(); + _logger.LogDebug($"Getting host certificate for domain {domain} via Cloudflare host {cloudflareHost}"); + + // Resolve Cloudflare IP + var hostEntry = await Dns.GetHostEntryAsync(cloudflareHost); + var cloudflareIp = hostEntry.AddressList.FirstOrDefault() + ?? throw new Exception($"Could not resolve address list from host {cloudflareHost}"); + + _logger.LogDebug($"Connecting to {cloudflareIp} for domain {domain}"); + + X509Certificate2? certificate = null; + X509Chain? chain = null; + + using var tcpClient = new TcpClient(); + await tcpClient.ConnectAsync(cloudflareIp, 443); + + await using var sslStream = new SslStream( + tcpClient.GetStream(), + leaveInnerStreamOpen: false, + userCertificateValidationCallback: (sender, cert, certChain, errors) => + { + if (cert != null) + { + certificate = new X509Certificate2(cert); + chain = certChain; + } + + return true; // Accept for inspection + }); + + await sslStream.AuthenticateAsClientAsync( + targetHost: domain, + clientCertificates: null, + checkCertificateRevocation: false); + + if (certificate == null) + { + throw new CertificateRetrievalException(domain); + } + + _logger.MethodExit(); + + return certificate; + } + catch (CertificateRetrievalException) + { + // Rethrow known exceptions + throw; + } + catch (Exception ex) + { + throw new CertificateRetrievalException(domain, ex); + } + } + + // public async Task GetCertificateChainAsync( + // string domain, + // string cloudflareHost = "www.cloudflare.com") + // { + // var hostEntry = await Dns.GetHostEntryAsync(cloudflareHost); + // var cloudflareIp = hostEntry.AddressList.FirstOrDefault() + // ?? throw new Exception($"Could not resolve {cloudflareHost}"); + // + // X509Certificate2Collection? chainCollection = null; + // + // using var tcpClient = new TcpClient(); + // await tcpClient.ConnectAsync(cloudflareIp, 443); + // + // using var sslStream = new SslStream( + // tcpClient.GetStream(), + // leaveInnerStreamOpen: false, + // userCertificateValidationCallback: (sender, cert, chain, errors) => + // { + // if (chain != null) + // { + // chainCollection = new X509Certificate2Collection(); + // foreach (var element in chain.ChainElements) + // { + // chainCollection.Add(element.Certificate); + // } + // } + // return true; + // }); + // + // await sslStream.AuthenticateAsClientAsync( + // targetHost: domain, + // clientCertificates: null, + // checkCertificateRevocation: false); + // + // return chainCollection ?? new X509Certificate2Collection(); + // } +} diff --git a/Cloudflare/Service/ICertificateRetrievalService.cs b/Cloudflare/Service/ICertificateRetrievalService.cs new file mode 100644 index 0000000..f9ef782 --- /dev/null +++ b/Cloudflare/Service/ICertificateRetrievalService.cs @@ -0,0 +1,24 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Security.Cryptography.X509Certificates; + +namespace Cloudflare.Service; + +public interface ICertificateRetrievalService +{ + Task GetHostCertificate( + string domain, + string cloudflareHost = "www.cloudflare.com"); +} diff --git a/Cloudflare/manifest.json b/Cloudflare/manifest.json index 81d7653..f3cd757 100644 --- a/Cloudflare/manifest.json +++ b/Cloudflare/manifest.json @@ -1,13 +1,9 @@ { "extensions": { "Keyfactor.Orchestrators.Extensions.IOrchestratorJobExtension": { - "CertStores.IISBindings.Inventory": { - "assemblypath": "IISWithBindings.dll", - "TypeFullName": "Keyfactor.Extensions.Orchestrator.IISWithBinding.Jobs.Inventory" - }, - "CertStores.IISBindings.Management": { - "assemblypath": "IISWithBindings.dll", - "TypeFullName": "Keyfactor.Extensions.Orchestrator.IISWithBinding.Jobs.Management" + "CertStores.CloudflareEdge.Inventory": { + "assemblypath": "Cloudflare.dll", + "TypeFullName": "Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs.Inventory" } } } diff --git a/README.md b/README.md new file mode 100644 index 0000000..f5137bc --- /dev/null +++ b/README.md @@ -0,0 +1,295 @@ +

+ Cloudflare Edge Universal Orchestrator Extension +

+ +

+ +Integration Status: production +Release +Issues +GitHub Downloads (all assets, all releases) +

+ +

+ + + Support + + · + + Installation + + · + + License + + · + + Related Integrations + +

