From 35ac0ad960e4dc0eda9968839bc689ae2e576440 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 15 Apr 2024 18:47:25 -0400 Subject: [PATCH 1/4] fix and clarify how to use router container in tproxy mode --- dist/docker-images/ziti-router/.gitignore | 3 +- dist/docker-images/ziti-router/README.md | 98 +++++++++++++++---- .../ziti-router/compose.override.yml | 14 +++ 3 files changed, 96 insertions(+), 19 deletions(-) create mode 100644 dist/docker-images/ziti-router/compose.override.yml diff --git a/dist/docker-images/ziti-router/.gitignore b/dist/docker-images/ziti-router/.gitignore index 849392039..2eea525d8 100644 --- a/dist/docker-images/ziti-router/.gitignore +++ b/dist/docker-images/ziti-router/.gitignore @@ -1,2 +1 @@ -.env -compose.override.yml \ No newline at end of file +.env \ No newline at end of file diff --git a/dist/docker-images/ziti-router/README.md b/dist/docker-images/ziti-router/README.md index 24a55ba67..02aeac00e 100644 --- a/dist/docker-images/ziti-router/README.md +++ b/dist/docker-images/ziti-router/README.md @@ -42,13 +42,20 @@ healthy before running. ```bash # fetch the compose file for the ziti-router image wget -O ./compose.router.yml https://get.openziti.io/dist/docker-images/ziti-router/compose.yml - -# run the quickstart network in the background to provide the ctrl.endpoint at quickstart:1280 +# fetch the router tproxy compose overrides files +wget -O ./compose.tproxy.yml https://get.openziti.io/dist/docker-images/ziti-router/compose.override.yml +# fetch the all-in-one quickstart compose file wget -O ./compose.quickstart.yml https://get.openziti.io/dock/all-in-one/compose.yml +``` + +Patch the Compose project to use the quickstart network and provide a web server to test the hello service. + +```bash +cat <>./compose.tproxy.yml + # link the router to the quickstart network so it can reach the Ziti controller + networks: + - quickstart -# patch the Compose project to use the quickstart network and provide a web server to test the hello service -cat <./compose.tproxy.yml -services: # add a hello web server to use for a Ziti service target hello: image: openziti/hello-world @@ -65,24 +72,66 @@ services: ziti-router: condition: service_healthy command: wget --output-document=- http://hello.internal/ +EOF +``` - # link the router to the quickstart network so it can reach the Ziti controller +Your `compose.tproxy.yml` should look like this. + +```yaml +services: ziti-router: + dns: + - 127.0.0.1 + - 1.1.1.1 + user: root + cap_add: + - NET_ADMIN networks: - quickstart -EOF -export COMPOSE_FILE=compose.router.yml:compose.quickstart.yml:compose.tproxy.yml -# run the Ziti controller in the background with the all-in-one quickstart container + hello: + image: openziti/hello-world + expose: + - 8000 + networks: + - quickstart + + tproxy-demo-client: + image: busybox + network_mode: service:ziti-router + depends_on: + ziti-router: + condition: service_healthy + command: wget --output-document=- http://hello.internal/ +``` + +Define the Compose project files. + +```bash +export COMPOSE_FILE=compose.router.yml:compose.tproxy.yml:compose.quickstart.yml +``` + +Run the Ziti controller in the background with the all-in-one quickstart container. + +```bash docker compose up quickstart-check +``` -# start the hello web server listening on 8000 +Start the hello web server listening on 8000. + +```bash docker compose up hello --detach +``` -# log in to the Ziti controller +Log in to the Ziti controller + +```bash ziti edge login 127.0.0.1:1280 -y -u admin -p admin +``` -# create a Ziti service for the hello web server +Create a Ziti service for the hello web server. + +```bash ziti edge create config "hello-intercept-config" intercept.v1 \ '{"portRanges":[{"high":80,"low":80}],"addresses":["hello.internal"],"protocols":["tcp"]}' ziti edge create config "hello-host-config" host.v1 \ @@ -98,24 +147,39 @@ ziti edge create service-policy "hello-bind-policy" Bind \ --semantic AnyOf \ --service-roles '#hello.services' \ --identity-roles '#hello.servers' +``` -# grant the quickstart router permission to bind (provide) the hello service +Grant the quickstart router permission to bind (provide) the hello service. + +```bash ziti edge update identity quickstart-router \ --role-attributes=hello.servers +``` -# create a second Ziti router to use as a tproxy client +Create a second Ziti router to use as a tproxy client. + +```bash ziti edge create edge-router "tproxy-router" \ --jwt-output-file=./tproxy-router.jwt \ --tunneler-enabled +``` -# grant the tproxy client permission to dial (consume) the hello service +Grant the tproxy client permission to dial (consume) the hello service + +```bash ziti edge update identity tproxy-router \ --role-attributes=hello.clients +``` -# simulate policies to check for authorization problems +Simulate policies to check for authorization problems + +```bash ziti edge policy-advisor services -q +``` -# run the demo client which triggers the run of the tproxy router because it is a dependency +Run the demo client which triggers the run of the tproxy router because it is a dependency. + +```bash ZITI_ENROLL_TOKEN="$(<./tproxyRouter.jwt)" \ ZITI_ROUTER_MODE=tproxy \ ZITI_CTRL_ADVERTISED_ADDRESS=quickstart \ diff --git a/dist/docker-images/ziti-router/compose.override.yml b/dist/docker-images/ziti-router/compose.override.yml new file mode 100644 index 000000000..3495d012a --- /dev/null +++ b/dist/docker-images/ziti-router/compose.override.yml @@ -0,0 +1,14 @@ +# include this Compose file in your project to grant elevated permissions to the ziti-router container that are +# necessary when ZITI_ROUTER_MODE=tproxy +services: + ziti-router: + # Additional config for other containers using this router as a transparent intercepting proxy sidecar and default + # nameserver - dns, user, cap_add are required when ZITI_ROUTER_MODE=tproxy (see adjacent README.md for TPROXY + # example) + # + dns: + - 127.0.0.1 # this router's Ziti resolver + - 1.1.1.1 # any recursive resolver + user: root # required to create TPROXY routes in a container? + cap_add: + - NET_ADMIN # required to create TPROXY rules From b1161f71aac3e876c2860d596786d075ec885c21 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 15 Apr 2024 21:15:25 -0400 Subject: [PATCH 2/4] tidy container images --- dist/docker-images/ziti-controller/Dockerfile | 35 ++++++++++--------- .../docker-images/ziti-controller/compose.yml | 10 ++---- dist/docker-images/ziti-router/Dockerfile | 28 +++++++++++---- dist/docker-images/ziti-router/compose.yml | 11 +++--- 4 files changed, 48 insertions(+), 36 deletions(-) diff --git a/dist/docker-images/ziti-controller/Dockerfile b/dist/docker-images/ziti-controller/Dockerfile index 3718f9116..83e093562 100644 --- a/dist/docker-images/ziti-controller/Dockerfile +++ b/dist/docker-images/ziti-controller/Dockerfile @@ -6,10 +6,7 @@ FROM ${ZITI_CLI_IMAGE}:${ZITI_CLI_TAG} ARG CONTROLLER_PACKAGE=./dist/dist-packages/linux/openziti-controller ARG DOCKER_BUILD_DIR=. -# This build stage grabs artifacts that are copied into the final image. -# It uses the same base as the final image to maximize docker cache hits. - -### Required OpenShift Labels +### Required Labels for OpenShift LABEL name="openziti/ziti-controller" \ maintainer="developers@openziti.org" \ vendor="NetFoundry" \ @@ -19,6 +16,22 @@ LABEL name="openziti/ziti-controller" \ # set up image as root, then drop privs to ziggy USER root +# used by entrypoint.bash to source the bootstrapping script in this image +ENV ZITI_CTRL_BOOTSTRAP_BASH=/bootstrap.bash + +COPY ${CONTROLLER_PACKAGE}/bootstrap.bash ${ZITI_CTRL_BOOTSTRAP_BASH} +COPY ${CONTROLLER_PACKAGE}/entrypoint.bash / + +WORKDIR /ziti-controller +RUN chown -R ziggy:ziggy /ziti-controller + +# configure logging +ENV PFXLOG_NO_JSON=true +ENV ZITI_TIME_FORMAT=utc + +# globally toggle