mirror of
https://github.com/openziti/ziti.git
synced 2026-10-15 00:22:01 +00:00
changelog and update deps
This commit is contained in:
Andrew Martinez
+135
@@ -1,3 +1,138 @@
|
||||
# Release 0.26.2
|
||||
|
||||
## What's New
|
||||
- Transport
|
||||
- WS/WSS Identity Support
|
||||
- Identity
|
||||
- Alternate Server Certificate Support
|
||||
- Edge
|
||||
- N/A
|
||||
- Fabric
|
||||
- N/A
|
||||
- Ziti CLI
|
||||
- Improvements to `ziti edge list posture-check` output
|
||||
- SDK Golang
|
||||
- N/A
|
||||
|
||||
## Transport
|
||||
### WS/WSS Identity Support
|
||||
|
||||
The binding `ws` and `wss` in the transport library now use identity for server certificates. Prior to this release
|
||||
`ws` and `wss` would load the `server_cert` and `key` field from files only. Both now support an optional field named
|
||||
`identity`. If not specified, the root `identity` field will be used. If specified it will be used for the specified
|
||||
`ws` or `wss` binding. Since this field is processed by the [identity library](https://github.com/openziti/identity)
|
||||
it supports all the private key and certificate sources that the identity framework supports (file, pem, hsm, etc.).
|
||||
Additionally it also enables SNI support for `ws` and `wss` listeners.
|
||||
|
||||
```yaml
|
||||
transport:
|
||||
ws:
|
||||
writeTimeout: 10
|
||||
readTimeout: 5
|
||||
idleTimeout: 5
|
||||
pongTimeout: 60
|
||||
pingInterval: 54
|
||||
handshakeTimeout: 10
|
||||
readBufferSize: 4096
|
||||
writeBufferSize: 4096
|
||||
enableCompression: false
|
||||
identity:
|
||||
server_cert: ./certs/er1.server.cert.pem
|
||||
server_key: ./certs/key.pem
|
||||
```
|
||||
|
||||
Example: Relying on in the root `server_cert` and `alt_server_cert` field
|
||||
```yaml
|
||||
v: 3
|
||||
|
||||
identity:
|
||||
cert: ./certs/er1.client.cert.pem
|
||||
server_cert: ./certs/er1.server.cert.pem
|
||||
key: ./certs/er1.key.pem
|
||||
ca: ./certs/er1.ca-chain.cert.pem
|
||||
alt_server_certs:
|
||||
- server_cert: ./certs/er1.alt.server.cert.pem
|
||||
server_key: ./certs/er1.alt.server.cert.pem
|
||||
...
|
||||
|
||||
transport:
|
||||
ws:
|
||||
writeTimeout: 10
|
||||
readTimeout: 5
|
||||
idleTimeout: 5
|
||||
pongTimeout: 60
|
||||
pingInterval: 54
|
||||
handshakeTimeout: 10
|
||||
readBufferSize: 4096
|
||||
writeBufferSize: 4096
|
||||
enableCompression: false
|
||||
```
|
||||
|
||||
## Identity
|
||||
### Alternate Server Certificate Support
|
||||
|
||||
The [identity library](https://github.com/openziti/identity) has been updated to support a new field: `alt_server_certs`
|
||||
. This field is an array of objects with `server_cert` and `server_key` fields. `alt_server_certs` is not touched by
|
||||
higher level Ziti automations to renew certificates and is intended for manual or externally automated use. It allows
|
||||
additional server certificates to be used for the controller and routers with separate private keys. It is useful in
|
||||
scenarios where routers or controllers are exposed using certificates signed by public CAs (i.e. Let's Encrypt).
|
||||
|
||||
The `server_cert` and `server_key` work the same as the root identity properties of the same name. In any single
|
||||
`server_cert` source that provides a chain, it assumed that all leaf-certificates are based on the private key in
|
||||
`server_key`. If `server_key` is not defined, the default root `server_key` will be used. The identity library will use
|
||||
the certificate chains and private key pairs specified in `alt_server_certs` when generating a TLS configuration via
|
||||
`ServerTLSConfig()`. All identity sources are viable: `pem`, `file`, etc.
