diff --git a/quickstart/local/express/README.md b/quickstart/local/express/README.md new file mode 100644 index 000000000..b61649f23 --- /dev/null +++ b/quickstart/local/express/README.md @@ -0,0 +1,5 @@ +# Express Dev Env + +This script is meant to provide a very quick method of deploying an absolute minimum ziti setup: one controller, one edge-router. + +This environment is entirely suitable for local development against the ziti apis. This is not a recommended configuration production configuration. diff --git a/quickstart/local/express/express-create-pki.sh b/quickstart/local/express/express-create-pki.sh new file mode 100644 index 000000000..a9b07fb21 --- /dev/null +++ b/quickstart/local/express/express-create-pki.sh @@ -0,0 +1,75 @@ +#!/bin/bash +function pki_client_server { + name_local=$1 + ZITI_CA_NAME_local=$2 + + echo "Creating server and client certs from ca: ${ZITI_CA_NAME_local} for ${name_local}" + + ziti pki create server --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \ + --server-file "${name_local}-server" \ + --dns "${name_local}, localhost" --ip 127.0.0.1 \ + --server-name "${name_local} server certificate" + + ziti pki create client --pki-root="${ZITI_PKI}" --ca-name "${ZITI_CA_NAME_local}" \ + --client-file "${name_local}-client" \ + --key-file "${name_local}-server" \ + --client-name "${name_local}" + echo "" +} + +echo "Creating CONTROLLER CA: ${ZITI_CONTROLLER_ROOTCA_NAME}" +ziti pki create ca --pki-root="${ZITI_PKI}" --ca-file="${ZITI_CONTROLLER_ROOTCA_NAME}" --ca-name="${ZITI_CONTROLLER_ROOTCA_NAME} Root CA" +echo "" + +echo "Creating controller intermediate: ${ZITI_CONTROLLER_INTERMEDIATE_NAME}" +ziti pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${ZITI_CONTROLLER_ROOTCA_NAME}" \ + --intermediate-name "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" \ + --intermediate-file "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" --max-path-len 1 +echo "" + +echo "Creating ziti-fabric client certificate: ${ZITI_NETWORK}-dotzeet" +ziti pki create client --pki-root="${ZITI_PKI}" --ca-name="${ZITI_CONTROLLER_INTERMEDIATE_NAME}" \ +--client-file="${ZITI_NETWORK}-dotzeet" \ +--client-name "${ZITI_NETWORK} Management" +echo + +echo "===============================================================" +echo "=== creating edge related CA chain ===" +echo "===============================================================" +echo "Creating EDGE CA: ${ZITI_EDGE_ROOTCA_NAME}" +ziti pki create ca --pki-root="${ZITI_PKI}" --ca-file="${ZITI_EDGE_ROOTCA_NAME}" --ca-name="${ZITI_EDGE_ROOTCA_NAME} Root CA" +echo "" + +echo "Creating edge intermediate: ${ZITI_EDGE_INTERMEDIATE_NAME}" +ziti pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${ZITI_EDGE_ROOTCA_NAME}" \ + --intermediate-name "${ZITI_EDGE_INTERMEDIATE_NAME}" \ + --intermediate-file "${ZITI_EDGE_INTERMEDIATE_NAME}" --max-path-len 1 +echo "" + +echo "===============================================================" +echo "=== creating signing related CA chain ===" +echo "===============================================================" +echo "Creating SIGNING CA: ${ZITI_SIGNING_ROOTCA_NAME}" +ziti pki create ca --pki-root="${ZITI_PKI}" --ca-file="${ZITI_SIGNING_ROOTCA_NAME}" --ca-name="${ZITI_SIGNING_ROOTCA_NAME} Root CA" +echo "" + +echo "Creating signing intermediate, intermediate (2 intermediates): ${ZITI_SIGNING_SPURIOUS_NAME}" +ziti pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${ZITI_SIGNING_ROOTCA_NAME}" \ + --intermediate-name "${ZITI_SIGNING_SPURIOUS_NAME}" \ + --intermediate-file "${ZITI_SIGNING_SPURIOUS_NAME}" --max-path-len 2 +echo "" + +echo "Creating signing intermediate: ${ZITI_SIGNING_INTERMEDIATE_NAME}" +ziti pki create intermediate --pki-root "${ZITI_PKI}" --ca-name "${ZITI_SIGNING_SPURIOUS_NAME}" \ + --intermediate-name "${ZITI_SIGNING_INTERMEDIATE_NAME}" \ + --intermediate-file "${ZITI_SIGNING_INTERMEDIATE_NAME}" --max-path-len 1 +echo "" + +pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" +pki_client_server "${ZITI_EDGE_HOSTNAME}" "${ZITI_EDGE_INTERMEDIATE_NAME}" +pki_client_server "${ZITI_ZAC_HOSTNAME}" "${ZITI_EDGE_INTERMEDIATE_NAME}" +#pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" +#pki_client_server "${ZITI_EDGE_HOSTNAME}" "${ZITI_EDGE_INTERMEDIATE_NAME}" +#pki_client_server "${ZITI_EDGE_ROUTER_HOSTNAME}" "${ZITI_EDGE_INTERMEDIATE_NAME}" +#pki_client_server "${ZITI_EDGE_WSS_ROUTER_NAME}" "${ZITI_EDGE_INTERMEDIATE_NAME}" + diff --git a/quickstart/local/express/express-dev-env.sh b/quickstart/local/express/express-dev-env.sh new file mode 100644 index 000000000..16a3fecbe --- /dev/null +++ b/quickstart/local/express/express-dev-env.sh @@ -0,0 +1,392 @@ +#!/bin/bash + +ASCI_WHITE='\033[01;37m' +ASCI_RESTORE='\033[0m' +ASCI_RED='\033[00;31m' +ASCI_GREEN='\033[00;32m' +ASCI_YELLOW='\033[00;33m' +ASCI_BLUE='\033[00;34m' +ASCI_MAGENTA='\033[00;35m' +ASCI_PURPLE='\033[00;35m' +ASCI_CYAN='\033[00;36m' +ASCI_LIGHTGRAY='\033[00;37m' +ASCI_LRED='\033[01;31m' +ASCI_LGREEN='\033[01;32m' +ASCI_LYELLOW='\033[01;33m' +ASCI_LBLUE='\033[01;34m' +ASCI_LMAGENTA='\033[01;35m' +ASCI_LPURPLE='\033[01;35m' +ASCI_LCYAN='\033[01;36m' + +function WHITE { + echo "${ASCI_WHITE}$1${ASCI_RESTORE}" +} +function RED { + echo "${ASCI_RED}$1${ASCI_RESTORE}" +} +function GREEN { + echo "${ASCI_GREEN}$1${ASCI_RESTORE}" +} +function YELLOW { + echo "${ASCI_YELLOW}$1${ASCI_RESTORE}" +} +function BLUE { + echo "${ASCI_BLUE}$1${ASCI_RESTORE}" +} + +# Test +#echo -e $(WHITE "AAAA") is nice +#echo -e $(GREEN "is cool too") +#echo -e $(YELLOW "yellow a lot") +#echo -e $(RED "rrreeeeed") +#echo -e $(BLUE "blue is swell") +ZITI_QUICKSTART_ROOT="${HOME}/.ziti/quickstart" +ZITI_SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" + +function issueGreeting { + #echo "-------------------------------------------------------------" + echo " " + echo " _ _ _" + echo " ____ (_) | |_ (_)" + echo " |_ / | | | __| | |" + echo " / / | | | |_ | |" + echo " /___| |_| \__| |_|" + echo "-------------------------------------------------------------" + echo " " + echo "This script will make it trivial to setup a very simple environment locally which will allow you to start" + echo "learning ziti. This environment is suitable