+ +## Overview + +The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). + + + +## Compatibility + +This integration is compatible with Keyfactor Universal Orchestrator version 11.0 and later. + +## Support +The Cloudflare Edge Universal Orchestrator extension is supported by Keyfactor. If you require support for any issues or have feature request, please open a support ticket by either contacting your Keyfactor representative or via the Keyfactor Support Portal at https://support.keyfactor.com. + +> If you want to contribute bug fixes or additional enhancements, use the **[Pull requests](../../pulls)** tab. + +## Requirements & Prerequisites + +Before installing the Cloudflare Edge Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. + + +To inventory certificates, the Universal Orchestrator instance **must** be able to reach the server hosting the certificate over the network. +Cloudflare's API does not provide the certificate contents, so the extension fetches the certificate directly from the server using a TLS handshake (via OpenSSL). + +### Authentication and Authorization + +When configuring the certificate store, the server password will contain the API token used to access the Cloudflare API. This can be either an **Account API Token** or a **User API Token**. See the [guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). + +The API token must have the following permissions: + +|Permission|Required|Documentation| +|--|--|--| +|Account:SSL|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| +|Certificates:Read|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| + + +## CloudflareEdge Certificate Store Type + +To use the Cloudflare Edge Universal Orchestrator extension, you **must** create the CloudflareEdge Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. + + + + + + + + +#### Supported Operations + +| Operation | Is Supported | +|--------------|------------------------------------------------------------------------------------------------------------------------| +| Add | 🔲 Unchecked | +| Remove | 🔲 Unchecked | +| Discovery | 🔲 Unchecked | +| Reenrollment | 🔲 Unchecked | +| Create | 🔲 Unchecked | + +#### Store Type Creation + +##### Using kfutil: +`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types. +For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart) +
Click to expand CloudflareEdge kfutil details + + ##### Using online definition from GitHub: + This will reach out to GitHub and pull the latest store-type definition + ```shell + # Cloudflare Edge + kfutil store-types create CloudflareEdge + ``` + + ##### Offline creation using integration-manifest file: + If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo. + You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command + in your offline environment. + ```shell + kfutil store-types create --from-file integration-manifest.json + ``` +
+ + +#### Manual Creation +Below are instructions on how to create the CloudflareEdge store type manually in +the Keyfactor Command Portal +
Click to expand manual CloudflareEdge details + + Create a store type called `CloudflareEdge` with the attributes in the tables below: + + ##### Basic Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Name | Cloudflare Edge | Display name for the store type (may be customized) | + | Short Name | CloudflareEdge | Short display name for the store type | + | Capability | CloudflareEdge | Store type name orchestrator will register with. Check the box to allow entry of value | + | Supports Add | 🔲 Unchecked | Indicates that the Store Type supports Management Add | + | Supports Remove | 🔲 Unchecked | Indicates that the Store Type supports Management Remove | + | Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery | + | Supports Reenrollment | 🔲 Unchecked | Indicates that the Store Type supports Reenrollment | + | Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation | + | Needs Server | ✅ Checked | Determines if a target server name is required when creating store | + | Blueprint Allowed | 🔲 Unchecked | Determines if store type may be included in an Orchestrator blueprint | + | Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell | + | Requires Store Password | 🔲 Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. | + | Supports Entry Password | 🔲 Unchecked | Determines if an individual entry within a store can have a password. | + + The Basic tab should look like this: + + ![CloudflareEdge Basic Tab](docsource/images/CloudflareEdge-basic-store-type-dialog.png) + + ##### Advanced Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Supports Custom Alias | Forbidden | Determines if an individual entry within a store can have a custom Alias. | + | Private Key Handling | Forbidden | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | + | PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | + + The Advanced tab should look like this: + + ![CloudflareEdge Advanced Tab](docsource/images/CloudflareEdge-advanced-store-type-dialog.png) + + > For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX. + + ##### Custom Fields Tab + Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + + | Name | Display Name | Description | Type | Default Value/Options | Required | + | ---- | ------------ | ---- | --------------------- | -------- | ----------- | + + The Custom Fields tab should look like this: + + ![CloudflareEdge Custom Fields Tab](docsource/images/CloudflareEdge-custom-fields-store-type-dialog.png) + + + + +
