From 91b9e0ebd1092f52768c1cf17d6c551ba817b13b Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 4 Mar 2023 14:15:22 -0500 Subject: [PATCH 01/97] add a BASH script for the K8s quickstart --- .../learn/quickstarts/network/miniziti.bash | 287 ++++++++++++++++++ 1 file changed, 287 insertions(+) create mode 100644 docusaurus/docs/learn/quickstarts/network/miniziti.bash diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash new file mode 100644 index 000000000..b109d772d --- /dev/null +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -0,0 +1,287 @@ +#!/usr/bin/env bash +set -o errexit +set -o nounset +set -o pipefail +set -o xtrace + +# require commands +declare -a BINS=(jq ziti minikube kubectl helm) +for BIN in ${BINS[*]}; do + if ! command -v $BIN &>/dev/null; then + echo "ERROR: this script requires '$BIN'. Please install it on the search PATH and try again." >&2 + $BIN || exit 1 + fi +done + +# start unless running +if ! minikube --profile miniziti status | grep -q "apiserver: Running"; then + minikube --profile miniziti start +fi + +# verify current context can connect to apiserver +kubectl cluster-info + +# enable minikube addons for ingress-nginx +minikube --profile miniziti addons enable ingress +minikube --profile miniziti addons enable ingress-dns + +# enable ssl-passthrough for OpenZiti ingresses +kubectl patch deployment \ + --namespace ingress-nginx "ingress-nginx-controller" \ + --type='json' \ + --patch='[{"op": "add", + "path": "/spec/template/spec/containers/0/args/-", + "value":"--enable-ssl-passthrough" + }]' + +# wait for ingress-nginx +kubectl wait jobs "ingress-nginx-admission-patch" \ + --namespace ingress-nginx \ + --for condition=complete \ + --timeout=120s + +kubectl wait pods \ + --namespace ingress-nginx \ + --for=condition=ready \ + --selector=app.kubernetes.io/component=controller \ + --timeout=120s + +if grep -qi "microsoft" /proc/sys/kernel/osrelease; then + echo "INFO: detected WSL. Privileged minikube tunnel required."\ + "You may be prompted for your WSL user's password to proceed."\ + "minikube tunnel will write log messages in /tmp/minitunnel.log" + # this approach allows us to grab stdin and prompt for password before proceeding in the background + sudo --background bash -c " + MINIKUBE_HOME=${HOME}/.minikube \ + KUBECONFIG=${HOME}/.kube/config \ + minikube --profile miniziti tunnel &> /tmp/minitunnel.log + " +fi + +kubectl apply \ + --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml +kubectl apply \ + --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml + +if helm list --namespace ziti-controller --all | grep -q minicontroller; then + helm upgrade "minicontroller" openziti/ziti-controller \ + --namespace ziti-controller \ + --set clientApi.advertisedHost="minicontroller.ziti" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml +else + helm install "minicontroller" openziti/ziti-controller \ + --namespace ziti-controller --create-namespace \ + --set clientApi.advertisedHost="minicontroller.ziti" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml +fi + +kubectl wait deployments "minicontroller" \ + --namespace ziti-controller \ + --for condition=Available=True \ + --timeout=120s + +MINIKUBE_EXTERNAL_IP=$(minikube --profile miniziti ip) + +if [[ -n "${MINIKUBE_EXTERNAL_IP:-}" ]]; then + echo "INFO: the minikube external IP is ${MINIKUBE_EXTERNAL_IP}" +else + echo "ERROR: failed to find minikube external IP" >&2 + exit 1 +fi + +# xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output +MINIKUBE_INTERNAL_HOST=$(minikube --profile miniziti ssh 'grep host.minikube.internal /etc/hosts') + +if [[ -n "${MINIKUBE_INTERNAL_HOST:-}" ]]; then + echo "INFO: the minikube internal host record is \"${MINIKUBE_INTERNAL_HOST}\"" +else + echo "ERROR: failed to find minikube internal IP" >&2 + exit 1 +fi + +kubectl patch configmap "coredns" \ + --namespace kube-system \ + --patch=" +data: + Corefile: | + .:53 { + log + errors + health { + lameduck 5s + } + ready + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + ttl 30 + } + prometheus :9153 + hosts { + ${MINIKUBE_INTERNAL_HOST} + fallthrough + } + forward . /etc/resolv.conf { + max_concurrent 1000 + } + cache 30 + loop + reload + loadbalance + } + ziti:53 { + errors + cache 30 + forward . ${MINIKUBE_EXTERNAL_IP} + } +" + +kubectl get pods \ + --namespace kube-system \ + | awk '/^coredns-/ {print $1}' \ + | xargs -rl kubectl delete pods \ + --namespace kube-system \ + +kubectl wait deployments "coredns" \ + --namespace kube-system \ + --for condition=Available=True + +if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ + nslookup minicontroller.ziti | grep "${MINIKUBE_EXTERNAL_IP}" >/dev/null; then + echo "INFO: cluster DNS is working" +else + echo "ERROR: cluster DNS test failed" >&2 + exit 1 +fi + +kubectl get secrets "minicontroller-admin-secret" \ + --namespace ziti-controller \ + --output go-template='{{index .data "admin-password" | base64decode }}' \ + | xargs -rl ziti edge login minicontroller.ziti:443 \ + --yes --username "admin" \ + --password + +if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then + ziti edge update edge-router "minirouter" \ + --role-attributes "public-routers" +else + ziti edge create edge-router "minirouter" \ + --role-attributes "public-routers" \ + --tunneler-enabled \ + --jwt-output-file /tmp/minirouter.jwt +fi + +if helm list --all --namespace ziti-router | grep -q