gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-13 15:51:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #426 from openziti/release-next

Browse Source 
Release 0.20.10
This commit is contained in:
Paul Lorenz
2021-06-23 10:53:41 -04:00
committed by GitHub
parent 1ee5f7a1fe 1a876a4284
commit b5df40e99e
10 changed files with 427 additions and 171 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+1
View File
@@ -25,3 +25,4 @@ Pipfile
ziti.ignore
linux-build
*.log
/build/
CHANGELOG.md
+119
View File
@@ -1,3 +1,122 @@
# Release 0.20.10
## What's New
* Bug fix: patch for process multi would clear information
* Bug fix: [ziti#420](https://github.com/openziti/ziti/issues/420) fix ziti-tunnel failover with multiple interfaces when once becomes unavailable
* Bug fix: [edge#670](https://github.com/openziti/edge/issues/670) fix ziti-tunnel issue where address were left assigned to loopback after clean shutdown
* Bug fix: race condition in edge session sync could cause router panic. Regression since 0.20.9
* Bug fix: terminator updates and deletes from the combined router/tunneler weren't working
* Feature: Router health checks
* Feature: Controller health check
## Router Health Checks
Routers can now enable an HTTP health check endpoint. The health check is configured in the router config file with the new `healthChecks` section.
```
healthChecks:
ctrlPingCheck:
# How often to ping the controller over the control channel. Defaults to 30 seconds
interval: 30s
# When to timeout the ping. Defaults to 15 seconds
timeout: 15s
# How long to wait before pinging the controller. Defaults to 15 seconds
initialDelay: 15s
```
The health check endpoint is configured via XWeb, same as in the controller. As section like the following can be added to the router config to enable the endpoint.
```
web:
- name: health-check
bindPoints:
- interface: 127.0.0.1:8081
address: 127.0.0.1:8081
apis:
- binding: health-checks
```
The health check output will look like this:
```
$ curl -k https://localhost:8081/health-checks
{
"data": {
"checks": [
{
"healthy": true,
"id": "controllerPing",
"lastCheckDuration": "767.381µs",
"lastCheckTime": "2021-06-21T16:22:36-04:00"
}
],
"healthy": true
},
"meta": {}
}
```
The endpoint will return a 200 if the health checks are passing and 503 if they are not.
# Controller Health Check
Routers can now enable an HTTP health check endpoint. The health check is configured in the router config file with the new `healthChecks` section.
```
healthChecks:
boltCheck:
# How often to check the bolt db. Defaults to 30 seconds
interval: 30s
# When to timeout the bolt db check. Defaults to 15 seconds
timeout: 15s
# How long to wait before starting bolt db checks. Defaults to 15 seconds
initialDelay: 15s
```
The health check endpoint is configured via XWeb. In order to enable the health check endpoint, add it **first** to the list of apis.
```
apis:
# binding - required
# Specifies an API to bind to this webListener. Built-in APIs are
# - edge-management
# - edge-client
# - fabric-management
- binding: health-checks
options: { }
- binding: edge-management
# options - variable optional/required
# This section is used to define values that are specified by the API they are associated with.
# These settings are per API. The example below is for the `edge-api` and contains both optional values and
# required values.
options: { }
- binding: edge-client
options: { }
```
The health check output will look like this:
```
$ curl -k https://localhost:1280/health-checks
{
"data": {
"checks": [
{
"healthy": true,
"id": "bolt.read",
"lastCheckDuration": "27.46µs",
"lastCheckTime": "2021-06-21T17:32:31-04:00"
}
],
"healthy": true
},
"meta": {}
}
```
# Release 0.20.9
## What's New
etc/ctrl.with.edge.yml
+14 -1
View File
@@ -79,6 +79,15 @@ mgmt:
# enabled: false
# delay: 5
healthChecks:
boltCheck:
# How often to try entering a bolt read tx. Defaults to 30 seconds
interval: 30s
# When to timeout the check. Defaults to 15 seconds
timeout: 15s
# How long to wait before starting the check. Defaults to 15 seconds
initialDelay: 15s
# By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this
# section, commenting out, or altering the name of the section will cause the edge to not run.
edge:
@@ -179,9 +188,12 @@ web:
apis:
# binding - required
# Specifies an API to bind to this webListener. Built-in APIs are
# - health-checks
# - edge-management
# - edge-client
# - fabric-management
- binding: health-checks
options: { }
- binding: edge-management
# options - variable optional/required
# This section is used to define values that are specified by the API they are associated with.
@@ -189,4 +201,5 @@ web:
# required values.
options: { }
- binding: edge-client
options: { }
options: { }
etc/edge.router.yml
+34
View File
@@ -36,6 +36,15 @@ link:
dialers:
- binding: transport
healthChecks:
ctrlPingCheck:
# How often to ping the controller over the control channel. Defaults to 30 seconds
interval: 30s
# When to timeout the ping. Defaults to 15 seconds
timeout: 15s
# How long to wait before pinging the controller. Defaults to 15 seconds
initialDelay: 15s
metrics:
reportInterval: 15s
messageQueueSize: 10
@@ -102,3 +111,28 @@ listeners:
- binding: transport
address: tls:0.0.0.0:7099
web:
# name - required
# Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.
