gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-11 23:12:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

take 2 on making 0.20.0 work

Browse Source
This commit is contained in:
dovholuknf
2021-05-10 15:39:55 -04:00
parent b5c240677e
commit 7c0fdd2cff
12 changed files with 130 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
quickstart/docker/image/create-controller-config.sh
+1 -5
View File
@@ -143,9 +143,5 @@ web:
options: { }
- binding: edge-client
options: { }
apis:
- binding: edge-management
options: { }
- binding: edge-client
options: { }
HereDocForEdgeConfiguration
quickstart/docker/image/create-edge-router-config.sh
+4 -4
View File
@@ -3,10 +3,10 @@ cat > ${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.yaml <<HereDocForEdgeRouter
v: 3
identity:
cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-client.cert
server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.cert
key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.key
ca: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.chain.pem
cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-client.cert
server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-server.cert
key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-server.key
ca: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-server.chain.pem
ctrl:
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
quickstart/docker/image/create-edge-router-wss-config.sh
+4 -4
View File
@@ -3,10 +3,10 @@ cat > ${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.yaml <<HereDocForEdgeRouter
v: 3
identity:
cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-client.cert
server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.cert
key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.key
ca: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.chain.pem
cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-client.cert
server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-server.cert
key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-server.key
ca: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-server.chain.pem
ctrl:
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
quickstart/docker/image/create-pki.sh
+1 -55
View File
@@ -1,60 +1,6 @@
#!/bin/bash
function pki_client_server {
name_local=$1
ZITI_CA_NAME_local=$2
ip_local=$3
if [[ "${ip_local}" == "" ]]; then
ip_local="127.0.0.1"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
ziti pki create server --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
--server-file "${name_local}-server" \
--dns "${name_local},localhost" --ip "${ip_local}" \
--server-name "${name_local} server certificate"
else
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "key exists"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
ziti pki create client --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
--client-file "${name_local}-client" \
--key-file "${name_local}-server" \
--client-name "${name_local}"
else
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "key exists"
fi
echo " "
}
function pki_create_ca {
if ! test -f "${ZITI_PKI}/${1}/keys/${1}.key"; then
echo "Creating CA: ${1}"
ziti pki create ca --pki-root="${ZITI_PKI}" --ca-file="${1}" --ca-name="${1} Root CA"
else
echo "Creating CA: ${1}"
echo "key exists"
fi
echo " "
}
function pki_create_intermediate {
if ! test -f "${ZITI_PKI}/${2}/keys/${2}.key"; then
echo "Creating intermediate: ${1} ${2} ${3}"
ziti pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${1}" \
--intermediate-name "${2}" \
--intermediate-file "${2}" --max-path-len ${3}
else
echo "Creating intermediate: ${1} ${2} ${3}"
echo "key exists"
fi
echo " "
}
source ./pki-functions.sh
pki_create_ca "${ZITI_CONTROLLER_ROOTCA_NAME}"
pki_create_ca "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}"
quickstart/docker/image/create-private-router-config.sh
+4 -4
View File
@@ -3,10 +3,10 @@ cat > ${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.yaml <<HereDocForEdgeRouter
v: 3
identity:
cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-client.cert
server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.cert
key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.key
ca: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.chain.pem
cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-client.cert
server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-server.cert
key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-server.key
ca: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-server.chain.pem
ctrl:
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
quickstart/docker/image/create-router-pki.sh
+1 -26
View File
@@ -1,30 +1,5 @@
#!/bin/bash
function pki_client_server {
name_local=$1
ZITI_CA_NAME_local=$2
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
ziti pki create server --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
--server-file "${name_local}-server" \
--dns "${name_local},localhost" --ip 127.0.0.1 \
--server-name "${name_local} server certificate"
else
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "key exists"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
ziti pki create client --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
--client-file "${name_local}-client" \
--key-file "${name_local}-server" \
--client-name "${name_local}"
else
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "key exists"
fi
echo " "
}
source ./pki-functions.sh
pki_client_server "${ZITI_EDGE_ROUTER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE}"
quickstart/docker/image/pki-functions.sh
+103
View File
@@ -0,0 +1,103 @@
#!/usr/bin/env bash
function pki_client_server {
name_local=$1
ZITI_CA_NAME_local=$2
ip_local=$3
if [[ "${ip_local}" == "" ]]; then
ip_local="127.0.0.1"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
ziti pki create server --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
--server-file "${name_local}-server" \
--dns "${name_local},localhost" --ip "${ip_local}" \
