mirror of
https://github.com/openziti/ziti.git
synced 2026-10-12 23:32:02 +00:00
Merge pull request #496 from openziti/add-snap-steps-back
add snapcraft steps back to etc in case we want it someday
This commit is contained in:
dovholuknf
Executable
+36
@@ -0,0 +1,36 @@
|
||||
# quick notes on builing a snap from scratch...
|
||||
|
||||
* checkout branch
|
||||
* install snapd if needed - https://docs.snapcraft.io/installing-snapd/6735
|
||||
* install snapcraft --classic to build snaps
|
||||
|
||||
snap install snapcraft --classic
|
||||
hash -r
|
||||
|
||||
* navigate to the root of the git checkout - not the $GOPATH
|
||||
* cd ~/git_or_wherever/nf/src/bitbucket.org/netfoundry/ziti
|
||||
* issue `snapcraft` you should see results (in green maybe) like (you may need the `--destructive-mode` flag):
|
||||
|
||||
Cleaning later steps and re-staging ziti ('build' step changed)
|
||||
Priming ziti
|
||||
Snapping 'netfoundry' -
|
||||
Snapped netfoundry_0.0.1_amd64.snap
|
||||
|
||||
* install the snap in spoooky 'dangerous' and 'devmode':
|
||||
|
||||
sudo snap install --devmode --dangerous netfoundry*.snap
|
||||
|
||||
* ensure the snap is listed:
|
||||
|
||||
snap list | grep netfoundry
|
||||
|
||||
should return something like:
|
||||
netfoundry 0.0.1 x1 - - devmode
|
||||
|
||||
* try the enroller out:
|
||||
|
||||
netfoundry.ziti-enroller
|
||||
|
||||
* try the tunneler out:
|
||||
|
||||
netfoundry.ziti-tunneler
|
||||
Executable
+13
@@ -0,0 +1,13 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
if [ "$1" == "" ]
|
||||
then
|
||||
echo "please provide the name of the ca already created"
|
||||
exit 1
|
||||
fi;
|
||||
ca_name=$1
|
||||
|
||||
./newid.sh $1
|
||||
./ott.sh $1
|
||||
./newid-thirdPartyOTT.sh $1
|
||||
Executable
+111
@@ -0,0 +1,111 @@
|
||||
#!/bin/bash
|
||||
###################################################
|
||||
# #
|
||||
# START CA VERIFICATION PROCESS #
|
||||
# #
|
||||
###################################################
|
||||
#
|
||||
# setup all the necessary parameters
|
||||
#
|
||||
set -e
|
||||
if [[ "xx" == "xx$1" ]]
|
||||
then
|
||||
edge_controller_uri="https://local-edge-controller:1280"
|
||||
else
|
||||
edge_controller_uri="$1"
|
||||
fi
|
||||
|
||||
echo "Edge controller set to: ${edge_controller_uri}"
|
||||
|
||||
ca_name="ca_$(date +"%m%d%y_%H%M%S")"
|
||||
|
||||
pki_root=~/ziti/pki/${ca_name}
|
||||
#pki_root=~/ziti/quickstart/auto-enroll-example/${ca_name}
|
||||
|
||||
mkdir -p ${pki_root}
|
||||
echo "pki root: ${pki_root}"
|
||||
|
||||
# make a root certificate using the ziti CLI
|
||||
ziti pki create ca --pki-root=$pki_root --ca-file=${ca_name}
|
||||
|
||||
#sleep a second to make sure the certs are not detected to be invalid if submitted too quickly
|
||||
sleep 1
|
||||
|
||||
# the ziti CLI puts keys and certs at a known location
|
||||
path_to_private_key=${pki_root}/${ca_name}/keys/${ca_name}.key
|
||||
path_to_cert=${pki_root}/${ca_name}/certs/${ca_name}.cert
|
||||
|
||||
# convert the key and cert which are in pem format into something that can be curl'ed
|
||||
private_key=$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ${path_to_private_key})
|
||||
cert=$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ${path_to_cert})
|
||||
|
||||
echo -n Enter the Password for the admin user:
|
||||
read -s adminpwd
|
||||
echo
|
||||
# Run Command
|
||||
echo $adminpwd
|
||||
|
||||
|
||||
# obtain a ziti session so the CA can be pushed into the edge controller
|
||||
zt_session=$(curl -sk -H "Content-Type: application/json" \
|
||||
${edge_controller_uri}/authenticate?method=password \
|
||||
-d "{\"username\":\"admin\",\"password\":\"${adminpwd}\"}" | \
|
||||
jq -r .data.token)
|
||||
|
||||
# capture the result of the ca registration specifically to pull the id out of the response which is used later
|
||||
ca_registration_result=$(cat <<HERE | curl -sk -H "Content-Type: application/json" \
|
||||
-H "zt-session: ${zt_session}" \
|
||||
"${edge_controller_uri}/cas" \
|
||||
-d @- | jq .
