Merge pull request #597 from openziti/config_generator_implementation_clint

Config generator implementation clint
2026-10-12 07:18:36 +00:00 · 2022-02-11 12:41:52 -05:00
parent c4ddd72af2 7d2d226e7b
commit c8b5013afd
13 changed files with 293 additions and 116 deletions
@@ -1,6 +1,8 @@
 #!/bin/bash

 . "${ZITI_SCRIPTS}/ziti-cli-functions.sh"
+export ZITI_CONTROLLER_RAWNAME=ziti-edge-controller
+export ZITI_CTRL_ADVERTISED_ADDRESS=ziti-edge-controller

 ziti_createEnvFile
 . ${ZITI_HOME}/ziti.env
@@ -1,22 +1,23 @@
 #!/bin/bash

 . "${ZITI_SCRIPTS}/ziti-cli-functions.sh"
-
+export ZITI_EDGE_CTRL_ADVERTISED=ziti-edge-controller:1280
+export ZITI_CTRL_ADVERTISED_ADDRESS=ziti-edge-controller
 ziti_createEnvFile
 . ${ZITI_HOME}/ziti.env

-until $(curl -s -o /dev/null --fail -k "https://${ZITI_EDGE_CONTROLLER_API}"); do
-    echo "waiting for https://${ZITI_EDGE_CONTROLLER_API}"
+until $(curl -s -o /dev/null --fail -k "https://${ZITI_EDGE_CTRL_ADVERTISED}"); do
+    echo "waiting for https://${ZITI_EDGE_CTRL_ADVERTISED}"
    sleep 2
 done

 if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
 if [[ "${ZITI_EDGE_ROUTER_PORT}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi

-createRouterPki
+createRouterPki "${ZITI_EDGE_ROUTER_RAWNAME}"

-echo "logging into ziti controller: ${ZITI_EDGE_API_HOSTNAME}"
-"${ZITI_BIN_DIR}/ziti" edge login "${ZITI_EDGE_CONTROLLER_API}" -u "${ZITI_USER}" -p "${ZITI_PWD}" -c "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert"
+echo "logging into ziti controller: ${ZITI_EDGE_CTRL_ADVERTISED}"
+"${ZITI_BIN_DIR}/ziti" edge login "${ZITI_EDGE_CTRL_ADVERTISED}" -u "${ZITI_USER}" -p "${ZITI_PWD}" -c "${ZITI_PKI}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert"

 if [[ "$1" == "edge" ]]; then
  echo "CREATING EDGE ROUTER CONFIG"
@@ -311,7 +311,7 @@ function generateEnvFile {

  echo -e "Generating new network with name: $(BLUE "${ZITI_NETWORK-}")"

-  if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-controller"; fi
+  if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-controller"; fi
  if [[ "${ZITI_CONTROLLER_HOSTNAME-}" == "" ]]; then export export ZITI_CONTROLLER_HOSTNAME="${ZITI_NETWORK-}"; fi
  if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-edge-controller"; fi
  if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME-}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_HOSTNAME="${ZITI_NETWORK-}"; fi
@@ -320,6 +320,7 @@ function generateEnvFile {
  if [[ "${ZITI_EDGE_ROUTER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_ROUTER_RAWNAME="${ZITI_NETWORK-}-edge-router"; fi
  if [[ "${ZITI_EDGE_ROUTER_HOSTNAME-}" == "" ]]; then export export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_NETWORK-}"; fi
  if [[ "${ZITI_EDGE_ROUTER_PORT-}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
+  if [[ "${ZITI_CTRL_ADVERTISED_ADDRESS-}" == "" ]]; then export ZITI_CTRL_ADVERTISED_ADDRESS="${ZITI_NETWORK-}-controller"; fi

  if [[ "${ZITI_BIN_ROOT-}" == "" ]]; then
    export ZITI_BIN_ROOT="${ZITI_HOME-}/ziti-bin"
@@ -628,6 +629,7 @@ function showIssuerAndSubjectForPEM() {
 }

 function createRouterPki {
+  #TODO: this needs to be parameterized to take other router_name
  pki_client_server "${ZITI_EDGE_ROUTER_RAWNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}"
 }

@@ -804,14 +806,23 @@ function createEdgeRouterConfig {
    return 1
  fi

-output_file="${ZITI_HOME}/${router_name}.yaml"
-"${ZITI_BIN_DIR}/ziti" create config router edge --routerName "${router_name}" > "${output_file}"
+  output_file="${ZITI_HOME}/${router_name}.yaml"