+ +## Installation + +1. **Download the latest Cloudflare Edge Universal Orchestrator extension from GitHub.** + + Navigate to the [Cloudflare Edge Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/cloudflare-edge-orchestrator/releases/latest). Refer to the compatibility matrix below to determine the asset should be downloaded. Then, click the corresponding asset to download the zip archive. + + | Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `cloudflare-edge-orchestrator` .NET version to download | + | --------- | ----------- | ----------- | ----------- | + | Older than `11.0.0` | | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` || Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` | + | `11.6` _and_ newer | `net8.0` | | `net8.0` | + + Unzip the archive containing extension assemblies to a known location. + + > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net6.0`. + +2. **Locate the Universal Orchestrator extensions directory.** + + * **Default on Windows** - `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions` + * **Default on Linux** - `/opt/keyfactor/orchestrator/extensions` + +3. **Create a new directory for the Cloudflare Edge Universal Orchestrator extension inside the extensions directory.** + + Create a new directory called `cloudflare-edge-orchestrator`. + > The directory name does not need to match any names used elsewhere; it just has to be unique within the extensions directory. + +4. **Copy the contents of the downloaded and unzipped assemblies from __step 2__ to the `cloudflare-edge-orchestrator` directory.** + +5. **Restart the Universal Orchestrator service.** + + Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm). + + + +> The above installation steps can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). + + + +## Defining Certificate Stores + + + +### Store Creation + +#### Manually with the Command UI + +
Click to expand details + +1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.** + + Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_. + +2. **Add a Certificate Store.** + + Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form. + + | Attribute | Description | + | --------- |---------------------------------------------------------| + | Category | Select "Cloudflare Edge" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | The account identifier for the Cloudflare account to be used for connecting to the Cloudflare API. | + | Store Path | The zone identifier for the Cloudflare zone where the edge certificates are located. | + | Orchestrator | Select an approved orchestrator capable of managing `CloudflareEdge` certificates. Specifically, one with the `CloudflareEdge` capability. | + +
+ + + +#### Using kfutil CLI + +
Click to expand details + +1. **Generate a CSV template for the CloudflareEdge certificate store** + + ```shell + kfutil stores import generate-template --store-type-name CloudflareEdge --outpath CloudflareEdge.csv + ``` +2. **Populate the generated CSV file** + + Open the CSV file, and reference the table below to populate parameters for each **Attribute**. + + | Attribute | Description | + | --------- | ----------- | + | Category | Select "Cloudflare Edge" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | The account identifier for the Cloudflare account to be used for connecting to the Cloudflare API. | + | Store Path | The zone identifier for the Cloudflare zone where the edge certificates are located. | + | Orchestrator | Select an approved orchestrator capable of managing `CloudflareEdge` certificates. Specifically, one with the `CloudflareEdge` capability. | + +3. **Import the CSV file to create the certificate stores** + + ```shell + kfutil stores import csv --store-type-name CloudflareEdge --file CloudflareEdge.csv + ``` + +
+ + + +> The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). + + + + +## Configuring the Certificate Store + +When setting up your certificate store, you will be required to fill in the following properties on your certificate store: + +|Name|Value| +|--|--| +|Client Machine|Account ID| +|Store Path|Zone ID| +|Server Username|| +|Server Password|Either your Account API Token or User API Token| + +You can find your account ID and zone ID on the Cloudflare dashboard, located under your Account. Please refer to the [Cloudflare documentation](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/) for more information. + +Account and Zone ID + + +## License + +Apache License 2.0, see [LICENSE](LICENSE). + +## Related Integrations + +See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator). \ No newline at end of file diff --git a/README.md.tpl b/README.md.tpl deleted file mode 100644 index 383563f..0000000 --- a/README.md.tpl +++ /dev/null @@ -1,96 +0,0 @@ -# {{ name }} -## {{ integration_type | capitalize }} - -{{ description }} - - -*** -**Cloudflare Orchestrator Configuration** - -**Overview** - - - -This agent implements three job types – Inventory, Management Add, and Management Remove. Below are the steps necessary to configure this AnyAgent. - - -**1. Create the New Certificate Store Type for the Cloudflare Orchestrator** - -In Keyfactor Command create a new Certificate Store Type similar to the one below: - -#### STORE TYPE CONFIGURATION -CONFIG ELEMENT | DESCRIPTION -------------------|------------------ -Name |Descriptive name for the Store Type -Short Name |The short name that identifies the registered functionality of the orchestrator. Must be IISWBin -Custom Capability|Store type name orchestrator will register with. Must be "IISBindings". -Needs Server |Must be checked -Blueprint Allowed |Unchecked -Requires Store Password |Determines if a store password is required when configuring an individual store. This must be unchecked. -Supports Entry Password |Determined if an individual entry within a store can have a password. This must be unchecked. -Supports Custom Alias |Determines if an individual entry within a store can have a custom Alias. This must be Forbidden. -Uses PowerShell |Unchecked -Store Path Type |Determines what restrictions are applied to the store path field when configuring a new store. This must be Multiple Choice -Store Path Value|A comma separated list of options to select from for the Store Path. This, combined with the hostname, will determine the location used for the certificate store management and inventory. Must be My, WebHosting -Private Keys |This determines if Keyfactor can send the private key associated with a certificate to the store. This is required since IIS will need the private key material to establish TLS connections. -PFX Password Style |This determines how the platform generate passwords to protect a PFX enrollment job that is delivered to the store. This can be either Default (system generated) or Custom (user determined). -Job Types |Inventory, Add, and Remove are the supported job types. - - -**Advanced Settings:** - - -**Custom Fields:** - - - -Parameter Name|Parameter Type|Default Value|Required ----|---|---|--- -spnwithport|Boolean|false|No - - -**Entry Parameters:** -This section must be configured with binding fields. The parameters will be populated with the appropriate data when creating a new certificate store.
- -- **Site Name** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The site name for the web site being bound to – i.e. "Default Web Site" -- **IP Address** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The IP address for the web site being bound to. Default is "\*" for all IP Addresses. -- **Port** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The port for the web site being bound to. Default is "443". -- **Host Name** – Optional. The host name for the web site being bound to. -- **Protocol** - Required (Adding an entry, Removing an entry, Reenrolling an entry) - - https - - http -- **Sni Flag** – Optional. Set the SNI flag associated with the binding being created. Default is "0". Acceptable values are: - - 0 - No SNI - - 1 - SNI Enabled - - 2 - Non SNI Binding - - 3 - SNI Binding - -Parameter Name|Parameter Type|Default Value|Required ----|---|---|--- -Port|String|443|Yes -IP Address|String|*|Yes -Host Name |String||No -Site Name |String|Default Web Site|Yes -Sni Flag |String|0 - No SNI|No -Protocol |Multiple Choice|https|Yes - -![](images/screen1-c.gif) - -**2. Register the Cloudflare Orchestrator with Keyfactor** -See Keyfactor InstallingKeyfactorOrchestrators.pdf Documentation. Get from your Keyfactor contact/representative. - -**3. Create an Cloudflare Certificate Store within Keyfactor Command** - -In Keyfactor Command create a new Certificate Store similar to the one below, selecting IIS With Binding as the Category and the parameters as described in "Create the New Certificate Store Type for the New IIS-With-Bindings AnyAgent". - -![](images/screen2.gif) - -#### STORE CONFIGURATION -CONFIG ELEMENT |DESCRIPTION -----------------|--------------- -Category |The type of certificate store to be configured. Select category based on the display name configured above. -Container |This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store. -Client Machine |The hostname of the server to be managed. The Change Credentials option must be clicked to provide a username and password. This account will be used to manage the remote server via PowerShell. -Store Path |My or WebHosting -Orchestrator |This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type. -Inventory Schedule |The interval that the system will use to report on what certificates are currently in the store. \ No newline at end of file diff --git