From 4176352d16cd834414bc3a336a5a23df751a6865 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Thu, 9 Dec 2021 16:24:33 -0500 Subject: [PATCH] update docker files for zac --- quickstart/docker/docker-compose.yml | 15 + quickstart/docker/image/ziti-cli-functions.sh | 263 ++++++------------ .../docker/simplified-docker-compose.yml | 15 + 3 files changed, 115 insertions(+), 178 deletions(-) diff --git a/quickstart/docker/docker-compose.yml b/quickstart/docker/docker-compose.yml index 157b81b50..813dfef1c 100644 --- a/quickstart/docker/docker-compose.yml +++ b/quickstart/docker/docker-compose.yml @@ -94,6 +94,21 @@ services: networks: - zitiblue + ziti-console: + image: openziti/zac + environment: + - ZAC_SERVER_CERT_CHAIN=/openziti/pki/ziti-controller-intermediate/certs/ziti-controller-server.cert + - ZAC_SERVER_KEY=/openziti/pki/ziti-controller-intermediate/keys/ziti-controller-server.key -it + ports: + - "1408:1408" + - "8443:8443" + volumes: + - ziti-fs:/openziti + + networks: + - zitiblue + - zitired + networks: zitired: zitiblue: diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh index 878db6316..fd866f605 100755 --- a/quickstart/docker/image/ziti-cli-functions.sh +++ b/quickstart/docker/image/ziti-cli-functions.sh @@ -45,11 +45,13 @@ function zitiLogin { "${ZITI_BIN_DIR-}/ziti" edge login "${ZITI_EDGE_CONTROLLER_API}" -u "${ZITI_USER-}" -p "${ZITI_PWD}" -c "${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert" } function cleanZitiController { - if [ "$(checkEnvVariable ZITI_HOME)" ]; then + ziti_home="${ZITI_HOME-}" + if [[ "${ziti_home}" == "" ]]; then + echo -e " * ERROR: $(RED "ZITI_HOME is not set") " return 1 fi - rm -rf "${ZITI_HOME}/db" - mkdir "${ZITI_HOME}/db" + rm -rf "${ziti_home}/db" + mkdir "${ziti_home}/db" initializeController } function initializeController { @@ -63,26 +65,20 @@ function startZitiController { echo -e "ziti-controller started as process id: $pid. log located at: $(BLUE "${ZITI_HOME-}/ziti-edge-controller.log")" return $pid } - function stopZitiController { killall ziti-controller # shellcheck disable=SC2181 if [[ $? == 0 ]]; then echo "Controller stopped."; fi } - function startExpressEdgeRouter { "${ZITI_BIN_DIR}/ziti-router" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.log" 2>&1 & pid=$! echo -e "Express Edge Router started as process id: $pid. log located at: $(BLUE "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.log")" return $pid } - function stopAllEdgeRouters { - killall ziti-controller - # shellcheck disable=SC2181 - if [[ $? == 0 ]]; then echo "Router(s) stopped."; fi + killall ziti-router } - function checkHostsFile { ctrlexists=$(grep -c "${ZITI_CONTROLLER_HOSTNAME}" /etc/hosts) edgectrlexists=$(grep -c "${ZITI_EDGE_CONTROLLER_HOSTNAME}" /etc/hosts) @@ -117,8 +113,6 @@ function checkHostsFile { echo " " echo "add these entries to your hosts file, and rerun the script when ready" return 1 - else - echo -e "$(GREEN "Hosts file looks good")" fi } @@ -148,7 +142,8 @@ function getLatestZitiVersion { function getLatestZiti { setupZitiHome - if [ "$(checkEnvVariable ZITI_HOME)" ]; then + if [[ "${ZITI_HOME-}" == "" ]]; then + echo "ERROR: ZITI_HOME is not set!" return 1 fi @@ -164,7 +159,12 @@ function getLatestZiti { return 1 fi - export ZITI_BIN_DIR="${ziti_bin_root}/ziti-${ZITI_BINARIES_VERSION}" + ziti_bin_ver="${ZITI_BINARIES_VERSION-}" + if [[ "${ziti_bin_ver}" == "" ]]; then + echo "ERROR: ZITI_BINARIES_VERSION is not set!" + return 1 + fi + export ZITI_BIN_DIR="${ziti_bin_root}/ziti-${ziti_bin_ver}" ZITI_BINARIES_FILE_ABSPATH="${ZITI_HOME-}/ziti-bin/${ZITI_BINARIES_FILE}" if ! test -f "${ZITI_BINARIES_FILE_ABSPATH}"; then @@ -222,9 +222,10 @@ function checkPrereqs { echo " " echo " " return 1 - else - echo -e "$(GREEN "Prerequisites confirmed")" fi + echo "Let's get stated creating your local development network!" + echo "" + echo "" } function checkControllerName { @@ -236,12 +237,7 @@ function checkControllerName { } function