gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-12 23:32:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #181 from openziti/release-next

Browse Source 
Release 0.16.1
This commit is contained in:
Andrew
2020-08-27 08:47:27 -04:00
committed by GitHub
parent e4ae43213a 3c0aa56af4
commit ae86b31729
16 changed files with 526 additions and 317 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+202 -175
View File
@@ -1,6 +1,33 @@
# Release 0.16.1
* What's New
* Metrics Refactoring
* [Support timers in metrics events](https://github.com/openziti/foundation/issues/121)
* [Convert json file reporter to generic reporter supporting multiple formatters, including json and plain](https://github.com/openziti/foundation/issues/122)
* Session Performance Fixes
* [Supported unindexed FK constraints in bbolt](https://github.com/openziti/foundation/issues/119)
* [Improve API Session and Session creation performance](https://github.com/openziti/edge/issues/281)
* [Make enrollment available from the ziti CLI](https://github.com/openziti/ziti/issues/182)
* Docker image for `ziti-tunnel` - Embellish examples and fix entrypoint script to wait for clean up of iptables rules on exit
* Various Internal Stability & Scale Fixes
* Edge Controller:
* Use bbolt batch operations where possible (heartbeat updates, sdk/env info)
* Stream API Sessions & Session during Edge Router Sync
* Removal of `Panic()` calls
* Edge Router:
* Support heartbeat interval configuration, default raised from 5s to 60s
* Ziti-Probe
* Attempts to retain and reuse API Sessions
* Attempts to reconnect on disconnection, API Session removal, session removal
* Improve reconnection strategy
* Adds `version` command to `ziti-probe`
* Go SDK
* Removal of `Fatal()` call
* Add ability to detect invalid sessions
# Release 0.16.0
# What's New:
## Overview:
**Important Note:** This release contains backwards incompatible changes. See below for details.
@@ -12,7 +39,7 @@
* [Denormalize policy links for performance](https://github.com/openziti/edge/issues/256)
* Datastore Integrity Checker
* [foundation#107](https://github.com/openziti/foundation/issues/107)
* [edge#258](https://github.com/openziti/edge/issues/258)
* [edge#258](https://github.com/openziti/edge/issues/258)
* [#163](https://github.com/openziti/ziti/issues/163)
* Events Framework
* [foundation#116](https://github.com/openziti/foundation/issues/116) - Add generic event framework and use it for metrics
@@ -27,8 +54,8 @@
* [edge#273](https://github.com/openziti/edge/issues/273) - Avoid tun "not pollable" read failures
* [fabric#114](https://github.com/openziti/fabric/issues/114) - When egress connect fails, router does not return failure to controller
* [fabric#117](https://github.com/openziti/fabric/issues/117) - Xgress setup has a race condition
* Backwards Compatibility
* Backwards Compatibility
* The `ziti edge snapshot-db` command is now `ziti edge db snapshot`
* In order to fix [fabric#117](https://github.com/openziti/fabric/issues/117), the xgress protocol flow had to be updated. This means 0.16+ controllers and routers will not work with older controllers and routers
@@ -36,7 +63,7 @@
### E2E Encryption Router Termination
A new xgress module has been added specifically for handling Ziti Edge e2e to handle SDK to Router Termination scenarios.
Previously, only SDK-to-SDK end-to-end encryption was supported. When e2e encryption is desired
for a router terminated service, use the bind value `xgress_edge_transport` when defining
for a router terminated service, use the bind value `edge_transport` when defining
the terminator for the service. This value is now the default when using the CLI to create
a terminator. If the `binding` value is omitted when using the REST API directly, it will default
to `transport` - which does not support e2e encryption.
@@ -44,7 +71,7 @@ to `transport` - which does not support e2e encryption.
##### CLI Example (explicit binding):
```
ziti edge create terminator mytcpservice 002 tcp:my-tcp-service.com:12345 --binding xgress_edge_transport
ziti edge create terminator mytcpservice 002 tcp:my-tcp-service.com:12345 --binding edge_transport
```
##### Edge Rest API Example:
@@ -54,7 +81,7 @@ POST /terminators
{
"service": "ZbX9",
"router": "002",
"binding": "xgress_edge_transport",
"binding": "edge_transport",
"address": "tcp:my-tcp-service.com:12345"
}
```
@@ -64,7 +91,7 @@ POST /terminators
Edge Services can now be set to require e2e encryption. All Edge
Services defined before this version will default to requiring e2e
encryption. Existing services will need to have their terminators
updated to use `xgress_edge_transport` or update the service to not
updated to use `edge_transport` or update the service to not
require e2e encryption.
##### Create Service Example (encryption required)
@@ -155,7 +182,7 @@ forwarder:
```
## Model Performance Improvements
Policy relationships are now stored in a denormalized fashion. This means that checking if an entity is tied to another entity via a policy is now a direct lookup, and much faster. This means that the Ziti controller should scale very well in cases where we have many identities, services and/or edge routers. Performance was tested against the APIs used by the SDKs.
Policy relationships are now stored in a denormalized fashion. This means that checking if an entity is tied to another entity via a policy is now a direct lookup, and much faster. This means that the Ziti controller should scale very well in cases where we have many identities, services and/or edge routers. Performance was tested against the APIs used by the SDKs.
See for more detail:
@@ -183,13 +210,13 @@ Ziti now has a shared events framework used across projects. Events are used int
Each project which exposes events will have a top-level events package where you can find registration hooks for all exposed events in the project
### Current Event Types
* foundation
* foundation
* metrics events
* fabric
* fabric session events (session created, session deleted, session path changed)
* trace events
* edge
* **NEW** edge session events (session created, session deleted)
* **NEW** edge session events (session created, session deleted)
* the session event created includes sessionId, session token, API sessionId and identity id
* the session deleted event includes sessionId and session token
@@ -198,7 +225,7 @@ NOTE: The clientId on fabric session events is the edge session token for fabric
# Release 0.15.3
* What's New:
* Add example docker compose for ziti-tunnel
* Add example docker compose for ziti-tunnel
# Release 0.15.2
@@ -215,7 +242,7 @@ NOTE: The clientId on fabric session events is the edge session token for fabric
* [edge#245](https://github.com/openziti/edge/issue/245) - fingerprint calculation changed from 0.14 to 0.15. Ensure 0.15 routers can work with 0.14 controllers
* [edge#248](https://github.com/openziti/edge/issue/248) - Edge Router Hello can time out on slow networks with many links to establish
* [foundation#103](https://github.com/openziti/foundation/issues/103) - Fix config file env injection for lists
# Release 0.15.1
* What's New:
@@ -255,19 +282,19 @@ Ziti 0.15.0 includes the following:
The code to migrate a Ziti instance from pre-0.9 releases has been removed. If you want to migrate from a pre-0.9 version you should first update to 0.14.12, then to new versions.
## Database Snapshots
Database snapshots can now be triggered in a variety of ways to cause the creation of a dabase backup/snapshot. This can be done from the ziti-fabric CLI, the ziti CLI and the REST API
Database snapshots can now be triggered in a variety of ways to cause the creation of a dabase backup/snapshot. This can be done from the ziti-fabric CLI, the ziti CLI and the REST API
$ ziti-fabric snapshot-db
$ ziti edge snapshot-db
The REST API is available by POSTing to `/edge/v1/database/snapshot`. This ability is only available to administrators.
The snapshot will be a copy of the database file created within a bolt transaction. The file name will have the data and time appended to it. Snapshotting can be done at most once per minute.
The snapshot will be a copy of the database file created within a bolt transaction. The file name will have the data and time appended to it. Snapshotting can be done at most once per minute.
## Edge Routers/Fabric Router subtyping
Previously edge routers and fabric routers were closely related, but weren't actually the same entity. When an edge router was created, there was no corresponding fabric router until the edge router had been succesfully enrolled.
Previously edge routers and fabric routers were closely related, but weren't actually the same entity. When an edge router was created, there was no corresponding fabric router until the edge router had been succesfully enrolled.
Now, edge routers are a type of fabric router. When an edge router is created, it will be visible as a fabric router with no fingerprint. This means that the corresponding router application won't be able to connect until enrollment is complete.
Now, edge routers are a type of fabric router. When an edge router is created, it will be visible as a fabric router with no fingerprint. This means that the corresponding router application won't be able to connect until enrollment is complete.
This simplifies some things, including allowing adding terminators to an edge router before enrollment is complete.
@@ -452,7 +479,7 @@ Ziti 0.14.10 includes the following:
# Release 0.14.9
Ziti 0.14.9 includes the following:
* [Move ziti edge controller commands to ziti edge](https://github.com/openziti/ziti/issues/108)
* Note: for now `ziti edge` and `ziti edge controller` will both have edge controller related commands. `ziti edge controller` is deprecated and will be removed in a future release. Please update your scripts.
@@ -463,7 +490,7 @@ Ziti 0.14.8 includes the following:
# Release 0.14.7
Ziti 0.14.7 includes the following:
* [Add CLI support for updating terminators](https://github.com/openziti/ziti/issues/106)
* [Add CLI support for managing identity service config overrides](https://github.com/openziti/ziti/issues/105)
@@ -479,7 +506,7 @@ Ziti 0.14.5 includes the following:
* [CA Identity Name Format](https://github.com/openziti/edge/issues/147)
* [Remove sourceType from metrics](https://github.com/openziti/foundation/issues/68)
* Fix name of metric from `egress.tx.Msgrate` to `egress.tx.msgrate`
## Ziti Edge API
### CA Identity Name Format
@@ -529,13 +556,13 @@ authenticators with their target identities, addresses the root cause, and adds
# Release 0.14.2
## Theme
Ziti 0.14.2 includes the following:
* CLI enhancements
* [can't create service policy with @ identity name](https://github.com/openziti/ziti/issues/93)
* [can't create service policy with @ identity name](https://github.com/openziti/ziti/issues/93)
* [Add CLI commands to allow updating policies and role attributes](https://github.com/openziti/ziti/issues/94)
* [CLI: read config/config-type JSON from file](https://github.com/openziti/ziti/issues/90)
* [Not found errors for assigned/related ids do not say which resource was not found](https://github.com/openziti/edge/issues/148)
* Fixes to connection setup timing
* Fixes to connection setup timing
## CLI Updates
### Names in Policy Roles
@@ -581,8 +608,8 @@ Ziti 0.14.1 includes the following:
* Xt fixes
* Fixed strategies missing session ended events
* Fixed costed terminator sorting
* Fixed race condition where terminators could be selected right after delete because they would have default cost.
