feat: add huaweicloud waf deployer

2025-06-27 14:49:56 +00:00 · 2025-02-17 10:25:25 +08:00 · 2025-02-17 10:25:25 +08:00 · 61b7165bac
commit 61b7165bac
parent a6f1f21c18
16 changed files with 695 additions and 14 deletions
--- a/README.md
+++ b/README.md
@ -125,7 +125,7 @@ make local.run
 | [阿里云](https://www.aliyun.com/)       | 可部署到阿里云 OSS、CDN、DCDN、ESA、SLB（CLB/ALB/NLB）、WAF、Live 等服务 |
 | [腾讯云](https://cloud.tencent.com/)    | 可部署到腾讯云 COS、CDN、ECDN、EdgeOne、CLB、CSS 等服务                  |
 | [百度智能云](https://cloud.baidu.com/)  | 可部署到百度智能云 CDN 等服务                                            |
-| [华为云](https://www.huaweicloud.com/)  | 可部署到华为云 CDN、ELB 等服务                                           |
+| [华为云](https://www.huaweicloud.com/)  | 可部署到华为云 CDN、ELB、WAF 等服务                                      |
 | [火山引擎](https://www.volcengine.com/) | 可部署到火山引擎 TOS、CDN、DCDN、CLB、ImageX、Live 等服务                |
 | [七牛云](https://www.qiniu.com/)        | 可部署到七牛云 CDN、直播云等服务                                         |
 | [多吉云](https://www.dogecloud.com/)    | 可部署到多吉云 CDN                                                       |
--- a/README_EN.md
+++ b/README_EN.md
@ -124,7 +124,7 @@ The following hosting providers are supported:
 | [Alibaba Cloud](https://www.alibabacloud.com/)  | Supports deployment to Alibaba Cloud OSS, CDN, DCDN, SLB(CLB/ALB/NLB), WAF, Live |
 | [Tencent Cloud](https://www.tencentcloud.com/)  | Supports deployment to Tencent Cloud COS, CDN, ECDN, EdgeOne, CLB, CSS           |
 | [Baidu AI Cloud](https://intl.cloud.baidu.com/) | Supports deployment to Baidu AI CLoud CDN                                        |
-| [Huawei Cloud](https://www.huaweicloud.com/)    | Supports deployment to Huawei Cloud CDN, ELB                                     |
+| [Huawei Cloud](https://www.huaweicloud.com/)    | Supports deployment to Huawei Cloud CDN, ELB, WAF                                |
 | [Volcengine](https://www.volcengine.com/)       | Supports deployment to Volcengine TOS, CDN, DCDN, CLB, ImageX, Live              |
 | [Qiniu Cloud](https://www.qiniu.com/)           | Supports deployment to Qiniu Cloud CDN, Pili                                     |
 | [Doge Cloud](https://www.dogecloud.com/)        | Supports deployment to Doge Cloud CDN                                            |
--- a/internal/deployer/providers.go
+++ b/internal/deployer/providers.go
@ -25,6 +25,7 @@ import (
 	pEdgioApplications "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/edgio-applications"
 	pHuaweiCloudCDN "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/huaweicloud-cdn"
 	pHuaweiCloudELB "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/huaweicloud-elb"
+	pHuaweiCloudWAF "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/huaweicloud-waf"
 	pK8sSecret "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/k8s-secret"
 	pLocal "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/local"
 	pQiniuCDN "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/qiniu-cdn"
@ -72,7 +73,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger,
 					AccessKeyId:     access.AccessKeyId,
 					AccessKeySecret: access.AccessKeySecret,
 					Region:          maps.GetValueAsString(options.ProviderDeployConfig, "region"),
-					ResourceType:    pAliyunALB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
+					ResourceType:    pAliyunALB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
 					LoadbalancerId:  maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"),
 					ListenerId:      maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"),
 					Domain:          maps.GetValueAsString(options.ProviderDeployConfig, "domain"),
@ -102,7 +103,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger,
 					AccessKeyId:     access.AccessKeyId,
 					AccessKeySecret: access.AccessKeySecret,
 					Region:          maps.GetValueAsString(options.ProviderDeployConfig, "region"),
-					ResourceType:    pAliyunCLB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
+					ResourceType:    pAliyunCLB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
 					LoadbalancerId:  maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"),
 					ListenerPort:    maps.GetValueOrDefaultAsInt32(options.ProviderDeployConfig, "listenerPort", 443),
 					Domain:          maps.GetValueAsString(options.ProviderDeployConfig, "domain"),
@ -140,7 +141,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger,
 					AccessKeyId:     access.AccessKeyId,
 					AccessKeySecret: access.AccessKeySecret,
 					Region:          maps.GetValueAsString(options.ProviderDeployConfig, "region"),
-					ResourceType:    pAliyunNLB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
+					ResourceType:    pAliyunNLB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
 					LoadbalancerId:  maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"),
 					ListenerId:      maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"),
 				}, logger)
@ -293,7 +294,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger,
 			return deployer, logger, err
 		}

-	case domain.DeployProviderTypeHuaweiCloudCDN, domain.DeployProviderTypeHuaweiCloudELB:
+	case domain.DeployProviderTypeHuaweiCloudCDN, domain.DeployProviderTypeHuaweiCloudELB, domain.DeployProviderTypeHuaweiCloudWAF:
 		{
 			access := domain.AccessConfigForHuaweiCloud{}
 			if err := maps.Populate(options.ProviderAccessConfig, &access); err != nil {
@ -315,13 +316,24 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger,
 					AccessKeyId:     access.AccessKeyId,
 					SecretAccessKey: access.SecretAccessKey,
 					Region:          maps.GetValueAsString(options.ProviderDeployConfig, "region"),
-					ResourceType:    pHuaweiCloudELB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
+					ResourceType:    pHuaweiCloudELB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
 					CertificateId:   maps.GetValueAsString(options.ProviderDeployConfig, "certificateId"),
 					LoadbalancerId:  maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"),
 					ListenerId:      maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"),
 				}, logger)
 				return deployer, logger, err

+			case domain.DeployProviderTypeHuaweiCloudWAF:
+				deployer, err := pHuaweiCloudWAF.NewWithLogger(&pHuaweiCloudWAF.HuaweiCloudWAFDeployerConfig{
+					AccessKeyId:     access.AccessKeyId,
+					SecretAccessKey: access.SecretAccessKey,
+					Region:          maps.GetValueAsString(options.ProviderDeployConfig, "region"),
+					ResourceType:    pHuaweiCloudWAF.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
+					CertificateId:   maps.GetValueAsString(options.ProviderDeployConfig, "certificateId"),
+					Domain:          maps.GetValueAsString(options.ProviderDeployConfig, "domain"),
+				}, logger)
+				return deployer, logger, err
+
 			default:
 				break
 			}
@ -441,7 +453,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger,
 					SecretId:       access.SecretId,
 					SecretKey:      access.SecretKey,
 					Region:         maps.GetValueAsString(options.ProviderDeployConfig, "region"),
-					ResourceType:   pTencentCloudCLB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
+					ResourceType:   pTencentCloudCLB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
 					LoadbalancerId: maps.GetValueAsString(options.ProviderDeployConfig, "loadbalancerId"),
 					ListenerId:     maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"),
 					Domain:         maps.GetValueAsString(options.ProviderDeployConfig, "domain"),
@ -552,7 +564,7 @@ func createDeployer(options *deployerOptions) (deployer.Deployer, logger.Logger,
 					AccessKeyId:     access.AccessKeyId,
 					AccessKeySecret: access.SecretAccessKey,
 					Region:          maps.GetValueAsString(options.ProviderDeployConfig, "region"),
-					ResourceType:    pVolcEngineCLB.DeployResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
+					ResourceType:    pVolcEngineCLB.ResourceType(maps.GetValueAsString(options.ProviderDeployConfig, "resourceType")),
 					ListenerId:      maps.GetValueAsString(options.ProviderDeployConfig, "listenerId"),
 				}, logger)
 				return deployer, logger, err
--- a/internal/domain/provider.go
+++ b/internal/domain/provider.go
@ -114,6 +114,7 @@ const (
 	DeployProviderTypeEdgioApplications     = DeployProviderType("edgio-applications")
 	DeployProviderTypeHuaweiCloudCDN        = DeployProviderType("huaweicloud-cdn")
 	DeployProviderTypeHuaweiCloudELB        = DeployProviderType("huaweicloud-elb")
+	DeployProviderTypeHuaweiCloudWAF        = DeployProviderType("huaweicloud-waf")
 	DeployProviderTypeKubernetesSecret      = DeployProviderType("k8s-secret")
 	DeployProviderTypeLocal                 = DeployProviderType("local")
 	DeployProviderTypeQiniuCDN              = DeployProviderType("qiniu-cdn")
--- a/internal/pkg/core/deployer/providers/huaweicloud-waf/consts.go
+++ b/internal/pkg/core/deployer/providers/huaweicloud-waf/consts.go
@ -0,0 +1,12 @@
+package huaweicloudwaf
+
+type ResourceType string
+
+const (
+	// 资源类型：替换指定证书。
+	RESOURCE_TYPE_CERTIFICATE = ResourceType("certificate")
+	// 资源类型：部署到云模式防护网站。
+	RESOURCE_TYPE_CLOUDSERVER = ResourceType("cloudserver")
+	// 资源类型：部署到独享模式防护网站。
+	RESOURCE_TYPE_PREMIUMHOST = ResourceType("premiumhost")
+)
--- a/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf.go
+++ b/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf.go
@ -0,0 +1,358 @@
+package huaweicloudwaf
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
+	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/global"
+	hcIam "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3"
+	hcIamModel "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3/model"
+	hcIamRegion "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3/region"
+	hcWaf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1"
+	hcWafModel "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model"
+	hcWafRegion "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region"
+	xerrors "github.com/pkg/errors"
+
+	"github.com/usual2970/certimate/internal/pkg/core/deployer"
+	"github.com/usual2970/certimate/internal/pkg/core/logger"
+	"github.com/usual2970/certimate/internal/pkg/core/uploader"
+	uploaderp "github.com/usual2970/certimate/internal/pkg/core/uploader/providers/huaweicloud-waf"
+	hwsdk "github.com/usual2970/certimate/internal/pkg/vendors/huaweicloud-sdk"
+)
+
+type HuaweiCloudWAFDeployerConfig struct {
+	// 华为云 AccessKeyId。
+	AccessKeyId string `json:"accessKeyId"`
+	// 华为云 SecretAccessKey。
+	SecretAccessKey string `json:"secretAccessKey"`
+	// 华为云区域。