-echo -e "edge router configuration file written to: $(BLUE "${output_file}")"
+  mkdir -p "${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}"
+  export ZITI_ROUTER_IDENTITY_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/client.cert"
+  export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.cert"
+  export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.key"
+  export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/cas.cert"
+  "${ZITI_BIN_DIR}/ziti" create config router edge --routerName "${router_name}" > "${output_file}"
+  echo -e "edge router configuration file written to: $(BLUE "${output_file}")"
+  unset ZITI_ROUTER_IDENTITY_CERT
+  unset ZITI_ROUTER_IDENTITY_SERVER_CERT
+  unset ZITI_ROUTER_IDENTITY_KEY
+  unset ZITI_ROUTER_IDENTITY_CA
 }

 function createFabricIdentity {
-  output_file="${ZITI_HOME}/identities.yaml"
+  output_file="${ZITI_HOME}/identities.yml"
 cat > "${output_file}" <<IdentitiesJsonHereDoc
 ---
 default:
@@ -851,14 +862,14 @@ function createControllerConfig {
    return 1
  fi

-cat "${ZITI_CTRL_IDENTITY_SERVER_CERT}" > "${ZITI_CTRL_IDENTITY_CA}"
-cat "${ZITI_SIGNING_CERT}" >> "${ZITI_CTRL_IDENTITY_CA}"
-echo -e "wrote CA file to: $(BLUE "${ZITI_CTRL_IDENTITY_CA}")"
+  cat "${ZITI_CTRL_IDENTITY_SERVER_CERT}" > "${ZITI_CTRL_IDENTITY_CA}"
+  cat "${ZITI_SIGNING_CERT}" >> "${ZITI_CTRL_IDENTITY_CA}"
+  echo -e "wrote CA file to: $(BLUE "${ZITI_CTRL_IDENTITY_CA}")"

-output_file="${ZITI_HOME}/${controller_name}.yaml"
-"${ZITI_BIN_DIR}/ziti" create config controller --ctrlListener 0.0.0.0:1280 > "${output_file}"
+  output_file="${ZITI_HOME}/${controller_name}.yaml"
+  "${ZITI_BIN_DIR}/ziti" create config controller > "${output_file}"

-echo -e "Controller configuration file written to: $(BLUE "${output_file}")"
+  echo -e "Controller configuration file written to: $(BLUE "${output_file}")"
 }

 # shellcheck disable=SC2120
@@ -947,18 +958,15 @@ function ziti_createEnvFile {
  if [[ "${ZITI_CTRL_IDENTITY_SERVER_CERT-}" == "" ]]; then export ZITI_CTRL_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem"; fi
  if [[ "${ZITI_CTRL_IDENTITY_KEY-}" == "" ]]; then export ZITI_CTRL_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_CONTROLLER_HOSTNAME}-server.key"; fi
  if [[ "${ZITI_CTRL_IDENTITY_CA-}" == "" ]]; then export ZITI_CTRL_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/cas.pem"; fi
+  if [[ "${ZITI_EDGE_CTRL_ADVERTISED_HOST_PORT}" == "" ]]; then export export ZITI_EDGE_CTRL_ADVERTISED_HOST_PORT="${ZITI_CONTROLLER_HOSTNAME}:${ZITI_EDGE_CONTROLLER_PORT}"; fi
  if [[ "${ZITI_EDGE_CTRL_IDENTITY_CERT}" == "" ]]; then export export ZITI_EDGE_CTRL_IDENTITY_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-client.cert"; fi
  if [[ "${ZITI_EDGE_CTRL_IDENTITY_SERVER_CERT}" == "" ]]; then export export ZITI_EDGE_CTRL_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.chain.pem"; fi
  if [[ "${ZITI_EDGE_CTRL_IDENTITY_KEY}" == "" ]]; then export export ZITI_EDGE_CTRL_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key"; fi
  if [[ "${ZITI_EDGE_CTRL_IDENTITY_CA}" == "" ]]; then export export ZITI_EDGE_CTRL_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert"; fi
+
  if [[ "${ZITI_SIGNING_CERT}" == "" ]]; then export export ZITI_SIGNING_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert"; fi
  if [[ "${ZITI_SIGNING_KEY}" == "" ]]; then export export ZITI_SIGNING_KEY="${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/keys/${ZITI_SIGNING_INTERMEDIATE_NAME}.key"; fi