--server-name "${name_local} server certificate"
else
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "key exists"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
ziti pki create client --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
--client-file "${name_local}-client" \
--key-file "${name_local}-server" \
--client-name "${name_local}"
else
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "key exists"
fi
echo " "
}
function pki_create_ca {
if ! test -f "${ZITI_PKI}/${1}/keys/${1}.key"; then
echo "Creating CA: ${1}"
ziti pki create ca --pki-root="${ZITI_PKI}" --ca-file="${1}" --ca-name="${1} Root CA"
else
echo "Creating CA: ${1}"
echo "key exists"
fi
echo " "
}
function pki_create_intermediate {
if ! test -f "${ZITI_PKI}/${2}/keys/${2}.key"; then
echo "Creating intermediate: ${1} ${2} ${3}"
ziti pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${1}" \
--intermediate-name "${2}" \
--intermediate-file "${2}" --max-path-len ${3}
else
echo "Creating intermediate: ${1} ${2} ${3}"
echo "key exists"
fi
echo " "
}
function yaml2json()
{
ruby -ryaml -rjson -e 'puts JSON.pretty_generate(YAML.load(ARGF))' $*
}
function printUsage()
{
echo "Usage: $1 [cert to test] [ca pool to use]"
}
function verifyCertAgainstPool()
{
if [[ "" == "$1" ]]
then
printUsage "verifyCertAgainstPool"
return 1
fi
if [[ "" == "$2" ]]
then
printUsage "verifyCertAgainstPool"
return 1
fi
echo " Verifying that this certificate:"
echo " - $1"
echo " is valid for this ca pool:"
echo " - $2"
echo ""
openssl verify -partial_chain -CAfile "$2" "$1"
if [ $? -eq 0 ]; then
echo ""
echo "============ SUCCESS! ============"
else
echo ""
echo "============ FAILED TO VALIDATE ============"
fi
}
function showIssuerAndSubjectForPEM()
{
echo "Displaying Issuer and Subject for cert pool:"
echo " $1"
openssl crl2pkcs7 -nocrl -certfile $1 | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)"
}
quickstart/local/create-router-pki.sh
Symlink
+1
View File
@@ -0,0 +1 @@
../docker/image/create-router-pki.sh
quickstart/local/express/express-dev-env.sh
+7 -6
View File
@@ -84,17 +84,12 @@ function expressConfiguration {
else
nw="$1"
fi
export ZITI_EDGE_ROUTER_RAWNAME="public-edge-router"
export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"
if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
generateEnvFile "${nw}"
#checkHostsFile
getLatestZiti "yes"
generatePki
generateControllerConfig
generateEdgeRouterConfig
initializeController
startZitiController
echo "starting the ziti controller to enroll the edge router"
@@ -109,6 +104,12 @@ function expressConfiguration {
unused=$(ziti edge delete service-edge-router-policy allSvcPublicRouters)
unused=$(ziti edge create service-edge-router-policy allSvcPublicRouters --edge-router-roles '#public' --service-roles '#all')
if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
"${ZITI_SCRIPTS}/create-router-pki.sh"
generateEdgeRouterConfig
echo "---------- Creating edge-router ${ZITI_EDGE_ROUTER_HOSTNAME}...."
unused=$(ziti edge delete edge-router "${ZITI_EDGE_ROUTER_HOSTNAME}")
unused=$(ziti edge create edge-router "${ZITI_EDGE_ROUTER_HOSTNAME}" -o "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.jwt" -t)
@@ -117,7 +118,7 @@ function expressConfiguration {
unused=$(ziti-router enroll "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.yaml" --jwt "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.jwt" &> "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.enrollment.log")
echo ""
sleep 1
unused=$(ziti-router run "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.yaml" > "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.log" 2>&1 &)
unused=$(ziti-router run "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.yaml" > "${ZITI_HOME}/ziti-edge-router-${ZITI_EDGE_ROUTER_HOSTNAME}.log" 2>&1 &)
}
function decideOperation {
quickstart/local/pki-functions.sh
-45
View File
@@ -1,45 +0,0 @@
function yaml2json()
{
ruby -ryaml -rjson -e 'puts JSON.pretty_generate(YAML.load(ARGF))' $*
}
function printUsage()
{
echo "Usage: $1 [cert to test] [ca pool to use]"
}
function verifyCertAgainstPool()
{
if [[ "" == "$1" ]]
then
printUsage "verifyCertAgainstPool"
return 1
fi
if [[ "" == "$2" ]]
then
printUsage "verifyCertAgainstPool"
return 1
fi
echo " Verifying that this certificate:"
echo " - $1"
echo " is valid for this ca pool:"
echo " - $2"
echo ""
openssl verify -partial_chain -CAfile "$2" "$1"
if [ $? -eq 0 ]; then
echo ""
echo "============ SUCCESS! ============"
else
echo ""
echo "============ FAILED TO VALIDATE ============"
fi
}
function showIssuerAndSubjectForPEM()
{
echo "Displaying Issuer and Subject for cert pool:"
echo " $1"
openssl crl2pkcs7 -nocrl -certfile $1 | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)"
}
quickstart/local/pki-functions.sh
Symlink
+1
View File
@@ -0,0 +1 @@
../docker/image/pki-functions.sh
quickstart/local/restart-ziti.sh
+1 -1
View File
@@ -14,7 +14,7 @@ source ${curdir}/env.sh
DIRNAME=$(dirname $0)
[[ ${USE_DNSMASQ:-} -eq 1 ]] && source ${DIRNAME}/run-dns.sh
ziti-controller -v run "${ZITI_HOME}/controller.yaml" > "${ZITI_HOME}/ziti-controller.log" 2>&1 &
ziti-controller -v run "${ZITI_HOME}/controller.yaml" > "${ZITI_HOME}/ziti_edge-controller.log" 2>&1 &
# sleep 2
# ziti-router run "${ZITI_HOME}/${ZITI_ROUTER_BR_NAME}.yaml" > "${ZITI_HOME}/ziti-${ZITI_ROUTER_BR_NAME}.log" 2>&1 &
# sleep 1
quickstart/ziti-cli-functions.sh
+2 -2
View File
@@ -57,8 +57,8 @@ function initializeController {
echo -e "ziti-controller initialized. see $(BLUE ${ZITI_HOME}/controller-init.log) for details"
}
function startZitiController {
unused=$(ziti-controller run "${ZITI_HOME}/controller.yaml" > "${ZITI_HOME}/ziti-controller.log" 2>&1 &)
echo -e "ziti-controller started. log located at: $(BLUE ${ZITI_HOME}/ziti-controller.log)"
unused=$(ziti-controller run "${ZITI_HOME}/controller.yaml" > "${ZITI_HOME}/ziti-edge-controller.log" 2>&1 &)
echo -e "ziti-controller started. log located at: $(BLUE ${ZITI_HOME}/ziti-edge-controller.log)"
}
function stopZitiController {
killall ziti-controller