+	Region string `json:"region"`
+	// 部署资源类型。
+	ResourceType ResourceType `json:"resourceType"`
+	// 证书 ID。
+	// 部署资源类型为 [RESOURCE_TYPE_CERTIFICATE] 时必填。
+	CertificateId string `json:"certificateId,omitempty"`
+	// 防护域名（支持泛域名）。
+	// 部署资源类型为 [RESOURCE_TYPE_CLOUDSERVER]、[RESOURCE_TYPE_PREMIUMHOST] 时必填。
+	Domain string `json:"domain,omitempty"`
+}
+
+type HuaweiCloudWAFDeployer struct {
+	config      *HuaweiCloudWAFDeployerConfig
+	logger      logger.Logger
+	sdkClient   *hcWaf.WafClient
+	sslUploader uploader.Uploader
+}
+
+var _ deployer.Deployer = (*HuaweiCloudWAFDeployer)(nil)
+
+func New(config *HuaweiCloudWAFDeployerConfig) (*HuaweiCloudWAFDeployer, error) {
+	return NewWithLogger(config, logger.NewNilLogger())
+}
+
+func NewWithLogger(config *HuaweiCloudWAFDeployerConfig, logger logger.Logger) (*HuaweiCloudWAFDeployer, error) {
+	if config == nil {
+		return nil, errors.New("config is nil")
+	}
+
+	if logger == nil {
+		return nil, errors.New("logger is nil")
+	}
+
+	client, err := createSdkClient(config.AccessKeyId, config.SecretAccessKey, config.Region)
+	if err != nil {
+		return nil, xerrors.Wrap(err, "failed to create sdk client")
+	}
+
+	uploader, err := uploaderp.New(&uploaderp.HuaweiCloudWAFUploaderConfig{
+		AccessKeyId:     config.AccessKeyId,
+		SecretAccessKey: config.SecretAccessKey,
+		Region:          config.Region,
+	})
+	if err != nil {
+		return nil, xerrors.Wrap(err, "failed to create ssl uploader")
+	}
+
+	return &HuaweiCloudWAFDeployer{
+		logger:      logger,
+		config:      config,
+		sdkClient:   client,
+		sslUploader: uploader,
+	}, nil
+}
+
+func (d *HuaweiCloudWAFDeployer) Deploy(ctx context.Context, certPem string, privkeyPem string) (*deployer.DeployResult, error) {
+	// 上传证书到 WAF
+	upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
+	if err != nil {
+		return nil, xerrors.Wrap(err, "failed to upload certificate file")
+	}
+
+	d.logger.Logt("certificate file uploaded", upres)
+
+	// 根据部署资源类型决定部署方式
+	switch d.config.ResourceType {
+	case RESOURCE_TYPE_CERTIFICATE:
+		if err := d.deployToCertificate(ctx, certPem, privkeyPem); err != nil {
+			return nil, err
+		}
+
+	case RESOURCE_TYPE_CLOUDSERVER:
+		if err := d.deployToCloudServer(ctx, certPem, privkeyPem); err != nil {
+			return nil, err
+		}
+
+	case RESOURCE_TYPE_PREMIUMHOST:
+		if err := d.deployToPremiumHost(ctx, certPem, privkeyPem); err != nil {
+			return nil, err
+		}
+
+	default:
+		return nil, fmt.Errorf("unsupported resource type: %s", d.config.ResourceType)
+	}
+
+	return &deployer.DeployResult{}, nil
+}
+
+func (d *HuaweiCloudWAFDeployer) deployToCertificate(ctx context.Context, certPem string, privkeyPem string) error {
+	if d.config.CertificateId == "" {
+		return errors.New("config `certificateId` is required")
+	}
+
+	// 查询证书
+	// REF: https://support.huaweicloud.com/api-waf/ShowCertificate.html
+	showCertificateReq := &hcWafModel.ShowCertificateRequest{
+		CertificateId: d.config.CertificateId,
+	}
+	showCertificateResp, err := d.sdkClient.ShowCertificate(showCertificateReq)
+	if err != nil {
+		return xerrors.Wrap(err, "failed to execute sdk request 'waf.ShowCertificate'")
+	} else {
+		d.logger.Logt("已获取 WAF 证书", showCertificateResp)
+	}
+
+	// 更新证书
+	// REF: https://support.huaweicloud.com/api-waf/UpdateCertificate.html
+	updateCertificateReq := &hcWafModel.UpdateCertificateRequest{
+		CertificateId: d.config.CertificateId,
+		Body: &hcWafModel.UpdateCertificateRequestBody{
+			Name:    *showCertificateResp.Name,
+			Content: hwsdk.StringPtr(certPem),
+			Key:     hwsdk.StringPtr(privkeyPem),
+		},
+	}
+	updateCertificateResp, err := d.sdkClient.UpdateCertificate(updateCertificateReq)
+	if err != nil {
+		return xerrors.Wrap(err, "failed to execute sdk request 'waf.UpdateCertificate'")
+	} else {
+		d.logger.Logt("已更新 WAF 证书", updateCertificateResp)
+	}
+
+	return nil
+}
+
+func (d *HuaweiCloudWAFDeployer) deployToCloudServer(ctx context.Context, certPem string, privkeyPem string) error {
+	if d.config.Domain == "" {
+		return errors.New("config `domain` is required")
+	}
+
+	// 上传证书到 WAF
+	upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
+	if err != nil {
+		return xerrors.Wrap(err, "failed to upload certificate file")
+	} else {
+		d.logger.Logt("certificate file uploaded", upres)
+	}
+
+	// 遍历查询云模式防护域名列表，获取防护域名 ID
+	// REF: https://support.huaweicloud.com/api-waf/ListHost.html
+	hostId := ""
+	listHostPage := int32(1)
+	listHostPageSize := int32(100)
+	for {
+		listHostReq := &hcWafModel.ListHostRequest{
+			Hostname: hwsdk.StringPtr(strings.TrimPrefix(d.config.Domain, "*")),
+			Page:     hwsdk.Int32Ptr(listHostPage),
+			Pagesize: hwsdk.Int32Ptr(listHostPageSize),
+		}
+		listHostResp, err := d.sdkClient.ListHost(listHostReq)
+		if err != nil {
+			return xerrors.Wrap(err, "failed to execute sdk request 'waf.ListHost'")
+		}
+
+		if listHostResp.Items != nil {
+			for _, hostItem := range *listHostResp.Items {
+				if strings.TrimPrefix(d.config.Domain, "*") == *hostItem.Hostname {
+					hostId = *hostItem.Id
+					break
+				}
+			}
+		}
+
+		if listHostResp.Items == nil || len(*listHostResp.Items) < int(listHostPageSize) {
+			break
+		} else {
+			listHostPage++
+		}
+	}
+	if hostId == "" {
+		return errors.New("host not found")
+	}
+
+	// 更新云模式防护域名的配置