|
||||
|
||||
Go Identity Config Struct Definition:
|
||||
```go
|
||||
type Config struct {
|
||||
Key string `json:"key" yaml:"key" mapstructure:"key"`
|
||||
Cert string `json:"cert" yaml:"cert" mapstructure:"cert"`
|
||||
ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"`
|
||||
ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"`
|
||||
AltServerCerts []ServerPair `json:"alt_server_certs,omitempty" yaml:"alt_server_certs,omitempty" mapstructure:"alt_server_certs,omitempty"`
|
||||
CA string `json:"ca,omitempty" yaml:"ca,omitempty" mapstructure:"ca"`
|
||||
}
|
||||
```
|
||||
|
||||
JSON Example:
|
||||
|
||||
```json
|
||||
{
|
||||
"cert": "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem",
|
||||
"key": "./ziti/etc/ca/intermediate/private/ctrl.key.pem",
|
||||
"server_cert": "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem",
|
||||
"server_key": "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem",
|
||||
"ca": "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem",
|
||||
"alt_server_certs": [
|
||||
{
|
||||
"server_cert": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem",
|
||||
"server_key": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem"
|
||||
},
|
||||
{
|
||||
"server_cert": "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT...",
|
||||
"server_key": "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..."
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
YAML Example:
|
||||
|
||||
```yaml
|
||||
cert: "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem"
|
||||
key: "./ziti/etc/ca/intermediate/private/ctrl.key.pem"
|
||||
server_cert: "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem"
|
||||
server_key: "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem"
|
||||
ca: "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem"
|
||||
alt_server_certs:
|
||||
- server_cert: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem"
|
||||
server_key: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem"
|
||||
- server_cert: "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT..."
|
||||
server_key: "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..."
|
||||
```
|
||||
|
||||
|
||||
# Release 0.26.1
|
||||
|
||||
There was a missed dependency update for xweb in 0.26.0 that kept SNI from working in HTTP API components. This would
|
||||
|
||||
@@ -23,22 +23,22 @@ require (
|
||||
github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19
|
||||
github.com/michaelquigley/pfxlog v0.6.9
|
||||
github.com/openziti/agent v1.0.1
|
||||
github.com/openziti/channel v0.18.53
|
||||
github.com/openziti/edge v0.22.21
|
||||
github.com/openziti/fabric v0.19.20
|
||||
github.com/openziti/channel v0.18.54
|
||||
github.com/openziti/edge v0.22.23
|
||||
github.com/openziti/fabric v0.19.21
|
||||
github.com/openziti/foundation/v2 v2.0.1
|
||||
github.com/openziti/identity v1.0.5
|
||||
github.com/openziti/metrics v1.0.2
|
||||
github.com/openziti/sdk-golang v0.16.98