* Expanded space between precedence levels to ensure terminator static cost doesn't allow total costs to jump precedence boundary
* Fixed race condition where terminators could be selected right after delete because they would have default cost.
* Expanded space between precedence levels to ensure terminator static cost doesn't allow total costs to jump precedence boundary
* Fixed type error in failure cost tracker
* Logging cleanup - many log statements that were error or info have been dropped to debug
* ziti-probe can now handle partial configs
@@ -599,9 +626,9 @@ type Listener interface {
}
```
This allows clients to set their precedence to `failed` when shutting down. This will allow them to gracefully finishing any outstanding requests while ensuring that no new requests will be routed to this application. This should allow for applications to do round-robin upgrades without service interruption to clients. It also allows clients to influence costs on the fly based on knowledge available to the application.
This allows clients to set their precedence to `failed` when shutting down. This will allow them to gracefully finishing any outstanding requests while ensuring that no new requests will be routed to this application. This should allow for applications to do round-robin upgrades without service interruption to clients. It also allows clients to influence costs on the fly based on knowledge available to the application.
Support is currently limited to the Golang SDK, support in other SDKs will be forthcoming as it is prioritized.
Support is currently limited to the Golang SDK, support in other SDKs will be forthcoming as it is prioritized.
# Release 0.14.0
## Theme
@@ -609,7 +636,7 @@ Ziti 0.14.0 includes the following:
### Features
* The first full implementation of high availability (HA) and horizontal scale (HS) services
### Fixes
* [When using index scanner, wrong count is returned when using skip](https://github.com/openziti/foundation/issues/62)
* fabric now includes migration to extract terminators from services
@@ -628,9 +655,9 @@ The fabric now includes a new framework called Xt (eXtensible Terminators) which
1. Smart routing finds all the active terminators for the session (active meaning the terminator's router is connected)
1. Smart routing calculates a cost for each terminator then hands the service's terminator strategy a list of terminators and their costs ranked from lowest to highest
1. The strategy returns the terminator that should be used
1. A new session is created using that path.
Strategies will often work by adjusting terminator costs. The selection algorithm the simply returns the lowest cost option presented by smart routing.
1. A new session is created using that path.
Strategies will often work by adjusting terminator costs. The selection algorithm the simply returns the lowest cost option presented by smart routing.
#### Costs
There are a number of elements which feed the smart routing cost algorithm.
@@ -643,11 +670,11 @@ Each terminator has a static cost which can be set or updated when the terminato
#### Precedence
Each terminator has a precedence. There are three precedence levels: `required`, `default` and `failed`.
Smart routing will always rank terminators with higher precedence levels higher than terminators with lower precedence levers. So required terminators will always be first, default second and failed third. Precedence levels can be used to implement HA. The primary will be marked as required and the secondary as default. When the primary is determined to be down, either by some internal or external set of heuristics, it will be marked as Failed and new sessions will go to the secondary. When the primary recovers it can be bumped back up to Required.
##### Dynamic Cost
Each terminator also has a dynamic cost that will move a terminator up and down relative to its precedence. This cost can be driven by stratagies or by external components. A strategy might use number of active of open sessions or dial successes and failures to drive the cost.
##### Dynamic Cost
Each terminator also has a dynamic cost that will move a terminator up and down relative to its precedence. This cost can be driven by stratagies or by external components. A strategy might use number of active of open sessions or dial successes and failures to drive the cost.
##### Cost API
Costs can be set via the Costs API in Xt:
@@ -667,7 +694,7 @@ type Costs interface {
}
```
Each terminator has an associated precedence and dynamic cost. This can be reduced to a single cost. The cost algorithm ensures terminators at difference precedence levels do not overlap. So a terminator which is marked failed, with dynamic cost 0, will always have a higher calculated cost than a terminator with default precedence and maximum value for dynamic cost.
Each terminator has an associated precedence and dynamic cost. This can be reduced to a single cost. The cost algorithm ensures terminators at difference precedence levels do not overlap. So a terminator which is marked failed, with dynamic cost 0, will always have a higher calculated cost than a terminator with default precedence and maximum value for dynamic cost.
#### Strategies
Strategies must implement the following interface:
@@ -692,15 +719,15 @@ This is the default strategy. It always uses the lowest cost terminator. It driv
* Cost is proportional to number of open sessions
* Dial failures drive the cost up
* Dial successes drive the cost down, but only as much as they were previously driven up by failures
##### `weighted`
This strategy drives costs in the same way as the `smartrouting` strategy. However instead of always picking the lowest cost terminator it does a weighted random selection across all terminators of the highest precedence. If a terminator has double the cost of another terminator it should get picked approximately half as often.
This strategy drives costs in the same way as the `smartrouting` strategy. However instead of always picking the lowest cost terminator it does a weighted random selection across all terminators of the highest precedence. If a terminator has double the cost of another terminator it should get picked approximately half as often.
##### `random`
This strategy does not change terminator weights. It does simple random selection across all terminators of the highest precedence.
This strategy does not change terminator weights. It does simple random selection across all terminators of the highest precedence.
##### `ha`
This strategy assumes that one terminator will have `required` precedence and there will be a secondary terminator with `default` precedence. If three consecutive dials to the highest ranked terminator fail in a row it will be marked as failed. This will allow the secondary to take over. If the primary recovers it can be marked as required again via the APIs.
This strategy assumes that one terminator will have `required` precedence and there will be a secondary terminator with `default` precedence. If three consecutive dials to the highest ranked terminator fail in a row it will be marked as failed. This will allow the secondary to take over. If the primary recovers it can be marked as required again via the APIs.
### API Changes
The terminator endpoint now supports setting the static terminator cost and terminator precedence.
@@ -717,9 +744,9 @@ The terminator endpoint now supports setting the static terminator cost and term
Ziti 0.13.9 includes the following:
* Adds paging information to cli commands
Example
```shell script
$ ec list api-sessions "true sort by token skip 2 limit 3"
id: 37dd1463-e4e7-40de-9a63-f75486430361 token: 0b392a2f-47f8-4561-af63-93807ce70d93 identity: Default Admin
@@ -741,7 +768,7 @@ Ziti 0.13.7 includes the following:
* Improvements to sdk availability when hosting services
* Various bug fixes to related to terminators and transit routers
## SDK Resilience
The golang sdk now has a new listen method on context, which takes listen options.
@@ -757,7 +784,7 @@ type ListenOptions struct {
ConnectTimeout time.Duration
MaxConnections int
}
```
```
The SDK now supports the following:
@@ -766,7 +793,7 @@ The SDK now supports the following:
* Allow establishing new API session, existing API session goes away
* If client doesn't have access to service, it should stop listening and return an error
* If client can't establish or re-establish API session, it should stop listening and return error
If paired with a ziti controller/routers which support terminator strategies for HA/HS, the following features are also supported:
* Handle listen to multiple edge routers.
@@ -897,13 +924,13 @@ listeners:
# Release 0.13
## Theme
Ziti 0.13 includes the following:
Ziti 0.13 includes the following:
* Changes to make working with policies easier, including
* New APIs to list existing role attributes used by edge routers, identities and services
* New APIs to list entities related by polices (such as listing edge routers available to a service via service edge router policies)
* Enhancements to the LIST APIs for edge routers, identities and services which allow one to filter by roles
* A policy advisor API, which helps analyze policies and current system state to figure out if an identity should be able to use a service and if not, why not
* A policy advisor API, which helps analyze policies and current system state to figure out if an identity should be able to use a service and if not, why not
* CA Auto Enrollment now allows identities to inherit role attributes from the validating CA
* New `identityRole` attributes added to CA entities
* New APIs to list and manage Transit Routers
@@ -915,16 +942,16 @@ Ziti 0.13 includes the following:
* Adjustable Xgress MTU size.
* All Ziti Go projects are now being built with Go 1.14
* See here for change to Go in 1.14 - https://golang.org/doc/go1.14
## Making Policies More User Friendly
## Making Policies More User Friendly
### Listing Role Attributes in Use
There are three new endpoints for listing role attributes in use.
There are three new endpoints for listing role attributes in use.
* Endpoint: /edge-router-role-attributes
* Endpoint: /identity-role-attributes
* Endpoint: /service-role-attributes
All three support the same operations:
* Supported operations
@@ -932,13 +959,13 @@ All three support the same operations:
* Supports filtering
* role attributes can be filtered/sorted using the symbol `id`
* Ex:`?filter=id contains "north" limit 5`
The CLI supports these new operations as well.
ziti edge controller list edge-router-role-attributes
ziti edge controller list identity-role-attributes
ziti edge controller list service-role-attributes
Example output:
$ ec list service-role-attributes "true sort by id desc limit 5" -j
@@ -997,8 +1024,8 @@ When building UIs it may be useful to list entities which have role attributes b
* Query: GET /services now supports two new query paramters
* roleFilter. May be specified more than one. Should be an id or role specifier (ex: @38683097-2412-4335-b056-ae8747314dd3 or #sales)
* roleSemantic. Optional. Defaults to AllOf if not specified. Indicates which semantic to use when evaluating role matches
Note that a roleFilter should have one role specifier (like `@some-id` or `#sales`). If you wish to specify multiple, provide multiple role filters.
Note that a roleFilter should have one role specifier (like `@some-id` or `#sales`). If you wish to specify multiple, provide multiple role filters.