+	// REF: https://support.huaweicloud.com/api-waf/UpdateHost.html
+	updateHostReq := &hcWafModel.UpdateHostRequest{
+		InstanceId: hostId,
+		Body: &hcWafModel.UpdateHostRequestBody{
+			Certificateid:   hwsdk.StringPtr(upres.CertId),
+			Certificatename: hwsdk.StringPtr(upres.CertName),
+		},
+	}
+	updateHostResp, err := d.sdkClient.UpdateHost(updateHostReq)
+	if err != nil {
+		return xerrors.Wrap(err, "failed to execute sdk request 'waf.UpdateHost'")
+	} else {
+		d.logger.Logt("已更新云模式防护域名的配置", updateHostResp)
+	}
+
+	return nil
+}
+
+func (d *HuaweiCloudWAFDeployer) deployToPremiumHost(ctx context.Context, certPem string, privkeyPem string) error {
+	if d.config.Domain == "" {
+		return errors.New("config `domain` is required")
+	}
+
+	// 上传证书到 WAF
+	upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
+	if err != nil {
+		return xerrors.Wrap(err, "failed to upload certificate file")
+	} else {
+		d.logger.Logt("certificate file uploaded", upres)
+	}
+
+	// 遍历查询独享模式域名列表，获取防护域名 ID
+	// REF: https://support.huaweicloud.com/api-waf/ListPremiumHost.html
+	hostId := ""
+	listPremiumHostPage := int32(1)
+	listPremiumHostPageSize := int32(100)
+	for {
+		listPremiumHostReq := &hcWafModel.ListPremiumHostRequest{
+			Hostname: hwsdk.StringPtr(strings.TrimPrefix(d.config.Domain, "*")),
+			Page:     hwsdk.StringPtr(fmt.Sprintf("%d", listPremiumHostPage)),
+			Pagesize: hwsdk.StringPtr(fmt.Sprintf("%d", listPremiumHostPageSize)),
+		}
+		listPremiumHostResp, err := d.sdkClient.ListPremiumHost(listPremiumHostReq)
+		if err != nil {
+			return xerrors.Wrap(err, "failed to execute sdk request 'waf.ListPremiumHost'")
+		}
+
+		if listPremiumHostResp.Items != nil {
+			for _, hostItem := range *listPremiumHostResp.Items {
+				if strings.TrimPrefix(d.config.Domain, "*") == *hostItem.Hostname {
+					hostId = *hostItem.Id
+					break
+				}
+			}
+		}
+
+		if listPremiumHostResp.Items == nil || len(*listPremiumHostResp.Items) < int(listPremiumHostPageSize) {
+			break
+		} else {
+			listPremiumHostPage++
+		}
+	}
+	if hostId == "" {
+		return errors.New("host not found")
+	}
+
+	// 修改独享模式域名配置
+	// REF: https://support.huaweicloud.com/api-waf/UpdatePremiumHost.html
+	updatePremiumHostReq := &hcWafModel.UpdatePremiumHostRequest{
+		HostId: hostId,
+		Body: &hcWafModel.UpdatePremiumHostRequestBody{
+			Certificateid:   hwsdk.StringPtr(upres.CertId),
+			Certificatename: hwsdk.StringPtr(upres.CertName),
+		},
+	}
+	updatePremiumHostResp, err := d.sdkClient.UpdatePremiumHost(updatePremiumHostReq)
+	if err != nil {
+		return xerrors.Wrap(err, "failed to execute sdk request 'waf.UpdatePremiumHost'")
+	} else {
+		d.logger.Logt("已修改独享模式域名配置", updatePremiumHostResp)
+	}
+
+	return nil
+}
+
+func createSdkClient(accessKeyId, secretAccessKey, region string) (*hcWaf.WafClient, error) {
+	projectId, err := getSdkProjectId(accessKeyId, secretAccessKey, region)
+	if err != nil {
+		return nil, err
+	}
+
+	auth, err := basic.NewCredentialsBuilder().
+		WithAk(accessKeyId).
+		WithSk(secretAccessKey).
+		WithProjectId(projectId).
+		SafeBuild()
+	if err != nil {
+		return nil, err
+	}
+
+	hcRegion, err := hcWafRegion.SafeValueOf(region)
+	if err != nil {
+		return nil, err
+	}
+
+	hcClient, err := hcWaf.WafClientBuilder().
+		WithRegion(hcRegion).
+		WithCredential(auth).
+		SafeBuild()
+	if err != nil {
+		return nil, err
+	}
+
+	client := hcWaf.NewWafClient(hcClient)
+	return client, nil
+}
+
+func getSdkProjectId(accessKeyId, secretAccessKey, region string) (string, error) {
+	auth, err := global.NewCredentialsBuilder().
+		WithAk(accessKeyId).
+		WithSk(secretAccessKey).
+		SafeBuild()
+	if err != nil {
+		return "", err
+	}
+
+	hcRegion, err := hcIamRegion.SafeValueOf(region)
+	if err != nil {
+		return "", err
+	}
+
+	hcClient, err := hcIam.IamClientBuilder().
+		WithRegion(hcRegion).
+		WithCredential(auth).
+		SafeBuild()
+	if err != nil {
+		return "", err
+	}
+
+	client := hcIam.NewIamClient(hcClient)
+
+	request := &hcIamModel.KeystoneListProjectsRequest{
+		Name: &region,
+	}
+	response, err := client.KeystoneListProjects(request)
+	if err != nil {
+		return "", err
+	} else if response.Projects == nil || len(*response.Projects) == 0 {
+		return "", errors.New("no project found")
+	}
+
+	return (*response.Projects)[0].Id, nil
+}
--- a/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf_test.go
+++ b/internal/pkg/core/deployer/providers/huaweicloud-waf/huaweicloud_waf_test.go
@ -0,0 +1,84 @@
+package huaweicloudwaf_test
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	provider "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/huaweicloud-waf"
+)
+
+var (
+	fInputCertPath   string
+	fInputKeyPath    string
+	fAccessKeyId     string
+	fSecretAccessKey string
+	fRegion          string
+	fResourceType    string
+	fDomain          string
+)
+
+func init() {
+	argsPrefix := "CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_"
+
+	flag.StringVar(&fInputCertPath, argsPrefix+"INPUTCERTPATH", "", "")
+	flag.StringVar(&fInputKeyPath, argsPrefix+"INPUTKEYPATH", "", "")
+	flag.StringVar(&fAccessKeyId, argsPrefix+"ACCESSKEYID", "", "")
+	flag.StringVar(&fSecretAccessKey, argsPrefix+"SECRETACCESSKEY", "", "")
+	flag.StringVar(&fRegion, argsPrefix+"REGION", "", "")
+	flag.StringVar(&fResourceType, argsPrefix+"RESOURCETYPE", "", "")