|
||||
{
|
||||
"name": "${ca_name}",
|
||||
"isAutoCaEnrollmentEnabled": true,
|
||||
"isOttCaEnrollmentEnabled": true,
|
||||
"isAuthEnabled": true,
|
||||
"certPem": "${cert}"
|
||||
}
|
||||
HERE
|
||||
)
|
||||
|
||||
# use jq to pull out the id from the (presumably) successful ca registration
|
||||
ca_id=$(echo $ca_registration_result | jq -r '.data.id')
|
||||
echo "CA ID set to: ${ca_id}"
|
||||
sleep 1 #trying to avoid edge race conditions?
|
||||
|
||||
# fetch the verificationToken from the edge controller. this token needs to be put into a certifiate
|
||||
# signed by the CA just registered
|
||||
verificationResponse=$(curl -X GET -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}")
|
||||
verificationToken=$(echo ${verificationResponse} | jq -r ".data.verificationToken")
|
||||
path_to_verificationToken_cert="$pki_root/${ca_name}/certs/${verificationToken}.cert"
|
||||
echo "CA Verification token set to: ${verificationToken}"
|
||||
sleep 1 #trying to avoid edge race conditions?
|
||||
|
||||
# using the ziti CLI - make a client cert for the verificationToken
|
||||
ziti pki create client --pki-root="${pki_root}" --ca-name=${ca_name} --client-name=${verificationToken} --client-file=${verificationToken}
|
||||
|
||||
#sleep a second to make sure the certs are not detected to be invalid
|
||||
sleep 1
|
||||
|
||||
# print out if the CA is now verified - expect false
|
||||
the_ca=$(curl -X GET -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}" | jq -r ".data")
|
||||
sleep 1 #trying to avoid edge race conditions?
|
||||
echo "at this point the ca should not be verified. is ca verified? $(echo ${the_ca} | jq -r ".isVerified")"
|
||||
|
||||
# submit the client cert to the proper endpoint using --data-binary or curl munges the file
|
||||
result=$(curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}/verify" --data-binary @${path_to_verificationToken_cert})
|
||||
|
||||
# print out if the CA is now verified - expect true
|
||||
the_ca=$(curl -X GET -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}" | jq -r ".data")
|
||||
sleep 1 #trying to avoid edge race conditions?