for development work only and is not a decent representation of" + echo "a fully redundant production-caliber network." + echo "" + echo "Please note that this script will write files to your home directory into a directory named .ziti." + echo -n "For you this location will be: " + echo -e "$(BLUE "${ZITI_QUICKSTART_ROOT}")" + echo " " +} + +function getLatestZiti { + if [[ "${ZITI_HOME}" == "" ]]; then + echo "ERROR: ZITI_HOME is not set!" + exit 1 + fi + + zitilatest=$(curl -s https://api.github.com/repos/openziti/ziti/releases/latest) + zitiversion=$(echo ${zitilatest} | jq -r '.tag_name') + echo "Latest ziti is: ${zitiversion}" + zititgz=$(echo ${zitilatest} | jq -r '.assets[] | select(.name | startswith("ziti-linux-amd")) | .name') + + if ! test -f "${ZITI_HOME}/${zititgz}"; then + echo -e 'Downloading '"$(BLUE "${zititgz}")"' into '"$(BLUE "${ZITI_HOME}")" + zitidl="https://github.com/openziti/ziti/releases/download/${zitiversion}/${zititgz}" + + wget -q "${zitidl}" -O "${ZITI_HOME}/${zititgz}" + fi + + mkdir -p "${ZITI_BIN_DIR}" + echo -e 'UNZIPPING '"$(BLUE "${ZITI_HOME}/${zititgz}")"' into: '"$(GREEN ${ZITI_BIN_DIR})" + tar -xf "${ZITI_HOME}/${zititgz}" --directory "${ZITI_BIN_DIR}" + + echo "Adding ${ZITI_BIN} to the path if necessary:" + if [[ "$(echo "$PATH"|grep -q "${ZITI_BIN}" && echo "yes")" == "yes" ]]; then + echo -e "$(GREEN "${ZITI_BIN}") is already on the path" + else + echo -e "adding $(RED "${ZITI_BIN}") to the path" + export PATH=$PATH:"${ZITI_BIN}" + fi + +} + +function generatePki { + PKI_DIR="${ZITI_PKI}/${ZITI_CONTROLLER_ROOTCA_NAME}" + if [ -d "${PKI_DIR}" ] + then + echo -e "Reusing existing PKI from: $(BLUE ${PKI_DIR})" + else + echo "Generating PKI" + . "${ZITI_SCRIPT_DIR}/express-create-pki.sh" + fi +} + +function checkPrereqs { + commands_to_test=(ziti ziti-router ziti-controller bash cat) + + # verify all the commands required in the automation exist before trying to run the full suite + for cmd in "${commands_to_test[@]}" + do + # checking all commands are on the path before continuing... + if ! [[ -x "$(command -v ${cmd})" ]]; then + missing_requirements="${missing_requirements} * ${cmd}\n" + fi + done + # are requirements ? if yes, stop here and help 'em out + if ! [[ "" = "${missing_requirements}" ]]; then + echo " " + echo "You're missing one or more commands that are used in this script." + echo "Please ensure the commands listed are on the path and then try again." + printf "\n${missing_requirements}" + echo " " + echo " " + exit 1 + fi + echo "Let's get stated creating your local development network!" + echo "" + echo "" +} + + +function checkControllerName { + if [[ ${ZITI_CONTROLLER_HOSTNAME} == *['!'@#\$%^\&*()_+]* ]]; then + echo -e "$(RED " - The provided Network name contains an invalid character: '!'