diff --git a/.gitignore b/.gitignore index 1b506c1de..6553b562a 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ Pipfile ziti.ignore linux-build *.log +/build/ diff --git a/CHANGELOG.md b/CHANGELOG.md index 8bb58c42f..724d744d7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,122 @@ +# Release 0.20.10 + +## What's New + +* Bug fix: patch for process multi would clear information +* Bug fix: [ziti#420](https://github.com/openziti/ziti/issues/420) fix ziti-tunnel failover with multiple interfaces when once becomes unavailable +* Bug fix: [edge#670](https://github.com/openziti/edge/issues/670) fix ziti-tunnel issue where address were left assigned to loopback after clean shutdown +* Bug fix: race condition in edge session sync could cause router panic. Regression since 0.20.9 +* Bug fix: terminator updates and deletes from the combined router/tunneler weren't working +* Feature: Router health checks +* Feature: Controller health check + +## Router Health Checks + +Routers can now enable an HTTP health check endpoint. The health check is configured in the router config file with the new `healthChecks` section. + +``` +healthChecks: + ctrlPingCheck: + # How often to ping the controller over the control channel. Defaults to 30 seconds + interval: 30s + # When to timeout the ping. Defaults to 15 seconds + timeout: 15s + # How long to wait before pinging the controller. Defaults to 15 seconds + initialDelay: 15s +``` + +The health check endpoint is configured via XWeb, same as in the controller. As section like the following can be added to the router config to enable the endpoint. + +``` +web: + - name: health-check + bindPoints: + - interface: 127.0.0.1:8081 + address: 127.0.0.1:8081 + apis: + - binding: health-checks +``` + +The health check output will look like this: + +``` +$ curl -k https://localhost:8081/health-checks +{ + "data": { + "checks": [ + { + "healthy": true, + "id": "controllerPing", + "lastCheckDuration": "767.381µs", + "lastCheckTime": "2021-06-21T16:22:36-04:00" + } + ], + "healthy": true + }, + "meta": {} +} + +``` + +The endpoint will return a 200 if the health checks are passing and 503 if they are not. + +# Controller Health Check +Routers can now enable an HTTP health check endpoint. The health check is configured in the router config file with the new `healthChecks` section. + +``` +healthChecks: + boltCheck: + # How often to check the bolt db. Defaults to 30 seconds + interval: 30s + # When to timeout the bolt db check. Defaults to 15 seconds + timeout: 15s + # How long to wait before starting bolt db checks. Defaults to 15 seconds + initialDelay: 15s +``` + +The health check endpoint is configured via XWeb. In order to enable the health check endpoint, add it **first** to the list of apis. + +``` + apis: + # binding - required + # Specifies an API to bind to this webListener. Built-in APIs are + # - edge-management + # - edge-client + # - fabric-management + - binding: health-checks + options: { } + - binding: edge-management + # options - variable optional/required + # This section is used to define values that are specified by the API they are associated with. + # These settings are per API. The example below is for the `edge-api` and contains both optional values and + # required values. + options: { } + - binding: edge-client + options: { } + +``` + +The health check output will look like this: + +``` +$ curl -k https://localhost:1280/health-checks +{ + "data": { + "checks": [ + { + "healthy": true, + "id": "bolt.read", + "lastCheckDuration": "27.46µs", + "lastCheckTime": "2021-06-21T17:32:31-04:00" + } + ], + "healthy": true + }, + "meta": {} +} + +``` + # Release 0.20.9 ## What's New diff --git a/etc/ctrl.with.edge.yml