|
||||
echo "at this point the ca _*SHOULD*_ be verified. is ca verified? $(echo ${the_ca} | jq -r ".isVerified")"
|
||||
|
||||
echo "acuiring the jwt from ${edge_controller_uri}/cas/${ca_id}/jwt into ${pki_root}/auto.jwt"
|
||||
curl -X GET -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}/jwt" -o ${pki_root}/auto.jwt
|
||||
|
||||
###################################################
|
||||
# #
|
||||
# END CA VERIFICATION PROCESS #
|
||||
# #
|
||||
###################################################
|
||||
|
||||
|
||||
Executable
+109
@@ -0,0 +1,109 @@
|
||||
#!/bin/bash
|
||||
###################################################
|
||||
# #
|
||||
# START CA AUTOMATIC REGISTRATION PROCESS #
|
||||
# #
|
||||
###################################################
|
||||
set -e
|
||||
|
||||
|
||||
|
||||
if [[ "xx" == "xx$2" ]]
|
||||
then
|
||||
edge_controller_uri="https://local-edge-controller:1280"
|
||||
else
|
||||
edge_controller_uri="$2"
|
||||
fi
|
||||
echo "Edge controller set to: ${edge_controller_uri}"
|
||||
|
||||
if [ "$1" == "" ]
|
||||
then
|
||||
echo "please provide the name of the ca already created"
|
||||
exit 1
|
||||
fi;
|
||||
#ca_name=$(cat /home/cd/pki/current-pki)
|
||||
ca_name=$1
|
||||
pki_root=/home/cd/ziti/pki/${ca_name}
|
||||
identity_name="${ca_name}_auto_ident_$(date +"%H%M%S")"
|
||||
identity_name="caott_$(date +"%H%M%S")"
|
||||
|
||||
echo "identity name: $identity_name"
|
||||
|
||||
# make a client certificate using the ziti CLI
|
||||
ziti pki create client --pki-root="${pki_root}" --ca-name=${ca_name} --client-name=${identity_name} --client-file=${identity_name}
|
||||
sleep 1 #avoiding the same NotAfter making the certificate invalid
|
||||
|
||||
# setup some variables to the key and cert
|
||||
###################################################################
|
||||
# NOTE: the identity_ca_path is very important and is not able to be fetched at this time!
|
||||
# you must obtain this file through some other means. you also MUST provide the full chain as shown
|
||||
#
|
||||
curl -sk ${edge_controller_uri}/.well-known/est/cacerts > ${pki_root}/fetched-ca-certs.p7
|
||||
openssl base64 -d -in ${pki_root}/fetched-ca-certs.p7 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${pki_root}/fetched-ca-certs.pem
|
||||
identity_full_ca_path="${pki_root}/fetched-ca-certs.pem"
|
||||
|
||||
#
|
||||
###################################################################
|
||||
identity_path_to_key="${pki_root}/${ca_name}/keys/${identity_name}.key"
|
||||
identity_path_to_cert="${pki_root}/${ca_name}/certs/${identity_name}.cert"
|
||||
|
||||
echo $identity_path_to_key
|
||||
echo $identity_path_to_cert
|
||||
|
||||
echo -n Enter the Password for the admin user:
|
||||
read -s adminpwd
|
||||
echo
|
||||
# Run Command
|
||||
echo $adminpwd
|
||||
|
||||
# establish a session by user/pwd
|
||||
export zt_session=$(curl -sk -H "Content-Type: application/json" \
|
||||
${edge_controller_uri}/authenticate?method=password \
|
||||
-d "{\"username\":\"admin\",\"password\":\"${adminpwd}\"}" | \
|
||||
jq -j .data.token)
|
||||
|
||||
#fetch the ca's id from the controller
|
||||
url="${edge_controller_uri}/cas?filter=name%3d%22${ca_name}%22"
|
||||
ca_id=$(curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${url}" | jq -j '.data[].id')
|
||||
echo "CA ID found by name ${ca_name}: ${ca_id}"
|
||||
|
||||
if [[ "xx" == "xx${ca_id}" ]]
|
||||
then
|
||||
echo "ERROR: ca not found by name!"