- name: health-check
# bindPoints - required
# One or more bind points are required. A bind point specifies an interface (interface:port string) that defines
# where on the host machine the webListener will listen and the address (host:port) that should be used to
# publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for
# incoming address resolution as well as used in responses in the API.
bindPoints:
#interface - required
# A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces
- interface: 127.0.0.1:8081
# address - required
# The public address that external incoming requests will be able to resolve. Used in request processing and
# response content that requires full host:port/path addresses.
address: 127.0.0.1:8081
# apis - required
# Allows one or more APIs to be bound to this webListener
apis:
# binding - required
# Specifies an API to bind to this webListener. Built-in APIs are
# - health-checks
- binding: health-checks
~
etc/router.yml
+13 -1
View File
@@ -58,6 +58,18 @@ forwarder:
ctrl:
endpoint: tls:127.0.0.1:6262
healthCheck:
# Specifies the health check port. If not present, the health check will be disabled
#port: 8081
# Specifies what address to bind to. Default to blank, which will bind to all available addresses
bindAddress: ""
# How often to ping the controller over the control channel. Defaults to 30 seconds
ctrlPingInterval: 30s
# When to timeout the ping. Defaults to 15 seconds
ctrlPingTimeout: 15s
# How long to wait before pinging the controller. Defaults to 15 seconds
initialDelay: 15s
# Listener Configuration
#
# Define the Xgress listeners to start up, and their configuration.
@@ -105,4 +117,4 @@ listeners:
options:
retransmission: true
randomDrops: true
drop1InN: 5000
drop1InN: 5000
go.mod
+4 -4
View File
@@ -29,10 +29,10 @@ require (
github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d
github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19
github.com/michaelquigley/pfxlog v0.3.7
github.com/openziti/edge v0.19.133
github.com/openziti/fabric v0.16.68
github.com/openziti/foundation v0.15.55
github.com/openziti/sdk-golang v0.15.53
github.com/openziti/edge v0.19.145
github.com/openziti/fabric v0.16.71
github.com/openziti/foundation v0.15.56
github.com/openziti/sdk-golang v0.15.57
github.com/pborman/uuid v1.2.0
github.com/pkg/errors v0.9.1
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
go.sum
+10 -10
View File
@@ -30,8 +30,8 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr
dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
github.com/AppsFlyer/go-sundheit v0.3.1 h1:Zqnr3wV3WQmXonc234k9XZAoV2KHUHw3osR5k2iHQZE=
github.com/AppsFlyer/go-sundheit v0.3.1/go.mod h1:iZ8zWMS7idcvmqewf5mEymWWgoOiG/0WD4+aeh+heX4=
github.com/AppsFlyer/go-sundheit v0.4.0 h1:7ECd0YWaXJQ9LzdCFrpGxJVeAgXvNarN6uwxrJsh69A=
github.com/AppsFlyer/go-sundheit v0.4.0/go.mod h1:iZ8zWMS7idcvmqewf5mEymWWgoOiG/0WD4+aeh+heX4=
github.com/Azure/azure-sdk-for-go v32.4.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/go-autorest/autorest v0.1.0/go.mod h1:AKyIcETwSUFxIcs/Wnq/C+kwCtlEYGUVd7FPNb2slmg=
github.com/Azure/go-autorest/autorest v0.5.0/go.mod h1:9HLKlQjVBH6U3oDfsXOeVc56THsLPw1L03yban4xThw=
@@ -622,14 +622,14 @@ github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e h1:ST9+54UtCr96S5
github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k=
github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo=
github.com/openziti/edge v0.19.133 h1:f1lCoPN4+RMO47+5f9flLfdrzt8j9IivbaYeUat/BjE=
github.com/openziti/edge v0.19.133/go.mod h1:aGSSMipVcsLSQZflt7arx/ixeIHDZTevFUNiet86n6g=
github.com/openziti/fabric v0.16.68 h1:xo432y7qewrK//nFEZYpujnTzYloYSZPzlwaLMdyd0s=
github.com/openziti/fabric v0.16.68/go.mod h1:JgQ6EWVAjjbePcsM20hqQLMMeGjAhqLDvqVjy2qnt6g=
github.com/openziti/foundation v0.15.55 h1:JNNown1ki8GHu3WRGTTAjTn0KrFIQoiSP93exoZPOI4=
github.com/openziti/foundation v0.15.55/go.mod h1:h8d47dCV3vgwAkY4pkQrgpu3wBblDwUrNb/uvDAs0sU=
github.com/openziti/sdk-golang v0.15.53 h1:GE/6Gb0T+Pv/uSJyboPPBVh5+3J3aUDuX5Dueq+8y2c=
github.com/openziti/sdk-golang v0.15.53/go.mod h1:FCQArKmdxtG+t5xyBtKpnSiXdsdTFFaVhLvRtto+YRs=
github.com/openziti/edge v0.19.145 h1:YVvTg+2iNuoqpnwVbID9AqYkhxdRrx3Z4o5P4/wrbq0=
github.com/openziti/edge v0.19.145/go.mod h1:+Rav15D9soV8grHd/UOM3deA7T1HvN4obeYnKNYfvBY=