+	flag.StringVar(&fDomain, argsPrefix+"DOMAIN", "", "")
+}
+
+/*
+Shell command to run this test:
+
+	go test -v ./huaweicloud_waf_test.go -args \
+	--CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_INPUTCERTPATH="/path/to/your-input-cert.pem" \
+	--CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_INPUTKEYPATH="/path/to/your-input-key.pem" \
+	--CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_ACCESSKEYID="your-access-key-id" \
+	--CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_SECRETACCESSKEY="your-secret-access-key" \
+	--CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_REGION="cn-north-1" \
+	--CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_RESOURCETYPE="premium" \
+	--CERTIMATE_DEPLOYER_HUAWEICLOUDWAF_DOMAIN="example.com"
+*/
+func TestDeploy(t *testing.T) {
+	flag.Parse()
+
+	t.Run("Deploy", func(t *testing.T) {
+		t.Log(strings.Join([]string{
+			"args:",
+			fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
+			fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
+			fmt.Sprintf("ACCESSKEYID: %v", fAccessKeyId),
+			fmt.Sprintf("SECRETACCESSKEY: %v", fSecretAccessKey),
+			fmt.Sprintf("REGION: %v", fRegion),
+			fmt.Sprintf("RESOURCETYPE: %v", fResourceType),
+		}, "\n"))
+
+		deployer, err := provider.New(&provider.HuaweiCloudWAFDeployerConfig{
+			AccessKeyId:     fAccessKeyId,
+			SecretAccessKey: fSecretAccessKey,
+			Region:          fRegion,
+			ResourceType:    provider.ResourceType(fResourceType),
+			Domain:          fDomain,
+		})
+		if err != nil {
+			t.Errorf("err: %+v", err)
+			return
+		}
+
+		fInputCertData, _ := os.ReadFile(fInputCertPath)
+		fInputKeyData, _ := os.ReadFile(fInputKeyPath)
+		res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
+		if err != nil {
+			t.Errorf("err: %+v", err)
+			return
+		}
+
+		t.Logf("ok: %v", res)
+	})
+}
--- a/internal/pkg/core/deployer/providers/volcengine-imagex/volcengine_imagex.go
+++ b/internal/pkg/core/deployer/providers/volcengine-imagex/volcengine_imagex.go
@ -83,9 +83,9 @@ func (d *VolcEngineImageXDeployer) Deploy(ctx context.Context, certPem string, p
 	upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
 	if err != nil {
 		return nil, xerrors.Wrap(err, "failed to upload certificate file")
-	}
-
+	} else {
 		d.logger.Logt("certificate file uploaded", upres)
+	}

 	// 获取域名配置
 	// REF: https://www.volcengine.com/docs/508/9366
--- a/internal/pkg/core/uploader/providers/huaweicloud-waf/huaweicloud_waf.go
+++ b/internal/pkg/core/uploader/providers/huaweicloud-waf/huaweicloud_waf.go
@ -7,6 +7,10 @@ import (
 	"time"

 	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
+	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/global"
+	hcIam "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3"
+	hcIamModel "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3/model"
+	hcIamRegion "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iam/v3/region"
 	hcWaf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1"
 	hcWafModel "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model"
 	hcWafRegion "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region"
@ -64,11 +68,11 @@ func (u *HuaweiCloudWAFUploader) Upload(ctx context.Context, certPem string, pri
 	// REF: https://support.huaweicloud.com/api-waf/ListCertificates.html
 	// REF: https://support.huaweicloud.com/api-waf/ShowCertificate.html
 	listCertificatesPage := int32(1)
-	listCertificatesLimit := int32(100)
+	listCertificatesPageSize := int32(100)
 	for {
 		listCertificatesReq := &hcWafModel.ListCertificatesRequest{
 			Page:     hwsdk.Int32Ptr(listCertificatesPage),
-			Pagesize: hwsdk.Int32Ptr(listCertificatesLimit),
+			Pagesize: hwsdk.Int32Ptr(listCertificatesPageSize),
 		}
 		listCertificatesResp, err := u.sdkClient.ListCertificates(listCertificatesReq)
 		if err != nil {
@ -107,7 +111,7 @@ func (u *HuaweiCloudWAFUploader) Upload(ctx context.Context, certPem string, pri
 			}
 		}

-		if listCertificatesResp.Items == nil || len(*listCertificatesResp.Items) < int(listCertificatesLimit) {
+		if listCertificatesResp.Items == nil || len(*listCertificatesResp.Items) < int(listCertificatesPageSize) {
 			break
 		} else {
 			listCertificatesPage++
@ -141,9 +145,15 @@ func (u *HuaweiCloudWAFUploader) Upload(ctx context.Context, certPem string, pri
 }

 func createSdkClient(accessKeyId, secretAccessKey, region string) (*hcWaf.WafClient, error) {
+	projectId, err := getSdkProjectId(accessKeyId, secretAccessKey, region)
+	if err != nil {
+		return nil, err
+	}
+
 	auth, err := basic.NewCredentialsBuilder().
 		WithAk(accessKeyId).
 		WithSk(secretAccessKey).
+		WithProjectId(projectId).
 		SafeBuild()
 	if err != nil {
 		return nil, err
@ -165,3 +175,40 @@ func createSdkClient(accessKeyId, secretAccessKey, region string) (*hcWaf.WafCli
 	client := hcWaf.NewWafClient(hcClient)
 	return client, nil
 }
+
+func getSdkProjectId(accessKeyId, secretAccessKey, region string) (string, error) {
+	auth, err := global.NewCredentialsBuilder().
+		WithAk(accessKeyId).
+		WithSk(secretAccessKey).
+		SafeBuild()
+	if err != nil {
+		return "", err
+	}
+
+	hcRegion, err := hcIamRegion.SafeValueOf(region)
+	if err != nil {
+		return "", err
+	}
+
+	hcClient, err := hcIam.IamClientBuilder().
+		WithRegion(hcRegion).
+		WithCredential(auth).