|
||||
cat << HERE
|
||||
curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${url}" | jq -j '.data[].id'
|
||||
HERE
|
||||
bash
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#create the new identity
|
||||
identity_id=$(cat <<HERE | curl -sk -H "Content-Type: application/json" \
|
||||
-H "zt-session: ${zt_session}" \
|
||||
"${edge_controller_uri}/identities" \
|
||||
-d @- | jq -j '.data.id'
|
||||
{
|
||||
"name": "caott_${identity_name}",
|
||||
"type": "User",
|
||||
"enrollment": {
|
||||
"ottca": "${ca_id}"
|
||||
}
|
||||
}
|
||||
HERE
|
||||
)
|
||||
|
||||
jwt_file="${pki_root}/${identity_name}.jwt"
|
||||
|
||||
echo "Third Party OTT identity created. ID: ${identity_id}"
|
||||
echo "fetching the jwt into ${jwt_file}"
|
||||
|
||||
curl -sk -H "Content-Type: application/json" \
|
||||
-H "zt-session: ${zt_session}" \
|
||||
"${edge_controller_uri}/identities/${identity_id}" \
|
||||
| jq -j .data.enrollment.ottca.jwt > ${jwt_file}
|
||||
|
||||
echo "using jwt to enroll"
|
||||
|
||||
#enroll it
|
||||
ziti-enroller -v --jwt ${jwt_file} --cert $identity_path_to_cert --key $identity_path_to_key --idname ${identity_name}
|
||||
|
||||
Executable
+58
@@ -0,0 +1,58 @@
|
||||
#!/bin/bash
|
||||
###################################################
|
||||
# #
|
||||
# START CA AUTOMATIC REGISTRATION PROCESS #
|
||||
# #
|
||||
###################################################
|
||||
set -e
|
||||
|
||||
|
||||
if [[ "xx" == "xx$2" ]]
|
||||
then
|
||||
edge_controller_uri="https://local-edge-controller:1280"
|
||||
else
|
||||
edge_controller_uri="$2"
|
||||
fi
|
||||
echo "Edge controller set to: ${edge_controller_uri}"
|
||||
|
||||
|
||||
if [ "$1" == "" ]
|
||||
then
|
||||
echo "please provide the name of the ca already created"
|
||||
exit 1
|
||||
fi;
|
||||
#ca_name=$(cat /home/cd/pki/current-pki)
|
||||
ca_name=$1
|
||||
pki_root=/home/cd/ziti/pki/${ca_name}
|
||||
#pki_root=~/ziti/quickstart/auto-enroll-example/${ca_name}
|
||||
identity_name="${ca_name}_auto_ident_$(date +"%H%M%S")"
|
||||
identity_name="caauto_$(date +"%H%M%S")"
|
||||
|
||||
echo "identity name: $identity_name"
|
||||
|
||||
# make a client certificate using the ziti CLI
|
||||
ziti pki create client --pki-root="${pki_root}" --ca-name=${ca_name} --client-name=${identity_name} --client-file=${identity_name}