-  if [[ "${ZITI_ROUTER_IDENTITY_CERT-}" == "" ]]; then export ZITI_ROUTER_IDENTITY_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-client.cert"; fi
-  if [[ "${ZITI_ROUTER_IDENTITY_SERVER_CERT-}" == "" ]]; then export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-server.cert"; fi
-  if [[ "${ZITI_ROUTER_IDENTITY_KEY-}" == "" ]]; then export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_ROUTER_HOSTNAME}-server.key"; fi
-  if [[ "${ZITI_ROUTER_IDENTITY_CA-}" == "" ]]; then export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_HOSTNAME}-cas.cert"; fi
-
  mkdir -p "${ZITI_BIN_ROOT}"
  mkdir -p "${ZITI_HOME}/db"
  mkdir -p "${ZITI_PKI}"
@@ -37,7 +37,7 @@ mgmt:
  #maxOutstandingConnects: 100
  # the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
  #connectTimeoutMs:       3000
-  listener:             tls:{{ .Controller.MgmtListenerHostPort }}
+  listener:             tls:{{ .Controller.ListenerAddress }}:10000

 #metrics:
 #  influxdb:
@@ -83,8 +83,8 @@ edge:
    # a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert
    # will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller.
    signingCert:
-      cert: {{ .ZitiSigningCert }}
-      key:  {{ .ZitiSigningKey }}
+      cert: {{ .Controller.Edge.ZitiSigningCert }}
+      key:  {{ .Controller.Edge.ZitiSigningKey }}
    # edgeIdentity - optional
    # A section for identity enrollment specific settings
    edgeIdentity:
@@ -167,4 +167,6 @@ web:
        # required values.
        options: { }
      - binding: edge-client
-        options: { }
+        options: { }
+      - binding: fabric
+        optoins: { }
@@ -17,10 +17,18 @@ ctrl:
  endpoint:             tls:{{ .Controller.AdvertisedAddress }}:{{ .Controller.Port }}

 link:
+{{ if .Router.IsPrivate }}#{{ end }}  listeners:
+{{ if .Router.IsPrivate }}#{{ end }}    - binding:          transport
+{{ if .Router.IsPrivate }}#{{ end }}      bind:             tls:0.0.0.0:10080
+{{ if .Router.IsPrivate }}#{{ end }}      advertise:        tls:{{ .Router.Edge.Hostname }}:10080
+{{ if .Router.IsPrivate }}#{{ end }}      options:
+{{ if .Router.IsPrivate }}#{{ end }}        outQueueSize:   16
  dialers:
    - binding: transport

 listeners:
+{{ if or .Router.IsFabric .Router.IsPrivate }}#{{- end }}  - binding: transport
+{{ if or .Router.IsFabric .Router.IsPrivate }}#{{- end }}    address: tls:0.0.0.0:1{{ .Router.Edge.Port }}
 {{ if or .Router.IsFabric .Router.IsPrivate }}#{{- end }}  - binding: tunnel
 {{ if or .Router.IsFabric .Router.IsPrivate }}#{{- end }}    options:
 {{ if or .Router.IsFabric .Router.IsPrivate }}#{{- end }}      mode: host #tproxy|tun|host
@@ -31,22 +39,6 @@ listeners:
 {{ if .Router.IsPrivate }}#{{ end }}      connectTimeoutMs: {{ .Router.Listener.ConnectTimeoutMs }}
 {{ if .Router.IsPrivate }}#{{ end }}      getSessionTimeout: {{ .Router.Listener.GetSessionTimeoutS }}s

-
-{{- if or .Router.IsPrivate .Router.IsFabric }}
-#edge:
-csr:
-  country: US
-  province: NC
-  locality: Charlotte
-  organization: NetFoundry
-  organizationalUnit: Ziti
-  sans:
-    dns:
-      - {{ .Router.Edge.Hostname }}
-      - localhost
-    ip:
-      - "127.0.0.1"
-{{- else }}
 edge:
  csr:
    country: US
@@ -60,7 +52,6 @@ edge:
        - localhost
      ip:
        - "127.0.0.1"
-{{ end }}

 {{ if not .Router.IsWss }}#{{ end }}transport:
 {{ if not .Router.IsWss }}#{{ end }}  ws:
@@ -43,10 +43,8 @@ type CreateConfigOptions struct {
 }

 type ConfigTemplateValues struct {
-	ZitiHome        string
-	Hostname        string
-	ZitiSigningCert string
-	ZitiSigningKey  string
+	ZitiHome string
+	Hostname string

 	Controller ControllerTemplateValues
 	Router     RouterTemplateValues
@@ -68,6 +66,9 @@ type ControllerTemplateValues struct {
 }

 type EdgeControllerValues struct {
+	ZitiSigningCert string
+	ZitiSigningKey  string
+
 	APISessionTimeoutMinutes int
 	ListenerHostPort         string
 	AdvertisedHostPort       string
@@ -137,6 +138,21 @@ type RouterListenerTemplateValues struct {
 	OutQueueSize       int
 }