/edge-routers?roleFilter=#sales&roleFilter=#us
@@ -1048,14 +1075,14 @@ This adds a new operation to the /identities endpoint
* Query related identities: GET /identities/<identity-id>/policy-advice/<service-id>
This will return the following information about the identity and service:
* If the identity can dial the service
* If the identity can bind the service
* How many edge routers the identity has access to
* How many edge routers the service can be accessed through
* Which edge routers the identity and service have in common (if this is none, then the service can't be accessed by the identity)
* Which of the common edge routers are on-line
* Which of the common edge routers are on-line
Example result:
{
@@ -1135,7 +1162,7 @@ Examples:
# Inspect the ssh service for issues related to the jsmith-laptop identity
ziti edge controller policy-advisor identities ssh jsmith-laptop
Some example output of the CLI:
$ ec policy-advisor identities -q
@@ -1184,8 +1211,8 @@ Some example output of the CLI:
## CA Auto Enrollment Identity Attributes
Identities that are enrolled via a CA can now inherit a static list of identity role attributes. The normal create,
update, patch requests supported by the CA entities now allow the role attributes to be specified. CA identity role
Identities that are enrolled via a CA can now inherit a static list of identity role attributes. The normal create,
update, patch requests supported by the CA entities now allow the role attributes to be specified. CA identity role
attribute changes do no propagate to identities that have completed enrollment.
This feature allows a simple degree of automation for identities that are auto-provisioning through a third party CA.
@@ -1277,8 +1304,8 @@ Example list output:
```
## Transit Routers now support enrolment via `ziti-router enroll`
Transit Routers now enroll using the same command: `ziti-router enroll <config> -j <jwt>`. During the enrollment process,
the CSR properties used will be taken from `edge.csr`. If `edge.csr` does not exist `csr` will be utilized. If both are
Transit Routers now enroll using the same command: `ziti-router enroll <config> -j <jwt>`. During the enrollment process,
the CSR properties used will be taken from `edge.csr`. If `edge.csr` does not exist `csr` will be utilized. If both are
missing an error will occur.
Example router configuration:
@@ -1394,8 +1421,8 @@ The main endpoint to retrieve the Swagger/Open API 2.0 specification is: `/specs
## APIs now only accept ID, not ID or Name
1. Some APIs related to configurations accepted config names or ids. These now only accept name.
1. Policies would accept entity references with names as well as ids. So you could use `@ssh`, for example when referencing the ssh service. These now also only accept ID
In general allowing both values adds complexity to the server side code. Consuming code, such as user interfaces or the ziti cli, can do the name to id translation just as easily.
In general allowing both values adds complexity to the server side code. Consuming code, such as user interfaces or the ziti cli, can do the name to id translation just as easily.
## Fabric Enhancements
### Xlink Framework
@@ -1444,16 +1471,16 @@ This MTU controls the maximum size of the `Payload` packet sent across the data
# Release 0.12
## Theme
Ziti 0.12 includes the following:
Ziti 0.12 includes the following:
* Terminators have been extracted from services
* Terminators define where a service terminates. Previously each service had exactly one terminator. Now services can have 0 to N terminators.
* List APIs now support inline paging
* Association APIs now support filtering, paging and querying
* Association APIs now support filtering, paging and querying
* The bolt datastore creates a backup of the datastore file before attempting a schema/data migration
* Fabric and edge code are now much more closely aligned at the persistence and model layers
* Some deprecated endpoints are now being removed
## Terminators
See https://github.com/openziti/fabric/wiki/Pluggable-Service-Terminators for a discussion of what service terminators are, the motivation for extracting them from services and the design for how they will work.
@@ -1461,13 +1488,13 @@ This release includes the following:
* Terminators extracted from service as separate entities
* When SDK applications bind and unbind, the controller now dynamically adds/removes terminators as appropriate
This release does not yet include a terminator strategy API. Strategies can be specified per service, but if a service has multiple terminators the first one will be used. The terminator strategy API along with some implementations will be added in a follow-up release. This release also does not include strategy inputs on terminators as discussed in the above design document. If strategy inputs end up being useful, they may be added in the furure.
### Terminator related API changes
There is a new terminators endpoint:
* Endpoint: /terminators
* Supported operations
* Detail: GET /terminators/<terminator-id>
@@ -1482,9 +1509,9 @@ There is a new terminators endpoint:
* router - type: uuid, must be a valid router id
* binding - type: string. Optional, defaults to "transport". The xgress binding on the selected router to use
* address - type: string. The address that will be dialed using the xgress component on the selected router
The service endpoint has changes as well:
* Endpoint: /services
* New operations
* Query related endpoints: GET /services/<service-id>/terminators?filter=<optional-filter>
@@ -1493,7 +1520,7 @@ The service endpoint has changes as well:
* endpointAddress
* The following property has been added
* terminatorStrategy - type: string, optional. The terminator strategy to use. Currently unused.
The fabric service definition has also changed (visible from ziti-fabric).
* The following properties have been removed
@@ -1502,9 +1529,9 @@ The fabric service definition has also changed (visible from ziti-fabric).
* `endpointAddress`
* The following property has been added
* `terminatorStrategy`
The ziti and ziti-fabric CLIs have been updated with new terminator related functionality, so that terminators can be viewed, created and deleted from both.
## Filtering/Sorting/Paging Changes
List operations on entities previously allowed the following parameters:
@@ -1512,8 +1539,8 @@ List operations on entities previously allowed the following parameters:
* `sort`
* `limit`
* `offset`
These are all still supported, but now sort, limit and offset can also be included in the filter. If parameters are specified both in the filter and in an explicit query parameter, the filter takes precedence.
These are all still supported, but now sort, limit and offset can also be included in the filter. If parameters are specified both in the filter and in an explicit query parameter, the filter takes precedence.
When listing entities from the ziti CLI, filters can be included as an optional argument.
@@ -1543,8 +1570,8 @@ For example:
id: dcc9922a-c681-41bf-8079-be2163509702 name: mattermost terminator strategy: role attributes: {}
id: 4e33859b-070d-42b1-8b40-4adf973f680c name: simple terminator strategy: role attributes: {}
Association lists now also support filtering, sorting and paging. Association GET operations only support the filter parameter.
Association lists now also support filtering, sorting and paging. Association GET operations only support the filter parameter.
$ ziti edge controller list service terminators ssh
Found services with id cd1ae16e-5015-49ad-9864-3ca0f5814091 for name ssh
@@ -1562,13 +1589,13 @@ Association lists now also support filtering, sorting and paging. Association GE
id: a5213300-9c5f-4b0e-a790-1ed460964d7c serviceId: cd1ae16e-5015-49ad-9864-3ca0f5814091 routerId: 888cfde1-5786-4ba8-aa75-9f97804cb7bb binding: transport address: tcp:localhost:2022
## Bolt Datastore Migrations
The fabric now supports migrating schema/data from one version to another. The fabric and edge share a common framework for migration. The migration framework now also automatically backs up the bolt data file before migration data. The backup file will have the same name as the original bolt file but with a timestamp appended to it.
The fabric now supports migrating schema/data from one version to another. The fabric and edge share a common framework for migration. The migration framework now also automatically backs up the bolt data file before migration data. The backup file will have the same name as the original bolt file but with a timestamp appended to it.
Example:
Original file: /tmp/ziti-bolt.db
Backup file: /tmp/ziti-bolt.db-20200316-134725
The fabric and edge schemas do not yet get migrated in the same transaction. This will be addressed in a follow-up release.
## Fabric and Edge Alignment
@@ -1580,13 +1607,13 @@ As part of this consolidation effort, fabric entities now share the same set of
* `createdAt`
* `updatedAt`
* `tags`
Previously the only common property was `id`.
## Deprecated Endpoints
The `/gateways` (replaced by `/edge-routers`) and `network-sessions` (replaced by `/sessions`) endpoints, which were previously deprecated, have now been removed.
The `/gateways` (replaced by `/edge-routers`) and `network-sessions` (replaced by `/sessions`) endpoints, which were previously deprecated, have now been removed.
## Miscellaneous
## Miscellaneous
There is a new `ziti edge controller version` command which shows information about the version of the controller being connected to:
@@ -1600,10 +1627,10 @@ Example:
# Release 0.11
## Theme
Ziti 0.11 includes the following:
Ziti 0.11 includes the following:
* Ziti connections from Ziti SDK client to services hosted by SDK are encrypted end-to-end (no API changes)
## End-to-end Encryption
@@ -1612,10 +1639,10 @@ Read more about on https://openziti.github.io (_coming soon_)
# Releaes 0.10
## Theme
Ziti 0.10 includes a single change:
Ziti 0.10 includes a single change:
* Edge API input validation processing was changed to operate on the supplied JSON instead of target objects
## Edge API Validation
@@ -1628,16 +1655,16 @@ operations. PATCH (partial update) should not be affected.
# Release 0.9
## Theme
Ziti 0.9 includes the following
Ziti 0.9 includes the following
* a generic service configuration facility, useful for configuring service centric edge configuration data
* several changes to policy syntax and semantics
* service edge router policies are now a separate entity, instead of just a field on service
## Service Configuration
Configurations are named JSON style objects that can be associated with services. Configurations have a type.
A service can have 0 or 1 configurations of each configuration type associated with it.
Configurations are named JSON style objects that can be associated with services. Configurations have a type.
A service can have 0 or 1 configurations of each configuration type associated with it.
### Configuration types
There is a new endpoint for managing config types.
@@ -1658,12 +1685,12 @@ There is a new endpoint for managing config types.
If a schema is set on a type, that schema will be used to validate config data on configurations of that type. Validation
will happen if a configuration is created or updated. If a config type schema changes, the system does not re-validate
configurations of that type.
configurations of that type.
It is generally assumed that if there are backwards incompatible changes being made to a schema that a new config type
will be created and interested applications can support multiple configuration types.
will be created and interested applications can support multiple configuration types.
The ziti CLI supports the following operations on config types:
The ziti CLI supports the following operations on config types:
* create config-type
* list config-types
@@ -1671,7 +1698,7 @@ The ziti CLI supports the following operations on config types:
* delete config-type
### Configurations
There is a new endpoint for managing configurations
There is a new endpoint for managing configurations
* Endpoint: `/configs`
* Supported operations
@@ -1688,13 +1715,13 @@ There is a new endpoint for managing configurations
* data - type: JSON object
* Support values are strings, numbers, booleans and nested objects/maps
The ziti CLI supports the following operations on configs:
The ziti CLI supports the following operations on configs:
* create config
* update config
* list configs
* delete config
```shell script
$ ziti edge controller create config ssh ziti-tunneler-client.v1 '{ "hostname" : "ssh.mycompany.com", "port" : 22 }'
83a1e815-04bc-4c91-8d88-1de8c943545f
@@ -1726,11 +1753,11 @@ Found configs with id 83a1e815-04bc-4c91-8d88-1de8c943545f for name ssh
$ ziti edge controller list configs
$
```
### Service Configuration
The DNS block, which included hostname and port, has been removed from service definitions. When creating or updating
services, you can submit a `configs` array, which may include config ids or names (or a mix of the two). Configs are
not required.
not required.