|
||||
sleep 1 #avoiding the same NotAfter making the certificate invalid
|
||||
|
||||
# setup some variables to the key and cert
|
||||
###################################################################
|
||||
# NOTE: the identity_ca_path is very important and is not able to be fetched at this time!
|
||||
# you must obtain this file through some other means. you also MUST provide the full chain as shown
|
||||
#
|
||||
curl -sk ${edge_controller_uri}/.well-known/est/cacerts > ${pki_root}/fetched-ca-certs.p7
|
||||
openssl base64 -d -in ${pki_root}/fetched-ca-certs.p7 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${pki_root}/fetched-ca-certs.pem
|
||||
identity_full_ca_path="${pki_root}/fetched-ca-certs.pem"
|
||||
|
||||
#
|
||||
###################################################################
|
||||
identity_path_to_key="${pki_root}/${ca_name}/keys/${identity_name}.key"
|
||||
identity_path_to_cert="${pki_root}/${ca_name}/certs/${identity_name}.cert"
|
||||
|
||||
echo $identity_path_to_key
|
||||
echo $identity_path_to_cert
|
||||
|
||||
#cp $identity_path_to_key /mnt/v/temp/key
|
||||
#cp $identity_path_to_cert /mnt/v/temp/cert
|
||||
|
||||
echo ""
|
||||
ziti-enroller -v --jwt ${pki_root}/auto.jwt --cert $identity_path_to_cert --key $identity_path_to_key --idname ${identity_name} --out "${pki_root}/${identity_name}.json"
|
||||
Executable
+48
@@ -0,0 +1,48 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
if [ "$1" == "" ]
|
||||
then
|
||||
echo "please provide the name of the ca already created"
|
||||
exit 1
|
||||
fi;
|
||||
#ca_name=$(cat /home/cd/pki/current-pki)
|
||||
ca_name=$1
|
||||
pki_root=/home/cd/ziti/pki/${ca_name}
|
||||
|
||||
if [[ "xx" == "xx$2" ]]
|
||||
then
|
||||
edge_controller_uri="https://local-edge-controller:1280"
|
||||
else
|
||||
edge_controller_uri="$2"
|
||||
fi
|
||||
echo "Edge controller set to: ${edge_controller_uri}"
|
||||
|
||||
echo -n Enter the Password for the admin user:
|
||||
read -s adminpwd
|
||||
echo
|
||||
|
||||
# Run Command
|
||||
echo $adminpwd
|
||||
|
||||
export zt_session=$(curl -sk -H "Content-Type: application/json" \
|
||||
${edge_controller_uri}/authenticate?method=password \
|
||||
-d "{\"username\":\"admin\",\"password\":\"${adminpwd}\"}" | \
|
||||
jq -j .data.token)
|
||||
|
||||
echo "zt_session: ${zt_session}"
|
||||
|
||||
identity_name="ott_$(date +"%H%M%S")"
|
||||
|
||||
export ziti_user_id=$(curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" \
|
||||
"${edge_controller_uri}/identities" \
|
||||
-d "{ \"name\": \"${identity_name}\", \"type\": \"User\", \"enrollment\": { \"ott\": true } }" \
|
||||
| jq -j .data.id)
|
||||
echo "ziti_user_id=$ziti_user_id"
|
||||
|
||||
curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" \
|
||||
"${edge_controller_uri}/identities/${ziti_user_id}" \
|
||||
| jq -j .data.enrollment.ott.jwt > "${pki_root}/${identity_name}.jwt"
|
||||
|
||||
echo "Writing jwt file to: ${pki_root}/${identity_name}.jwt"
|
||||
ziti-enroller -v --jwt "${pki_root}/${identity_name}.jwt"
|
||||
@@ -0,0 +1,39 @@
|
||||
name: openziti
|
||||
version: 0.22.5
|
||||
base: core18
|
||||
summary: Netfoundry ziti application suite
|
||||
description: |
|
||||
The ziti-tunneler provides access to the NetFoundry network
|
||||
grade: devel
|
||||
confinement: strict
|
||||
|
||||
parts:
|
||||
ziti:
|
||||
source: .
|
||||
plugin: go
|
||||
go-importpath: bitbucket.org/netfoundry/ziti
|
||||
go-channel: 1.17/stable
|
||||
build-packages:
|
||||
- gcc
|
||||
|
||||
random-scripts:
|
||||
source: etc/ubuntu-snap
|
||||
plugin: dump
|
||||
|
||||
apps:
|
||||
ziti:
|
||||
command: bin/ziti
|
||||
plugs:
|
||||
- home
|
||||
- network
|
||||
ziti-tunnel:
|
||||
daemon: simple
|
||||
command: bin/ziti-tunnel run $SNAP_COMMON/ziti.json
|
||||
plugs:
|
||||
- home
|
||||
- network
|
||||
- network-control
|
||||
|
||||
#hooks:
|
||||
# configure:
|
||||
# plugs: [network]
|
||||
Reference in New Issue
Block a user