From 6c764aac5656c1d4c2fcc588863fd51f331b4d96 Mon Sep 17 00:00:00 2001 From: gberl002 Date: Tue, 27 Sep 2022 15:10:37 -0400 Subject: [PATCH] ZITI_EDGE_ROUTER_IP_OVERRIDE value is now added to SANs for router config generation Fixes #845 Signed-off-by: gberl002 --- CHANGELOG.md | 4 +++ ziti/cmd/ziti/cmd/config_templates/router.yml | 2 ++ ziti/cmd/ziti/cmd/create_config.go | 5 ++-- .../cmd/ziti/cmd/create_config_environment.go | 3 ++ .../ziti/cmd/create_config_router_common.go | 6 ++++ .../cmd/ziti/cmd/create_config_router_test.go | 30 +++++++++++++++++++ ziti/cmd/ziti/cmd/create_config_test.go | 1 + ziti/cmd/ziti/constants/constants.go | 2 ++ 8 files changed, 51 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d924f05db..a2672297f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ - Ziti CLI - `ziti edge create|update ca` now supports `externalIdClaim` - Improved List CAs + - Bug Fixes - Identity - Automatic File Reloads @@ -196,6 +197,9 @@ Example: │ │ │ │ │ │ │ Identity Roles │ three, two,one │ ╰────────────────────────┴─────────┴────────┴────────────┴─────────────┴─────────────────┴──────────────────────┴────────────────────────╯ ``` +### Bug Fixes + +* [Issue 845](https://github.com/openziti/ziti/issues/845): Setting ZITI_EDGE_ROUTER_IP_OVERRIDE now adds the IP to the CSR SANs of the router config ## Ziti Library Updates diff --git a/ziti/cmd/ziti/cmd/config_templates/router.yml b/ziti/cmd/ziti/cmd/config_templates/router.yml index 4676eb883..035905b12 100644 --- a/ziti/cmd/ziti/cmd/config_templates/router.yml +++ b/ziti/cmd/ziti/cmd/config_templates/router.yml @@ -50,6 +50,7 @@ csr: - localhost ip: - "127.0.0.1" +{{ if .Router.Edge.IPOverride }} - "{{ .Router.Edge.IPOverride }}"{{ end }} {{ else }} edge: csr: @@ -64,6 +65,7 @@ edge: - localhost ip: - "127.0.0.1" +{{ if .Router.Edge.IPOverride }} - "{{ .Router.Edge.IPOverride }}"{{ end }} {{ end }} {{ if not .Router.IsWss }}#{{ end }}transport: {{ if not .Router.IsWss }}#{{ end }} ws: diff --git a/ziti/cmd/ziti/cmd/create_config.go b/ziti/cmd/ziti/cmd/create_config.go index dfaf30e4a..cdec4754d 100644 --- a/ziti/cmd/ziti/cmd/create_config.go +++ b/ziti/cmd/ziti/cmd/create_config.go @@ -128,8 +128,9 @@ type RouterTemplateValues struct { } type EdgeRouterTemplateValues struct { - Hostname string - Port string + Hostname string + Port string + IPOverride string } type WSSRouterTemplateValues struct { diff --git a/ziti/cmd/ziti/cmd/create_config_environment.go b/ziti/cmd/ziti/cmd/create_config_environment.go index a123580a4..ba6a4d129 100644 --- a/ziti/cmd/ziti/cmd/create_config_environment.go +++ b/ziti/cmd/ziti/cmd/create_config_environment.go @@ -111,6 +111,7 @@ func NewCmdCreateConfigEnvironment() *cobra.Command { {constants.ZitiRouterIdentityServerCertVarName, constants.ZitiRouterIdentityServerCertVarDescription, data.Router.IdentityServerCert}, {constants.ZitiRouterIdentityKeyVarName, constants.ZitiRouterIdentityKeyVarDescription, data.Router.IdentityKey}, {constants.ZitiRouterIdentityCAVarName, constants.ZitiRouterIdentityCAVarDescription, data.Router.IdentityCA}, + {constants.ZitiEdgeRouterIPOverrideVarName, constants.ZitiEdgeRouterIPOverrideVarDescription, data.Router.Edge.IPOverride}, {constants.ZitiCtrlListenerAddressVarName, constants.ZitiCtrlListenerAddressVarDescription, data.Controller.ListenerAddress}, {constants.ZitiCtrlAdvertisedAddressVarName, constants.ZitiCtrlAdvertisedAddressVarDescription, data.Controller.AdvertisedAddress}, {constants.ZitiEdgeCtrlListenerHostPortVarName, constants.ZitiEdgeCtrlListenerHostPortVarDescription, data.Controller.Edge.ListenerHostPort}, @@ -176,6 +177,7 @@ func NewCmdCreateConfigEnvironment() *cobra.Command { "%-36s %-50s %s\n"+ "%-36s %-50s %s\n"+ "%-36s %-50s %s\n"+ + "%-36s %-50s %s\n"+ "%-36s %-50s %s", constants.ZitiHomeVarName, constants.ZitiHomeVarDescription, data.ZitiHome, constants.ZitiCtrlPortVarName, constants.ZitiCtrlPortVarDescription, data.Controller.Port, @@ -191,6 +193,7 @@ func NewCmdCreateConfigEnvironment() *cobra.Command { constants.ZitiRouterIdentityServerCertVarName, constants.ZitiRouterIdentityServerCertVarDescription, data.Router.IdentityServerCert, constants.ZitiRouterIdentityKeyVarName, constants.ZitiRouterIdentityKeyVarDescription, data.Router.IdentityKey, constants.ZitiRouterIdentityCAVarName, constants.ZitiRouterIdentityCAVarDescription, data.Router.IdentityCA, + constants.ZitiEdgeRouterIPOverrideVarName, constants.ZitiEdgeRouterIPOverrideVarDescription, data.Router.Edge.IPOverride, constants.ZitiCtrlIdentityCertVarName, constants.ZitiCtrlIdentityCertVarDescription, data.Controller.IdentityCert, constants.ZitiCtrlIdentityServerCertVarName, constants.ZitiCtrlIdentityServerCertVarDescription, data.Controller.IdentityServerCert, constants.ZitiCtrlIdentityKeyVarName, constants.ZitiCtrlIdentityKeyVarDescription, data.Controller.IdentityKey, diff --git a/ziti/cmd/ziti/cmd/create_config_router_common.go b/ziti/cmd/ziti/cmd/create_config_router_common.go index aa50b5c43..f01e916f2 100644 --- a/ziti/cmd/ziti/cmd/create_config_router_common.go +++ b/ziti/cmd/ziti/cmd/create_config_router_common.go @@ -38,6 +38,12 @@ func SetZitiRouterIdentity(r *RouterTemplateValues, routerName string) { } else { r.Edge.Hostname, _ = os.Hostname() } + + // Edge router IP override + edgeRouterIPOverride := os.Getenv(constants.ZitiEdgeRouterIPOverrideVarName) + if edgeRouterIPOverride != "" { + r.Edge.IPOverride = edgeRouterIPOverride + } } func SetZitiRouterIdentityCert(r *RouterTemplateValues, routerName string) { val := os.Getenv(constants.ZitiRouterIdentityCertVarName) diff --git a/ziti/cmd/ziti/cmd/create_config_router_test.go b/ziti/cmd/ziti/cmd/create_config_router_test.go index 55075883b..7bf3d7e7f 100644 --- a/ziti/cmd/ziti/cmd/create_config_router_test.go +++ b/ziti/cmd/ziti/cmd/create_config_router_test.go @@ -4,6 +4,7 @@ import ( "github.com/openziti/ziti/ziti/cmd/ziti/constants" "github.com/stretchr/testify/assert" "os" + "strings" "testing" "time" ) @@ -316,3 +317,32 @@ func TestExecuteCreateConfigRouterFabricHasNonBlankTemplateValues(t *testing.T) assert.NotZero(t, *value, expectedNonEmptyTimeFields[field]+" should be a non-zero value") } } + +func TestEdgeRouterIPOverrideIsConsumed(t *testing.T) { + routerName := "MyFabricRouter" + blank := "" + externalIP := "123.456.78.9" + + // Setup options + clearOptionsAndTemplateData() + routerOptions.Output = defaultOutput + + // Set the env variable to non-empty value + _ = os.Setenv(constants.ZitiEdgeRouterIPOverrideVarName, externalIP) + + // Check that template value is currently blank + assert.Equal(t, blank, data.Router.Edge.IPOverride, "Mismatch router IP override, expected %s but got %s", blank, data.Router.Edge.IPOverride) + + // Create and run the CLI command (capture output, otherwise config prints to stdout instead of test results) + cmd := NewCmdCreateConfigRouter() + cmd.SetArgs([]string{"edge", "--routerName", routerName}) + configOutput := captureOutput(func() { + _ = cmd.Execute() + }) + + // Check that the template values now contains the custom external IP override value + assert.Equal(t, externalIP, data.Router.Edge.IPOverride, "Mismatch router IP override, expected %s but got %s", externalIP, data.Router.Edge.IPOverride) + + // Check that the config output has the IP + assert.True(t, strings.Contains(configOutput, externalIP), "Expected value not found; expected to find value of "+constants.ZitiEdgeRouterIPOverrideVarName+" in config output.") +} diff --git a/ziti/cmd/ziti/cmd/create_config_test.go b/ziti/cmd/ziti/cmd/create_config_test.go index 9df823841..ebcb9370b 100644 --- a/ziti/cmd/ziti/cmd/create_config_test.go +++ b/ziti/cmd/ziti/cmd/create_config_test.go @@ -32,6 +32,7 @@ func getZitiEnvironmentVariables() []string { "ZITI_ROUTER_IDENTITY_SERVER_CERT", "ZITI_ROUTER_IDENTITY_KEY", "ZITI_ROUTER_IDENTITY_CA", + "ZITI_EDGE_ROUTER_IP_OVERRIDE", "ZITI_CTRL_LISTENER_ADDRESS", "ZITI_CTRL_ADVERTISED_ADDRESS", "ZITI_CTRL_EDGE_LISTENER_HOST_PORT", diff --git a/ziti/cmd/ziti/constants/constants.go b/ziti/cmd/ziti/constants/constants.go index 8a0b39971..90ce33c5a 100644 --- a/ziti/cmd/ziti/constants/constants.go +++ b/ziti/cmd/ziti/constants/constants.go @@ -99,4 +99,6 @@ const ( ZitiEdgeCtrlAdvertisedPortVarName = "ZITI_EDGE_CONTROLLER_PORT" ZitiEdgeCtrlAdvertisedPortVarDescription = "The advertised port of the edge controller" ExternalDNSVarName = "EXTERNAL_DNS" + ZitiEdgeRouterIPOverrideVarName = "ZITI_EDGE_ROUTER_IP_OVERRIDE" + ZitiEdgeRouterIPOverrideVarDescription = "Override the default edge router IP with a custom IP, this IP will also be added to the PKI" )