unsetZitiEnv { - if [[ "${1-}" == "-s" ]]; then - # Silent... - for zEnvVar in $(set | grep -e "^ZITI_" | sort); do envvar="$(echo "${zEnvVar}" | cut -d '=' -f1)"; unset "${envvar}"; done - else - for zEnvVar in $(set | grep -e "^ZITI_" | sort); do envvar="$(echo "${zEnvVar}" | cut -d '=' -f1)"; echo unsetting "[${envvar}]${zEnvVar}"; unset "${envvar}"; done - fi + for zEnvVar in $(set | grep -e "^ZITI_" | sort); do envvar="$(echo "${zEnvVar}" | cut -d '=' -f1)"; echo unsetting "[${envvar}]${zEnvVar}"; unset "${envvar}"; done unset ZITIx_EXPRESS_COMPLETE } @@ -273,8 +269,7 @@ function setupZitiNetwork { echo -n "what a hostname looks like. A good choice is to actually use your system's hostname: " echo -e "$(BLUE "$(hostname)")" echo " " - echo -en "$(echo -ne "Network Name [$(BLUE "$(hostname)")]: ")" - read -r ZITI_NETWORK + read -rp "$(echo -ne "Network Name [$(BLUE "$(hostname)")]: ")" ZITI_NETWORK echo " " if checkControllerName; then : #clear to continue @@ -283,8 +278,8 @@ function setupZitiNetwork { fi echo "name: ${ZITI_NETWORK-}" else - echo "" - echo "============ FAILED TO SETUP NETWORK ============" + echo " " + echo "nah bro" return 1 fi echo " " @@ -296,7 +291,7 @@ function setupZitiNetwork { function setupZitiHome { if [[ "${ZITI_HOME-}" == "" ]]; then export ZITI_HOME="${HOME}/.ziti/quickstart/${ZITI_NETWORK-}" - echo -e "using default ZITI_HOME: $(BLUE "${ZITI_HOME}")" + echo "using default ZITI_HOME: ${ZITI_HOME}" fi } @@ -324,22 +319,14 @@ function generateEnvFile { export ENV_FILE="${ZITI_HOME-}/${ZITI_NETWORK-}.env" - echo -e "environment file sourced from: $(BLUE "${ENV_FILE}")" + echo -e "environment file created and sourced from: $(BLUE "${ENV_FILE}")" } function ziti_expressConfiguration { if [[ "${ZITIx_EXPRESS_COMPLETE-}" != "" ]]; then echo -e "$(RED " --- It looks like you've run an express install in this shell already. ---")" - echo -en "Would you like to clear existing Ziti variables and continue (y/N)? " - read -r - echo " " - if [[ "${REPLY}" =~ [Yy]$ ]]; then - echo -e "$(GREEN "Clearing existing Ziti variables and continuing with express install")" - unsetZitiEnv "-s" - else - echo -e "$(RED " --- Exiting express install ---")" - return 1 - fi + echo -e "$(RED " --- Please execute unsetZitiEnv to clear any variables already set. ---")" + return 1 fi export ZITIx_EXPRESS_COMPLETE="true" echo " " @@ -362,9 +349,6 @@ function ziti_expressConfiguration { if [[ "${ZITI_EDGE_ROUTER_HOSTNAME-}" != "" ]]; then echo "ZITI_EDGE_ROUTER_HOSTNAME OVERIDDEN: $ZITI_EDGE_ROUTER_HOSTNAME"; fi if [[ "${ZITI_EDGE_ROUTER_PORT-}" != "" ]]; then echo "ZITI_EDGE_ROUTER_PORT OVERIDDEN: $ZITI_EDGE_ROUTER_PORT"; fi - echo " " - echo " " - echo -e "******** Setting Up Environment ********" if [[ "${1-}" == "" ]]; then nw="$(hostname)" else @@ -373,7 +357,7 @@ function ziti_expressConfiguration { setupZitiNetwork "${nw}" setupZitiHome - echo "ZITI HOME SET TO: $(BLUE "${ZITI_HOME}")" + echo "ZITI HOME SET TO: ${ZITI_HOME}" if ! getLatestZiti "no"; then echo -e "$(RED "getLatestZiti failed")" @@ -385,16 +369,9 @@ function ziti_expressConfiguration { fi #checkHostsFile - echo " " - echo " " - echo -e "******** Setting Up Public Key Infrastructure ********" createPki - - echo " " - echo " " - echo -e "******** Setting Up Controller ********" - createControllerConfig "controller" - #createControllerSystemdFile controller + createControllerConfig + #createControllerSystemdFile initializeController startZitiController echo "waiting for the controller to come online to allow the edge router to enroll" @@ -402,9 +379,6 @@ function ziti_expressConfiguration { zitiLogin - echo " " - echo " " - echo -e "******** Setting Up Edge Routers ********" echo -e "---------- Creating an edge router policy allowing all identities to connect to routers with a $(GREEN "#public") attribute" "${ZITI_BIN_DIR-}/ziti" edge delete edge-router-policy allEdgeRouters > /dev/null "${ZITI_BIN_DIR-}/ziti" edge create edge-router-policy