+var workingDir string
+
+func init() {
+	zh := os.Getenv("ZITI_HOME")
+	if zh == "" {
+		wd, err := os.Getwd()
+		if wd == "" || err != nil {
+			//on error just use "."
+			workingDir = "."
+		}
+	}
+
+	workingDir = cmdhelper.NormalizePath(zh)
+}
+
 // NewCmdCreateConfig creates a command object for the "config" command
 func NewCmdCreateConfig() *cobra.Command {
 	cmd := &cobra.Command{
@@ -189,52 +205,52 @@ func (data *ConfigTemplateValues) populateEnvVars() {
 	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiEdgeRouterPortVarName)

 	// Get Ziti Controller Identity Cert
-	zitiCtrlIdentityCert, err := cmdhelper.GetZitiCtrlIdentityCert()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCertVarName)
+	//zitiCtrlIdentityCert, err := cmdhelper.GetZitiCtrlIdentityCert()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCertVarName)

 	// Get Ziti Controller Identity Server Cert
-	zitiCtrlIdentityServerCert, err := cmdhelper.GetZitiCtrlIdentityServerCert()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityServerCertVarName)
+	//zitiCtrlIdentityServerCert, err := cmdhelper.GetZitiCtrlIdentityServerCert()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityServerCertVarName)

 	// Get Ziti Controller Identity Key
-	zitiCtrlIdentityKey, err := cmdhelper.GetZitiCtrlIdentityKey()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityKeyVarName)
+	//zitiCtrlIdentityKey, err := cmdhelper.GetZitiCtrlIdentityKey()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityKeyVarName)

 	// Get Ziti Controller Identity CA
-	zitiCtrlIdentityCA, err := cmdhelper.GetZitiCtrlIdentityCA()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCAVarName)
+	//zitiCtrlIdentityCA, err := cmdhelper.GetZitiCtrlIdentityCA()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCAVarName)

 	// Get Ziti Controller Identity Cert
-	zitiRouterIdentityCert, err := cmdhelper.GetZitiRouterIdentityCert(zitiEdgeRouterHostName, true)
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCertVarName)
+	//zitiRouterIdentityCert, err := cmdhelper.GetZitiRouterIdentityCert(zitiEdgeRouterHostName, true)
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCertVarName)

 	// Get Ziti Controller Identity Server Cert
-	zitiRouterIdentityServerCert, err := cmdhelper.GetZitiRouterIdentityServerCert(zitiEdgeRouterHostName, true)
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityServerCertVarName)
+	//zitiRouterIdentityServerCert, err := cmdhelper.GetZitiRouterIdentityServerCert(zitiEdgeRouterHostName, true)
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityServerCertVarName)

 	// Get Ziti Controller Identity Key
-	zitiRouterIdentityKey, err := cmdhelper.GetZitiRouterIdentityKey(zitiEdgeRouterHostName, true)
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityKeyVarName)
+	//zitiRouterIdentityKey, err := cmdhelper.GetZitiRouterIdentityKey(zitiEdgeRouterHostName, true)
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityKeyVarName)

 	// Get Ziti Controller Identity CA
-	zitiRouterIdentityCA, err := cmdhelper.GetZitiRouterIdentityCA(zitiEdgeRouterHostName, true)
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCAVarName)
+	//zitiRouterIdentityCA, err := cmdhelper.GetZitiRouterIdentityCA(zitiEdgeRouterHostName, true)
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCAVarName)

 	// Get Ziti Edge Controller Identity Cert
-	zitiEdgeCtrlIdentityCert, err := cmdhelper.GetZitiEdgeIdentityCert()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCertVarName)
+	//zitiEdgeCtrlIdentityCert, err := cmdhelper.GetZitiEdgeIdentityCert()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCertVarName)

 	// Get Ziti Edge Controller Identity Server Cert
-	zitiEdgeCtrlIdentityServerCert, err := cmdhelper.GetZitiEdgeIdentityServerCert()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityServerCertVarName)
+	//zitiEdgeCtrlIdentityServerCert, err := cmdhelper.GetZitiEdgeIdentityServerCert()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityServerCertVarName)

 	// Get Ziti Edge Controller Identity Key
-	zitiEdgeCtrlIdentityKey, err := cmdhelper.GetZitiEdgeIdentityKey()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityKeyVarName)
+	//zitiEdgeCtrlIdentityKey, err := cmdhelper.GetZitiEdgeIdentityKey()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityKeyVarName)