@#\$%^\&*()_+")" + return 1 + fi + return 0 +} + +function generateEnvFile { + if [[ "$1" == "" ]]; then + echo " " + echo "Creating a controller is effectively creating a network. The name of the network will be used when writing" + echo "configuration files locally. Choose the name of your network now. The format of the network name should resemble" + echo -n "what a hostname looks like. A good choice is to actually use your system's hostname: " + echo -e "$(BLUE $(hostname))" + echo " " + read -p "$(echo -ne "Network Name [$(BLUE $(hostname))]: ")" ZITI_NETWORK + echo " " + if checkControllerName; then + : #clear to continue + if [[ "ZITI_NETWORK" == "" ]]; then + ZITI_NETWORK="$(hostname)" + fi + echo "name: ${ZITI_NETWORK}" + else + echo " " + echo "nah bro" + return 1 + fi + echo " " + else + ZITI_NETWORK="$1" + fi + + echo -e "Generating new network with name: $(BLUE "${ZITI_NETWORK}")" + + ZITI_HOME="${ZITI_QUICKSTART_ROOT}/${ZITI_NETWORK}" + ZITI_USER="admin" + ZITI_PWD="admin" + ZITI_DOMAIN_SUFFIX=".ziti.netfoundry.io" + ZITI_DOMAIN_SUFFIX="" + ZITI_ID="${ZITI_HOME}/identities.yml" + ZITI_FAB_MGMT_PORT="10000" + ZITI_FAB_CTRL_PORT="6262" + ZITI_CONTROLLER_NAME="${ZITI_NETWORK}-controller" + ZITI_EDGE_NAME="${ZITI_NETWORK}-edge-controller" + ZITI_EDGE_PORT="1280" + ZITI_ZAC_NAME="${ZITI_NETWORK}-zac" + ZITI_EDGE_ROUTER_NAME="${ZITI_NETWORK}-edge-router" + ZITI_EDGE_WSS_ROUTER_NAME="${ZITI_NETWORK}-edge-wss-router" + ZITI_ROUTER_BR_NAME="${ZITI_NETWORK}-fabric-router-br" + ZITI_ROUTER_BLUE_NAME="${ZITI_NETWORK}-fabric-router-blue" + ZITI_ROUTER_RED_NAME="${ZITI_NETWORK}-fabric-router-red" + + ZITI_PKI="${ZITI_HOME}/pki" + ZITI_CONTROLLER_HOSTNAME="${ZITI_CONTROLLER_NAME}${ZITI_DOMAIN_SUFFIX}" + ZITI_EDGE_HOSTNAME="${ZITI_EDGE_NAME}${ZITI_DOMAIN_SUFFIX}" + ZITI_ZAC_HOSTNAME="${ZITI_ZAC_NAME}${ZITI_DOMAIN_SUFFIX}" + ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_NAME}${ZITI_DOMAIN_SUFFIX}" + ZITI_EDGE_WSS_ROUTER_HOSTNAME="${ZITI_EDGE_WSS_ROUTER_NAME}${ZITI_DOMAIN_SUFFIX}" + ZITI_SIGNING_CERT_NAME="${ZITI_NETWORK}-signing" + ZITI_ROUTER_BR_HOSTNAME="${ZITI_ROUTER_BR_NAME}${ZITI_DOMAIN_SUFFIX}" + ZITI_ROUTER_BLUE_HOSTNAME="${ZITI_ROUTER_BLUE_NAME}${ZITI_DOMAIN_SUFFIX}" + ZITI_ROUTER_RED_HOSTNAME="${ZITI_ROUTER_RED_NAME}${ZITI_DOMAIN_SUFFIX}" + + ZITI_EDGE_API_HOSTNAME="${ZITI_EDGE_HOSTNAME}:${ZITI_EDGE_PORT}" + + ZITI_CONTROLLER_ROOTCA_NAME="${ZITI_CONTROLLER_HOSTNAME}-root-ca" + ZITI_EDGE_ROOTCA_NAME="${ZITI_EDGE_HOSTNAME}-root-ca" + ZITI_SIGNING_ROOTCA_NAME="${ZITI_SIGNING_CERT_NAME}-root-ca" + ZITI_CONTROLLER_INTERMEDIATE_NAME="${ZITI_CONTROLLER_HOSTNAME}-intermediate" + ZITI_EDGE_INTERMEDIATE_NAME="${ZITI_EDGE_HOSTNAME}-intermediate" + ZITI_SIGNING_INTERMEDIATE_NAME="${ZITI_SIGNING_CERT_NAME}-intermediate" + ZITI_SIGNING_SPURIOUS_NAME="${ZITI_SIGNING_INTERMEDIATE_NAME}_spurious_intermediate" + + ZITI_BIN_DIR="${ZITI_HOME}/ziti-bin" + ZITI_BIN="${ZITI_BIN_DIR}/ziti" + + mkdir -p ${ZITI_HOME}/db + mkdir -p ${ZITI_PKI} + + ENV_FILE="${ZITI_HOME}/${ZITI_NETWORK}.env" + echo "" > "${ENV_FILE}" + for zEnvVar in $(set -o posix ; set | grep ZITI_ | sort); do echo "export ${zEnvVar}" >> "${ENV_FILE}"; done + echo "export PFXLOG_NO_JSON=true" >> "${ENV_FILE}" + + echo "alias zec='ziti edge controller'" >> "${ENV_FILE}" + echo "alias zlogin='ziti edge controller login \"${ZITI_EDGE_API_HOSTNAME}\" -u \"${ZITI_USER}\" -p \"${ZITI_PWD}\" -c \"${ZITI_PKI}/${ZITI_EDGE_ROOTCA_NAME}/certs/${ZITI_EDGE_INTERMEDIATE_NAME}.cert\"'" >> "${ENV_FILE}" + echo "alias psz='ps -ef | grep ziti'" >> "${ENV_FILE}" + + echo -e "environment file created and source from: $(BLUE ${ENV_FILE})" + source "${ENV_FILE}" +} + +function expressConfiguration { + echo " " + echo "___________ _______________________________________^__" + echo " ___ ___ ||| ___ ___ ___ ___ ___ | __ ,----\ " + echo "| | | |||| | | | | | | | | | | | | |_____\ " + echo "|___| |___|||| |___| |___| |___| | O | O | | | | \ " + echo " ||| ===== EXPRESS ==== |___|___| | |__| )" + echo "___________|||______________________________|______________/" + echo " ||| /--------" + echo "-----------'''---------------------------------------'" + echo "" + + if [[ "$1" == "" ]]; then + nw="$(hostname)" + else + nw="$1" + fi + generateEnvFile "${nw}" + #checkHostsFile + getLatestZiti + generatePki + generateControllerConfig + generateEdgeRouterConfig + initializeController + startZitiController + echo "starting the ziti controller to enroll the edge router" + sleep 2 + zitiLogin + + echo -e "---------- Creating an edge router policy allowing all identities to connect to routers with a $(GREEN "#public") attribute" + unused=$(ziti edge controller create edge-router-policy allEdgeRouters --edge-router-roles '#public' --identity-roles '#all' ) + + echo -e "---------- Creating a service edge router policy allowing all services to use $(GREEN "#public") edge routers" + unused=$(ziti edge controller create service-edge-router-policy allSvcPublicRouters --edge-router-roles '#public' --service-roles '#all') + + echo "---------- Creating edge-router ${ZITI_EDGE_ROUTER_NAME}...." + unused=$(ziti edge controller create edge-router "${ZITI_EDGE_ROUTER_NAME}" -o "${ZITI_HOME}/${ZITI_EDGE_ROUTER_NAME}.jwt" -t) + sleep 1 + echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_NAME}...." + unused=$(ziti-router enroll "${ZITI_HOME}/${ZITI_EDGE_ROUTER_NAME}.yaml" --jwt "${ZITI_HOME}/${ZITI_EDGE_ROUTER_NAME}.jwt" &> "${ZITI_EDGE_ROUTER_NAME}.enrollment.log") + echo "" + sleep 1 + unused=$(ziti-router run "${ZITI_HOME}/${ZITI_EDGE_ROUTER_NAME}.yaml" > "${ZITI_HOME}/ziti-${ZITI_EDGE_ROUTER_NAME}.log" 2>&1 &) + +} +function zitiLogin { + unused=$(ziti edge controller login "${ZITI_EDGE_API_HOSTNAME}" -u "${ZITI_USER}" -p "${ZITI_PWD}" -c "${ZITI_PKI}/${ZITI_EDGE_ROOTCA_NAME}/certs/${ZITI_EDGE_INTERMEDIATE_NAME}.cert") +} +function reinitializeZitiController { + cleanZitiController +} +function cleanZitiController { + rm -rf "${ZITI_HOME}/db" + mkdir "${ZITI_HOME}/db" + initializeController +} +function generateControllerConfig { + "${ZITI_SCRIPT_DIR}/../create-controller-config.sh" +} +function generateEdgeRouterConfig { + "${ZITI_SCRIPT_DIR}/../create-edge-router-config.sh" +} +function initializeController { + ziti-controller edge init "${ZITI_HOME}/controller.yaml" -u "${ZITI_USER}" -p "${ZITI_PWD}" &> "${ZITI_HOME}/controller-init.log" + echo -e "ziti-controller initialized. see $(BLUE ${ZITI_HOME}/controller-init.log) for details" +} +function startZitiController { + unused=$(ziti-controller