github.com/openziti/fabric v0.16.71 h1:5y66bJYXXOI2xdCfD79KCBlW3g638Vx80VVrnyq9kRc=
github.com/openziti/fabric v0.16.71/go.mod h1:RhooR5KtpxSpesOa/L9VelwlkhaToBTwzwT1QiGDB/4=
github.com/openziti/foundation v0.15.56 h1:St4FLcaBD8ER1QyO/P0enyIRw+ErOKayHc3zY6aY6aU=
github.com/openziti/foundation v0.15.56/go.mod h1:h8d47dCV3vgwAkY4pkQrgpu3wBblDwUrNb/uvDAs0sU=
github.com/openziti/sdk-golang v0.15.57 h1:QvGUKA806IDtzb4L4PbN+Aq8aylgBg6kbS1nDF3UrYI=
github.com/openziti/sdk-golang v0.15.57/go.mod h1:+dbV733phFpHXLSHFJZ+3bDRy93Vv7YhmpItE03sYWs=
github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888=
github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI=
github.com/orcaman/concurrent-map v0.0.0-20210106121528-16402b402231 h1:fa50YL1pzKW+1SsBnJDOHppJN9stOEwS+CRWyUtyYGU=
quickstart/docker/image/ziti-cli-functions.sh
Regular → Executable
+215 -140
View File
@@ -5,8 +5,9 @@ set -uo pipefail
# shellcheck disable=SC2155
export DEFAULT_ZITI_HOME_LOCATION="${HOME}/.ziti/quickstart/$(hostname)"
# shellcheck disable=SC2164
# shellcheck disable=SC2155
export ZITI_QUICKSTART_SCRIPT_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
export ZITI_QUICKSTART_SCRIPT_ROOT="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
export ZITI_QUICKSTART_ENVROOT="${HOME}/.ziti/quickstart"
ASCI_WHITE='\033[01;37m'
@@ -44,7 +45,7 @@ function BLUE {
}
function zitiLogin {
unused=$("${ZITI_BIN_DIR-}/ziti" edge login "${ZITI_EDGE_CONTROLLER_API}" -u "${ZITI_USER-}" -p "${ZITI_PWD}" -c "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert")
unused=$("${ZITI_BIN_DIR-}/ziti" edge login "${ZITI_EDGE_CONTROLLER_API}" -u "${ZITI_USER-}" -p "${ZITI_PWD}" -c "${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert")
}
function cleanZitiController {
ziti_home="${ZITI_HOME-}"
@@ -57,12 +58,12 @@ function cleanZitiController {
initializeController
}
function initializeController {
"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME-}/controller.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${ZITI_HOME-}/controller-init.log"
"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/controller.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${ZITI_HOME_OS_SPECIFIC}/controller-init.log"
echo -e "ziti-controller initialized. see $(BLUE "${ZITI_HOME-}/controller-init.log") for details"
}
function startZitiController {
# shellcheck disable=SC2034
unused=$("${ZITI_BIN_DIR-}/ziti-controller" run "${ZITI_HOME-}/controller.yaml" > "${ZITI_HOME-}/ziti-edge-controller.log" 2>&1 &)
unused=$("${ZITI_BIN_DIR-}/ziti-controller" run "${ZITI_HOME_OS_SPECIFIC}/controller.yaml" > "${ZITI_HOME_OS_SPECIFIC}/ziti-edge-controller.log" 2>&1 &)
echo -e "ziti-controller started. log located at: $(BLUE "${ZITI_HOME-}/ziti-edge-controller.log")"
}
function stopZitiController {
@@ -106,19 +107,31 @@ function checkHostsFile {
}
function getLatestZitiVersion {
setupZitiHome
if ! setOs; then
return 1
fi
ZITI_ARCH="amd64"
if [[ "$(uname -a)" == *"arm"* ]]; then
ZITI_ARCH="arm"
fi
unset ZITI_BINARIES_VERSION
if [[ "${ZITI_BINARIES_VERSION-}" == "" ]]; then
zitilatest=$(curl -s https://api.github.com/repos/openziti/ziti/releases/latest)
echo "${zitilatest}" > /mnt/v/temp/a.txt
# shellcheck disable=SC2155
export ZITI_BINARIES_TARFILE=$(echo "${zitilatest}" | jq -r '.assets[] | select(.name | startswith("ziti-linux-amd")) | .name')
export ZITI_BINARIES_FILE=$(echo "${zitilatest}" | jq -r '.assets[] | select(.name | startswith("'"ziti-${ZITI_OSTYPE}-${ZITI_ARCH}"'")) | .name')
# shellcheck disable=SC2155
export ZITI_BINARIES_VERSION=$(echo "${zitilatest}" | jq -r '.tag_name')
fi
#echo -e 'Ziti tar.gz: '"$(BLUE "${ZITI_BINARIES_TARFILE}")"
#echo -e 'Latest ziti is: '"$(BLUE "${ZITI_BINARIES_VERSION}")"
echo "ZITI_BINARIES_VERSION: ${ZITI_BINARIES_VERSION}"
}
function getLatestZiti {
setupZitiHome
if [[ "${ZITI_HOME-}" == "" ]]; then
echo "ERROR: ZITI_HOME is not set!"
return 1
@@ -131,42 +144,56 @@ function getLatestZiti {
export ZITI_BIN_ROOT="${ziti_bin_root}/ziti-bin"
mkdir -p "${ziti_bin_root}"
getLatestZitiVersion
if ! getLatestZitiVersion; then
return 1
fi
ziti_bin_ver="${ZITI_BINARIES_VERSION-}"
if [[ "${ziti_bin_ver}" == "" ]]; then
echo "ERROR: ZITI_HOME is not set!"
echo "ERROR: ZITI_BINARIES_VERSION is not set!"