+		SafeBuild()
+	if err != nil {
+		return "", err
+	}
+
+	client := hcIam.NewIamClient(hcClient)
+
+	request := &hcIamModel.KeystoneListProjectsRequest{
+		Name: &region,
+	}
+	response, err := client.KeystoneListProjects(request)
+	if err != nil {
+		return "", err
+	} else if response.Projects == nil || len(*response.Projects) == 0 {
+		return "", errors.New("no project found")
+	}
+
+	return (*response.Projects)[0].Id, nil
+}
--- a/ui/src/components/workflow/node/DeployNodeConfigForm.tsx
+++ b/ui/src/components/workflow/node/DeployNodeConfigForm.tsx
@ -34,6 +34,7 @@ import DeployNodeConfigFormDogeCloudCDNConfig from "./DeployNodeConfigFormDogeCl
 import DeployNodeConfigFormEdgioApplicationsConfig from "./DeployNodeConfigFormEdgioApplicationsConfig";
 import DeployNodeConfigFormHuaweiCloudCDNConfig from "./DeployNodeConfigFormHuaweiCloudCDNConfig";
 import DeployNodeConfigFormHuaweiCloudELBConfig from "./DeployNodeConfigFormHuaweiCloudELBConfig";
+import DeployNodeConfigFormHuaweiCloudWAFConfig from "./DeployNodeConfigFormHuaweiCloudWAFConfig";
 import DeployNodeConfigFormKubernetesSecretConfig from "./DeployNodeConfigFormKubernetesSecretConfig";
 import DeployNodeConfigFormLocalConfig from "./DeployNodeConfigFormLocalConfig";
 import DeployNodeConfigFormQiniuCDNConfig from "./DeployNodeConfigFormQiniuCDNConfig";
@ -165,6 +166,8 @@ const DeployNodeConfigForm = forwardRef<DeployNodeConfigFormInstance, DeployNode
          return <DeployNodeConfigFormHuaweiCloudCDNConfig {...nestedFormProps} />;
        case DEPLOY_PROVIDERS.HUAWEICLOUD_ELB:
          return <DeployNodeConfigFormHuaweiCloudELBConfig {...nestedFormProps} />;
+        case DEPLOY_PROVIDERS.HUAWEICLOUD_WAF:
+          return <DeployNodeConfigFormHuaweiCloudWAFConfig {...nestedFormProps} />;
        case DEPLOY_PROVIDERS.KUBERNETES_SECRET:
          return <DeployNodeConfigFormKubernetesSecretConfig {...nestedFormProps} />;
        case DEPLOY_PROVIDERS.LOCAL:
--- a/ui/src/components/workflow/node/DeployNodeConfigFormHuaweiCloudWAFConfig.tsx
+++ b/ui/src/components/workflow/node/DeployNodeConfigFormHuaweiCloudWAFConfig.tsx
@ -0,0 +1,132 @@
+import { useTranslation } from "react-i18next";
+import { Form, type FormInstance, Input, Select } from "antd";
+import { createSchemaFieldRule } from "antd-zod";
+import { z } from "zod";
+
+import Show from "@/components/Show";
+import { validDomainName } from "@/utils/validators";
+
+type DeployNodeConfigFormHuaweiCloudWAFConfigFieldValues = Nullish<{
+  resourceType: string;
+  region: string;
+  certificateId?: string;
+  domain?: string;
+  listenerId?: string;
+}>;
+
+export type DeployNodeConfigFormHuaweiCloudWAFConfigProps = {
+  form: FormInstance;
+  formName: string;
+  disabled?: boolean;
+  initialValues?: DeployNodeConfigFormHuaweiCloudWAFConfigFieldValues;
+  onValuesChange?: (values: DeployNodeConfigFormHuaweiCloudWAFConfigFieldValues) => void;
+};
+
+const RESOURCE_TYPE_CERTIFICATE = "certificate" as const;
+const RESOURCE_TYPE_CLOUDSERVER = "cloudserver" as const;
+const RESOURCE_TYPE_PREMIUMHOST = "premiumhost" as const;
+
+const initFormModel = (): DeployNodeConfigFormHuaweiCloudWAFConfigFieldValues => {
+  return {};
+};
+
+const DeployNodeConfigFormHuaweiCloudWAFConfig = ({
+  form: formInst,
+  formName,
+  disabled,
+  initialValues,
+  onValuesChange,
+}: DeployNodeConfigFormHuaweiCloudWAFConfigProps) => {
+  const { t } = useTranslation();
+
+  const formSchema = z.object({
+    resourceType: z.union([z.literal(RESOURCE_TYPE_CERTIFICATE), z.literal(RESOURCE_TYPE_CLOUDSERVER), z.literal(RESOURCE_TYPE_PREMIUMHOST)], {
+      message: t("workflow_node.deploy.form.huaweicloud_waf_resource_type.placeholder"),
+    }),
+    region: z
+      .string({ message: t("workflow_node.deploy.form.huaweicloud_waf_region.placeholder") })
+      .nonempty(t("workflow_node.deploy.form.huaweicloud_waf_region.placeholder"))
+      .trim(),
+    certificateId: z
+      .string()
+      .max(64, t("common.errmsg.string_max", { max: 64 }))
+      .trim()
+      .nullish()
+      .refine((v) => {
+        if (fieldResourceType !== RESOURCE_TYPE_CERTIFICATE) return true;
+        return !!v?.trim();
+      }, t("workflow_node.deploy.form.huaweicloud_waf_certificate_id.placeholder")),
+    domain: z
+      .string()
+      .nullish()
+      .refine((v) => {
+        if (fieldResourceType !== RESOURCE_TYPE_CLOUDSERVER && fieldResourceType !== RESOURCE_TYPE_PREMIUMHOST) return true;
+        return validDomainName(v!, { allowWildcard: true });
+      }, t("workflow_node.deploy.form.huaweicloud_waf_domain.placeholder")),
+  });
+  const formRule = createSchemaFieldRule(formSchema);
+
+  const fieldResourceType = Form.useWatch("resourceType", formInst);
+
+  const handleFormChange = (_: unknown, values: z.infer<typeof formSchema>) => {
+    onValuesChange?.(values);
+  };
+
+  return (
+    <Form
+      form={formInst}
+      disabled={disabled}
+      initialValues={initialValues ?? initFormModel()}
+      layout="vertical"
+      name={formName}
+      onValuesChange={handleFormChange}
+    >