 	// Get Ziti Edge Controller Identity CA
-	zitiEdgeCtrlIdentityCA, err := cmdhelper.GetZitiEdgeIdentityCA()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCAVarName)
+	//zitiEdgeCtrlIdentityCA, err := cmdhelper.GetZitiEdgeIdentityCA()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlIdentityCAVarName)

 	// Get Ziti Controller Listener Address
 	zitiCtrlListenerAddress, err := cmdhelper.GetZitiCtrlListenerAddress()
@@ -253,12 +269,12 @@ func (data *ConfigTemplateValues) populateEnvVars() {
 	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiCtrlMgmtListenerHostPortVarName)

 	// Get Ziti Signing Cert
-	zitiSigningCert, err := cmdhelper.GetZitiSigningCert()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiSigningCertVarName)
+	//zitiSigningCert, err := cmdhelper.GetZitiSigningCert()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiSigningCertVarName)

 	// Get Ziti Signing Key
-	zitiSigningKey, err := cmdhelper.GetZitiSigningKey()
-	handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiSigningKeyVarName)
+	//zitiSigningKey, err := cmdhelper.GetZitiSigningKey()
+	//handleVariableError(err, cmdhelper.EnvVariableDetails.ZitiSigningKeyVarName)

 	// Get Ziti Edge Controller Listener Host and Port
 	zitiEdgeCtrlListenerHostPort, err := cmdhelper.GetZitiEdgeCtrlListenerHostPort()
@@ -270,8 +286,6 @@ func (data *ConfigTemplateValues) populateEnvVars() {

 	data.ZitiHome = zitiHome
 	data.Hostname = hostname
-	data.ZitiSigningCert = zitiSigningCert
-	data.ZitiSigningKey = zitiSigningKey
 	data.Controller.Name = zitiCtrlHostname
 	data.Controller.ListenerAddress = zitiCtrlListenerAddress
 	data.Controller.AdvertisedAddress = zitiCtrlAdvertisedAddress
@@ -279,18 +293,20 @@ func (data *ConfigTemplateValues) populateEnvVars() {
 	data.Controller.MgmtListenerHostPort = zitiCtrlMgmtListenerHostPort
 	data.Controller.Edge.ListenerHostPort = zitiEdgeCtrlListenerHostPort
 	data.Controller.Edge.AdvertisedHostPort = zitiEdgeCtrlAdvertisedHostPort
-	data.Controller.IdentityCert = zitiCtrlIdentityCert
-	data.Controller.IdentityServerCert = zitiCtrlIdentityServerCert
-	data.Controller.IdentityKey = zitiCtrlIdentityKey
-	data.Controller.IdentityCA = zitiCtrlIdentityCA
-	data.Controller.Edge.IdentityCert = zitiEdgeCtrlIdentityCert
-	data.Controller.Edge.IdentityServerCert = zitiEdgeCtrlIdentityServerCert
-	data.Controller.Edge.IdentityKey = zitiEdgeCtrlIdentityKey
-	data.Controller.Edge.IdentityCA = zitiEdgeCtrlIdentityCA
-	data.Router.IdentityCert = zitiRouterIdentityCert
-	data.Router.IdentityServerCert = zitiRouterIdentityServerCert
-	data.Router.IdentityKey = zitiRouterIdentityKey
-	data.Router.IdentityCA = zitiRouterIdentityCA
+	//data.Controller.IdentityCert = zitiCtrlIdentityCert
+	//data.Controller.IdentityServerCert = zitiCtrlIdentityServerCert
+	//data.Controller.IdentityKey = zitiCtrlIdentityKey
+	//data.Controller.IdentityCA = zitiCtrlIdentityCA
+	//data.Controller.Edge.IdentityCert = zitiEdgeCtrlIdentityCert
+	//data.Controller.Edge.IdentityServerCert = zitiEdgeCtrlIdentityServerCert
+	//data.Controller.Edge.IdentityKey = zitiEdgeCtrlIdentityKey
+	//data.Controller.Edge.IdentityCA = zitiEdgeCtrlIdentityCA
+	//data.Controller.Edge.ZitiSigningCert = zitiSigningCert
+	//data.Controller.Edge.ZitiSigningKey = zitiSigningKey
+	//data.Router.IdentityCert = zitiRouterIdentityCert
+	//data.Router.IdentityServerCert = zitiRouterIdentityServerCert
+	//data.Router.IdentityKey = zitiRouterIdentityKey
+	//data.Router.IdentityCA = zitiRouterIdentityCA
 	data.Router.Edge.Hostname = zitiEdgeRouterHostName
 	data.Router.Edge.Port = zitiEdgeRouterPort
 }
@@ -326,6 +342,6 @@ func (data *ConfigTemplateValues) populateDefaults() {