run "${ZITI_HOME}/controller.yaml" > "${ZITI_HOME}/ziti-controller.log" 2>&1 &) + echo -e "ziti-controller started. log located at: $(BLUE ${ZITI_HOME}/ziti-controller.log)" +} +function stopZitiController { + killall ziti-controller +} +function checkHostsFile { + ctrlexists=$(grep -c ${ZITI_CONTROLLER_NAME} /etc/hosts) + edgeexists=$(grep -c ${ZITI_EDGE_HOSTNAME} /etc/hosts) + erexists=$(grep -c ${ZITI_EDGE_ROUTER_NAME} /etc/hosts) + + if [[ "0" = "${ctrlexists}" ]] || [[ "0" = "${edgeexists}" ]] || [[ "0" = "${erexists}" ]]; then + echo " " + echo -e $(YELLOW "Ziti is generally used to create an overlay network. Generally speaking this will involve more than one host") + echo -e $(YELLOW "Since this is a script geared towards setting up a very minimal development environment it needs to make some") + echo -e $(YELLOW "assumptions. One of these assumptions is that the three specific entries are entered onto your hosts file.") + echo -e $(YELLOW "One or more of these are missing:") + echo " " + if [[ "0" == "${ctrlexists}" ]]; then + echo -e " * $(RED "MISSING: ${ZITI_CONTROLLER_NAME}") " + else + echo -e " * $(GREEN " FOUND: ${ZITI_CONTROLLER_NAME}") " + fi + if [[ "0" == "${edgeexists}" ]]; then + echo -e " * $(RED "MISSING: ${ZITI_EDGE_HOSTNAME}") " + else + echo -e " * $(GREEN " FOUND: ${ZITI_EDGE_HOSTNAME}") " + fi + if [[ "0" == "${erexists}" ]]; then + echo -e " * $(RED "MISSING: ${ZITI_EDGE_ROUTER_NAME}") " + else + echo -e " * $(GREEN " FOUND: ${ZITI_EDGE_ROUTER_NAME}") " + fi + + echo " " + echo "The easiest way to correct this is to run the following command:" + echo " echo \"127.0.0.1 ${ZITI_CONTROLLER_NAME} ${ZITI_EDGE_HOSTNAME} ${ZITI_EDGE_ROUTER_NAME}\" | sudo tee -a /etc/hosts" + echo " " + echo "add these entries to your hosts file, and rerun the script when ready" + exit 1 + fi +} + +function decideOperation { + if [[ "$1" != "" ]]; then + yn=$1 + fi + while true + do + if [[ "${yn}" == "" ]]; then + echo "What sort of operation are you looking to perform?" + echo " 1.) Express configuration - a simple overlay will be spawned containing one controller and two edge routers" + echo " 2.) Create Controller configuration - answer a few questions and a controller config will be emitted" + echo " 3.) Create Edge Router configuration - answer a few questions and an edge router config will be emitted" + echo " 4.) Start a network with the provided name" + echo " " + read -p "Select an action: " yn + fi + case $yn in + [1]* ) + expressConfiguration "$2" + break;; + [2]* ) + generateEnvFile + + ;; + [3]* ) + echo "333 has been chosen" + echo " " + ;; + [4]* ) + echo "4444 has been chosen" + echo " " + ;; + [yYqQeE]* ) + break + ;; + [Nn]* ) + echo ""; echo "Ok - come back when you're ready." + exit;; + * ) echo "Please answer yes or no. (yes/NO)";; + esac + yn= + done + echo " " +} + +#greet the user with the banner and quick blurb about what to expect +issueGreeting + +#make sure the user has all the necessary commands to be successful +#checkPrereqs + +#prompt the user for input and do what they want/need +decideOperation 1 "$1" +