allEdgeRouters --edge-router-roles '#public' --identity-roles '#all' > /dev/null @@ -421,12 +395,12 @@ function ziti_expressConfiguration { "${ZITI_BIN_DIR-}/ziti" edge delete edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" > /dev/null "${ZITI_BIN_DIR-}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" -o "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" -t -a "public"> /dev/null sleep 1 - echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...." + echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...." "${ZITI_BIN_DIR-}/ziti-router" enroll "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" --jwt "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" &> "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.enrollment.log" echo "" - stopZitiController + killall ziti-controller echo "Edge Router enrolled. Controller stopped." echo "" @@ -442,8 +416,7 @@ function decideToUseDefaultZitiHome { do echo "ZITI_HOME has not been set. Do you want to use the default ZITI_HOME: ${DEFAULT_ZITI_HOME_LOCATION}" echo " " - echo -en "Select an action: " - read -r yn + read -rp "Select an action: " yn case $yn in [yY]* ) break;; @@ -470,8 +443,7 @@ function decideOperation { echo " 3.) Create Edge Router configuration - answer a few questions and an edge router config will be emitted" echo " 4.) Start a network with the provided name" echo " " - echo -en "Select an action: " - read -r yn + read -rp "Select an action: " yn fi case $yn in [1]* ) @@ -509,10 +481,6 @@ function expressInstall { #make sure the user has all the necessary commands to be successful checkPrereqs - echo "Let's get started creating your local development network!" - echo "" - echo "" - #prompt the user for input and do what they want/need decideOperation 1 "${1-}" } @@ -573,11 +541,13 @@ function pki_create_intermediate { fi echo " " } -function printUsage() { +function printUsage() +{ echo "Usage: ${1-} [cert to test] [ca pool to use]" } -function verifyCertAgainstPool() { +function verifyCertAgainstPool() +{ if [[ "" == "${1-}" ]] then printUsage "verifyCertAgainstPool" @@ -606,7 +576,8 @@ function verifyCertAgainstPool() { fi } -function showIssuerAndSubjectForPEM() { +function showIssuerAndSubjectForPEM() +{ echo "Displaying Issuer and Subject for cert pool:" echo " ${1-}" openssl crl2pkcs7 -nocrl -certfile "${1-}" | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)" @@ -617,29 +588,18 @@ function createRouterPki { } function createPrivateRouterConfig { - # Allow router name to be passed in as arg router_name="${1-}" if [[ "${router_name}" == "" ]]; then - - # If router name is not passed as arg, prompt user for input - echo -e "$(YELLOW "createPrivateRouterConfig requires a router name to be supplied") " - default_router_name="${ZITI_EDGE_ROUTER_RAWNAME}" - echo -en "Enter router name (${default_router_name}):" - read -r router_name - - # Accept the default if no name provided - if [[ "${router_name}" == "" ]]; then - router_name="${default_router_name}" - fi - fi - - # Make sure necessary env variables are set - if [ "$(checkEnvVariable ZITI_HOME ZITI_BIN_DIR)" ]; then + echo -e " * ERROR: $(RED "createPrivateRouterConfig requires a parameter to be supplied") " return 1 fi -output_file="${ZITI_HOME-}/${router_name}.yaml" -cat > "${output_file}" < "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" < "${output_file}" < "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" < "${output_file}" < "${ZITI_HOME-}/${router_name}.yaml" < "${output_file}" < "${ziti_home}/${router_name}.yaml" < "${output_file}" < "${ZITI_HOME}/identities.yml" < "${ZITI_PKI_OS_SPECIFIC}/cas.pem" cat "${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert" >> "${ZITI_PKI_OS_SPECIFIC}/cas.pem" -echo "wrote CA file to: $(BLUE "${ZITI_PKI_OS_SPECIFIC}/cas.pem")" +echo "wrote CA file to: ${ZITI_PKI_OS_SPECIFIC}/cas.pem" -output_file="${ZITI_HOME}/${controller_name}.yaml" -cat > "${output_file}" < "${ziti_home}/controller.yaml" <