gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-12 23:32:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #707 from openziti/fix-external-edge-router

Browse Source 
Fix external edge router PKI
This commit is contained in:
Geoff Berl
2022-05-04 11:19:03 -04:00
committed by GitHub
parent d873335917 1ce7fbbe8e
commit b6eff80092
2 changed files with 22 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+2 -1
View File
@@ -1,6 +1,7 @@
# Release 0.25.6
There are no features or bug fixes in the release. The only change is moving from Go 1.17 to 1.18
* Moving from Go 1.17 to 1.18
* Bug fix: Fixes an issue in quickstart "Host it anywhere" where an EXTERNAL_DNS was not added to the PKI causing failures when attempting to use a router from outside the hosted environment.
# Release 0.25.5
quickstart/docker/image/ziti-cli-functions.sh
+20 -17
View File
@@ -56,7 +56,7 @@ function cleanZitiController {
}
function initializeController {
log_file="${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}-init.log"
"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}"
"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}"
echo -e "ziti-controller initialized. see $(BLUE "${log_file}") for details"
}
function startZitiController {
@@ -611,33 +611,34 @@ function expressInstall {
}
function pki_client_server {
name_local=${1-}
allow_list=${1-}
ZITI_CA_NAME_local=$2
ip_local=$3
file_name=$4
if [[ "${ip_local}" == "" ]]; then
ip_local="127.0.0.1"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${file_name}-server.key"; then
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
"${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \
--server-file "${name_local}-server" \
--dns "${name_local},localhost" --ip "${ip_local}" \
--server-name "${name_local} server certificate"
--server-file "${file_name}-server" \
--dns "${allow_list}" --ip "${ip_local}" \
--server-name "${file_name} server certificate"
else
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
echo "key exists"
fi
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${file_name}-client.key"; then
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
"${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \
--client-file "${name_local}-client" \
--key-file "${name_local}-server" \
--client-name "${name_local}"
--client-file "${file_name}-client" \
--key-file "${file_name}-server" \
--client-name "${file_name}"
else
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
echo "key exists"
fi
echo " "
@@ -717,7 +718,7 @@ function createRouterPki {
export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.cert"
export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.key"
export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/cas.cert"
pki_client_server "${router_name}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}"
pki_client_server "${router_name},localhost,127.0.0.1,$(hostname)" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" "${router_name}"
}
function createPrivateRouterConfig {
@@ -773,8 +774,10 @@ function createPki {
pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1
echo " "
pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}"
pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}"
pki_allow_list="${ZITI_CONTROLLER_HOSTNAME},localhost,127.0.0.1"
if [[ "$EXTERNAL_DNS" != "" ]]; then pki_allow_list="$pki_allow_list,$EXTERNAL_DNS"; fi
pki_client_server "${pki_allow_list}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}" "${ZITI_CONTROLLER_HOSTNAME}"
pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME},localhost,127.0.0.1" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}" "${ZITI_EDGE_CONTROLLER_HOSTNAME}"
}