|
||||
github.com/openziti/sdk-golang v0.16.99
|
||||
github.com/openziti/storage v0.1.14
|
||||
github.com/openziti/transport/v2 v2.0.16
|
||||
github.com/openziti/transport/v2 v2.0.17
|
||||
github.com/openziti/xweb/v2 v2.0.2
|
||||
github.com/openziti/ziti-db-explorer v1.1.1
|
||||
github.com/pborman/uuid v1.2.0
|
||||
github.com/pkg/errors v0.9.1
|
||||
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
|
||||
github.com/russross/blackfriday v1.5.2
|
||||
github.com/shirou/gopsutil/v3 v3.22.5
|
||||
github.com/shirou/gopsutil/v3 v3.22.6
|
||||
github.com/sirupsen/logrus v1.8.1
|
||||
github.com/spf13/cobra v1.5.0
|
||||
github.com/spf13/pflag v1.0.5
|
||||
|
||||
@@ -667,14 +667,14 @@ github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTm
|
||||
github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
|
||||
github.com/openziti/agent v1.0.1 h1:mk3M6MOyK75Qc+lOdtKHywfaxnbSES9qi4NiLZQxOMU=
|
||||
github.com/openziti/agent v1.0.1/go.mod h1:ALOg74f4b4GpUOjDPusp6lezbQa/7rgo09HOrodDWAw=
|
||||
github.com/openziti/channel v0.18.53 h1:YEGsizInlHoEPITJye/HZqTMykRvuzIoa4wrFMcSMkc=
|
||||
github.com/openziti/channel v0.18.53/go.mod h1:6vF4dSujAqDsmJU5+g82pXvZRiagqq972E0uNA4LG9o=
|
||||
github.com/openziti/channel v0.18.54 h1:aREX3VYknMmIBI2uQtg5jqkqEKRZOVZ+gkFuSm28GNM=
|
||||
github.com/openziti/channel v0.18.54/go.mod h1:VzfH+/biFfdDMqACj4xaeKsMhREqjyjHcA70JVS8E4k=
|
||||
github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k=
|
||||
github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo=
|
||||
github.com/openziti/edge v0.22.21 h1:tPvj5CcdFGIEY6jSkM2dhbRht4n+X4J0ISa5qwgJ9Dg=
|
||||
github.com/openziti/edge v0.22.21/go.mod h1:viW34MBUDZnLGW2mpHTnR89LHXYbmi74Umt2C6v6sNg=
|
||||
github.com/openziti/fabric v0.19.20 h1:3hd6q2pCwGdGRySvoFAdBeyMQwMNHr5ZdIwsJLUzoDA=
|
||||
github.com/openziti/fabric v0.19.20/go.mod h1:SLFSzdEqkCwJoW7nmUdeo2bvfDObK6M1h+fBQ8oUiGk=
|
||||
github.com/openziti/edge v0.22.23 h1:3Mbw5iv/9zG51ziqUg4iADdqjE9hDXzqqc2mrLCoMuc=
|
||||
github.com/openziti/edge v0.22.23/go.mod h1:7c9IErnlq/+cMaks6eltrE4YwF/12u/20f3GS86xDcU=
|
||||
github.com/openziti/fabric v0.19.21 h1:Zvs9Il/pJJoIr9Au3uQFmQLNG/GORDDMExfsY6HJD+4=
|
||||
github.com/openziti/fabric v0.19.21/go.mod h1:peqUiaaqc7I05oM5KXDSr8sX/iw8mwObkxB3fyqe+As=
|
||||
github.com/openziti/foundation/v2 v2.0.1 h1:HKYwAyxlZ4zmlt0t9Y/v6SWso0qUaeWapkWOlQDKPEk=
|
||||
github.com/openziti/foundation/v2 v2.0.1/go.mod h1:L75kwCC5WTUPqxuAd3G+WMBompaElMb/nYlJjR1sJ9Q=
|
||||
github.com/openziti/identity v1.0.5 h1:PKW1tj0ctOWgscL3P4gKiVFfKrP6dYeP0U6R8Aw6DKM=
|
||||
@@ -683,12 +683,12 @@ github.com/openziti/jwks v1.0.1 h1:+BtBzDWFVUlJfCbBhQR0BZI3YNtoBvfhfdCUSSB0G+0=
|
||||
github.com/openziti/jwks v1.0.1/go.mod h1:KwO0x9FBG0aoJS5f6nH5xeHoplyR1H143SMI9kF0mC8=
|
||||
github.com/openziti/metrics v1.0.2 h1:X3ip93aDDgVeyhqxBLVwCtdG7/kILktFxcpl5N2+4+E=
|
||||
github.com/openziti/metrics v1.0.2/go.mod h1:30EzUXm/VJfTVNoqPLx4x3mC/eslpCeh6wc4ejbZR/g=
|
||||