return 1
fi
export ZITI_BIN_DIR="${ziti_bin_root}/ziti-${ziti_bin_ver}"
ZITI_BINARIES_TARFILE_ABSPATH="${ZITI_HOME-}/ziti-bin/${ZITI_BINARIES_TARFILE}"
if ! test -f "${ZITI_BINARIES_TARFILE_ABSPATH}"; then
echo -e 'Downloading '"$(BLUE "${ZITI_BINARIES_TARFILE}")"' to '"$(BLUE "${ZITI_BINARIES_TARFILE_ABSPATH}")"
zitidl="https://github.com/openziti/ziti/releases/download/${ZITI_BINARIES_VERSION-}/${ZITI_BINARIES_TARFILE}"
wget -q "${zitidl}" -O "${ZITI_BINARIES_TARFILE_ABSPATH}"
ZITI_BINARIES_FILE_ABSPATH="${ZITI_HOME-}/ziti-bin/${ZITI_BINARIES_FILE}"
if ! test -f "${ZITI_BINARIES_FILE_ABSPATH}"; then
zitidl="https://github.com/openziti/ziti/releases/download/${ZITI_BINARIES_VERSION-}/${ZITI_BINARIES_FILE}"
echo -e 'Downloading '"$(BLUE "${zitidl}")"' to '"$(BLUE "${ZITI_BINARIES_FILE_ABSPATH}")"
curl -Ls "${zitidl}" -o "${ZITI_BINARIES_FILE_ABSPATH}"
else
echo -e "$(YELLOW 'Already Downloaded ')""$(BLUE "${ZITI_BINARIES_TARFILE}")"' at: '"${ZITI_BINARIES_TARFILE_ABSPATH}"
echo -e "$(YELLOW 'Already Downloaded ')""$(BLUE "${ZITI_BINARIES_FILE}")"' at: '"${ZITI_BINARIES_FILE_ABSPATH}"
fi
echo -e 'UNZIPPING '"$(BLUE "${ZITI_BINARIES_TARFILE_ABSPATH}")"' into: '"$(GREEN "${ZITI_BIN_DIR-}")"
echo -e 'UNZIPPING '"$(BLUE "${ZITI_BINARIES_FILE_ABSPATH}")"' into: '"$(GREEN "${ZITI_BIN_DIR}")"
rm -rf "${ziti_bin_root}/ziti-${ZITI_BINARIES_VERSION-}"
tar -xf "${ZITI_BINARIES_TARFILE_ABSPATH}" --directory "${ziti_bin_root}"
mv "${ziti_bin_root}/ziti" "${ZITI_BIN_DIR-}"
if [[ "${ZITI_OSTYPE}" == "windows" ]]; then
unzip "${ZITI_BINARIES_FILE_ABSPATH}" -d "${ZITI_BIN_DIR}"
mv "${ZITI_BIN_DIR}/ziti/"* "${ZITI_BIN_DIR}/"
rm -rf "${ZITI_BIN_DIR}/ziti/"*
rmdir "${ZITI_BIN_DIR}/ziti/"
chmod +x "${ZITI_BIN_DIR}/"*
else
tar -xf "${ZITI_BINARIES_FILE_ABSPATH}" --directory "${ziti_bin_root}"
mv "${ziti_bin_root}/ziti" "${ZITI_BIN_DIR}"
fi
echo -e 'Marking executables at '"$(GREEN "${ZITI_BIN_DIR}")"' executable'
chmod +x "${ZITI_BIN_DIR}/"*
if [[ "${1-}" == "yes" ]]; then
echo "Adding ${ZITI_BIN_DIR-} to the path if necessary:"
if [[ "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR-}" && echo "yes")" == "yes" ]]; then
echo -e "$(GREEN "${ZITI_BIN_DIR-}") is already on the path"
echo "Adding ${ZITI_BIN_DIR} to the path if necessary:"
if [[ "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR}" && echo "yes")" == "yes" ]]; then
echo -e "$(GREEN "${ZITI_BIN_DIR}") is already on the path"
else
echo -e "adding $(RED "${ZITI_BIN_DIR-}") to the path"
export PATH=$PATH:"${ZITI_BIN_DIR-}"
echo -e "adding $(RED "${ZITI_BIN_DIR}") to the path"
export PATH=$PATH:"${ZITI_BIN_DIR}"
fi
fi
}
function checkPrereqs {
commands_to_test=(curl jq wget)
commands_to_test=(curl jq)
missing_requirements=""
# verify all the commands required in the automation exist before trying to run the full suite
for cmd in "${commands_to_test[@]}"
@@ -192,7 +219,7 @@ function checkPrereqs {
}
function checkControllerName {
if [[ ${ZITI_EDGE_CONTROLLER_HOSTNAME} == *['!'@#\$%^\&*()_+]* ]]; then
if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME}" == *['!'@#\$%^\&*\(\)_+]* ]]; then
echo -e "$(RED " - The provided Network name contains an invalid character: '!'@#\$%^\&*()_+")"
return 1
fi
@@ -251,7 +278,10 @@ function setupZitiNetwork {
}
function setupZitiHome {
export ZITI_HOME="${HOME}/.ziti/quickstart/${ZITI_NETWORK-}"
if [[ "${ZITI_HOME-}" == "" ]]; then
export ZITI_HOME="${HOME}/.ziti/quickstart/${ZITI_NETWORK-}"
echo "using default ZITI_HOME: ${ZITI_HOME}"
fi
}
function generateEnvFile {
@@ -272,9 +302,6 @@ function generateEnvFile {
export ZITI_BIN_ROOT="${ZITI_HOME-}/ziti-bin"
fi
# shellcheck disable=SC2155
export ZITI_SCRIPTS="$(realpath "${ZITI_SCRIPT_DIR}/..")"
if ! ziti_createEnvFile; then
return 1
fi
@@ -341,15 +368,15 @@ function ziti_expressConfiguration {
echo "---------- Creating edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...."
unused=$("${ZITI_BIN_DIR-}/ziti" edge delete edge-router "${ZITI_EDGE_ROUTER_RAWNAME}")
unused=$("${ZITI_BIN_DIR-}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" -o "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" -t)
unused=$("${ZITI_BIN_DIR-}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" -o "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" -t)
sleep 1
echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...."
unused=$("${ZITI_BIN_DIR-}/ziti-router" enroll "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" --jwt "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" &> "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.enrollment.log")
unused=$("${ZITI_BIN_DIR-}/ziti-router" enroll "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" --jwt "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" &> "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.enrollment.log")
echo ""
sleep 1
# shellcheck disable=SC2034
unused=$("${ZITI_BIN_DIR-}/ziti-router" run "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.log" 2>&1 &)
unused=$("${ZITI_BIN_DIR-}/ziti-router" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.log" 2>&1 &)
echo "Express setup complete!"
