gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-11 23:12:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding EXTERNAL_DNS to PKI for controller

Browse Source
This commit is contained in:
gberl002
2022-05-03 18:23:31 -04:00
parent 7900350afb
commit 0cb47ff486
1 changed files with 22 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
quickstart/docker/image/ziti-cli-functions.sh
+22 -19
View File
@@ -56,7 +56,7 @@ function cleanZitiController {
}
function initializeController {
log_file="${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}-init.log"
"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}"
"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}"
echo -e "ziti-controller initialized. see $(BLUE "${log_file}") for details"
}
function startZitiController {
@@ -611,33 +611,34 @@ function expressInstall {
}
function pki_client_server {
name_local=${1-}
ZITI_CA_NAME_local=$2
ip_local=$3
file_name=${1-}
allow_list=$2
ZITI_CA_NAME_local=$3
ip_local=$4
if [[ "${ip_local}" == "" ]]; then
ip_local="127.0.0.1"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${file_name}-server.key"; then
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
"${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \
--server-file "${name_local}-server" \
--dns "${name_local},localhost" --ip "${ip_local}" \
--server-name "${name_local} server certificate"
--server-file "${file_name}-server" \
--dns "${allow_list}" --ip "${ip_local}" \
--server-name "${file_name} server certificate"
else
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
echo "key exists"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${file_name}-client.key"; then
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
"${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \
--client-file "${name_local}-client" \
--key-file "${name_local}-server" \
--client-name "${name_local}"
--client-file "${file_name}-client" \
--key-file "${file_name}-server" \
--client-name "${file_name}"
else
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
echo "key exists"
fi
echo " "
@@ -717,7 +718,7 @@ function createRouterPki {
export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.cert"
export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.key"
export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/cas.cert"
pki_client_server "${router_name}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}"
pki_client_server "${router_name}" "${router_name},localhost,$(hostname)" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}"
}
function createPrivateRouterConfig {
@@ -773,8 +774,10 @@ function createPki {
pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1
echo " "
pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}"
pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}"
pki_allow_list="${ZITI_CONTROLLER_HOSTNAME},localhost"
if [[ "$EXTERNAL_DNS" != "" ]]; then pki_allow_list="$pki_allow_list,$EXTERNAL_DNS"; fi
pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${pki_allow_list}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}"
pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}"
}