**NOTE**: Only one config of a given type may be associated with a service.
@@ -1739,18 +1766,18 @@ Configurations associated with a service may be listed as entities using:
* List associated configs GET `/services/<config-id>/configs`
#### Retrieving service configuration
When authenticating, a user may now indicate which config types should be included when listing services.
The authentication POST may include a body. If the body has a content-type of application/json, it will
When authenticating, a user may now indicate which config types should be included when listing services.
The authentication POST may include a body. If the body has a content-type of application/json, it will
be parsed as a map. The controller will looking for a key at the top level of the map called `configTypes`,
which should be an array of config type ids or names (or mix of the two).
which should be an array of config type ids or names (or mix of the two).
Example authentication POST body:
```json
{
"configTypes" : ["ziti-tunneler-client.v1", "ziti-tunneler-client.v2"]
}
```
When retrieving services, the config data for for those configuration types that were requested will be embedded in
```
When retrieving services, the config data for for those configuration types that were requested will be embedded in
the service definition. For example, if the user has requested (by name) the config types "ziti-tunneler-client.v1" and
"ziti-tunneler-server.v1" and the `ssh` service has configurations of both of those kinds associated, a listing which
includes that service might look as follows:
@@ -1812,7 +1839,7 @@ includes that service might look as follows:
]
}
```
### Identity Service Configuration
Configuration for a service can also be specified for a given identity. If a configuration is specified for a service,
it will replace any configuration of that type on that service.
@@ -1829,7 +1856,7 @@ it will replace any configuration of that type on that service.
* service may be a service name or id. If there are id and name collisions, id will take precedence
* config may be a config name or id. If there are id and name collisions, id will take precedence
* Ex: [{"service": "ssh", "config" : "my-custom-ssh-config" }]
## Policy Changes
### Syntax Changes
1. Roles are now prefixed with `#` instead of `@`
@@ -1839,36 +1866,36 @@ it will replace any configuration of that type on that service.
### Entity Reference by Name
Previously, entities could be referenced in policies by id. They can now also be referenced by name, using the same
syntax. So a service named "ssh" can be referenced as `@ssh`. If the entity is renamed, the policy will be updated
with the updated name.
syntax. So a service named "ssh" can be referenced as `@ssh`. If the entity is renamed, the policy will be updated
with the updated name.
If a reference matches both a name and an ID, the ID will always take precedence.
### `Any Of` Semantics
Previously polices operated using 'all of' semantics. In other words, to match a policy, an entity had to have ALL OF
the role attributes specified by the policy or be listed explicitly by id.
the role attributes specified by the policy or be listed explicitly by id.
Edge Router and Service policies now have a new field `semantics`, which may have values of `AnyOf` or `AllOf`. If no
value is provided, it will default to the original behavior of `AllOf`. If `AnyOf` is provided then an entity will match
if it matches any of the roles listed, or if it is listed explicitly by id or name.
if it matches any of the roles listed, or if it is listed explicitly by id or name.
**NOTE**
Because service edgeRouterRoles are not broken out into a separate policy entity, they do not support `AnyOf` semantics.
**NOTE**
Because service edgeRouterRoles are not broken out into a separate policy entity, they do not support `AnyOf` semantics.
### `#All` limitations
Because having #all grouped with other roles or entity references doesn't make any sense, `#all` policies must now be
created with no other roles or entity references.
created with no other roles or entity references.
### Service Edge Router Policy
Previously services could be confgured with edge router roles, which limited which edge routers could be used to dial
or bind the service.
or bind the service.
In 0.9 that is replaced with a new standalone type: service edge router policies. A service edge router policy has three attributes:
* Name
* Service Roles
* Edge Router Roles
An service can be a member of multiple policies and will have access to the union of all edge routers linked to from those policies.
There is a new `/service-edge-router-policies` endpoint which can be used for creating/updating/deleting/querying service edge router policies. Service edge router policies PUT/POST/PATCH all take the following properties:
@@ -1877,14 +1904,14 @@ There is a new `/service-edge-router-policies` endpoint which can be used for cr
* edgeRouterRoles
* serviceRoles
* tags
#### IMPORTANT NOTES
1. Previously edge router roles on service could be left blank, and the service would be allowed access to all edge routers. Now, a service must be included in at least one service edge router policy or it cannot be dialed or bound.
1. The set of edge routers an identity can use to dial/bind a service is the intersection of the edge routers that the identity has access to via edge router policies and the edge routers that the service has access to via service edge router policies
#### CLI Updates
The CLI now has
# create service-edge-router-policy
The CLI now has
# create service-edge-router-policy
# list service-edge-router-policies
# list service-edge-router-policy services
# list service-edge-router-policy edge-routers
@@ -1905,15 +1932,15 @@ Ex:
}
```
Similarly, when sessions were listed, they had a `hosting` flag, which has been replaced by a `type` flag.
Similarly, when sessions were listed, they had a `hosting` flag, which has been replaced by a `type` flag.
**NOTE**: Finally when sessions are transmitted between the controller and edge router, the format has also switched from using
a hosting flag to a type field. This means that controllers and edge routers will **not inter-operate** across the the 0.9
version boundary.
# Release 0.8
## Theme
## Theme
* Ziti 0.8.0 replaces appwans with role attribute based service policies
* Ziti 0.8.0 consolidates dial and bind permissions into service policies
@@ -1925,7 +1952,7 @@ In 0.7.0 and prior access to services was controlled by appwans.
* Services had explicit lists of identities that could bind the service
* In order to dial a service, the identity had to be an admin or be in at least one appwan with that service
* In order to bind a serivice, the identity had to be able to dial the service and be in the list of identities allowed to bind the service
Release 0.8.0 replaces this model with something new. It has the following goals:
* Allow grouping identities and services dynamically using role attributes rather than hard-coded lists
@@ -1935,11 +1962,11 @@ The following concepts were introduced in 0.7 for edge router policies. They are
* Role attributes
* Role attributes are just a set of strings associated to a model entity
* The semantics of the role attributes are determined by the system administrator
* Ex: an edge router might have the role attributes `["us-east", "new-york", "omnicorp"]`
* The semantics of the role attributes are determined by the system administrator
* Ex: an edge router might have the role attributes `["us-east", "new-york", "omnicorp"]`
* These tags might indicate that this edge router is located on the east coast of the USA, specifically in New York and should be dedicated to use by a customer named OmniCorp
* Currently role attributes are supported on edge routers and identities
* Roles
* Roles
* Roles specify a set of entities
* Roles may include role attributes as well as entity ids
* A role will match all entities which either:
@@ -1948,22 +1975,22 @@ The following concepts were introduced in 0.7 for edge router policies. They are
* Role attributes are prefixed with `@`. Role elements not prefixed with `@` are assumed to be ids
* There is a special role attribute `@all` which will match all entities
* A role may have only role attributes or only ids or may have both
### Role Example
* Service with id 1 has role attributes `["sales", "New York City"]`
* Service with id 2 has role attributes `["sales", "Albany"]`
* Service with id 1 has role attributes `["sales", "New York City"]`
* Service with id 2 has role attributes `["sales", "Albany"]`
* Service with id 3 has role attributes `["support", "Los Angeles"]`
* A service role of `["@sales", "@New York City", "3"]` would evaluate as follows
* Service 1 would match because it has all listed role attributes
* Service 2 would not match, because it doesn't have all listed role attributes
* Service 3 would match because its ID is listed explicitly
### Model Changes
#### Session Names
1. api sessions had two endpoints in 0.7, `/api-sessions` and `/sessions` which was deprecated. `/sessions` is now no longer valid for api sessions
2. sessions used the `/network-sessions` endpoint. In this release, `/network-sessions` has been deprecated and `/sessions` should be used instead.
2. sessions used the `/network-sessions` endpoint. In this release, `/network-sessions` has been deprecated and `/sessions` should be used instead.
3. `/current-session` is now `/current-api-session`
#### Session Format
1. When creating a session, the returned JSON has the same base format as when listing sessions, so it now includes the service and api-session information. The only difference is that the session token is also returned from session create, but not when listing sessions.
1. The gateways attribute of session has been renamed to edgeRouters.
@@ -1978,13 +2005,13 @@ Services now have a roleAttributes field. Identities already had a roleAttribute
* Policy Type ("Bind" or "Dial")
* Identity Roles
* Service Roles
An identity can be a member of multiple policies and will have access to the union of all services linked to from those policies.
There is a new `/service-policies` endpoint which can be used for creating/updating/deleting/querying service policies. Service policies PUT/POST/PATCH all take the following properties:
* name
* type
* type
* valid values are "Bind" and "Dial"
* identityRoles
* serviceRoles
@@ -1997,11 +2024,11 @@ There are also new association endpoints allowing the listing of services and id
* /identities/<id>/service-policies
* /services/<id>/service-policies
#### Service Access
#### Service Access
* An admin may dial or bind any service
* A non-admin identity may dial any service it has access to via service policies of type "Dial"
* A non-admin identity may bind any service it has access to via service policies of type "Bind"
When listing services, the controller used to provide a hostable flag with each service to indicate if the service could be bound in addition to being dialed. Now, the service will have a permissions block which will indicate if the service may be dialed, bound or both.