}
@@ -440,7 +467,7 @@ function pki_client_server {
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
"${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
"${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \
--server-file "${name_local}-server" \
--dns "${name_local},localhost" --ip "${ip_local}" \
--server-name "${name_local} server certificate"
@@ -451,7 +478,7 @@ function pki_client_server {
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
"${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \
"${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \
--client-file "${name_local}-client" \
--key-file "${name_local}-server" \
--client-name "${name_local}"
@@ -463,24 +490,24 @@ function pki_client_server {
}
function pki_create_ca {
if ! test -f "${ZITI_PKI}/${1}/keys/${1}.key"; then
echo "Creating CA: ${1}"
"${ZITI_BIN_DIR-}/ziti" pki create ca --pki-root="${ZITI_PKI}" --ca-file="${1}" --ca-name="${1} Root CA"
cert=$1
echo "Creating CA: ${cert}"
if ! test -f "${ZITI_PKI}/${cert}/keys/${cert}.key"; then
"${ZITI_BIN_DIR}/ziti" pki create ca --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-file="${cert}" --ca-name="${cert} Root CA"
else
echo "Creating CA: ${1}"
echo "key exists"
fi
echo " "
}
function pki_create_intermediate {
echo "Creating intermediate: ${1} ${2} ${3}"
if ! test -f "${ZITI_PKI}/${2}/keys/${2}.key"; then
echo "Creating intermediate: ${1} ${2} ${3}"
"${ZITI_BIN_DIR-}/ziti" pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${1}" \
"${ZITI_BIN_DIR}/ziti" pki create intermediate --pki-root "${ZITI_PKI_OS_SPECIFIC}" --ca-name "${1}" \
--intermediate-name "${2}" \
--intermediate-file "${2}" --max-path-len "${3}"
else
echo "Creating intermediate: ${1} ${2} ${3}"
echo "key exists"
fi
echo " "
@@ -492,43 +519,43 @@ function printUsage()
function verifyCertAgainstPool()
{
if [[ "" == "${1-}" ]]
then
printUsage "verifyCertAgainstPool"
return 1
fi
if [[ "" == "${1-}" ]]
then
printUsage "verifyCertAgainstPool"
return 1
fi
if [[ "" == "$2" ]]
then
printUsage "verifyCertAgainstPool"
return 1
fi
if [[ "" == "$2" ]]
then
printUsage "verifyCertAgainstPool"
return 1
fi
echo " Verifying that this certificate:"
echo " - ${1-}"
echo " is valid for this ca pool:"
echo " - $2"
echo ""
openssl verify -partial_chain -CAfile "$2" "${1-}"
# shellcheck disable=SC2181
if [ $? -eq 0 ]; then
echo ""
echo "============ SUCCESS! ============"
else
echo ""
echo "============ FAILED TO VALIDATE ============"
fi
echo " Verifying that this certificate:"
echo " - ${1-}"
echo " is valid for this ca pool:"
echo " - $2"
echo ""
openssl verify -partial_chain -CAfile "$2" "${1-}"
# shellcheck disable=SC2181
if [ $? -eq 0 ]; then
echo ""
echo "============ SUCCESS! ============"
else
echo ""
echo "============ FAILED TO VALIDATE ============"
fi
}
function showIssuerAndSubjectForPEM()
{
echo "Displaying Issuer and Subject for cert pool:"
echo " ${1-}"
openssl crl2pkcs7 -nocrl -certfile "${1-}" | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)"
echo "Displaying Issuer and Subject for cert pool:"
echo " ${1-}"
openssl crl2pkcs7 -nocrl -certfile "${1-}" | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)"
}
function createRouterPki {
pki_client_server "${ZITI_EDGE_ROUTER_RAWNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}"
pki_client_server "${ZITI_EDGE_ROUTER_RAWNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}"
}
function createPrivateRouterConfig {
@@ -536,10 +563,10 @@ cat > "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" <<HereDocForEdgeRouter
v: 3
identity:
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-client.cert"
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-server.cert"
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_RAWNAME}-server.key"
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-client.cert"
server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-server.cert"
key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_RAWNAME}-server.key"
ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
ctrl:
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
@@ -590,8 +617,8 @@ csr:
# readBufferSize: 4096
# writeBufferSize: 4096
# enableCompression: true
# server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.cert
# key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.key
# server_cert: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.cert
# key: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.key
forwarder:
latencyProbeInterval: 1000
@@ -605,29 +632,29 @@ HereDocForEdgeRouter
function createPki {
echo "Generating PKI"
pki_create_ca "${ZITI_CONTROLLER_ROOTCA_NAME}"
pki_create_ca "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}"
pki_create_ca "${ZITI_SIGNING_ROOTCA_NAME}"
pki_create_ca "${ZITI_CONTROLLER_ROOTCA_NAME}"
pki_create_ca "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}"
pki_create_ca "${ZITI_SIGNING_ROOTCA_NAME}"
ZITI_SPURIOUS_INTERMEDIATE="${ZITI_SIGNING_INTERMEDIATE_NAME}_spurious_intermediate"
pki_create_intermediate "${ZITI_CONTROLLER_ROOTCA_NAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" 1
pki_create_intermediate "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" 1
pki_create_intermediate "${ZITI_SIGNING_ROOTCA_NAME}" "${ZITI_SPURIOUS_INTERMEDIATE}" 2
pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1
ZITI_SPURIOUS_INTERMEDIATE="${ZITI_SIGNING_INTERMEDIATE_NAME}_spurious_intermediate"
pki_create_intermediate "${ZITI_CONTROLLER_ROOTCA_NAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" 1
pki_create_intermediate "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" 1
pki_create_intermediate "${ZITI_SIGNING_ROOTCA_NAME}" "${ZITI_SPURIOUS_INTERMEDIATE}" 2
pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1
if ! test -f "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_NETWORK-}-dotzeet.key"; then
echo "Creating ziti-fabric client certificate for network: ${ZITI_NETWORK-}"
"${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI}" --ca-name="${ZITI_CONTROLLER_INTERMEDIATE_NAME}" \
--client-file="${ZITI_NETWORK-}-dotzeet" \
--client-name "${ZITI_NETWORK-} Management"
else
echo "Creating ziti-fabric client certificate for network: ${ZITI_NETWORK-}"
echo "key exists"
fi
echo " "
if ! test -f "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_NETWORK-}-dotzeet.key"; then
echo "Creating ziti-fabric client certificate for network: ${ZITI_NETWORK-}"
"${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name="${ZITI_CONTROLLER_INTERMEDIATE_NAME}" \
--client-file="${ZITI_NETWORK-}-dotzeet" \
--client-name "${ZITI_NETWORK-} Management"
else