 func handleVariableError(err error, varName string) {
 	if err != nil {
-		logrus.Errorf("Unable to get %s", varName)
+		logrus.Errorf("Unable to get %s: %v", varName, err)
 	}
 }
@@ -98,6 +98,12 @@ func NewCmdCreateConfigController(data *ConfigTemplateValues) *cobra.Command {
 			if data.Controller.MgmtListenerHostPort == "" || controllerOptions.MgmtListener != constants.DefaultZitiMgmtControllerListenerHostPort {
 				data.Controller.MgmtListenerHostPort = controllerOptions.MgmtListener
 			}
+
+			// process identity information
+			SetControllerIdentity(&data.Controller)
+			SetEdgeConfig(&data.Controller)
+			SetWebConfig(&data.Controller)
+
 		},
 		Run: func(cmd *cobra.Command, args []string) {
 			controllerOptions.Cmd = cmd
@@ -157,3 +163,104 @@ func (options *CreateConfigControllerOptions) run(data *ConfigTemplateValues) er

 	return nil
 }
+
+func hostnameOrNetworkName() string {
+	val := os.Getenv("ZITI_NETWORK_NAME")
+	if val == "" {
+		h, err := os.Hostname()
+		if err != nil {
+			return "localhost"
+		}
+		return h
+	}
+	return val
+}
+
+func SetControllerIdentity(data *ControllerTemplateValues) {
+	SetControllerIdentityCert(data)
+	SetControllerIdentityServerCert(data)
+	SetControllerIdentityKey(data)
+	SetControllerIdentityCA(data)
+}
+func SetControllerIdentityCert(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_CTRL_IDENTITY_CERT")
+	if val == "" {
+		val = workingDir + "/" + hostnameOrNetworkName() + ".cert" //default
+	}
+	c.IdentityCert = cmdhelper.NormalizePath(val)
+}
+func SetControllerIdentityServerCert(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_CTRL_IDENTITY_SERVER_CERT")
+	if val == "" {
+		val = workingDir + "/" + hostnameOrNetworkName() + ".server.chain.cert" //default
+	}
+	c.IdentityServerCert = cmdhelper.NormalizePath(val)
+}
+func SetControllerIdentityKey(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_CTRL_IDENTITY_KEY")
+	if val == "" {
+		val = workingDir + "/" + hostnameOrNetworkName() + ".key" //default
+	}
+	c.IdentityKey = cmdhelper.NormalizePath(val)
+}
+func SetControllerIdentityCA(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_CTRL_IDENTITY_CA")
+	if val == "" {
+		val = workingDir + "/" + hostnameOrNetworkName() + ".ca" //default
+	}
+	c.IdentityCA = cmdhelper.NormalizePath(val)
+}
+
+func SetEdgeConfig(data *ControllerTemplateValues) {
+	SetEdgeSigningCert(data)
+	SetEdgeSigningKey(data)
+}
+func SetEdgeSigningCert(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_SIGNING_CERT")
+	if val == "" {
+		val = workingDir + "/" + hostnameOrNetworkName() + ".signing.cert" //default
+	}
+	c.Edge.ZitiSigningCert = cmdhelper.NormalizePath(val)
+}
+func SetEdgeSigningKey(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_SIGNING_KEY")
+	if val == "" {
+		val = workingDir + "/" + hostnameOrNetworkName() + ".signing.key" //default
+	}
+	c.Edge.ZitiSigningKey = cmdhelper.NormalizePath(val)
+}
+
+func SetWebConfig(data *ControllerTemplateValues) {
+	SetWebIdentityCert(data)
+	SetWebIdentityServerCert(data)
+	SetWebIdentityKey(data)
+	SetWebIdentityCA(data)
+}
+func SetWebIdentityCert(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_EDGE_CTRL_IDENTITY_CERT")
+	if val == "" {
+		val = c.IdentityCert //default
+	}
+	c.Edge.IdentityCert = cmdhelper.NormalizePath(val)
+}
+func SetWebIdentityServerCert(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_EDGE_CTRL_IDENTITY_SERVER_CERT")
+	if val == "" {
+		val = c.IdentityServerCert //default
+	}
+	c.Edge.IdentityServerCert = cmdhelper.NormalizePath(val)
+}
+func SetWebIdentityKey(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_EDGE_CTRL_IDENTITY_KEY")
+	if val == "" {
+		val = c.IdentityKey //default
+	}
+	c.Edge.IdentityKey = cmdhelper.NormalizePath(val)
+}
+func SetWebIdentityCA(c *ControllerTemplateValues) {
+	val := os.Getenv("ZITI_EDGE_CTRL_IDENTITY_CA")
+	if val == "" {
+		val = c.IdentityCA //default
+	}
+	c.Edge.IdentityCA = cmdhelper.NormalizePath(val)
+}
@@ -144,8 +144,8 @@ func NewCmdCreateConfigEnvironment(data *ConfigTemplateValues) *cobra.Command {
 		cmdhelper.EnvVariableDetails.ZitiEdgeCtrlIdentityServerCertVarName, cmdhelper.EnvVariableDetails.ZitiEdgeCtrlIdentityServerCertVarDescription, data.Controller.Edge.IdentityServerCert,
 		cmdhelper.EnvVariableDetails.ZitiEdgeCtrlIdentityKeyVarName, cmdhelper.EnvVariableDetails.ZitiEdgeCtrlIdentityKeyVarDescription, data.Controller.Edge.IdentityKey,
 		cmdhelper.EnvVariableDetails.ZitiEdgeCtrlIdentityCAVarName, cmdhelper.EnvVariableDetails.ZitiEdgeCtrlIdentityCAVarDescription, data.Controller.Edge.IdentityCA,
-		cmdhelper.EnvVariableDetails.ZitiSigningCertVarName, cmdhelper.EnvVariableDetails.ZitiSigningCertVarDescription, data.ZitiSigningCert,
-		cmdhelper.EnvVariableDetails.ZitiSigningKeyVarName, cmdhelper.EnvVariableDetails.ZitiSigningKeyVarDescription, data.ZitiSigningKey)
+		cmdhelper.EnvVariableDetails.ZitiSigningCertVarName, cmdhelper.EnvVariableDetails.ZitiSigningCertVarDescription, data.Controller.Edge.ZitiSigningCert,
+		cmdhelper.EnvVariableDetails.ZitiSigningKeyVarName, cmdhelper.EnvVariableDetails.ZitiSigningKeyVarDescription, data.Controller.Edge.ZitiSigningKey)

