gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-13 07:41:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #159 from openziti/e2e.terminators

Browse Source 
E2e.terminators
This commit is contained in:
Andrew
2020-08-03 11:15:49 -04:00
committed by GitHub
parent 83a8ef338d c0482d1f3f
commit 87dddb421e
7 changed files with 84 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/release-notes.md
+50 -2
View File
@@ -1,11 +1,59 @@
# Release 0.15.3
* What's New:
# What's New:
* End-To-End Encryption Enhancements
* [e2e Service Configuration & Router Termination](https://github.com/openziti/edge/issues/173)
* Bug Fixes:
* [#152](https://github.com/openziti/ziti/issues/152) - Fix ziti-router enroll exit code on failure
* [#156](https://github.com/openziti/ziti/issues/156) - fix display of policies with empty roles lists
## End-To-End Encryption Enhancements
### E2E Encryption Router Termination
A new xgress module has been added specifically for handling Ziti Edge e2e to handle SDK to Router Termination scenarios.
Previously, only SDK-to-SDK end-to-end encryption was supported. When e2e encryption is desired
for a router terminated service, use the bind value `xgress_edge_transport` when defining
the terminator for the service. This value is now the default when using the CLI to create
a terminator. If the `binding` value is omitted when using the REST API directly, it will default
to `transport` - which does not support e2e encryption.
##### CLI Example (explicit binding):
```
ziti edge create terminator mytcpservice 002 tcp:my-tcp-service.com:12345 --binding xgress_edge_transport
```
##### Edge Rest API Example:
```
POST /terminators
{
"service": "ZbX9",
"router": "002",
"binding": "xgress_edge_transport",
"address": "tcp:my-tcp-service.com:12345"
}
```
### E2E Encryption Service Configuration
Edge Services can now be set to require e2e encryption. All Edge
Services defined before this version will default to requiring e2e
encryption. Existing services will need to have their terminators
updated to use `xgress_edge_transport` or update the service to not
require e2e encryption.
##### Create Service Example (e2e on)
```
POST /services
{
"name": "my-service",
"encryptionRequired": true
}
```
# Release 0.15.2
* What's New:
go.mod
+4 -4
View File
@@ -25,10 +25,10 @@ require (
github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0
github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19
github.com/michaelquigley/pfxlog v0.0.0-20190813191113-2be43bd0dccc
github.com/openziti/edge v0.15.20
github.com/openziti/fabric v0.11.54
github.com/openziti/foundation v0.11.12
github.com/openziti/sdk-golang v0.13.21
github.com/openziti/edge v0.15.30
github.com/openziti/fabric v0.11.58
github.com/openziti/foundation v0.11.16
github.com/openziti/sdk-golang v0.13.27
github.com/pborman/uuid v1.2.0
github.com/pkg/errors v0.9.1
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
go.sum
+18 -14
View File
@@ -102,6 +102,8 @@ github.com/go-openapi/jsonreference v0.18.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3Hfo
github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
github.com/go-openapi/jsonreference v0.19.3 h1:5cxNfTy0UVC3X8JL5ymxzyoUZmo8iZb+jeTWn7tUa8o=
github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
github.com/go-openapi/jsonreference v0.19.4 h1:3Vw+rh13uq2JFNxgnMTGE1rnoieU9FmyE1gvnyylsYg=
github.com/go-openapi/jsonreference v0.19.4/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg=
github.com/go-openapi/loads v0.17.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
github.com/go-openapi/loads v0.18.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
github.com/go-openapi/loads v0.19.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
@@ -123,6 +125,8 @@ github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8
github.com/go-openapi/spec v0.19.6/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHKHb3gWUSk=