echo "Creating ziti-fabric client certificate for network: ${ZITI_NETWORK-}"
echo "key exists"
fi
echo " "
pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}"
pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}"
pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}"
pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}"
}
@@ -643,14 +670,14 @@ function createFabricRouterConfig {
echo -e " * ERROR: $(RED "ZITI_HOME is not set") "
return 1
fi
cat > "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" <<HereDocForEdgeRouter
cat > "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" <<HereDocForEdgeRouter
v: 3
identity:
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-client.cert"
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-server.cert"
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_RAWNAME}-server.key"
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-client.cert"
server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-server.cert"
key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_RAWNAME}-server.key"
ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
ctrl:
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
@@ -701,8 +728,8 @@ csr:
# readBufferSize: 4096
# writeBufferSize: 4096
# enableCompression: true
# server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.cert
# key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.key
# server_cert: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.cert
# key: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.key
forwarder:
latencyProbeInterval: 1000
@@ -730,10 +757,10 @@ cat > "${ZITI_HOME-}/${router_name}.yaml" <<HereDocForEdgeRouter
v: 3
identity:
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-client.cert"
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-server.cert"
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${router_name}-server.key"
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-client.cert"
server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-server.cert"
key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${router_name}-server.key"
ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
ctrl:
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
@@ -784,8 +811,8 @@ transport:
readBufferSize: 4096
writeBufferSize: 4096
enableCompression: true
server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.cert
key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.key
server_cert: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.cert
key: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-router-server.key
forwarder:
latencyProbeInterval: 1000
@@ -814,10 +841,10 @@ cat > "${ziti_home}/${router_name}.yaml" <<HereDocForEdgeRouter
v: 3
identity:
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-client.cert"
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-server.cert"
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${router_name}-server.key"
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-client.cert"
server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-server.cert"
key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${router_name}-server.key"
ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
ctrl:
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT}
@@ -868,8 +895,8 @@ edge:
# readBufferSize: 4096
# writeBufferSize: 4096
# enableCompression: true
# server_cert: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.cert
# key: ${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.key
# server_cert: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.cert
# key: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.key
forwarder:
latencyProbeInterval: 1000
@@ -881,12 +908,12 @@ HereDocForEdgeRouter
}
function createFabricIdentity {
cat > "${ZITI_HOME-}/identities.yml" <<IdentitiesJsonHereDoc
cat > "${ZITI_HOME}/identities.yml" <<IdentitiesJsonHereDoc
---
default:
caCert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem"
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_NETWORK-}-dotzeet.cert"
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_NETWORK-}-dotzeet.key"
caCert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem"
cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_NETWORK-}-dotzeet.cert"
key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_NETWORK-}-dotzeet.key"
endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_MGMT_PORT}
IdentitiesJsonHereDoc
}
@@ -902,19 +929,19 @@ cat > "${ziti_home}/controller.yaml" <<HereDocForEdgeConfiguration
v: 3
#trace:
# path: "${ZITI_CONTROLLER_RAWNAME-}.trace"
# path: "${ZITI_CONTROLLER_RAWNAME}.trace"
#profile:
# memory:
# path: ctrl.memprof
db: "${ZITI_HOME-}/db/ctrl.db"
db: "${ZITI_HOME_OS_SPECIFIC}/db/ctrl.db"
identity:
cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-client.cert"
server_cert: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem"
key: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_CONTROLLER_HOSTNAME}-server.key"
ca: "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-client.cert"
server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem"
key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_CONTROLLER_HOSTNAME}-server.key"
ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert"
ctrl:
listener: tls:0.0.0.0:${ZITI_FAB_CTRL_PORT}
@@ -957,8 +984,8 @@ edge:
# a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert
# will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller.
signingCert:
cert: ${ZITI_PKI}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert
key: ${ZITI_PKI}/${ZITI_SIGNING_INTERMEDIATE_NAME}/keys/${ZITI_SIGNING_INTERMEDIATE_NAME}.key
cert: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert
key: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/keys/${ZITI_SIGNING_INTERMEDIATE_NAME}.key
# edgeIdentity - optional
# A section for identity enrollment specific settings
edgeIdentity:
@@ -997,10 +1024,10 @@ web:
# identity - optional
# Allows the webListener to have a specific identity instead of defaulting to the root 'identity' section.
identity:
ca: "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert"
key: "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key"
server_cert: "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.chain.pem"
cert: "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-client.cert"
ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert"
key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key"
server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.chain.pem"
cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-client.cert"