+      <Form.Item name="resourceType" label={t("workflow_node.deploy.form.huaweicloud_waf_resource_type.label")} rules={[formRule]}>
+        <Select placeholder={t("workflow_node.deploy.form.huaweicloud_waf_resource_type.placeholder")}>
+          <Select.Option key={RESOURCE_TYPE_CERTIFICATE} value={RESOURCE_TYPE_CERTIFICATE}>
+            {t("workflow_node.deploy.form.huaweicloud_waf_resource_type.option.certificate.label")}
+          </Select.Option>
+          <Select.Option key={RESOURCE_TYPE_CLOUDSERVER} value={RESOURCE_TYPE_CLOUDSERVER}>
+            {t("workflow_node.deploy.form.huaweicloud_waf_resource_type.option.cloudserver.label")}
+          </Select.Option>
+          <Select.Option key={RESOURCE_TYPE_PREMIUMHOST} value={RESOURCE_TYPE_PREMIUMHOST}>
+            {t("workflow_node.deploy.form.huaweicloud_waf_resource_type.option.premiumhost.label")}
+          </Select.Option>
+        </Select>
+      </Form.Item>
+
+      <Form.Item
+        name="region"
+        label={t("workflow_node.deploy.form.huaweicloud_waf_region.label")}
+        rules={[formRule]}
+        tooltip={<span dangerouslySetInnerHTML={{ __html: t("workflow_node.deploy.form.huaweicloud_waf_region.tooltip") }}></span>}
+      >
+        <Input placeholder={t("workflow_node.deploy.form.huaweicloud_waf_region.placeholder")} />
+      </Form.Item>
+
+      <Show when={fieldResourceType === RESOURCE_TYPE_CERTIFICATE}>
+        <Form.Item
+          name="certificateId"
+          label={t("workflow_node.deploy.form.huaweicloud_waf_certificate_id.label")}
+          rules={[formRule]}
+          tooltip={<span dangerouslySetInnerHTML={{ __html: t("workflow_node.deploy.form.huaweicloud_waf_certificate_id.tooltip") }}></span>}
+        >
+          <Input placeholder={t("workflow_node.deploy.form.huaweicloud_waf_certificate_id.placeholder")} />
+        </Form.Item>
+      </Show>
+
+      <Show when={fieldResourceType === RESOURCE_TYPE_CLOUDSERVER || fieldResourceType === RESOURCE_TYPE_PREMIUMHOST}>
+        <Form.Item
+          name="domain"
+          label={t("workflow_node.deploy.form.huaweicloud_waf_domain.label")}
+          rules={[formRule]}
+          tooltip={<span dangerouslySetInnerHTML={{ __html: t("workflow_node.deploy.form.huaweicloud_waf_domain.tooltip") }}></span>}
+        >
+          <Input placeholder={t("workflow_node.deploy.form.huaweicloud_waf_domain.placeholder")} />
+        </Form.Item>
+      </Show>
+    </Form>
+  );
+};
+
+export default DeployNodeConfigFormHuaweiCloudWAFConfig;
--- a/ui/src/domain/provider.ts
+++ b/ui/src/domain/provider.ts
@ -195,6 +195,7 @@ export const DEPLOY_PROVIDERS = Object.freeze({
  EDGIO_APPLICATIONS: `${ACCESS_PROVIDERS.EDGIO}-applications`,
  HUAWEICLOUD_CDN: `${ACCESS_PROVIDERS.HUAWEICLOUD}-cdn`,
  HUAWEICLOUD_ELB: `${ACCESS_PROVIDERS.HUAWEICLOUD}-elb`,
+  HUAWEICLOUD_WAF: `${ACCESS_PROVIDERS.HUAWEICLOUD}-waf`,
  KUBERNETES_SECRET: `${ACCESS_PROVIDERS.KUBERNETES}-secret`,
  LOCAL: `${ACCESS_PROVIDERS.LOCAL}`,
  QINIU_CDN: `${ACCESS_PROVIDERS.QINIU}-cdn`,
@ -270,6 +271,7 @@ export const deployProvidersMap: Map<DeployProvider["type"] | string, DeployProv
    [DEPLOY_PROVIDERS.TENCENTCLOUD_SSL_DEPLOY, "provider.tencentcloud.ssl_deploy", DEPLOY_CATEGORIES.OTHER],
    [DEPLOY_PROVIDERS.HUAWEICLOUD_CDN, "provider.huaweicloud.cdn", DEPLOY_CATEGORIES.CDN],
    [DEPLOY_PROVIDERS.HUAWEICLOUD_ELB, "provider.huaweicloud.elb", DEPLOY_CATEGORIES.LOADBALANCE],
+    [DEPLOY_PROVIDERS.HUAWEICLOUD_WAF, "provider.huaweicloud.waf", DEPLOY_CATEGORIES.FIREWALL],
    [DEPLOY_PROVIDERS.BAIDUCLOUD_CDN, "provider.baiducloud.cdn", DEPLOY_CATEGORIES.CDN],
    [DEPLOY_PROVIDERS.VOLCENGINE_TOS, "provider.volcengine.tos", DEPLOY_CATEGORIES.STORAGE],
    [DEPLOY_PROVIDERS.VOLCENGINE_CDN, "provider.volcengine.cdn", DEPLOY_CATEGORIES.CDN],
--- a/ui/src/i18n/locales/en/nls.provider.json
+++ b/ui/src/i18n/locales/en/nls.provider.json
@ -50,6 +50,7 @@
  "provider.huaweicloud.cdn": "Huawei Cloud - CDN (Content Delivery Network)",
  "provider.huaweicloud.dns": "Huawei Cloud - DNS (Domain Name Service)",
  "provider.huaweicloud.elb": "Huawei Cloud - ELB (Elastic Load Balance)",
+  "provider.huaweicloud.waf": "Huawei Cloud - WAF (Web Application Firewall)",
  "provider.kubernetes": "Kubernetes",
  "provider.kubernetes.secret": "Kubernetes - Secret",
  "provider.local": "Local deployment",
--- a/ui/src/i18n/locales/en/nls.workflow.nodes.json
+++ b/ui/src/i18n/locales/en/nls.workflow.nodes.json
@ -226,6 +226,20 @@
  "workflow_node.deploy.form.huaweicloud_elb_listener_id.label": "Huawei Cloud ELB listener ID",
  "workflow_node.deploy.form.huaweicloud_elb_listener_id.placeholder": "Please enter Huawei Cloud ELB listener ID",
  "workflow_node.deploy.form.huaweicloud_elb_listener_id.tooltip": "For more information, see <a href=\"https://console-intl.huaweicloud.com/vpc/#/elb/list/grid\" target=\"_blank\">https://console-intl.huaweicloud.com/vpc/#/elb/list/grid</a>",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.label": "Resource type",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.placeholder": "Please select resource type",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.certificate.label": "WAF certificate",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.cloudserver.label": "WAF cloud server",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.premiumhost.label": "WAF premium host",