github.com/go-openapi/spec v0.19.8 h1:qAdZLh1r6QF/hI/gTq+TJTvsQUodZsM7KLqkAJdiJNg=
github.com/go-openapi/spec v0.19.8/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHKHb3gWUSk=
github.com/go-openapi/spec v0.19.9 h1:9z9cbFuZJ7AcvOHKIY+f6Aevb4vObNDkTEyoMfO7rAc=
github.com/go-openapi/spec v0.19.9/go.mod h1:vqK/dIdLGCosfvYsQV3WfC7N3TiZSnGY2RZKoFK7X28=
github.com/go-openapi/strfmt v0.17.0/go.mod h1:P82hnJI0CXkErkXi8IKjPbNBM6lV6+5pLP5l494TcyU=
github.com/go-openapi/strfmt v0.18.0/go.mod h1:P82hnJI0CXkErkXi8IKjPbNBM6lV6+5pLP5l494TcyU=
github.com/go-openapi/strfmt v0.19.0/go.mod h1:+uW+93UVvGGq2qGaZxdDeJqSAqBqBdl+ZPMF/cC8nDY=
@@ -193,8 +197,8 @@ github.com/google/go-cmp v0.3.1 h1:Xye71clBPdm5HgqGwUkwhbynsUJZhDbS20FvLhQ2izg=
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.0 h1:/QaMHBdZ26BB3SSst0Iwl10Epc+xhTquomWX0oZEB6w=
github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.1 h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k=
github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -299,6 +303,8 @@ github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQz
github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
github.com/mitchellh/mapstructure v1.3.2 h1:mRS76wmkOn3KkKAyXDu42V+6ebnXWIztFSYGN7GeoRg=
github.com/mitchellh/mapstructure v1.3.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/mitchellh/mapstructure v1.3.3 h1:SzB1nHZ2Xi+17FP0zVQBHIZqvwRN9408fJO8h+eeNA8=
github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
github.com/netfoundry/secretstream v0.1.2 h1:NgqrYytDnjKbOfWI29TT0SJM+RwB3yf9MIkJVJaU+J0=
@@ -311,18 +317,14 @@ github.com/onsi/ginkgo v1.7.0 h1:WSHQ+IS43OoUrWtD1/bbclrwK8TTH5hzp+umCiuxHgs=
github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/gomega v1.4.3 h1:RE1xgDvH7imwFD45h+u2SgIfERHlS2yNG4DObb5BSKU=
github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
github.com/openziti/edge v0.15.20 h1:AJRMgs7tz2HMSKzliaxBHxuAZqPd0NqnABhF6pmUyjM=
github.com/openziti/edge v0.15.20/go.mod h1:VzEl+g4zbiFAWy+QCBZa+LvyYV8vxFblKjlKlcqn/jk=
github.com/openziti/fabric v0.11.53 h1:OVT71Hmbgf5gqsO7fz4iwsyP/T/ZzUfgOD0Bp39z/3U=
github.com/openziti/fabric v0.11.53/go.mod h1:d0EueCQD4CIC3TLAMdw0EoYb+GsmwPrZz3BwRgtU28c=
github.com/openziti/fabric v0.11.54 h1:o7s5sy6nloYAfLjyru01xpgoWjemgro5Vmj+JMrbM84=
github.com/openziti/fabric v0.11.54/go.mod h1:AR9VallPHO6h/o3xeRS/yBJNLgq++Ip18u9k2sbHmYY=
github.com/openziti/foundation v0.11.11 h1:GPASO0aTtzuzwQbfvu1OMOPdAKzi/DTkxKJ0y2NTzXU=
github.com/openziti/foundation v0.11.11/go.mod h1:Qdd7eCuTrpRwEeDbvYy89sFbEY4+J7OuX8UygxNBsvY=
github.com/openziti/foundation v0.11.12 h1:Dmi0hRnZCtB8uXWxHgaFpXppX5UVml76lGJKd5xwyo8=
github.com/openziti/foundation v0.11.12/go.mod h1:Qdd7eCuTrpRwEeDbvYy89sFbEY4+J7OuX8UygxNBsvY=
github.com/openziti/sdk-golang v0.13.21 h1:suH2LgSUGQBfu8lGIotXSxQvRRSGjZORdE6UrqvZGCM=
github.com/openziti/sdk-golang v0.13.21/go.mod h1:BKHVNgpVUv9nGuwXFYVTDmdfGjreZvVf1/g1UA8Lm5s=
github.com/openziti/edge v0.15.30 h1:5JXP/c/AxzZxm37d3nVDzlys8WJ2Th2p755xGpE5y7Y=
github.com/openziti/edge v0.15.30/go.mod h1:Me4HblJi5+ZC29sii2QpwVYgrC92Y2PYTrtFAe0nIW0=
github.com/openziti/fabric v0.11.58 h1:wPiUZxCQrJm+t9envMf0ksfgEjCWSI97KRmeG1W1R94=
github.com/openziti/fabric v0.11.58/go.mod h1:KJN8zm/krVb4aeMRR/8QcEszHQOoaGxUmE+jm88K4iA=
github.com/openziti/foundation v0.11.16 h1:8pWIEHGM6Stmc9QxW/R+saRzxkzDsTDlAcyO21qrh4k=
github.com/openziti/foundation v0.11.16/go.mod h1:4Jgs3HGDiP1aVk5nNzXJqwJwWhrjOYy1F+4Xtxcgxvo=
github.com/openziti/sdk-golang v0.13.27 h1:J0LSHHplqZiJLI6f22bo40+94n3k4QKQHSjvBM9DTX8=
github.com/openziti/sdk-golang v0.13.27/go.mod h1:leIaRUZzYSt+AHnwXlzH/XSX0hOhcjjJ/rMDTkieV/8=
github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6 h1:lNCW6THrCKBiJBpz8kbVGjC7MgdCGKwuvBgc7LoD6sw=
github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI=
github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
@@ -515,6 +517,8 @@ golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