# options - optional
# Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are
# used for all http servers started by the current webListener.
@@ -1063,6 +1090,11 @@ function ziti_createEnvFile {
fi
export ZITI_HOME="${ziti_home}"
if [[ "${ZITI_OSTYPE}" == "windows" ]]; then
export ZITI_HOME_OS_SPECIFIC="$(cygpath -m ${ZITI_HOME})"
else
export ZITI_HOME_OS_SPECIFIC="${ZITI_HOME}"
fi
export ENV_FILE="${ZITI_HOME}/${ZITI_NETWORK}.env"
export ZITI_SHARED="${ZITI_HOME}"
@@ -1087,7 +1119,7 @@ function ziti_createEnvFile {
fi
fi
echo "ZITI_NETWORK set to: ${ZITI_NETWORK-}"
echo "ZITI_NETWORK set to: ${ZITI_NETWORK}"
if [[ "${ZITI_USER-}" == "" ]]; then export ZITI_USER="admin"; fi
if [[ "${ZITI_PWD-}" == "" ]]; then export ZITI_PWD="admin"; fi
@@ -1096,10 +1128,15 @@ function ziti_createEnvFile {
if [[ "${ZITI_FAB_MGMT_PORT-}" == "" ]]; then export ZITI_FAB_MGMT_PORT="10000"; fi
if [[ "${ZITI_FAB_CTRL_PORT-}" == "" ]]; then export ZITI_FAB_CTRL_PORT="6262"; fi
if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-controller"; fi
if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-edge-controller"; fi
if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK}-controller"; fi
if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_NETWORK}-edge-controller"; fi
export ZITI_PKI="${ZITI_SHARED-}/pki"
export ZITI_PKI="${ZITI_SHARED}/pki"
if [[ "${ZITI_OSTYPE}" == "windows" ]]; then
export ZITI_PKI_OS_SPECIFIC="$(cygpath -m ${ZITI_PKI})"
else
export ZITI_PKI_OS_SPECIFIC="${ZITI_PKI}"
fi
if [[ "${ZITI_EDGE_CONTROLLER_PORT-}" == "" ]]; then export ZITI_EDGE_CONTROLLER_PORT="1280"; fi
if [[ "${ZITI_CONTROLLER_HOSTNAME-}" == "" ]]; then export ZITI_CONTROLLER_HOSTNAME="${ZITI_CONTROLLER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
@@ -1107,7 +1144,7 @@ function ziti_createEnvFile {
if [[ "${ZITI_ZAC_HOSTNAME-}" == "" ]]; then export ZITI_ZAC_HOSTNAME="${ZITI_ZAC_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
if [[ "${ZITI_EDGE_CONTROLLER_API-}" == "" ]]; then export ZITI_EDGE_CONTROLLER_API="${ZITI_EDGE_CONTROLLER_HOSTNAME}:${ZITI_EDGE_CONTROLLER_PORT}"; fi
export ZITI_SIGNING_CERT_NAME="${ZITI_NETWORK-}-signing"
export ZITI_SIGNING_CERT_NAME="${ZITI_NETWORK}-signing"
export ZITI_CONTROLLER_ROOTCA_NAME="${ZITI_CONTROLLER_HOSTNAME}-root-ca"
export ZITI_CONTROLLER_INTERMEDIATE_NAME="${ZITI_CONTROLLER_HOSTNAME}-intermediate"
@@ -1144,16 +1181,25 @@ if [[ ! "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR}" && echo "yes")" == "yes" ]]; t
else
echo " ziti binaries are located at: ${ZITI_BIN_DIR}"
echo -e 'add this to your path if you want by executing: export PATH=$PATH:'"${ZITI_BIN_DIR}"
echo " "
fi
heredoc
}
function waitForController {
#devnull="/dev/null"
#if [[ "${ZITI_OSTYPE}" == "windows" ]]; then
# devnull="nul"
#fi
# shellcheck disable=SC2091
until $(curl -s -o /dev/null --fail -k "https://${ZITI_EDGE_CONTROLLER_API}"); do
echo "waiting for https://${ZITI_EDGE_CONTROLLER_API}"
sleep 2
#until $(curl -o /dev/null -sk /dev/null --fail "https://${ZITI_EDGE_CONTROLLER_API}"); do
# echo "waiting for https://${ZITI_EDGE_CONTROLLER_API}"
# sleep 2
#done
while [[ "$(curl -w "%{http_code}" -m 1 -s -k -o /dev/null https://${ZITI_EDGE_CONTROLLER_API}/version)" != "200" ]]; do
echo "waiting for https://${ZITI_EDGE_CONTROLLER_API}"
sleep 3
done
}
@@ -1269,6 +1315,35 @@ HeredocForSystemd
echo "ziti-console systemd file written to: ${systemd_file}"
}
ZITI_SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
function setOs {
if [[ "$OSTYPE" == "linux-gnu"* ]]; then
export ZITI_OSTYPE="linux"
elif [[ "$OSTYPE" == "darwin"* ]]; then
export ZITI_OSTYPE="darwin"
elif [[ "$OSTYPE" == "cygwin" ]]; then
export ZITI_OSTYPE="windows"
#echo -e " * ERROR: $(RED "\$OSTYPE [$OSTYPE] is not supported at this time") "
#return 1
elif [[ "$OSTYPE" == "msys" ]]; then
export ZITI_OSTYPE="windows"
#echo -e " * ERROR: $(RED "\$OSTYPE [$OSTYPE] is not supported at this time") "
#return 1
elif [[ "$OSTYPE" == "win32" ]]; then
export ZITI_OSTYPE="windows"
elif [[ "$OSTYPE" == "freebsd"* ]]; then
echo -e " * ERROR: $(RED "\$OSTYPE [$OSTYPE] is not supported at this time") "
return 1
else
echo -e " * ERROR: $(RED "\$OSTYPE is not set or is unknown: [$OSTYPE]. Cannot continue") "
return 1
fi
return 0
}
param1="$@"
if [[ "${param1}" != "" ]]; then
eval "$@"
fi
set +uo pipefail
quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md
+16 -14
View File
@@ -16,12 +16,10 @@ by hostname instead of IP address.