 	cmd.Long = createConfigLong

@@ -60,10 +60,7 @@ func NewCmdCreateConfigRouter(data *ConfigTemplateValues) *cobra.Command {

 			// Update router data with options passed in
 			data.Router.Name = options.RouterName
-			data.Router.IdentityCert, _ = cmdhelper.GetZitiRouterIdentityCert(data.Router.Name, true)
-			data.Router.IdentityServerCert, _ = cmdhelper.GetZitiRouterIdentityServerCert(data.Router.Name, true)
-			data.Router.IdentityKey, _ = cmdhelper.GetZitiRouterIdentityKey(data.Router.Name, true)
-			data.Router.IdentityCA, _ = cmdhelper.GetZitiRouterIdentityCA(data.Router.Name, true)
+			SetZitiRouterIdentity(&data.Router, data.Router.Name)
 		},
 		Run: func(cmd *cobra.Command, args []string) {
 			cmdhelper.CheckErr(cmd.Help())
@@ -0,0 +1,63 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package cmd
+
+import (
+	_ "embed"
+	cmdhelper "github.com/openziti/ziti/ziti/cmd/ziti/cmd/helpers"
+	"os"
+)
+
+func SetZitiRouterIdentity(r *RouterTemplateValues, routerName string) {
+	SetZitiRouterIdentityCert(r, routerName)
+	SetZitiRouterIdentityServerCert(r, routerName)
+	SetZitiRouterIdentityKey(r, routerName)
+	SetZitiRouterIdentityCA(r, routerName)
+
+	val := os.Getenv("ZITI_EDGE_ROUTER_RAWNAME")
+	if val != "" {
+		r.Edge.Hostname = val
+	}
+}
+func SetZitiRouterIdentityCert(r *RouterTemplateValues, routerName string) {
+	val := os.Getenv("ZITI_ROUTER_IDENTITY_CERT")
+	if val == "" {
+		val = workingDir + "/" + routerName + ".cert" //default
+	}
+	r.IdentityCert = cmdhelper.NormalizePath(val)
+}
+func SetZitiRouterIdentityServerCert(r *RouterTemplateValues, routerName string) {
+	val := os.Getenv("ZITI_ROUTER_IDENTITY_SERVER_CERT")
+	if val == "" {
+		val = workingDir + "/" + routerName + ".server.chain.cert" //default
+	}
+	r.IdentityServerCert = cmdhelper.NormalizePath(val)
+}
+func SetZitiRouterIdentityKey(r *RouterTemplateValues, routerName string) {
+	val := os.Getenv("ZITI_ROUTER_IDENTITY_KEY")
+	if val == "" {
+		val = workingDir + "/" + routerName + ".key" //default
+	}
+	r.IdentityKey = cmdhelper.NormalizePath(val)
+}
+func SetZitiRouterIdentityCA(r *RouterTemplateValues, routerName string) {
+	val := os.Getenv("ZITI_ROUTER_IDENTITY_CA")
+	if val == "" {
+		val = workingDir + "/" + routerName + ".cas" //default
+	}
+	r.IdentityCA = cmdhelper.NormalizePath(val)
+}
@@ -86,10 +86,7 @@ func NewCmdCreateConfigRouterEdge(data *ConfigTemplateValues) *cobra.Command {