github.com/openziti/sdk-golang v0.16.98 h1:djkdN8DHGuJehnGYTx5fD1gPqEhBy9v0rXj/eVXFtcc=
|
||||
github.com/openziti/sdk-golang v0.16.98/go.mod h1:u/ft5kUJ2t4nxo0My33n0FNOc6MhBljmFJ4TpyfokEA=
|
||||
github.com/openziti/sdk-golang v0.16.99 h1:+2+/iIhAMhGcUmPng8htNvjvN5Cz5Saz8ifUTHCnkMU=
|
||||
github.com/openziti/sdk-golang v0.16.99/go.mod h1:Fjos3xNCHu/SHpEBb377x3pqxb1B6poyA8ytRcXknKk=
|
||||
github.com/openziti/storage v0.1.14 h1:JZv9OP0O4d3Z5c+ebaVpNUDJWrRsqgpTPHIwdCgYud0=
|
||||
github.com/openziti/storage v0.1.14/go.mod h1:PXc1iYT8m+EmZf9EGyRTFwAToY1/jd5cAV2FFxL2D/g=
|
||||
github.com/openziti/transport/v2 v2.0.16 h1:dTo8TyJeYzLly04eadbN8o6m2tehzNNGadyL7abSMHk=
|
||||
github.com/openziti/transport/v2 v2.0.16/go.mod h1:tkKEcr/NEjJ2NaYyn9ppAlXEidSOyusJGulfKLcqMws=
|
||||
github.com/openziti/transport/v2 v2.0.17 h1:vMzNaqZbtYs9z3GoUZJPfwUlt55ascTDmwzzvFH45p0=
|
||||
github.com/openziti/transport/v2 v2.0.17/go.mod h1:GgO7xeiT8pBxncGx/8wtz8XSelfpCGBC5pcG0FTGqcw=
|
||||
github.com/openziti/x509-claims v1.0.2 h1:PSv/xRfejIAcPc16A902k08rSBs3R8bjtL4qq6WEwCI=
|
||||
github.com/openziti/x509-claims v1.0.2/go.mod h1:Z0WIpBm6c4ecrpRKrou6Gk2wrLWxJO/+tuUwKh8VewE=
|
||||
github.com/openziti/xweb/v2 v2.0.2 h1:XYlVFriTq/U1wcUrc+XPnWJGhXh9NJPhtQ7+r3aC0cU=
|
||||
@@ -781,8 +781,8 @@ github.com/sacloud/libsacloud v1.36.2/go.mod h1:P7YAOVmnIn3DKHqCZcUKYUXmSwGBm3yS
|
||||
github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
|
||||
github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
|
||||
github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
|
||||
github.com/shirou/gopsutil/v3 v3.22.5 h1:atX36I/IXgFiB81687vSiBI5zrMsxcIBkP9cQMJQoJA=
|
||||
github.com/shirou/gopsutil/v3 v3.22.5/go.mod h1:so9G9VzeHt/hsd0YwqprnjHnfARAUktauykSbr+y2gA=
|
||||
github.com/shirou/gopsutil/v3 v3.22.6 h1:FnHOFOh+cYAM0C30P+zysPISzlknLC5Z1G4EAElznfQ=
|
||||
github.com/shirou/gopsutil/v3 v3.22.6/go.mod h1:EdIubSnZhbAvBS1yJ7Xi+AShB/hxwLHOMz4MCYz7yMs=
|
||||
github.com/shurcooL/component v0.0.0-20170202220835-f88ec8f54cc4/go.mod h1:XhFIlyj5a1fBNx5aJTbKoIq0mNaPvOagO+HjB3EtxrY=
|
||||
github.com/shurcooL/events v0.0.0-20181021180414-410e4ca65f48/go.mod h1:5u70Mqkb5O5cxEA8nxTsgrgLehJeAw6Oc4Ab1c/P1HM=
|
||||
github.com/shurcooL/github_flavored_markdown v0.0.0-20181002035957-2122de532470/go.mod h1:2dOwnU2uBioM+SGy2aZoq1f/Sd1l9OkAeAUvjSyvgU0=
|
||||
@@ -862,6 +862,7 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
|
||||
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
|
||||
github.com/stretchr/testify v1.7.4/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
|
||||
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
|
||||
@@ -1176,6 +1177,7 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc
|
||||
golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220712014510-0a85c31ab51e h1:NHvCuwuS43lGnYhten69ZWqi2QOj/CiDNcKbVqwVoew=
|
||||
golang.org/x/sys v0.0.0-20220712014510-0a85c31ab51e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
|
||||
|
||||
Reference in New Issue
Block a user