Ex:
@@ -2045,12 +2072,12 @@ Ex:
#### Appwan Removal and Migration
The `/app-wans` endpoint has been removed. The bbolt schema version has been bumped to 3. If starting a fresh controller no action will be taken. However, if coming from an existing 0.7 or earlier bbolt database, the following will be done:
1. For each existing appwan, a service policy with type "Dial" will be created
1. The new service policy will have the same name as the appwan it replaces
1. For each existing appwan, a service policy with type "Dial" will be created
1. The new service policy will have the same name as the appwan it replaces
1. The new service policy will have the same identities and services as the appwan it replaces
1. Identities and services will be specified explicitly by ID rather as opposed to by creating new role attributes
1. Identities and services will be specified explicitly by ID rather as opposed to by creating new role attributes
NOTE: Service hosting identities will not be migrated into equivalent Bind service policies, as binds are not yet used in any production scenarios.
NOTE: Service hosting identities will not be migrated into equivalent Bind service policies, as binds are not yet used in any production scenarios.
## Go SDK changes
Several types have been renamed to conform to standard nomenclature
@@ -2061,30 +2088,30 @@ Several types have been renamed to conform to standard nomenclature
* The Gateways field is now EdgeRouters
* Gateway is now EdgeRouter
* On the Service type the Hostable flag has been removed and replaced with a Permissions string array
* It may be nil, empty or contain either or both of "Dial" and "Bind"
* It may be nil, empty or contain either or both of "Dial" and "Bind"
* On the Context type
* GetNetworkSession is now GetSession
* GetNetworkHostSession is now GetBindSession
## ziti command line changes
1. The `ziti edge controller create/delete gateway` commands have been removed. Use `ziti edge controller create/delete edge-router` instead.
2. There are new `ziti edge controller create/delete service-policy` commands
## Ziti Proxy changes
ziti-proxy has been incorporated into the ziti-tunnel command. Where previously one would have run
ziti-proxy has been incorporated into the ziti-tunnel command. Where previously one would have run
```
ZITI_SDK_CONFIG=./config.json ziti-proxy run <proxied services>
```
```
now one should use
now one should use
```
ziti-tunnel proxy -i ./config.json <proxied services>
```
```
# Release 0.7
## Theme
## Theme
* Ziti 0.7.0 replaces clusters with role attribute based policies
* Ziti 0.7.0 takes steps towards consistent terminology for sessions
@@ -2093,10 +2120,10 @@ In 0.6.0 access to edge routers was controlled by clusters and services.
* Every edge router was assigned to a cluster
* Services belonged to 1 or more clusters
* Dial/bind request would results would include a list of edge routers which were
* in clusters linked to the dialed/bound service and
* were online when the request was made
* Dial/bind request would results would include a list of edge routers which were
* in clusters linked to the dialed/bound service and
* were online when the request was made
Release 0.7.0 replaces this model with something new. It has the following goals:
* Allow grouping edge routers and other entities dynamically using role attributes rather than hard-coded lists
@@ -2106,11 +2133,11 @@ It includes the following new concepts:
* Role attributes
* Role attributes are just a set of strings associated to a model entity
* The semantics of the role attributes are determined by the system administrator
* Ex: an edge router might have the role attributes `["us-east", "new-york", "omnicorp"]`
* The semantics of the role attributes are determined by the system administrator
* Ex: an edge router might have the role attributes `["us-east", "new-york", "omnicorp"]`
* These tags might indicate that this edge router is located on the east coast of the USA, specifically in New York and should be dedicated to use by a customer named OmniCorp
* Currently role attributes are supported on edge routers and identities
* Roles
* Roles
* Roles specify a set of entities
* Roles may include role attributes as well as entity ids
* A role will match all entities which either:
@@ -2119,16 +2146,16 @@ It includes the following new concepts:
* Role attributes are prefixed with `@`. Role elements not prefixed with `@` are assumed to be ids
* There is a special role attribute `@all` which will match all entities
* A role may have only role attributes or only ids or may have both
### Role Example
* Edge router with id 1 has role attributes `["us-east", "New York City"]`
* Edge router with id 2 has role attributes `["us-east", "Albany"]`
* Edge router with id 1 has role attributes `["us-east", "New York City"]`
* Edge router with id 2 has role attributes `["us-east", "Albany"]`
* Edge router with id 3 has role attributes `["us-west", "Los Angeles"]`
* An edge router role of `["@us-east", "@New York City", "3"]` would evaluate as follows
* Edge router 1 would match because it has all listed role attributes
* Edge router 2 would not match, because it doesn't have all listed role attributes
* Edge router 3 would match because its ID is listed explicitly
### Model Changes
#### Role Attributes
Edge routers and identities now have roleAttributes fields. Edge routers no longer have an associated cluster.
@@ -2139,7 +2166,7 @@ Edge routers and identities now have roleAttributes fields. Edge routers no long
* Name
* Identity Roles
* Edge Router Roles
An identity can be a member of multiple policies and will have access to the union of all edge routers linked to from those policies.
There is a new `/edge-router-policies` endpoint which can be used for creating/updating/deleting/querying edge router policies. Edge router policies PUT/POST/PATCH all take the following properties:
@@ -2150,12 +2177,12 @@ There is a new `/edge-router-policies` endpoint which can be used for creating/u
* tags
#### Service Edge Router Roles
Services now have a new edgeRouterRoles field. If set, this specifies which edge routers may be used for a service. This replaces the old cluster functionality.
Services now have a new edgeRouterRoles field. If set, this specifies which edge routers may be used for a service. This replaces the old cluster functionality.
#### Edge Router Access
#### Edge Router Access
When a service is dialed or bound, which edge routers will be returned?
* If the service edgeRouterRoles are NOT set, then it will be the set of edge routers to which the dialing/binding identity has access
* If the service edgeRouterRoles are NOT set, then it will be the set of edge routers to which the dialing/binding identity has access
* If the service edgeRouterRoles ARE set, then it will be the intersection of the edge routers to which the service has access and the set of edge routers to which the identity has access
#### Cluster Removal and Migration
@@ -2163,8 +2190,8 @@ The `/clusters` endpoint has been removed. The bbolt schema version has been bum
1. An edge router policy will be created with `@all` for both identityRoles and edgeRouterRoles, allowing access to all edge routers from all identities. This will allow the current identities to continue using the system. Otherwise, no identities would be able to connect to any edge routers.
2. Each edge router will get a role attribute of `cluster-<cluster name>` for the cluster it belonged to
3. If a service belongs to 1 or more clusters it will get a role attribute corresponding to the first cluster. Any edge routers assigned to additional clusters will be added to edge router roles field by ID.
1. Noe: If we were to add additional role clusters for the other clusts we'd get the intersection, not the union and would end up with access to 0 edge routers
3. If a service belongs to 1 or more clusters it will get a role attribute corresponding to the first cluster. Any edge routers assigned to additional clusters will be added to edge router roles field by ID.
1. Noe: If we were to add additional role clusters for the other clusts we'd get the intersection, not the union and would end up with access to 0 edge routers
## Session changes
Terminology related to sessions is being made consistent between the edge and fabric.
@@ -2175,13 +2202,13 @@ There are two types of sessions:
1. These were referred to as sessions in the edge and have no fabric equivalent
1. Sessions which establish routing and allow data flow to/from/within the edge and fabric
1. These were referred to as network sessions in the edge and sessions in the fabric
Going forward, what was called a session in the edge will now be referred to as an API session. What was called a network session will be now just be called session in both the edge and fabric.
As a first step, in 0.7.0 API sessions will be available at both the `/sessions` and `/api-sessions` endpoints. Use of the `/sessions` endpoint is deprecated. In later releases the `/sessions` endpoint will be used for sessions instead of API sessions.
As a first step, in 0.7.0 API sessions will be available at both the `/sessions` and `/api-sessions` endpoints. Use of the `/sessions` endpoint is deprecated. In later releases the `/sessions` endpoint will be used for sessions instead of API sessions.
# Release 0.6
## Theme
## Theme
Ziti 0.6.0 moves the back-end persistence model of Ziti Edge and Ziti Fabric into the same repository based on Bbolt (an in memory data store that is backed by a memory mapped file). The changes remove the requirement for PostgresSQL.
## UPDB Enrollment JWTs
README.md
+1 -1
View File
@@ -6,7 +6,7 @@ Ziti represents the next generation of secure, open-source networking for your a
* [Developer Overview](https://github.com/openziti/ziti/blob/master/doc/001-overview.md)
* [Local Development](https://github.com/openziti/ziti/blob/master/doc/002-local-dev.md)
* [Local Deployment](https://github.com/openziti/ziti/blob/master/doc/003-local-deploy.md)
* [Release Notes](https://github.com/openziti/ziti/blob/master/doc/release-notes.md)
* [Release Notes](https://github.com/openziti/ziti/blob/master/CHANGELOG.md)
## What is Ziti?
* The Ziti fabric provides a scalable, plugable, networking mesh with built in smart routing
ziti-tunnel/cmd/ziti-tunnel/subcmd/enroll.go → common/enrollment/enroll.go
+27 -27
View File
@@ -14,7 +14,7 @@
limitations under the License.