b/etc/ctrl.with.edge.yml index 683d68c08..b78e4dd3f 100644 --- a/etc/ctrl.with.edge.yml +++ b/etc/ctrl.with.edge.yml @@ -79,6 +79,15 @@ mgmt: # enabled: false # delay: 5 +healthChecks: + boltCheck: + # How often to try entering a bolt read tx. Defaults to 30 seconds + interval: 30s + # When to timeout the check. Defaults to 15 seconds + timeout: 15s + # How long to wait before starting the check. Defaults to 15 seconds + initialDelay: 15s + # By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this # section, commenting out, or altering the name of the section will cause the edge to not run. edge: @@ -179,9 +188,12 @@ web: apis: # binding - required # Specifies an API to bind to this webListener. Built-in APIs are + # - health-checks # - edge-management # - edge-client # - fabric-management + - binding: health-checks + options: { } - binding: edge-management # options - variable optional/required # This section is used to define values that are specified by the API they are associated with. @@ -189,4 +201,5 @@ web: # required values. options: { } - binding: edge-client - options: { } \ No newline at end of file + options: { } + diff --git a/etc/edge.router.yml b/etc/edge.router.yml index 4daf717b9..f426aa7ea 100644 --- a/etc/edge.router.yml +++ b/etc/edge.router.yml @@ -36,6 +36,15 @@ link: dialers: - binding: transport +healthChecks: + ctrlPingCheck: + # How often to ping the controller over the control channel. Defaults to 30 seconds + interval: 30s + # When to timeout the ping. Defaults to 15 seconds + timeout: 15s + # How long to wait before pinging the controller. Defaults to 15 seconds + initialDelay: 15s + metrics: reportInterval: 15s messageQueueSize: 10 @@ -102,3 +111,28 @@ listeners: - binding: transport address: tls:0.0.0.0:7099 +web: + # name - required + # Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested. + - name: health-check + # bindPoints - required + # One or more bind points are required. A bind point specifies an interface (interface:port string) that defines + # where on the host machine the webListener will listen and the address (host:port) that should be used to + # publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for + # incoming address resolution as well as used in responses in the API. + bindPoints: + #interface - required + # A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces + - interface: 127.0.0.1:8081 + # address - required + # The public address that external incoming requests will be able to resolve. Used in request processing and + # response content that requires full host:port/path addresses. + address: 127.0.0.1:8081 + # apis - required + # Allows one or more APIs to be bound to this webListener + apis: + # binding - required + # Specifies an API to bind to this webListener. Built-in APIs are + # - health-checks + - binding: health-checks +~ diff --git a/etc/router.yml b/etc/router.yml index bd5c6b19e..d77b162a2 100644 --- a/etc/router.yml +++ b/etc/router.yml @@ -58,6 +58,18 @@ forwarder: ctrl: endpoint: tls:127.0.0.1:6262 +healthCheck: + # Specifies the health check port. If not present, the health check will be disabled + #port: 8081 + # Specifies what address to bind to. Default to blank, which will bind to all available addresses + bindAddress: "" + # How often to ping the controller over the control channel. Defaults to 30 seconds + ctrlPingInterval: 30s + # When to timeout the ping. Defaults to 15 seconds + ctrlPingTimeout: 15s + # How long to wait before pinging the controller. Defaults to 15 seconds + initialDelay: 15s + # Listener Configuration # # Define the Xgress listeners to start up, and their configuration. @@ -105,4 +117,4 @@ listeners: options: retransmission: true randomDrops: true - drop1InN: 5000 \ No newline at end of file + drop1InN: 5000 diff --git a/go.mod b/go.mod index d6c10b661..3ed9d9da4 100644 --- a/go.mod +++ b/go.mod @@ -29,10 +29,10 @@ require ( github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.3.7 - github.com/openziti/edge v0.19.133 - github.com/openziti/fabric v0.16.68 - github.com/openziti/foundation v0.15.55 - github.com/openziti/sdk-golang v0.15.53 + github.com/openziti/edge v0.19.145 + github.com/openziti/fabric v0.16.71 + github.com/openziti/foundation v0.15.56 + github.com/openziti/sdk-golang v0.15.57 github.com/pborman/uuid v1.2.0 github.com/pkg/errors v0.9.1 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 diff --git a/go.sum b/go.sum index 7582f3224..7015bff50 100644 --- a/go.sum +++ b/go.sum @@ -30,8 +30,8 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4= dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU= git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg= -github.com/AppsFlyer/go-sundheit v0.3.1 h1:Zqnr3wV3WQmXonc234k9XZAoV2KHUHw3osR5k2iHQZE= -github.com/AppsFlyer/go-sundheit v0.3.1/go.mod h1:iZ8zWMS7idcvmqewf5mEymWWgoOiG/0WD4+aeh+heX4= +github.com/AppsFlyer/go-sundheit v0.4.0 h1:7ECd0YWaXJQ9LzdCFrpGxJVeAgXvNarN6uwxrJsh69A= +github.com/AppsFlyer/go-sundheit v0.4.0/go.mod h1:iZ8zWMS7idcvmqewf5mEymWWgoOiG/0WD4+aeh+heX4= github.com/Azure/azure-sdk-for-go v32.4.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc= github.com/Azure/go-autorest/autorest v0.1.0/go.mod h1:AKyIcETwSUFxIcs/Wnq/C+kwCtlEYGUVd7FPNb2slmg= github.com/Azure/go-autorest/autorest v0.5.0/go.mod h1:9HLKlQjVBH6U3oDfsXOeVc56THsLPw1L03yban4xThw= @@ -622,14 +622,14 @@ github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e h1:ST9+54UtCr96S5 github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ= github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k= github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo= -github.com/openziti/edge v0.19.133 h1:f1lCoPN4+RMO47+5f9flLfdrzt8j9IivbaYeUat/BjE= -github.com/openziti/edge v0.19.133/go.mod h1:aGSSMipVcsLSQZflt7arx/ixeIHDZTevFUNiet86n6g= -github.com/openziti/fabric v0.16.68 h1:xo432y7qewrK//nFEZYpujnTzYloYSZPzlwaLMdyd0s= -github.com/openziti/fabric v0.16.68/go.mod h1:JgQ6EWVAjjbePcsM20hqQLMMeGjAhqLDvqVjy2qnt6g= -github.com/openziti/foundation v0.15.55 h1:JNNown1ki8GHu3WRGTTAjTn0KrFIQoiSP93exoZPOI4= -github.com/openziti/foundation v0.15.55/go.mod h1:h8d47dCV3vgwAkY4pkQrgpu3wBblDwUrNb/uvDAs0sU= -github.com/openziti/sdk-golang v0.15.53 h1:GE/6Gb0T+Pv/uSJyboPPBVh5+3J3aUDuX5Dueq+8y2c= -github.com/openziti/sdk-golang v0.15.53/go.mod h1:FCQArKmdxtG+t5xyBtKpnSiXdsdTFFaVhLvRtto+YRs= +github.com/openziti/edge v0.19.145 h1:YVvTg+2iNuoqpnwVbID9AqYkhxdRrx3Z4o5P4/wrbq0= +github.com/openziti/edge v0.19.145/go.mod h1:+Rav15D9soV8grHd/UOM3deA7T1HvN4obeYnKNYfvBY= +github.com/openziti/fabric v0.16.71 h1:5y66bJYXXOI2xdCfD79KCBlW3g638Vx80VVrnyq9kRc= +github.com/openziti/fabric v0.16.71/go.mod h1:RhooR5KtpxSpesOa/L9VelwlkhaToBTwzwT1QiGDB/4= +github.com/openziti/foundation v0.15.56 h1:St4FLcaBD8ER1QyO/P0enyIRw+ErOKayHc3zY6aY6aU= +github.com/openziti/foundation v0.15.56/go.mod h1:h8d47dCV3vgwAkY4pkQrgpu3wBblDwUrNb/uvDAs0sU= +github.com/openziti/sdk-golang v0.15.57 h1:QvGUKA806IDtzb4L4PbN+Aq8aylgBg6kbS1nDF3UrYI= +github.com/openziti/sdk-golang v0.15.57/go.mod h1:+dbV733phFpHXLSHFJZ+3bDRy93Vv7YhmpItE03sYWs= github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI= github.com/orcaman/concurrent-map v0.0.0-20210106121528-16402b402231 h1:fa50YL1pzKW+1SsBnJDOHppJN9stOEwS+CRWyUtyYGU= diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh old mode 100644 new mode 100755 index 546130a16..5804c1475 --- a/quickstart/docker/image/ziti-cli-functions.sh +++ b/quickstart/docker/image/ziti-cli-functions.sh @@ -5,8 +5,9 @@ set -uo pipefail # shellcheck disable=SC2155 export DEFAULT_ZITI_HOME_LOCATION="${HOME}/.ziti/quickstart/$(hostname)" +# shellcheck disable=SC2164 # shellcheck disable=SC2155 -export ZITI_QUICKSTART_SCRIPT_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +export ZITI_QUICKSTART_SCRIPT_ROOT="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )" export ZITI_QUICKSTART_ENVROOT="${HOME}/.ziti/quickstart" ASCI_WHITE='\033[01;37m' @@ -44,7 +45,7 @@ function BLUE { } function zitiLogin { - unused=$("${ZITI_BIN_DIR-}/ziti" edge login "${ZITI_EDGE_CONTROLLER_API}" -u "${ZITI_USER-}" -p "${ZITI_PWD}" -c "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert") + unused=$("${ZITI_BIN_DIR-}/ziti" edge login "${ZITI_EDGE_CONTROLLER_API}" -u "${ZITI_USER-}" -p "${ZITI_PWD}" -c "${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert") } function cleanZitiController { ziti_home="${ZITI_HOME-}" @@ -57,12 +58,12 @@ function cleanZitiController { initializeController } function initializeController { - "${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME-}/controller.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${ZITI_HOME-}/controller-init.log" + "${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/controller.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${ZITI_HOME_OS_SPECIFIC}/controller-init.log" echo -e "ziti-controller initialized. see $(BLUE "${ZITI_HOME-}/controller-init.log") for details" } function startZitiController { # shellcheck disable=SC2034 - unused=$("${ZITI_BIN_DIR-}/ziti-controller" run "${ZITI_HOME-}/controller.yaml" > "${ZITI_HOME-}/ziti-edge-controller.log" 2>&1 &) + unused=$("${ZITI_BIN_DIR-}/ziti-controller" run "${ZITI_HOME_OS_SPECIFIC}/controller.yaml" > "${ZITI_HOME_OS_SPECIFIC}/ziti-edge-controller.log" 2>&1 &) echo -e "ziti-controller started. log located at: $(BLUE "${ZITI_HOME-}/ziti-edge-controller.log")" } function stopZitiController { @@ -106,19 +107,31 @@ function checkHostsFile { } function getLatestZitiVersion { + setupZitiHome + + if ! setOs; then + return 1 + fi + + ZITI_ARCH="amd64" + if [[ "$(uname -a)" == *"arm"* ]]; then + ZITI_ARCH="arm" + fi + + unset ZITI_BINARIES_VERSION + if [[ "${ZITI_BINARIES_VERSION-}" == "" ]]; then zitilatest=$(curl -s https://api.github.com/repos/openziti/ziti/releases/latest) - echo "${zitilatest}" > /mnt/v/temp/a.txt # shellcheck disable=SC2155 - export ZITI_BINARIES_TARFILE=$(echo "${zitilatest}" | jq -r '.assets[] | select(.name | startswith("ziti-linux-amd")) | .name') + export ZITI_BINARIES_FILE=$(echo "${zitilatest}" | jq -r '.assets[] | select(.name | startswith("'"ziti-${ZITI_OSTYPE}-${ZITI_ARCH}"'")) | .name') # shellcheck disable=SC2155 export ZITI_BINARIES_VERSION=$(echo "${zitilatest}" | jq -r '.tag_name') fi - #echo -e 'Ziti tar.gz: '"$(BLUE "${ZITI_BINARIES_TARFILE}")" - #echo -e 'Latest ziti is: '"$(BLUE "${ZITI_BINARIES_VERSION}")" + echo "ZITI_BINARIES_VERSION: ${ZITI_BINARIES_VERSION}" } function getLatestZiti { + setupZitiHome if [[ "${ZITI_HOME-}" == "" ]]; then echo "ERROR: ZITI_HOME is not set!" return 1 @@ -131,42 +144,56 @@ function getLatestZiti { export ZITI_BIN_ROOT="${ziti_bin_root}/ziti-bin" mkdir -p "${ziti_bin_root}" - getLatestZitiVersion + + if ! getLatestZitiVersion; then + return 1 + fi ziti_bin_ver="${ZITI_BINARIES_VERSION-}" if [[ "${ziti_bin_ver}" == "" ]]; then - echo "ERROR: ZITI_HOME is not set!" + echo "ERROR: ZITI_BINARIES_VERSION is not set!" return 1 fi export ZITI_BIN_DIR="${ziti_bin_root}/ziti-${ziti_bin_ver}" - ZITI_BINARIES_TARFILE_ABSPATH="${ZITI_HOME-}/ziti-bin/${ZITI_BINARIES_TARFILE}" - if ! test -f "${ZITI_BINARIES_TARFILE_ABSPATH}"; then - echo -e 'Downloading '"$(BLUE "${ZITI_BINARIES_TARFILE}")"' to '"$(BLUE "${ZITI_BINARIES_TARFILE_ABSPATH}")" - zitidl="https://github.com/openziti/ziti/releases/download/${ZITI_BINARIES_VERSION-}/${ZITI_BINARIES_TARFILE}" - wget -q "${zitidl}" -O "${ZITI_BINARIES_TARFILE_ABSPATH}" + ZITI_BINARIES_FILE_ABSPATH="${ZITI_HOME-}/ziti-bin/${ZITI_BINARIES_FILE}" + if ! test -f "${ZITI_BINARIES_FILE_ABSPATH}"; then + zitidl="https://github.com/openziti/ziti/releases/download/${ZITI_BINARIES_VERSION-}/${ZITI_BINARIES_FILE}" + echo -e 'Downloading '"$(BLUE "${zitidl}")"' to '"$(BLUE "${ZITI_BINARIES_FILE_ABSPATH}")" + curl -Ls "${zitidl}" -o "${ZITI_BINARIES_FILE_ABSPATH}" else - echo -e "$(YELLOW 'Already Downloaded ')""$(BLUE "${ZITI_BINARIES_TARFILE}")"' at: '"${ZITI_BINARIES_TARFILE_ABSPATH}" + echo -e "$(YELLOW 'Already Downloaded ')""$(BLUE "${ZITI_BINARIES_FILE}")"' at: '"${ZITI_BINARIES_FILE_ABSPATH}" fi - echo -e 'UNZIPPING '"$(BLUE "${ZITI_BINARIES_TARFILE_ABSPATH}")"' into: '"$(GREEN "${ZITI_BIN_DIR-}")" + echo -e 'UNZIPPING '"$(BLUE "${ZITI_BINARIES_FILE_ABSPATH}")"' into: '"$(GREEN "${ZITI_BIN_DIR}")" rm -rf "${ziti_bin_root}/ziti-${ZITI_BINARIES_VERSION-}" - tar -xf "${ZITI_BINARIES_TARFILE_ABSPATH}" --directory "${ziti_bin_root}" - mv "${ziti_bin_root}/ziti" "${ZITI_BIN_DIR-}" + if [[ "${ZITI_OSTYPE}" == "windows" ]]; then + unzip "${ZITI_BINARIES_FILE_ABSPATH}" -d "${ZITI_BIN_DIR}" + mv "${ZITI_BIN_DIR}/ziti/"* "${ZITI_BIN_DIR}/" + rm -rf "${ZITI_BIN_DIR}/ziti/"* + rmdir "${ZITI_BIN_DIR}/ziti/" + chmod +x "${ZITI_BIN_DIR}/"* + else + tar -xf "${ZITI_BINARIES_FILE_ABSPATH}" --directory "${ziti_bin_root}" + mv "${ziti_bin_root}/ziti" "${ZITI_BIN_DIR}" + fi + + echo -e 'Marking executables at '"$(GREEN "${ZITI_BIN_DIR}")"' executable' + chmod +x "${ZITI_BIN_DIR}/"* if [[ "${1-}" == "yes" ]]; then - echo "Adding ${ZITI_BIN_DIR-} to the path if necessary:" - if [[ "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR-}" && echo "yes")" == "yes" ]]; then - echo -e "$(GREEN "${ZITI_BIN_DIR-}") is already on the path" + echo "Adding ${ZITI_BIN_DIR} to the path if necessary:" + if [[ "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR}" && echo "yes")" == "yes" ]]; then + echo -e "$(GREEN "${ZITI_BIN_DIR}") is already on the path" else - echo -e "adding $(RED "${ZITI_BIN_DIR-}") to the path" - export PATH=$PATH:"${ZITI_BIN_DIR-}" + echo -e "adding $(RED "${ZITI_BIN_DIR}") to the path" + export PATH=$PATH:"${ZITI_BIN_DIR}" fi fi } function checkPrereqs { - commands_to_test=(curl jq wget) + commands_to_test=(curl jq) missing_requirements="" # verify all the commands required in the automation exist before trying to run the full suite for cmd in "${commands_to_test[@]}" @@ -192,7 +219,7 @@ function checkPrereqs { } function checkControllerName { - if [[ ${ZITI_EDGE_CONTROLLER_HOSTNAME} == *['!'@#\$%^\&*()_+]* ]]; then + if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME}" == *['!'@#\$%^\&*\(\)_+]* ]]; then echo -e "$(RED " - The provided Network name contains an invalid character: '!'@#\$%^\&*()_+")" return 1 fi @@ -251,7 +278,10 @@ function setupZitiNetwork { } function setupZitiHome { - export ZITI_HOME="${HOME}/.ziti/quickstart/${ZITI_NETWORK-}" + if [[ "${ZITI_HOME-}" == "" ]]; then + export ZITI_HOME="${HOME}/.ziti/quickstart/${ZITI_NETWORK-}" + echo "using default ZITI_HOME: ${ZITI_HOME}" + fi } function generateEnvFile { @@ -272,9 +302,6 @@ function generateEnvFile { export ZITI_BIN_ROOT="${ZITI_HOME-}/ziti-bin" fi - # shellcheck disable=SC2155 - export ZITI_SCRIPTS="$(realpath "${ZITI_SCRIPT_DIR}/..")" - if ! ziti_createEnvFile; then return 1 fi @@ -341,15 +368,15 @@ function ziti_expressConfiguration { echo "---------- Creating edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...." unused=$("${ZITI_BIN_DIR-}/ziti" edge delete edge-router "${ZITI_EDGE_ROUTER_RAWNAME}") - unused=$("${ZITI_BIN_DIR-}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" -o "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" -t) + unused=$("${ZITI_BIN_DIR-}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" -o "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" -t) sleep 1 echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...." - unused=$("${ZITI_BIN_DIR-}/ziti-router" enroll "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" --jwt "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" &> "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.enrollment.log") + unused=$("${ZITI_BIN_DIR-}/ziti-router" enroll "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" --jwt "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" &> "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.enrollment.log") echo "" sleep 1 # shellcheck disable=SC2034 - unused=$("${ZITI_BIN_DIR-}/ziti-router" run "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.log" 2>&1 &) + unused=$("${ZITI_BIN_DIR-}/ziti-router" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.log" 2>&1 &) echo "Express setup complete!" } @@ -440,7 +467,7 @@ function pki_client_server { if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" - "${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \ + "${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \ --server-file "${name_local}-server" \ --dns "${name_local},localhost" --ip "${ip_local}" \ --server-name "${name_local} server certificate" @@ -451,7 +478,7 @@ function pki_client_server { if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" - "${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \ + "${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \ --client-file "${name_local}-client" \ --key-file "${name_local}-server" \ --client-name "${name_local}" @@ -463,24 +490,24 @@ function pki_client_server { } function pki_create_ca { - if ! test -f "${ZITI_PKI}/${1}/keys/${1}.key"; then - echo "Creating CA: ${1}" - "${ZITI_BIN_DIR-}/ziti" pki create ca --pki-root="${ZITI_PKI}" --ca-file="${1}" --ca-name="${1} Root CA" + cert=$1 + + echo "Creating CA: ${cert}" + if ! test -f "${ZITI_PKI}/${cert}/keys/${cert}.key"; then + "${ZITI_BIN_DIR}/ziti" pki create ca --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-file="${cert}" --ca-name="${cert} Root CA" else - echo "Creating CA: ${1}" echo "key exists" fi echo " " } function pki_create_intermediate { + echo "Creating intermediate: ${1} ${2} ${3}" if ! test -f "${ZITI_PKI}/${2}/keys/${2}.key"; then - echo "Creating intermediate: ${1} ${2} ${3}" - "${ZITI_BIN_DIR-}/ziti" pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${1}" \ + "${ZITI_BIN_DIR}/ziti" pki create intermediate --pki-root "${ZITI_PKI_OS_SPECIFIC}" --ca-name "${1}" \ --intermediate-name "${2}" \ --intermediate-file "${2}" --max-path-len "${3}" else - echo "Creating intermediate: ${1} ${2} ${3}" echo "key exists" fi echo " " @@ -492,43 +519,43 @@ function printUsage() function verifyCertAgainstPool() { - if [[ "" == "${1-}" ]] - then - printUsage "verifyCertAgainstPool" - return 1 - fi + if [[ "" == "${1-}" ]] + then + printUsage "verifyCertAgainstPool" + return 1 + fi - if [[ "" == "$2" ]] - then - printUsage "verifyCertAgainstPool" - return 1 - fi + if [[ "" == "$2" ]] + then + printUsage "verifyCertAgainstPool" + return 1 + fi - echo " Verifying that this certificate:" - echo " - ${1-}" - echo " is valid for this ca pool:" - echo " - $2" - echo "" - openssl verify -partial_chain -CAfile "$2" "${1-}" - # shellcheck disable=SC2181 - if [ $? -eq 0 ]; then - echo "" - echo "============ SUCCESS! ============" - else - echo "" - echo "============ FAILED TO VALIDATE ============" - fi + echo " Verifying that this certificate:" + echo " - ${1-}" + echo " is valid for this ca pool:" + echo " - $2" + echo "" + openssl verify -partial_chain -CAfile "$2" "${1-}" + # shellcheck disable=SC2181 + if [ $? -eq 0 ]; then + echo "" + echo "============ SUCCESS! ============" + else + echo "" + echo "============ FAILED TO VALIDATE ============" + fi } function showIssuerAndSubjectForPEM() { - echo "Displaying Issuer and Subject for cert pool:" - echo " ${1-}" - openssl crl2pkcs7 -nocrl -certfile "${1-}" | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)" + echo "Displaying Issuer and Subject for cert pool:" + echo " ${1-}" + openssl crl2pkcs7 -nocrl -certfile "${1-}" | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)" } function createRouterPki { -pki_client_server "${ZITI_EDGE_ROUTER_RAWNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" + pki_client_server "${ZITI_EDGE_ROUTER_RAWNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" } function createPrivateRouterConfig { @@ -536,10 +563,10 @@ cat > "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" < "${ZITI_HOME-}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" < "${ZITI_HOME}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" < "${ZITI_HOME-}/${router_name}.yaml" < "${ziti_home}/${router_name}.yaml" < "${ZITI_HOME-}/identities.yml" < "${ZITI_HOME}/identities.yml" < "${ziti_home}/controller.yaml" </dev/null 2>&1 && pwd )" +function setOs { + if [[ "$OSTYPE" == "linux-gnu"* ]]; then + export ZITI_OSTYPE="linux" + elif [[ "$OSTYPE" == "darwin"* ]]; then + export ZITI_OSTYPE="darwin" + elif [[ "$OSTYPE" == "cygwin" ]]; then + export ZITI_OSTYPE="windows" + #echo -e " * ERROR: $(RED "\$OSTYPE [$OSTYPE] is not supported at this time") " + #return 1 + elif [[ "$OSTYPE" == "msys" ]]; then + export ZITI_OSTYPE="windows" + #echo -e " * ERROR: $(RED "\$OSTYPE [$OSTYPE] is not supported at this time") " + #return 1 + elif [[ "$OSTYPE" == "win32" ]]; then + export ZITI_OSTYPE="windows" + elif [[ "$OSTYPE" == "freebsd"* ]]; then + echo -e " * ERROR: $(RED "\$OSTYPE [$OSTYPE] is not supported at this time") " + return 1 + else + echo -e " * ERROR: $(RED "\$OSTYPE is not set or is unknown: [$OSTYPE]. Cannot continue") " + return 1 + fi + return 0 +} + +param1="$@" + +if [[ "${param1}" != "" ]]; then + eval "$@" +fi set +uo pipefail \ No newline at end of file diff --git a/quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md b/quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md index 0c7d8de0c..2eed1fc08 100644 --- a/quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md +++ b/quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md @@ -16,12 +16,10 @@ by hostname instead of IP address. [Here's some detail on how the various intercept modes work on Linux](https://openziti.github.io/ziti/clients/linux.html) - ### Solution Overview ![Diagram of solution](./sidecar-diagram.svg) - ## Prerequisites - Complete the [Ziti Network Quickstart](https://openziti.github.io/ziti/quickstarts/networks-overview.html). This guide @@ -36,11 +34,13 @@ We will create a new identity for our client, with a new AppWAN that uses the et Create the Identity: - $ ziti edge controller create identity device tunnel-sidecar -o tunnel-sidecar.jwt + ziti edge controller create identity device tunnel-sidecar -o tunnel-sidecar.jwt -Create the AppWAN: +Create the AppWAN and reference the service created in the Ziti Network Quickstart. We'll be using `eth0.ziti.cli` +here but if you created `eth0.ziti.ui` in the