[Here's some detail on how the various intercept modes work on Linux](https://openziti.github.io/ziti/clients/linux.html)
### Solution Overview
![Diagram of solution](./sidecar-diagram.svg)
## Prerequisites
- Complete the [Ziti Network Quickstart](https://openziti.github.io/ziti/quickstarts/networks-overview.html). This guide
@@ -36,11 +34,13 @@ We will create a new identity for our client, with a new AppWAN that uses the et
Create the Identity:
$ ziti edge controller create identity device tunnel-sidecar -o tunnel-sidecar.jwt
ziti edge controller create identity device tunnel-sidecar -o tunnel-sidecar.jwt
Create the AppWAN:
Create the AppWAN and reference the service created in the Ziti Network Quickstart. We'll be using `eth0.ziti.cli`
here but if you created `eth0.ziti.ui` in the quickstart - use that instead. Also note that in the
tunnel-sidecar-demo.yaml:
$ ziti edge controller create app-wan ziti-tunnel-appwan -i tunnel-sidecar -s eth0.ziti.cli
ziti edge controller create app-wan ziti-tunnel-appwan -i tunnel-sidecar -s eth0.ziti.cli
## Create a Kubernetes Secret
@@ -48,11 +48,12 @@ The `ziti-tunnel` sidecar will access its identity by mounting a Kubernetes secr
We can mount the JWT as a secret like this:
$ kubectl create secret generic tunnel-sidecar.jwt --from-file=tunnel-sidecar.jwt
secret/tunnel-sidecar.jwt created
## Deploy the Pod
Deploy a Pod that runs a client application and `ziti-tunnel` as a sidecar container. For this
demonstration, the client application is `wget`. Our Pod runs `wget` in a loop so we can see content
demonstration, the client application is `curl`. Our Pod runs `curl` in a loop so we can see content
from our Ziti service in the Pod's logs.
Save the following yaml to a file named tunnel-sidecar-demo.yaml
@@ -66,7 +67,7 @@ Save the following yaml to a file named tunnel-sidecar-demo.yaml
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storage: 100Mi
---
apiVersion: apps/v1
kind: Deployment
@@ -87,22 +88,22 @@ Save the following yaml to a file named tunnel-sidecar-demo.yaml
containers:
- image: centos
name: testclient
command: ["sh","-c","while true; set -x; do curl -sSLf ethzero.ziti.ui 2>&1; set +x; sleep 5; done"]
- image: netfoundry/ziti-tunnel:0.5.8-2554
command: ["sh","-c","while true; set -x; do curl -sSLf eth0.ziti.cli 2>&1; set +x; sleep 5; done"]
- image: netfoundry/ziti-tunnel:latest
name: ziti-tunnel
env:
- name: NF_REG_NAME
value: tunnel-sidecar
volumeMounts:
- name: tunnel-sidecar-jwt
mountPath: "/var/run/secrets/netfoundry.io/enrollment-token"
mountPath: "/var/run/secrets/kubernetes.io/enrollment-token"
readOnly: true
- name: ziti-tunnel-persistent-storage
mountPath: /netfoundry
securityContext:
capabilities:
add:
- NET_ADMIN
- NET_ADMIN
dnsPolicy: "None"
dnsConfig:
nameservers:
@@ -117,7 +118,6 @@ Save the following yaml to a file named tunnel-sidecar-demo.yaml
secret:
secretName: tunnel-sidecar.jwt
You'll notice that the `ziti-tunnel` sidecar container has a few requirements:
1. The name of the identity that is assumed by `ziti-tunnel` must be passed into the container with the
@@ -131,6 +131,8 @@ You'll notice that the `ziti-tunnel` sidecar container has a few requirements:
Once the yaml is saved, we can deploy the Pod with `kubectl`
$ kubectl apply -f ./tunnel-sidecar-demo.yaml
persistentvolumeclaim/tunnel-sidecar-pv-claim created
deployment.apps/ziti-tunnel-sidecar-demo created
## Test the Service
@@ -146,5 +148,5 @@ Then we can tail the logs for the "testclient" container:
54.67.121.213
54.67.121.213
Notice that the `wget` client is using the DNS name that we provided in the Ziti service definition to make the
request.
Notice that the `curl` client is using the DNS name that we provided in the Ziti service definition to make the
request.
ziti-router/subcmd/run.go
+1 -1
View File
@@ -72,7 +72,7 @@ func run(cmd *cobra.Command, args []string) {
stateManager := fabric.NewStateManager()
xgressEdgeFactory := xgress_edge.NewFactory(config, version.GetCmdBuildInfo(), stateManager)
xgressEdgeFactory := xgress_edge.NewFactory(config, version.GetCmdBuildInfo(), stateManager, r.MetricsRegistry())
xgress.GlobalRegistry().Register(edge_common.EdgeBinding, xgressEdgeFactory)
if err := r.RegisterXctrl(xgressEdgeFactory); err != nil {
logrus.Panicf("error registering edge in framework (%v)", err)