*/
package subcmd
package enrollment
import (
"encoding/json"
@@ -42,7 +42,30 @@ const idnameDesc = "Names the identity. Ignored if not 3rd party auto enrollment
const outFlag = "out"
func init() {
func NewEnrollCommand() *cobra.Command {
var enrollSubCmd = &cobra.Command{
SilenceErrors: true,
SilenceUsage: true,
Use: "enroll",
Short: "enroll an identity",
PersistentPreRun: func(cmd *cobra.Command, args []string) {
if verbose {
logrus.SetLevel(logrus.DebugLevel)
}
},
RunE: func(cmd *cobra.Command, args []string) error {
//set the formatter for enrolling via ziti-tunnel
logrus.SetFormatter(&logrus.TextFormatter{
ForceColors: true,
DisableTimestamp: true,
TimestampFormat: "",
PadLevelText: true,
})
logrus.SetReportCaller(false) // for enrolling don't bother with this
return processEnrollment()
},
}
enrollSubCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, verboseDesc)
enrollSubCmd.Flags().StringVarP(&jwtpath, "jwt", "j", "", jwtpathDesc)
enrollSubCmd.Flags().StringVarP(&outpath, outFlag, "o", "", outpathDesc)
@@ -62,30 +85,7 @@ func init() {
_ = enrollSubCmd.MarkFlagRequired("jwt")
root.AddCommand(enrollSubCmd)
}
var enrollSubCmd = &cobra.Command{
SilenceErrors: true,
SilenceUsage: true,
Use: "enroll",
Short: "enroll an identity",
PersistentPreRun: func(cmd *cobra.Command, args []string) {
if verbose {
logrus.SetLevel(logrus.DebugLevel)
}
},
RunE: func(cmd *cobra.Command, args []string) error {
//set the formatter for enrolling via ziti-tunnel
logrus.SetFormatter(&logrus.TextFormatter{
ForceColors: true,
DisableTimestamp: true,
TimestampFormat: "",
PadLevelText: true,
})
logrus.SetReportCaller(false) // for enrolling don't bother with this
return processEnrollment()
},
return enrollSubCmd
}
func processEnrollment() error {
@@ -135,10 +135,10 @@ func processEnrollment() error {
}
output, err := os.Create(outpath)
defer output.Close()
if err != nil {
return fmt.Errorf("failed to open file '%s': %s", outpath, err.Error())
}
defer func() { _ = output.Close() }()
enc := json.NewEncoder(output)
enc.SetEscapeHTML(false)
common/version/info_generated.go
+5 -5
View File
@@ -3,9 +3,9 @@
package version
const (
Version = "v0.9.0"
Revision = "ea556fc18740"
Branch = "travis-build"
BuildUser = "Paul Lorenz"
BuildDate = "2020-02-11 16:09:08"
Version = "v0.16.2-beta07"
Revision = "local"
Branch = "local"
BuildUser = "Andrew Martinez"
BuildDate = "2020-08-24 09:00:00"
)
etc/ctrl.with.edge.yml
+10 -4
View File
@@ -39,10 +39,16 @@ mgmt:
# the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
#connectTimeoutMs: 3000
#metrics:
# influxdb:
# url: http://localhost:8086
# database: ziti
metrics:
#file:
#path: /tmp/ziti-controller-metrics.log
#maxsizemb: 100:wq
# Supported formats: json, plain
# Defaults to json
#format: plain
#influxdb:
#url: http://localhost:8086
#database: ziti
# xctrl_example
#
etc/edge.router.yml
+2
View File
@@ -40,6 +40,8 @@ link:
# section, commenting out, or altering the name of the section will cause the router to no longer operate as an Edge
# Router.
edge:
# (optional) Determines the rate at which API session heartbeats are sent for connected SDK clients (default: 60)
heartbeatIntervalSeconds: 60
# (required) Information used to generate the initial registration CSR. For documentation on these fields please
# refer to the openssl documentation. These values MUST be supplied and have no defaults.
csr:
go.mod
+6 -6
View File
@@ -20,16 +20,16 @@ require (
github.com/fatih/color v1.7.0
github.com/go-ole/go-ole v1.2.4 // indirect
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
github.com/golang/protobuf v1.4.0
github.com/golang/protobuf v1.4.2
github.com/gorilla/mux v1.7.4
github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d
github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0
github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19
github.com/michaelquigley/pfxlog v0.0.0-20190813191113-2be43bd0dccc
github.com/openziti/edge v0.15.40
github.com/openziti/fabric v0.12.1
github.com/openziti/foundation v0.12.0
github.com/openziti/sdk-golang v0.13.30
github.com/openziti/edge v0.16.4
github.com/openziti/fabric v0.12.5
github.com/openziti/foundation v0.13.2
github.com/openziti/sdk-golang v0.13.36
github.com/pborman/uuid v1.2.0
github.com/pkg/errors v0.9.1
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
@@ -43,7 +43,7 @@ require (
github.com/spf13/viper v1.5.0
github.com/stretchr/testify v1.6.1
github.com/urfave/negroni v1.0.0
golang.org/x/net v0.0.0-20200602114024-627f9648deb9
golang.org/x/net v0.0.0-20200707034311-ab3426394381
google.golang.org/grpc v1.25.1
gopkg.in/AlecAivazis/survey.v1 v1.8.7
gopkg.in/resty.v1 v1.12.0
go.sum
+45 -8
View File
@@ -84,6 +84,8 @@ github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJn
github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvDvId8XSGPu3rmpmSe+wKRcEWNgsfWU=
github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
github.com/getkin/kin-openapi v0.2.0/go.mod h1:V1z9xl9oF5Wt7v32ne4FmiF1alpS4dM6mNzoywPOXlk=
@@ -199,12 +201,16 @@ github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zV
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/groupcache v0.0.0-20191027212112-611e8accdfc9/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
github.com/golang/mock v1.2.0 h1:28o5sBqPkBsMGnC6b4MvE2TzSr5/AT4c/1fLqVGIwlk=
github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
github.com/golang/mock v1.4.0 h1:Rd1kQnQu0Hq3qvJppYSG0HtP+f5LPPUiDswTLiEegLg=
github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
github.com/golang/mock v1.4.4 h1:l75CXGRSwbaYNpl/Z2X1XIIAMSCquvXgpVZDhwEIJsc=
github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
@@ -215,6 +221,8 @@ github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrU
github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
github.com/golang/protobuf v1.4.0 h1:oOuy+ugB+P/kBdUnG5QaMXSIyJ1q38wWSojYCb3z5VQ=
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/golangci/lint-1 v0.0.0-20181222135242-d2cdd8c08219/go.mod h1:/X8TswGSh1pIozq4ZwCfxS0WA5JGXguxk94ar/4c87Y=
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -308,6 +316,8 @@ github.com/labstack/gommon v0.3.0 h1:JEeO0bvc78PKdyHxloTKiF8BD5iGrH8T6MSeGvSgob0
github.com/labstack/gommon v0.3.0/go.mod h1:MULnywXg0yavhxWKc+lOruYdAhDwPK9wf0OL7NoOu+k=
github.com/lucas-clemente/quic-go v0.17.1 h1:ezsH76xpn6hKugfsXUy6voIJBFmAOwnM/Oy9F4b/n+M=
github.com/lucas-clemente/quic-go v0.17.1/go.mod h1:I0+fcNTdb9eS1ZcjQZbDVPGchJ86chcIxPALn9lEJqE=
github.com/lucas-clemente/quic-go v0.18.0 h1:JhQDdqxdwdmGdKsKgXi1+coHRoGhvU6z0rNzOJqZ/4o=
github.com/lucas-clemente/quic-go v0.18.0/go.mod h1:yXttHsSNxQi8AWijC/vLP+OJczXqzHSOcJrM5ITUlCg=
github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
@@ -321,8 +331,13 @@ github.com/mailru/easyjson v0.7.1/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7
github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
github.com/marten-seemann/qpack v0.1.0/go.mod h1:LFt1NU/Ptjip0C2CPkhimBz5CGE3WGDAUWqna+CNTrI=
github.com/marten-seemann/qpack v0.2.0/go.mod h1:F7Gl5L1jIgN1D11ucXefiuJS9UMVP2opoCp2jDKb7wc=
github.com/marten-seemann/qtls v0.9.1 h1:O0YKQxNVPaiFgMng0suWEOY2Sb4LT2sRn9Qimq3Z1IQ=
github.com/marten-seemann/qtls v0.9.1/go.mod h1:T1MmAdDPyISzxlK6kjRr0pcZFBVd1OZbBb/j3cvzHhk=
github.com/marten-seemann/qtls v0.10.0 h1:ECsuYUKalRL240rRD4Ri33ISb7kAQ3qGDlrrl55b2pc=
github.com/marten-seemann/qtls v0.10.0/go.mod h1:UvMd1oaYDACI99/oZUYLzMCkBXQVT0aGm99sJhbT8hs=
github.com/marten-seemann/qtls-go1-15 v0.1.0 h1:i/YPXVxz8q9umso/5y474CNcHmTpA+5DH+mFPjx6PZg=
github.com/marten-seemann/qtls-go1-15 v0.1.0/go.mod h1:GyFwywLKkRt+6mfU99csTEY1joMZz5vmB1WNZH3P81I=
github.com/matryer/moq v0.0.0-20190312154309-6cfb0558e1bd/go.mod h1:9ELz6aaclSIGnZBoaSLZ3NAl1VTufbOrXBPvtcy6WiQ=
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
@@ -371,25 +386,34 @@ github.com/netfoundry/secretstream v0.1.2 h1:NgqrYytDnjKbOfWI29TT0SJM+RwB3yf9MIk
github.com/netfoundry/secretstream v0.1.2/go.mod h1:uasYkYSp0MmNSlKOWJ2sVzxPms8e58TS4ENq4yro86k=
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.7.0 h1:WSHQ+IS43OoUrWtD1/bbclrwK8TTH5hzp+umCiuxHgs=
github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.11.0 h1:JAKSXpt1YjtLA7YpPiqO9ss6sNXEsPfSGdwN0UHqzrw=
github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA=
github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
github.com/onsi/gomega v1.4.3 h1:RE1xgDvH7imwFD45h+u2SgIfERHlS2yNG4DObb5BSKU=
github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.8.1 h1:C5Dqfs/LeauYDX0jJXIe2SWmwCbGzx9yF8C8xy3Lh34=
github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