a/docsource/cloudflare-account-id-zone-id.png b/docsource/cloudflare-account-id-zone-id.png new file mode 100644 index 0000000..f67b348 Binary files /dev/null and b/docsource/cloudflare-account-id-zone-id.png differ diff --git a/docsource/cloudflareedge.md b/docsource/cloudflareedge.md new file mode 100644 index 0000000..0685dfd --- /dev/null +++ b/docsource/cloudflareedge.md @@ -0,0 +1,3 @@ +## Overview + + diff --git a/docsource/content.md b/docsource/content.md new file mode 100644 index 0000000..0ce59f6 --- /dev/null +++ b/docsource/content.md @@ -0,0 +1,34 @@ +## Overview + +The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). + +## Requirements + +To inventory certificates, the Universal Orchestrator instance **must** be able to reach the server hosting the certificate over the network. +Cloudflare's API does not provide the certificate contents, so the extension fetches the certificate directly from the server using a TLS handshake (via OpenSSL). + +### Authentication and Authorization + +When configuring the certificate store, the server password will contain the API token used to access the Cloudflare API. This can be either an **Account API Token** or a **User API Token**. See the [guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). + +The API token must have the following permissions: + +|Permission|Required|Documentation| +|--|--|--| +|Account:SSL|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| +|Certificates:Read|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| + +## Configuring the Certificate Store + +When setting up your certificate store, you will be required to fill in the following properties on your certificate store: + +|Name|Value| +|--|--| +|Client Machine|Account ID| +|Store Path|Zone ID| +|Server Username|| +|Server Password|Either your Account API Token or User API Token| + +You can find your account ID and zone ID on the Cloudflare dashboard, located under your Account. Please refer to the [Cloudflare documentation](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/) for more information. + +Account and Zone ID \ No newline at end of file diff --git a/docsource/images/CloudflareEdge-advanced-store-type-dialog.png b/docsource/images/CloudflareEdge-advanced-store-type-dialog.png new file mode 100644 index 0000000..ce89bb7 Binary files /dev/null and b/docsource/images/CloudflareEdge-advanced-store-type-dialog.png differ diff --git a/docsource/images/CloudflareEdge-basic-store-type-dialog.png b/docsource/images/CloudflareEdge-basic-store-type-dialog.png new file mode 100644 index 0000000..342b7b7 Binary files /dev/null and b/docsource/images/CloudflareEdge-basic-store-type-dialog.png differ diff --git a/docsource/images/CloudflareEdge-custom-fields-store-type-dialog.png b/docsource/images/CloudflareEdge-custom-fields-store-type-dialog.png new file mode 100644 index 0000000..ea975d3 Binary files /dev/null and b/docsource/images/CloudflareEdge-custom-fields-store-type-dialog.png differ diff --git a/integration-manifest.json b/integration-manifest.json index 4673202..b96e7b9 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -1,7 +1,50 @@ { - "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", + "$schema": "https://keyfactor.github.io/v2/integration-manifest-schema.json", "integration_type": "orchestrator", - "name": "Cloudflare Orchestrator", - "status": "Development", - "description": "" + "name": "Cloudflare Edge Orchestrator", + "status": "production", + "support_level": "kf-supported", + "update_catalog": true, + "link_github": false, + "release_project": "Cloudflare/Cloudflare.csproj", + "release_dir": "Cloudflare/bin/Release", + "description": "The Cloudflare Edge Orchestrator integration enables Keyfactor to inventory SSL/TLS certificates from Cloudflare's edge network.", + "about": { + "orchestrator": { + "UOFramework": "11.0", + "keyfactor_platform_version": "11.0", + "store_types": [ + { + "Name": "Cloudflare Edge", + "ShortName": "CloudflareEdge", + "Capability": "CloudflareEdge", + "LocalStore": false, + "SupportedOperations": { + "Add": false, + "Create": false, + "Discovery": false, + "Enrollment": false, + "Remove": false + }, + "EntryParameters": [], + "StorePathType": "", + "StorePathValue": "", + "PrivateKeyAllowed": "Forbidden", + "ClientMachineDescription": "The account identifier for the Cloudflare account to be used for connecting to the Cloudflare API.", + "StorePathDescription": "The zone identifier for the Cloudflare zone where the edge certificates are located.", + "JobProperties": [], + "ServerRequired": true, + "PowerShell": false, + "BlueprintAllowed": false, + "CustomAliasAllowed": "Forbidden", + "Properties": [], + "PasswordOptions": { + "EntrySupported": false, + "StoreRequired": false, + "Style": "Default" + } + } + ] + } + } } \ No newline at end of file