quickstart - use that instead. Also note that in the +tunnel-sidecar-demo.yaml: - $ ziti edge controller create app-wan ziti-tunnel-appwan -i tunnel-sidecar -s eth0.ziti.cli + ziti edge controller create app-wan ziti-tunnel-appwan -i tunnel-sidecar -s eth0.ziti.cli ## Create a Kubernetes Secret @@ -48,11 +48,12 @@ The `ziti-tunnel` sidecar will access its identity by mounting a Kubernetes secr We can mount the JWT as a secret like this: $ kubectl create secret generic tunnel-sidecar.jwt --from-file=tunnel-sidecar.jwt + secret/tunnel-sidecar.jwt created ## Deploy the Pod Deploy a Pod that runs a client application and `ziti-tunnel` as a sidecar container. For this -demonstration, the client application is `wget`. Our Pod runs `wget` in a loop so we can see content +demonstration, the client application is `curl`. Our Pod runs `curl` in a loop so we can see content from our Ziti service in the Pod's logs. Save the following yaml to a file named tunnel-sidecar-demo.yaml @@ -66,7 +67,7 @@ Save the following yaml to a file named tunnel-sidecar-demo.yaml - ReadWriteOnce resources: requests: - storage: 1Gi + storage: 100Mi --- apiVersion: apps/v1 kind: Deployment @@ -87,22 +88,22 @@ Save the following yaml to a file named tunnel-sidecar-demo.yaml containers: - image: centos name: testclient - command: ["sh","-c","while true; set -x; do curl -sSLf ethzero.ziti.ui 2>&1; set +x; sleep 5; done"] - - image: netfoundry/ziti-tunnel:0.5.8-2554 + command: ["sh","-c","while true; set -x; do curl -sSLf eth0.ziti.cli 2>&1; set +x; sleep 5; done"] + - image: netfoundry/ziti-tunnel:latest name: ziti-tunnel env: - name: NF_REG_NAME value: tunnel-sidecar volumeMounts: - name: tunnel-sidecar-jwt - mountPath: "/var/run/secrets/netfoundry.io/enrollment-token" + mountPath: "/var/run/secrets/kubernetes.io/enrollment-token" readOnly: true - name: ziti-tunnel-persistent-storage mountPath: /netfoundry securityContext: capabilities: add: - - NET_ADMIN + - NET_ADMIN dnsPolicy: "None" dnsConfig: nameservers: @@ -117,7 +118,6 @@ Save the following yaml to a file named tunnel-sidecar-demo.yaml secret: secretName: tunnel-sidecar.jwt - You'll notice that the `ziti-tunnel` sidecar container has a few requirements: 1. The name of the identity that is assumed by `ziti-tunnel` must be passed into the container with the @@ -131,6 +131,8 @@ You'll notice that the `ziti-tunnel` sidecar container has a few requirements: Once the yaml is saved, we can deploy the Pod with `kubectl` $ kubectl apply -f ./tunnel-sidecar-demo.yaml + persistentvolumeclaim/tunnel-sidecar-pv-claim created + deployment.apps/ziti-tunnel-sidecar-demo created ## Test the Service @@ -146,5 +148,5 @@ Then we can tail the logs for the "testclient" container: 54.67.121.213 54.67.121.213 -Notice that the `wget` client is using the DNS name that we provided in the Ziti service definition to make the -request. \ No newline at end of file +Notice that the `curl` client is using the DNS name that we provided in the Ziti service definition to make the +request. diff --git a/ziti-router/subcmd/run.go b/ziti-router/subcmd/run.go index aa9ec6d42..e38417e9e 100644 --- a/ziti-router/subcmd/run.go +++ b/ziti-router/subcmd/run.go @@ -72,7 +72,7 @@ func run(cmd *cobra.Command, args []string) { stateManager := fabric.NewStateManager() - xgressEdgeFactory := xgress_edge.NewFactory(config, version.GetCmdBuildInfo(), stateManager) + xgressEdgeFactory := xgress_edge.NewFactory(config, version.GetCmdBuildInfo(), stateManager, r.MetricsRegistry()) xgress.GlobalRegistry().Register(edge_common.EdgeBinding, xgressEdgeFactory) if err := r.RegisterXctrl(xgressEdgeFactory); err != nil { logrus.Panicf("error registering edge in framework (%v)", err)