github.com/openziti/edge v0.15.40 h1:UC18994wrt6CMS37U9frLN2dsaoGaPo6zzF8e1nNugU=
github.com/openziti/edge v0.15.40/go.mod h1:3c5RLzZAIMGwdLj6AZ9dxJcv/qKDiSsd/Kp7c4yDVtE=
github.com/openziti/fabric v0.12.1 h1:zrz2n+WGF5+wgur8BNIOMZfMSVn1FLpT8tQpkUrWfKk=
github.com/openziti/fabric v0.12.1/go.mod h1:eNpt7GEtH0Ip2GlTjHPUMX2hWLqmiTjWqVdlNbPWbmw=
github.com/openziti/foundation v0.12.0 h1:SbzKnB36JV6XGK/+qBvm1dueutwBnAu/SijAvgtFo1c=
github.com/openziti/foundation v0.12.0/go.mod h1:uvBYCrcoXW1qOKM3RL7SHhafJz4EHfpjdpzbS0D0Qdc=
github.com/openziti/sdk-golang v0.13.30 h1:DifRP6gwEUDOUvtRVhlUKOxOaC+uKVRPQ15YAa47Ki4=
github.com/openziti/sdk-golang v0.13.30/go.mod h1:oyZT3jGkpEmcey9+joMaudW3OVmBt1QOrZ3tvEGdyW0=
github.com/openziti/edge v0.16.4 h1:NTcTeum1pu1jYiYyKvosw1CHnruePV65tTLPBosWXhQ=
github.com/openziti/edge v0.16.4/go.mod h1:RHlF/l+PtXQHDslOaY0oX6vUrAqGQ9hV1qCgSHhJAlc=
github.com/openziti/fabric v0.12.5 h1:K85PendocjszlkLnFC3dGtqqBlYnA9hJdi9WdSmlLig=
github.com/openziti/fabric v0.12.5/go.mod h1:ylhCe7OOkpJGFwy+SYtZn2VTk0q1YVtGZO8yDjCUVLY=
github.com/openziti/foundation v0.13.2 h1:oLyq+JQzUiVoodklMb4T2gd/knZznxAvYIOmVx8g8N0=
github.com/openziti/foundation v0.13.2/go.mod h1:EZ17GjcO0gq8VfVHZeKjkWj+h/mgYUrWhjpA4+XEN6w=
github.com/openziti/sdk-golang v0.13.36 h1:UNo9jYZu0pj6UK8OmjXIzv7bbCOpX/SCyN701/SbItA=
github.com/openziti/sdk-golang v0.13.36/go.mod h1:nUBh+1zeaTqhmk8JwPXptsl/6uaQLRsfvOKEILg2jLY=
github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6 h1:lNCW6THrCKBiJBpz8kbVGjC7MgdCGKwuvBgc7LoD6sw=
github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI=
github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
@@ -535,6 +559,7 @@ go.mongodb.org/mongo-driver v1.3.0/go.mod h1:MSWZXKOynuguX+JSvwP8i+58jYCXxbia8HS
go.mongodb.org/mongo-driver v1.3.4 h1:zs/dKNwX0gYUtzwrN9lLiR15hCO0nDwQj5xXx+vjCdE=
go.mongodb.org/mongo-driver v1.3.4/go.mod h1:MSWZXKOynuguX+JSvwP8i+58jYCXxbia8HS3gZBapIE=
go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA=
go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
@@ -591,8 +616,11 @@ golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLL
golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM=
golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
golang.org/x/net v0.0.0-20200707034311-ab3426394381 h1:VXak5I6aEWmAXeQjA+QSZzlgNrpq9mjcfDemuexIKsU=
golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -605,6 +633,8 @@ golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJ
golang.org/x/sync v0.0.0-20190412183630-56d357773e84/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190423024810-112230192c58 h1:8gQV6CLnAEikrhgkHFbMAEhagSSnXWGV915qUMm9mrU=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e h1:vcxGaoTs7kV8m5Np9uUNQin4BrLOthgV7252N8V+FwY=
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20180606202747-9527bec2660b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -622,18 +652,23 @@ golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190419153524-e8e3143a4f4a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190531175056-4c3a928424d2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5 h1:LfCXLvNmTYH9kEmVgqbnsWfruoXZIrh4YBgqVHtDvw0=
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 h1:ogLJMz+qpzav7lGMh10LMvAkM/fAoGlaiiHYiFYdm80=
golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae h1:Ih9Yo4hSPImZOpfGuA4bR/ORKTAbhZo2AbWNRCnevdo=
@@ -684,12 +719,14 @@ google.golang.org/genproto v0.0.0-20180831171423-11092d34479b/go.mod h1:JiN7NxoA
google.golang.org/genproto v0.0.0-20181029155118-b69ba1387ce2/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
google.golang.org/genproto v0.0.0-20181202183823-bd91e49a0898/go.mod h1:7Ep/1NZk928CDR8SjdVbjWNpdIf6nzjE3BTgJDr2Atg=
google.golang.org/genproto v0.0.0-20190306203927-b5d61aea6440/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 h1:gSJIx1SDwno+2ElGhA4+qG2zF97qiUzTM+rQ0klBOcE=
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
google.golang.org/grpc v1.25.1 h1:wdKvqQk7IttEw92GoRyKG2IDrUIpgpj6H6m81yfeMW0=
ziti-fabric-test/subcmd/loop2/listener.go
+44 -16
View File
@@ -17,12 +17,15 @@
package loop2
import (
"github.com/openziti/ziti/ziti-fabric-test/subcmd/loop2/pb"
"github.com/michaelquigley/pfxlog"
"github.com/openziti/foundation/identity/dotziti"
"github.com/openziti/foundation/identity/identity"
"github.com/openziti/foundation/transport"
"github.com/michaelquigley/pfxlog"
"github.com/openziti/sdk-golang/ziti"
"github.com/openziti/ziti/ziti-fabric-test/subcmd/loop2/pb"
"github.com/spf13/cobra"
"net"
"strings"
)
func init() {
@@ -41,17 +44,42 @@ var listenerCmdIdentity string
var listenerCmdBindAddress string
func listener(_ *cobra.Command, _ []string) {
_, id, err := dotziti.LoadIdentity(listenerCmdIdentity)
if strings.HasPrefix(listenerCmdBindAddress, "edge") {
listenEdge()
} else {
_, id, err := dotziti.LoadIdentity(listenerCmdIdentity)
if err != nil {
panic(err)
}
bindAddress, err := transport.ParseAddress(listenerCmdBindAddress)
if err != nil {
panic(err)
}
listen(bindAddress, id)
}
}
func listenEdge() {
log := pfxlog.ContextLogger(dialerCmdEndpoint)
defer log.Error("exited")
log.Info("started")
context := ziti.NewContext()
service := strings.TrimPrefix(dialerCmdEndpoint, "edge:")
listener, err := context.Listen(service)
if err != nil {
panic(err)
}
bindAddress, err := transport.ParseAddress(listenerCmdBindAddress)
if err != nil {
panic(err)
for {
if conn, err := listener.Accept(); err != nil {
panic(err)
} else {
go handle(conn, dialerCmdEndpoint)
}
}
listen(bindAddress, id)
}
func listen(bind transport.Address, i *identity.TokenId) {
@@ -68,18 +96,18 @@ func listen(bind transport.Address, i *identity.TokenId) {
for {
select {
case peer := <-incoming:
if peer != nil {
go handle(peer)
} else {
return
if peer != nil {
go handle(peer.Conn(), peer.Detail().String())
} else {
return
}
}
}
}
}
func handle(peer transport.Connection) {
log := pfxlog.ContextLogger(peer.Detail().String())
if proto, err := newProtocol(peer.Conn()); err == nil {
func handle(conn net.Conn, context string) {
log := pfxlog.ContextLogger(context)
if proto, err := newProtocol(conn); err == nil {
if test, err := proto.rxTest(); err == nil {
var result *loop2_pb.Result
if err := proto.run(test); err == nil {
ziti-probe/subcmd/run.go
+98 -43
View File
@@ -2,11 +2,10 @@ package subcmd
import (
"context"
"fmt"
influxdb "github.com/influxdata/influxdb1-client"
"github.com/michaelquigley/pfxlog"
"github.com/openziti/foundation/events"
"github.com/openziti/foundation/metrics"
"github.com/openziti/foundation/metrics/metrics_pb"
"github.com/openziti/sdk-golang/ziti"
"github.com/openziti/sdk-golang/ziti/config"
"github.com/openziti/sdk-golang/ziti/edge"
@@ -34,6 +33,7 @@ const (
DefaultDbName = "ziti"
DefaultDbType = "influxdb"
DefaultInterval = 5 * 60 // 5 minutes
ProbeService = "probe-service"
)
func init() {
@@ -57,27 +57,23 @@ var defaultConfig = probeCfg{
}
type probe struct {
cfg *probeCfg
indb *influxdb.Client
ctx ziti.Context
latest atomic.Value
closer chan interface{}
cfg *probeCfg
influxDb *influxdb.Client
ctx ziti.Context
latest atomic.Value
closer chan interface{}
}
var theProbe = &probe{
closer: make(chan interface{}),
}
func (p *probe) AcceptMetrics(message *metrics_pb.MetricsMessage) {
p.latest.Store(message)
}
func (p *probe) sendMetrics() {
for {
select {
case <-time.After(time.Duration(p.cfg.interval) * time.Second):
message, ok := p.latest.Load().(*metrics_pb.MetricsMessage)
if !ok {
message := p.ctx.Metrics().Poll()
if message == nil {
continue
}
bp, err := metrics.AsBatch(message)
@@ -86,15 +82,38 @@ func (p *probe) sendMetrics() {
return
}
bp.Database = p.cfg.dbName
_, err = p.indb.Write(*bp)
if err != nil {
logrus.Errorln(err)
_, err = p.influxDb.Write(*bp)
if err == nil {
logrus.Debug("write complete")
} else {
logrus.Errorf("error writing to influxdb: %v", err)
for {
logrus.Info("attempting to reconnect")
if service, ok := p.ctx.GetService(ProbeService); ok {
if err := p.connectToInfluxDb(service); err == nil {
logrus.Info("reconnected")
if _, err = p.influxDb.Write(*bp); err != nil {
logrus.Errorf("failed to write after reconnect")
} else {
break
}
} else {
logrus.Errorf("failed to reconnect: %v", err)
}
} else {
logrus.Errorf("could not find %s", ProbeService)
}
time.Sleep(30 * time.Second)
}
}
}
}
}
func (p *probe) run(cmd *cobra.Command, args []string) {
func (p *probe) run(_ *cobra.Command, args []string) {
var err error
if len(args) == 0 {
@@ -110,30 +129,48 @@ func (p *probe) run(cmd *cobra.Command, args []string) {
}
if _, err = p.ctx.GetServices(); err != nil {