ziti-router/subcmd/run.go
+4
View File
@@ -18,6 +18,7 @@ package subcmd
import (
"github.com/openziti/edge/gateway/xgress_edge"
"github.com/openziti/edge/gateway/xgress_edge_transport"
"github.com/openziti/fabric/router"
"github.com/openziti/fabric/router/xgress"
"github.com/sirupsen/logrus"
@@ -48,6 +49,9 @@ func run(cmd *cobra.Command, args []string) {
logrus.Panicf("error registering edge in framework (%v)", err)
}
xgressEdgeTransportFactory := xgress_edge_transport.NewFactory(config.Id, r)
xgress.GlobalRegistry().Register(xgress_edge_transport.BindingName, xgressEdgeTransportFactory)
if err := r.Run(); err != nil {
logrus.Panicf("error starting (%v)", err)
}
ziti/cmd/ziti/cmd/edge_controller/create_service.go
+3
View File
@@ -32,6 +32,7 @@ type createServiceOptions struct {
tags map[string]string
roleAttributes []string
configs []string
encryptionRequired bool
}
// newCreateServiceCmd creates the 'edge controller create service local' command for the given entity type
@@ -67,6 +68,7 @@ func newCreateServiceCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *co
cmd.Flags().StringSliceVarP(&options.roleAttributes, "role-attributes", "a", nil, "Role attributes of the new service")
cmd.Flags().StringSliceVarP(&options.configs, "configs", "c", nil, "Configuration id or names to be associated with the new service")
cmd.Flags().StringVar(&options.terminatorStrategy, "terminator-strategy", "", "Specifies the terminator strategy for the service")
cmd.Flags().BoolVar(&options.encryptionRequired, "encryption-required", true, "Whether e2e encryption is required for this service")
options.AddCommonFlags(cmd)
return cmd
@@ -85,6 +87,7 @@ func runCreateService(o *createServiceOptions) (err error) {
if o.terminatorStrategy != "" {
setJSONValue(entityData, o.terminatorStrategy, "terminatorStrategy")
}
setJSONValue(entityData, o.encryptionRequired, "encryptionRequired")
setJSONValue(entityData, o.roleAttributes, "roleAttributes")
setJSONValue(entityData, configs, "configs")
setJSONValue(entityData, o.tags, "tags")
ziti/cmd/ziti/cmd/edge_controller/create_terminator.go
+2 -1
View File
@@ -19,6 +19,7 @@ package edge_controller
import (
"fmt"
"github.com/Jeffail/gabs"
"github.com/openziti/edge/gateway/xgress_edge_transport"
"github.com/openziti/foundation/util/stringz"
"github.com/openziti/ziti/ziti/cmd/ziti/cmd/common"
cmdutil "github.com/openziti/ziti/ziti/cmd/ziti/cmd/factory"
@@ -63,7 +64,7 @@ func newCreateTerminatorCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer)
// allow interspersing positional args and flags
cmd.Flags().SetInterspersed(true)
cmd.Flags().StringVar(&options.binding, "binding", "transport", "Set the terminator binding")
cmd.Flags().StringVar(&options.binding, "binding", xgress_edge_transport.BindingName, "Set the terminator binding")
cmd.Flags().Int32VarP(&options.cost, "cost", "c", 0, "Set the terminator cost")
cmd.Flags().StringVarP(&options.precedence, "precedence", "p", "", "Set the terminator precedence ('default', 'required' or 'failed')")
options.AddCommonFlags(cmd)
ziti/cmd/ziti/cmd/edge_controller/list.go
+3 -1
View File
@@ -508,9 +508,11 @@ func outputServices(o *commonOptions, children []*gabs.Container, pagingInfo *pa
for _, entity := range children {
id, _ := entity.Path("id").Data().(string)
name, _ := entity.Path("name").Data().(string)
encryptionRequired, _ := entity.Path("encryptionRequired").Data().(bool)
terminatorStrategy, _ := entity.Path("terminatorStrategy").Data().(string)
roleAttributes := entity.Path("roleAttributes").String()
_, err := fmt.Fprintf(o.Out, "id: %v name: %v terminator strategy: %v role attributes: %v\n", id, name, terminatorStrategy, roleAttributes)
_, err := fmt.Fprintf(o.Out, "id: %v name: %v encryption required: %v terminator strategy: %v role attributes: %v\n", id, name, encryptionRequired , terminatorStrategy, roleAttributes)
if err != nil {
return err
}