bootstrapping; false preserves "thin" behavior for existing deployments like K8s +ENV ZITI_BOOTSTRAP=false + # selectively toggle bootstrapping steps ENV ZITI_BOOTSTRAP_PKI=true ENV ZITI_BOOTSTRAP_CONFIG=true @@ -30,6 +43,8 @@ ENV ZITI_CA_FILE=root ENV ZITI_INTERMEDIATE_FILE=intermediate ENV ZITI_SERVER_FILE=server ENV ZITI_CLIENT_FILE=client +ENV ZITI_NETWORK_NAME=ctrl +ENV ZITI_AUTO_RENEW_CERTS=true # defaults for bootstrapping config ENV ZITI_CTRL_ADVERTISED_PORT=1280 @@ -38,18 +53,6 @@ ENV ZITI_CTRL_ADVERTISED_PORT=1280 ENV ZITI_CTRL_DATABASE_FILE=bbolt.db ENV ZITI_USER=admin -# emit human-friendly text logs -ENV PFXLOG_NO_JSON=true -# used by entrypoint.bash to source the bootstrapping script in this image -ENV ZITI_CTRL_BOOTSTRAP_BASH=/bootstrap.bash -# used by "ziti create config controller" as filename for the controller's identity files -ENV ZITI_NETWORK_NAME=ctrl -# used by ziti to format timestamps in output -ENV ZITI_TIME_FORMAT=utc - -COPY ${CONTROLLER_PACKAGE}/bootstrap.bash ${ZITI_CTRL_BOOTSTRAP_BASH} -COPY ${CONTROLLER_PACKAGE}/entrypoint.bash / - # run as ziggy (2171:2171) by default USER ziggy ENTRYPOINT [ "/entrypoint.bash" ] diff --git a/dist/docker-images/ziti-controller/compose.yml b/dist/docker-images/ziti-controller/compose.yml index 7d4c96b2e..17540be10 100644 --- a/dist/docker-images/ziti-controller/compose.yml +++ b/dist/docker-images/ziti-controller/compose.yml @@ -6,9 +6,9 @@ volumes: services: chown-controller: image: busybox - command: chown -R ${ZIGGY_UID:-2171} /mnt + command: chown -R ${ZIGGY_UID:-2171} /ziti-controller volumes: - - ziti-controller:/mnt + - ziti-controller:/ziti-controller ziti-controller: image: ${ZITI_CONTROLLER_IMAGE:-openziti/ziti-controller} @@ -16,8 +16,7 @@ services: chown-controller: condition: service_completed_successfully volumes: - - ziti-controller:/mnt - working_dir: /mnt + - ziti-controller:/ziti-controller # assign override vars in an .env file or export from parent env to ensure consistency throughout the compose # project environment: @@ -32,9 +31,6 @@ services: ZITI_BOOTSTRAP_CONFIG: true # make config file from env vars and defaults if "true," overwrite if "force"; requires ZITI_BOOTSTRAP=true ZITI_BOOTSTRAP_DATABASE: true # make the default admin user if "true"; requires ZITI_BOOTSTRAP=true ZITI_AUTO_RENEW_CERTS: true # renew certs automatically every startup; requires ZITI_BOOTSTRAP_PKI=true - ZITI_NETWORK_NAME: ctrl # identity files basename - PFXLOG_NO_JSON: true # disable JSON logging - ZITI_TIME_FORMAT: utc # time format for logs command: run config.yml ports: # ensure this port matches the value of ZITI_CTRL_PORT in the container diff --git a/dist/docker-images/ziti-router/Dockerfile b/dist/docker-images/ziti-router/Dockerfile index 8e09c95de..4140dc6a1 100644 --- a/dist/docker-images/ziti-router/Dockerfile +++ b/dist/docker-images/ziti-router/Dockerfile @@ -22,12 +22,7 @@ RUN INSTALL_PKGS="util-linux iptables libbpf iproute" && \ # set a var for entrypoint.bash to find this script ENV ZITI_ROUTER_BOOTSTRAP_BASH=/bootstrap.bash -ENV ZITI_ROUTER_TYPE=edge -ENV ZITI_ROUTER_PORT=3022 -ENV ZITI_BOOTSTRAP=true -ENV ZITI_BOOTSTRAP_CONFIG=true -ENV ZITI_BOOTSTRAP_ENROLLMENT=true -ENV PFXLOG_NO_JSON=true + COPY ${ROUTER_PACKAGE}/bootstrap.bash ${ZITI_ROUTER_BOOTSTRAP_BASH} COPY ${ROUTER_PACKAGE}/entrypoint.bash / @@ -37,4 +32,25 @@ RUN chown -R ziggy:ziggy /ziti-router # run as ziggy (2171:2171) by default, override run-as user with root when DOCKER_ROUTER_MODE=tproxy USER ziggy +# configure logging +ENV PFXLOG_NO_JSON=true +ENV ZITI_TIME_FORMAT=utc + +# globally toggle bootstrapping; false preserves "thin" behavior for existing deployments like K8s +ENV ZITI_BOOTSTRAP=false + +# selectively toggle bootstrapping steps +ENV ZITI_BOOTSTRAP_CONFIG=true +ENV ZITI_BOOTSTRAP_ENROLLMENT=true + +# defaults for bootstrapping +ENV ZITI_ROUTER_NAME=router +ENV ZITI_ROUTER_TYPE=edge +ENV ZITI_ROUTER_PORT=3022 +ENV ZITI_ROUTER_MODE=none + +# renew router certs at startup with run --extend +ENV ZITI_AUTO_RENEW_CERTS=true + + ENTRYPOINT [ "/entrypoint.bash" ] diff --git a/dist/docker-images/ziti-router/compose.yml b/dist/docker-images/ziti-router/compose.yml index be9cb2c6e..4cd3be9fe 100644 --- a/dist/docker-images/ziti-router/compose.yml +++ b/dist/docker-images/ziti-router/compose.yml @@ -6,9 +6,9 @@ volumes: services: chown-router: image: busybox - command: chown -R ${ZIGGY_UID:-2171} /mnt + command: chown -R ${ZIGGY_UID:-2171} /ziti-router volumes: - - ziti-router:/mnt + - ziti-router:/ziti-router ziti-router: image: ${ZITI_ROUTER_IMAGE:-openziti/ziti-router} @@ -16,8 +16,7 @@ services: chown-router: condition: service_completed_successfully volumes: - - ziti-router:/mnt - working_dir: /mnt + - ziti-router:/ziti-router # these declared vars pass through to container and should be assigned in an .env file or exported from parent env # to ensure consistency throughout the compose project environment: @@ -33,10 +32,8 @@ services: ZITI_BOOTSTRAP: true # bootstrap the router if "true" ZITI_BOOTSTRAP_CONFIG: true # make config file from env vars and defaults if "true," overwrite if "force"; requires ZITI_BOOTSTRAP=true ZITI_BOOTSTRAP_ENROLLMENT: true # enroll with controller if "true," overwrite if "force"; requires ZITI_BOOTSTRAP=true + ZITI_AUTO_RENEW_CERTS: true # renew certs every startup ZITI_ROUTER_TYPE: edge # edge, fabric - ZITI_ROUTER_NAME: router # identity files basename - PFXLOG_NO_JSON: true # disable JSON logging - ZITI_TIME_FORMAT: utc # time format for logs command: run config.yml ports: # ensure this port matches the value of ZITI_ROUTER_PORT in the container From f95f1a24c851038517fccbd76c4e8fa85140231c Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 15 Apr 2024 21:59:45 -0400 Subject: [PATCH 3/4] finish testing the tproxy example --- dist/docker-images/ziti-router/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dist/docker-images/ziti-router/README.md b/dist/docker-images/ziti-router/README.md index 02aeac00e..32eee9d21 100644 --- a/dist/docker-images/ziti-router/README.md +++ b/dist/docker-images/ziti-router/README.md @@ -137,7 +137,7 @@ ziti edge create config "hello-intercept-config" intercept.v1 \ ziti edge create config "hello-host-config" host.v1 \ '{"address":"hello","port":8000,"forwardProtocol":true,"allowedProtocols":["tcp"]}' ziti edge create service "hello" \ - --configs 'intercept.v1,host.v1' \ + --configs "hello-intercept-config,hello-host-config" \ --role-attributes 'hello.services' ziti edge create service-policy "hello-dial-policy" Dial \ --semantic AnyOf \ @@ -180,7 +180,7 @@ ziti edge policy-advisor services -q Run the demo client which triggers the run of the tproxy router because it is a dependency. ```bash -ZITI_ENROLL_TOKEN="$(<./tproxyRouter.jwt)" \ +ZITI_ENROLL_TOKEN="$(<./tproxy-router.jwt)" \ ZITI_ROUTER_MODE=tproxy \ ZITI_CTRL_ADVERTISED_ADDRESS=quickstart \ ZITI_CTRL_ADVERTISED_PORT=1280 \ From 62daafa801cf6b5ad3ae97bb6d4ac3707648d8e1 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 16 Apr 2024 08:11:23 -0400 Subject: [PATCH 4/4] tidy gitignore --- dist/docker-images/ziti-controller/.gitignore | 2 +- dist/docker-images/ziti-router/.gitignore | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dist/docker-images/ziti-controller/.gitignore b/dist/docker-images/ziti-controller/.gitignore index 849392039..1123e99cf 100644 --- a/dist/docker-images/ziti-controller/.gitignore +++ b/dist/docker-images/ziti-controller/.gitignore @@ -1,2 +1,2 @@ .env -compose.override.yml \ No newline at end of file +compose.override.yml diff --git a/dist/docker-images/ziti-router/.gitignore b/dist/docker-images/ziti-router/.gitignore index 2eea525d8..4c49bd78f 100644 --- a/dist/docker-images/ziti-router/.gitignore +++ b/dist/docker-images/ziti-router/.gitignore @@ -1 +1 @@ -.env \ No newline at end of file +.env