 			// Update edge router specific values with options passed in
 			data.Router.Name = options.RouterName
-			data.Router.IdentityCert, _ = cmdhelper.GetZitiRouterIdentityCert(data.Router.Name, true)
-			data.Router.IdentityServerCert, _ = cmdhelper.GetZitiRouterIdentityServerCert(data.Router.Name, true)
-			data.Router.IdentityKey, _ = cmdhelper.GetZitiRouterIdentityKey(data.Router.Name, true)
-			data.Router.IdentityCA, _ = cmdhelper.GetZitiRouterIdentityCA(data.Router.Name, true)
+			SetZitiRouterIdentity(&data.Router, data.Router.Name)
 			data.Router.IsWss = options.WssEnabled
 			data.Router.IsPrivate = options.IsPrivate
 		},
@@ -74,10 +74,7 @@ func NewCmdCreateConfigRouterFabric(data *ConfigTemplateValues) *cobra.Command {

 			// Update fabric router specific values with options passed in
 			data.Router.Name = options.RouterName
-			data.Router.IdentityCert, _ = cmdhelper.GetZitiRouterIdentityCert(data.Router.Name, true)
-			data.Router.IdentityServerCert, _ = cmdhelper.GetZitiRouterIdentityServerCert(data.Router.Name, true)
-			data.Router.IdentityKey, _ = cmdhelper.GetZitiRouterIdentityKey(data.Router.Name, true)
-			data.Router.IdentityCA, _ = cmdhelper.GetZitiRouterIdentityCA(data.Router.Name, true)
+			SetZitiRouterIdentity(&data.Router, data.Router.Name)
 			data.Router.IsFabric = true
 		},
 		Run: func(cmd *cobra.Command, args []string) {
@@ -137,7 +137,7 @@ func HomeDir() string {
 	if h == "" {
 		h = "."
 	}
-	return strings.ReplaceAll(h, "\\", EnvVariableDetails.PathSeparator)
+	return NormalizePath(h)
 }

 func WorkingDir() (string, error) {
@@ -146,7 +146,7 @@ func WorkingDir() (string, error) {
 		return "", err
 	}

-	return strings.ReplaceAll(wd, "\\", EnvVariableDetails.PathSeparator), nil
+	return NormalizePath(wd), nil
 }

 func GetZitiHome() (string, error) {
@@ -169,7 +169,7 @@ func GetZitiHome() (string, error) {
 		retVal = os.Getenv(EnvVariableDetails.ZitiHomeVarName)
 	}

-	return strings.ReplaceAll(retVal, "\\", EnvVariableDetails.PathSeparator), nil
+	return NormalizePath(retVal), nil
 }

 func GetZitiCtrlIdentityCert() (string, error) {
@@ -240,15 +240,6 @@ func GetZitiCtrlIdentityCA() (string, error) {
 	return getValueOrSetAndGetDefault(EnvVariableDetails.ZitiCtrlIdentityCAVarName, fmt.Sprintf("%s/%s-cas.pem", workingDir, controllerName), false)
 }

-func GetZitiRouterIdentityCert(routerName string, forceSet bool) (string, error) {
-	workingDir, err := WorkingDir()
-	if err != nil {
-		return "", err
-	}
-
-	return getValueOrSetAndGetDefault(EnvVariableDetails.ZitiRouterIdentityCertVarName, fmt.Sprintf("%s/%s-client.cert", workingDir, routerName), forceSet)
-}
-
 func GetZitiRouterIdentityServerCert(routerName string, forceSet bool) (string, error) {
 	workingDir, err := WorkingDir()
 	if err != nil {
@@ -440,3 +431,8 @@ func getValueOrSetAndGetDefault(envVarName string, defaultValue string, forceDef

 	return retVal, nil
 }
+
+// replaces windows \ with / which windows allows for
+func NormalizePath(input string) string {
+	return strings.ReplaceAll(input, "\\", "/")
+}