log.Fatal("failed to load available services")
for {
if err = p.ctx.Authenticate(); err != nil {
sleepDuration := 5 * time.Second
log.Errorf("failed to authenticate, trying again in %.2f seconds: %v", sleepDuration.Seconds(), err)
time.Sleep(sleepDuration)
} else {
break
}
}
service, found := p.ctx.GetService("probe-service")
if !found {
log.Fatal("required service was not found")
for {
if _, err = p.ctx.GetServices(); err != nil {
sleepDuration := 5 * time.Second
log.Error("failed to load available services, try again in %.2f seconds: %v", sleepDuration.Seconds(), err)
time.Sleep(sleepDuration)
} else {
break
}
}
p.cfg = getProbeConfig(service)
p.indb, err = p.createInfluxDbClient(p.cfg)
if err != nil {
log.Error(err)
return
var service *edge.Service
for {
var found bool
service, found = p.ctx.GetService(ProbeService)
if !found {
sleepDuration := 5 * time.Second
log.Errorf("required service was not found, try again in %.2f seconds", sleepDuration.Seconds())
time.Sleep(sleepDuration)
} else {
break
}
}
_, res, err := p.indb.Ping()
if err != nil {
log.WithError(err).Fatal("failed to get server info")
for {
err := p.connectToInfluxDb(service)
if err != nil {
sleepDuration := 5 * time.Second
log.Errorf("could not connect to influxDb, trying again in %.2f seconds: %v", sleepDuration.Seconds(), err)
time.Sleep(sleepDuration)
} else {
break
}
}
log.Info("connected to influx version = ", res)
events.AddMetricsEventHandler(p)
go p.sendMetrics()
@@ -144,6 +181,24 @@ func (p *probe) run(cmd *cobra.Command, args []string) {
p.ctx.Close()
}
func (p *probe) connectToInfluxDb(service *edge.Service) error {
p.cfg = getProbeConfig(service)
var err error
p.influxDb, err = p.createInfluxDbClient(p.cfg)
if err != nil {
return fmt.Errorf("could not create influxDb client: %v", err)
}
_, res, err := p.influxDb.Ping()
if err != nil {
return fmt.Errorf("failed to get influxDb server info: %v", err)
}
log.Info("connected to influx version = ", res)
return nil
}
func getProbeConfig(service *edge.Service) *probeCfg {
cfg, found := service.Configs["ziti-probe-config.v1"]
if !found {
@@ -205,12 +260,12 @@ func (p *probe) createInfluxDbClient(cfg *probeCfg) (*influxdb.Client, error) {
},
}
config := influxdb.NewConfig()
u, _ := url.Parse("http://probe-service")
config.URL = *u
config.Username = cfg.dbUser
config.Password = cfg.dbPassword
clt, _ := influxdb.NewClient(config)
influxConfig := influxdb.NewConfig()
u, _ := url.Parse("http://" + ProbeService)
influxConfig.URL = *u
influxConfig.Username = cfg.dbUser
influxConfig.Password = cfg.dbPassword
clt, _ := influxdb.NewClient(influxConfig)
ic := reflect.ValueOf(clt)
ict := ic.Type()
@@ -218,8 +273,8 @@ func (p *probe) createInfluxDbClient(cfg *probeCfg) (*influxdb.Client, error) {
hcp := unsafe.Pointer(uintptr(unsafe.Pointer(clt)) + hcf.Offset)
hcpp := (**http.Client)(hcp)
*hcpp = httpC
httpCppClient := (**http.Client)(hcp)
*httpCppClient = httpC
return clt, nil
}
ziti-probe/subcmd/version.go
+35
View File
@@ -0,0 +1,35 @@
/*
Copyright NetFoundry, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package subcmd
import (
"fmt"
"github.com/openziti/ziti/common/version"
"github.com/spf13/cobra"
)
func init() {
root.AddCommand(versionCmd)
}
var versionCmd = &cobra.Command{
Use: "version",
Short: "Show component version",
Run: func(cmd *cobra.Command, args []string) {
fmt.Println(version.GetBuildMetadata(verbose))
},
}
ziti-tunnel/cmd/ziti-tunnel/subcmd/root.go
+3
View File
@@ -23,6 +23,7 @@ import (
"github.com/openziti/edge/tunnel/intercept"
"github.com/openziti/sdk-golang/ziti"
"github.com/openziti/sdk-golang/ziti/config"
"github.com/openziti/ziti/common/enrollment"
"github.com/sirupsen/logrus"
"github.com/spf13/cobra"
"os"
@@ -41,6 +42,8 @@ func init() {
root.PersistentFlags().Uint(svcPollRateFlag, 15, "Set poll rate for service updates (seconds)")
root.PersistentFlags().StringP(resolverCfgFlag, "r", "udp://127.0.0.1:53", "Resolver configuration")
root.PersistentFlags().StringVar(&logFormatter, "log-formatter", "", "Specify log formatter [json|pfxlog|text]")
root.AddCommand(enrollment.NewEnrollCommand())
}
var root = &cobra.Command{
ziti-tunnel/docker/.gitignore
+3
View File
@@ -0,0 +1,3 @@
# enrollments in-use with Docker Compose
*.json
*.jwt
ziti-tunnel/docker/README.md
+15 -10
View File
@@ -72,28 +72,29 @@ This example uses Compose to store in a file the Docker `build` and `run` parame
### Docker Transparent Proxy for Linux
1. Modify "ziti-tunnel" under "services" in the file named `docker-compose.yml` in this Git repo. Optionally, override the default value of `command` to pass additional parameters to `ziti-tunnel`.
1. Modify "ziti-tproxy" under "services" in the file named `docker-compose.yml` in this Git repo, optionally overriding the default value of `command` to pass additional parameters to `ziti-tunnel`.
```yaml
version: "3.3"
services:
ziti-tunnel:
image: netfoundry/ziti-tunnel:local
ziti-tproxy:
image: netfoundry/ziti-tunnel:tproxy
build:
context: .
args:
ZITI_VERSION: 0.15.2
ZITI_VERSION: 0.15.3
volumes:
- .:/netfoundry
network_mode: host
cap_add:
- NET_ADMIN
environment:
- NF_REG_NAME=my-ziti-identity-file
- NF_REG_NAME
# command: run --resolver udp://127.0.0.123:53
# command: run --resolver none
```
2. Run `docker-compose up --build ziti-tunnel` in the same directory.
2. Run `NF_REG_NAME=my-ziti-identity-file docker-compose up --build ziti-tproxy` in the same directory.
This will cause the container to configure the Linux host to transparently proxy any domain names or IP addresses that match a Ziti service.
@@ -104,22 +105,26 @@ This will cause the container to configure the Linux host to transparently proxy
version: "3.3"
services:
ziti-proxy:
image: netfoundry/ziti-tunnel:local
image: netfoundry/ziti-tunnel:proxy
build:
context: .
args:
ZITI_VERSION: 0.15.2
ZITI_VERSION: 0.15.3
volumes:
- .:/netfoundry
environment:
- NF_REG_NAME=my-ziti-identity-file
- NF_REG_NAME
ports:
- "8888:8888"
- "9999:9999"
command: proxy "my example service":8888 "my other example service":9999
```
2. Run `docker-compose up --build ziti-proxy` in the same directory.
2. Run in the same directory:
```bash
NF_REG_NAME=my-ziti-identity-file docker-compose up --build ziti-proxy
```
This will cause the container to listen on the mapped port(s) and proxy any received traffic to the Ziti service that is bound to that port.
ziti-tunnel/docker/docker-compose.yml
+28 -22
View File
@@ -1,60 +1,66 @@
version: "3.3"
services:
ziti-test:
image: netfoundry/ziti-tunnel:local
build:
context: .
args:
ZITI_VERSION: 0.15.2
volumes:
- .:/netfoundry
image: netfoundry/ziti-tunnel:tproxy
network_mode: host
cap_add:
- NET_ADMIN
environment:
- NF_REG_NAME=my-ziti-identity-file
entrypoint: ["sh", "-c", "while true; do sleep 11; done"]
#command: bash
ziti-tproxy:
image: netfoundry/ziti-tunnel:local
image: netfoundry/ziti-tunnel:tproxy
network_mode: host
cap_add:
- NET_ADMIN
build:
context: .
args:
ZITI_VERSION: 0.15.2
ZITI_VERSION: 0.15.3
volumes:
- .:/netfoundry
environment:
- NF_REG_NAME
command: tproxy
# command: tproxy --resolver udp://127.0.0.123:53
ziti-iproxy:
image: netfoundry/ziti-tunnel:tproxy
build:
context: .
args:
ZITI_VERSION: 0.15.3
volumes:
- .:/netfoundry
network_mode: host
cap_add:
- NET_ADMIN
environment:
- NF_REG_NAME=my-ziti-identity-file
command: tproxy --resolver udp://127.0.0.123:53 --verbose
- NF_REG_NAME
command: tproxy --resolver none
ziti-tun:
image: netfoundry/ziti-tunnel:local
image: netfoundry/ziti-tunnel:tun
build:
context: .
args:
ZITI_VERSION: 0.15.2
ZITI_VERSION: 0.15.3
volumes:
- .:/netfoundry
network_mode: host
cap_add:
- NET_ADMIN
environment:
- NF_REG_NAME=my-ziti-identity-file
command: tun --resolver udp://127.0.0.123:53
- NF_REG_NAME
command: tun
devices:
- "/dev/net/tun:/dev/net/tun"
- "/dev/net/tun:/dev/net/tun"
ziti-proxy:
image: netfoundry/ziti-tunnel:local
image: netfoundry/ziti-tunnel:proxy
build:
context: .
args:
ZITI_VERSION: 0.15.2
ZITI_VERSION: 0.15.3
volumes:
- .:/netfoundry
environment:
- NF_REG_NAME=my-ziti-identity-file
- NF_REG_NAME
ports:
- "8888:8888"
- "9999:9999"
ziti/cmd/ziti/cmd/edge_controller/root.go
+2
View File
@@ -17,6 +17,7 @@
package edge_controller
import (
"github.com/openziti/ziti/common/enrollment"
"io"
"github.com/Jeffail/gabs"
@@ -64,6 +65,7 @@ func populateEdgeCommands(f cmdutil.Factory, out io.Writer, errOut io.Writer, cm
cmd.AddCommand(newPolicyAdivsorCmd(f, out, errOut))
cmd.AddCommand(newVerifyCmd(f, out, errOut))
cmd.AddCommand(newDbCmd(f, out, errOut))
cmd.AddCommand(enrollment.NewEnrollCommand())
return cmd
}