+  "workflow_node.deploy.form.huaweicloud_waf_region.label": "Huawei Cloud WAF region",
+  "workflow_node.deploy.form.huaweicloud_waf_region.placeholder": "Please enter Huawei Cloud WAF region (e.g. cn-north-1)",
+  "workflow_node.deploy.form.huaweicloud_waf_region.tooltip": "For more information, see <a href=\"https://console-intl.huaweicloud.com/apiexplorer/#/endpoint?locale=en-us\" target=\"_blank\">https://console-intl.huaweicloud.com/apiexplorer/#/endpoint</a>",
+  "workflow_node.deploy.form.huaweicloud_waf_certificate_id.label": "Huawei Cloud WAF certificate ID",
+  "workflow_node.deploy.form.huaweicloud_waf_certificate_id.placeholder": "Please enter Huawei Cloud WAF certificate ID",
+  "workflow_node.deploy.form.huaweicloud_waf_certificate_id.tooltip": "For more information, see <a href=\"https://console-intl.huaweicloud.com/console/#/waf/certificateManagement\" target=\"_blank\">https://console-intl.huaweicloud.com/console/#/waf/certificateManagement</a>",
+  "workflow_node.deploy.form.huaweicloud_waf_domain.label": "Huawei Cloud WAF domain",
+  "workflow_node.deploy.form.huaweicloud_waf_domain.placeholder": "Please enter Huawei Cloud WAF domain name",
+  "workflow_node.deploy.form.huaweicloud_waf_domain.tooltip": "For more information, see <a href=\"https://console-intl.huaweicloud.com/console/#/waf/domain/list\" target=\"_blank\">https://console-intl.huaweicloud.com/console/#/waf/domain/list</a>",
  "workflow_node.deploy.form.k8s_namespace.label": "Kubernetes Namespace",
  "workflow_node.deploy.form.k8s_namespace.placeholder": "Please enter Kubernetes Namespace",
  "workflow_node.deploy.form.k8s_namespace.tooltip": "For more information, see <a href=\"https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/\" target=\"_blank\">https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/</a>",
--- a/ui/src/i18n/locales/zh/nls.provider.json
+++ b/ui/src/i18n/locales/zh/nls.provider.json
@ -50,6 +50,7 @@
  "provider.huaweicloud.cdn": "华为云 - 内容分发网络 CDN",
  "provider.huaweicloud.dns": "华为云 - 云解析 DNS",
  "provider.huaweicloud.elb": "华为云 - 弹性负载均衡 ELB",
+  "provider.huaweicloud.waf": "华为云 - Web 应用防火墙 WAF",
  "provider.kubernetes": "Kubernetes",
  "provider.kubernetes.secret": "Kubernetes - Secret",
  "provider.local": "本地部署",
--- a/ui/src/i18n/locales/zh/nls.workflow.nodes.json
+++ b/ui/src/i18n/locales/zh/nls.workflow.nodes.json
@ -226,6 +226,20 @@
  "workflow_node.deploy.form.huaweicloud_elb_listener_id.label": "华为云 ELB 监听器 ID",
  "workflow_node.deploy.form.huaweicloud_elb_listener_id.placeholder": "请输入华为云 ELB 监听器 ID",
  "workflow_node.deploy.form.huaweicloud_elb_listener_id.tooltip": "这是什么？请参阅 <a href=\"https://console.huaweicloud.com/vpc/#/elb/list/grid\" target=\"_blank\">https://console.huaweicloud.com/vpc/#/elb/list/grid</a>",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.label": "证书替换方式",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.placeholder": "请选择证书替换方式",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.certificate.label": "替换指定证书",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.cloudserver.label": "替换指定云模式防护网站的证书",
+  "workflow_node.deploy.form.huaweicloud_waf_resource_type.option.premiumhost.label": "替换指定独享模式防护网站的证书",
+  "workflow_node.deploy.form.huaweicloud_waf_region.label": "华为云 WAF 服务区域",
+  "workflow_node.deploy.form.huaweicloud_waf_region.placeholder": "请输入华为云 WAF 服务区域（例如：cn-north-1）",
+  "workflow_node.deploy.form.huaweicloud_waf_region.tooltip": "这是什么？请参阅 <a href=\"https://console.huaweicloud.com/apiexplorer/#/endpoint\" target=\"_blank\">https://console.huaweicloud.com/apiexplorer/#/endpoint</a>",
+  "workflow_node.deploy.form.huaweicloud_waf_certificate_id.label": "华为云 WAF 证书 ID",
+  "workflow_node.deploy.form.huaweicloud_waf_certificate_id.placeholder": "请输入华为云 WAF 证书 ID",
+  "workflow_node.deploy.form.huaweicloud_waf_certificate_id.tooltip": "这是什么？请参阅 <a href=\"https://console.huaweicloud.com/console/#/waf/certificateManagement\" target=\"_blank\">https://console.huaweicloud.com/console/#/waf/certificateManagement</a>",
+  "workflow_node.deploy.form.huaweicloud_waf_domain.label": "华为云 WAF 防护域名（支持泛域名）",
+  "workflow_node.deploy.form.huaweicloud_waf_domain.placeholder": "请输入华为云 WAF 防护域名",
+  "workflow_node.deploy.form.huaweicloud_waf_domain.tooltip": "这是什么？请参阅 <a href=\"https://console.huaweicloud.com/console/#/waf/domain/list\" target=\"_blank\">https://console.huaweicloud.com/console/#/waf/domain/list</a>",
  "workflow_node.deploy.form.k8s_namespace.label": "Kubernetes 命名空间",
  "workflow_node.deploy.form.k8s_namespace.placeholder": "请输入 Kubernetes 命名空间",
  "workflow_node.deploy.form.k8s_namespace.tooltip": "这是什么？请参阅 <a href=\"https://kubernetes.io/zh-cn/docs/concepts/overview/working-with-objects/namespaces/\" target=\"_blank\">https://kubernetes.io/zh-cn/docs/concepts/overview/working-with-objects/namespaces/</a>",