minirouter; then + helm upgrade "minirouter" openziti/ziti-router \ + --namespace ziti-router \ + --set enrollmentJwt=\ \ + --set edge.advertisedHost=minirouter.ziti \ + --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml +else + helm install "minirouter" openziti/ziti-router \ + --namespace ziti-router --create-namespace \ + --set-file enrollmentJwt=/tmp/minirouter.jwt \ + --set edge.advertisedHost=minirouter.ziti \ + --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml +fi + +kubectl wait deployments "minirouter" \ + --namespace ziti-router \ + --for condition=Available=True + +if ziti edge list edge-routers 'name="minirouter"' \ + | awk '/minirouter/ {print $6}' \ + | grep -q true; then + echo "INFO: minirouter is online" +else + echo "ERROR: minirouter is offline" >&2 + exit 1 +fi + +if helm --namespace ziti-console list --all | grep -q miniconsole; then + helm upgrade "miniconsole" openziti/ziti-console \ + --namespace ziti-console \ + --set ingress.advertisedHost=miniconsole.ziti \ + --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml +else + helm install "miniconsole" openziti/ziti-console \ + --namespace ziti-console --create-namespace \ + --set ingress.advertisedHost=miniconsole.ziti \ + --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml +fi + +kubectl wait deployments "miniconsole" \ + --namespace ziti-console \ + --for condition=Available=True \ + --timeout=120s + +if ! ziti edge list identities 'name="edge-client"' | grep -q "edge-client"; then + ziti edge create identity device "edge-client" \ + --jwt-output-file /tmp/edge-client.jwt --role-attributes testapi-clients +fi + +if ! ziti edge list identities 'name="testapi-host"' | grep -q "testapi-host"; then + ziti edge create identity device "testapi-host" \ + --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts +fi + +if ! ziti edge list configs 'name="testapi-intercept-config"' | grep -q "testapi-intercept-config"; then + ziti edge create config "testapi-intercept-config" intercept.v1 \ + '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' +fi + +if ! ziti edge list configs 'name="testapi-host-config"' | grep -q "testapi-host-config"; then + ziti edge create config "testapi-host-config" host.v1 \ + '{"protocol":"tcp", "address":"httpbin","port":8080}' +fi + +if ! ziti edge list services 'name="testapi-service"' | grep -q "testapi-service"; then + ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config +fi + +if ! ziti edge list service-policies 'name="testapi-bind-policy"' | grep -q "testapi-bind-policy"; then + ziti edge create service-policy "testapi-bind-policy" Bind \ + --service-roles '@testapi-service' --identity-roles '#testapi-hosts' +fi + +if ! ziti edge list service-policies 'name="testapi-dial-policy"' | grep -q "testapi-dial-policy"; then + ziti edge create service-policy "testapi-dial-policy" Dial \ + --service-roles '@testapi-service' --identity-roles '#testapi-clients' +fi + +if ! ziti edge list edge-router-policies 'name="public-routers"' | grep -q "public-routers"; then + ziti edge create edge-router-policy "public-routers" \ + --edge-router-roles '#public-routers' --identity-roles '#all' +fi + +if ! ziti edge list service-edge-router-policies 'name="public-routers"' | grep -q "public-routers"; then + ziti edge create service-edge-router-policy "public-routers" \ + --edge-router-roles '#public-routers' --service-roles '#all' +fi + +if [[ -s /tmp/testapi-host.json ]]; then + echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ + "If the file was left over from a prior exercise and is no longer"\ + "working then delete it and re-run this script." >&2 +else + ziti edge enroll /tmp/testapi-host.jwt +fi + +if helm list --all --namespace default | grep -q testapi-host; then + helm upgrade "testapi-host" openziti/httpbin \ + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service +else + helm install "testapi-host" openziti/httpbin \ + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service +fi + +kubectl get secrets "minicontroller-admin-secret" \ + --namespace ziti-controller \ + --output go-template='{{"\nINFO: Your OpenZiti Console http://miniconsole.ziti password for \"admin\" is: "}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' + From 96a9254cdfa0ef96b4b5102ba172eb1c79012e17 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 4 Mar 2023 14:59:01 -0500 Subject: [PATCH 02/97] adjust timeouts for deployment waits --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index b109d772d..73f261e62 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -78,7 +78,7 @@ fi kubectl wait deployments "minicontroller" \ --namespace ziti-controller \ --for condition=Available=True \ - --timeout=120s + --timeout=240s MINIKUBE_EXTERNAL_IP=$(minikube --profile miniziti ip) @@ -140,7 +140,7 @@ kubectl get pods \ --namespace kube-system \ | awk '/^coredns-/ {print $1}' \ | xargs -rl kubectl delete pods \ - --namespace kube-system \ + --namespace kube-system kubectl wait deployments "coredns" \ --namespace kube-system \ @@ -217,7 +217,7 @@ fi kubectl wait deployments "miniconsole" \ --namespace ziti-console \ --for condition=Available=True \ - --timeout=120s + --timeout=240s if ! ziti edge list identities 'name="edge-client"' | grep -q "edge-client"; then ziti edge create identity device "edge-client" \ From c198842deb7e4a524252826683e11a84525ea971 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 4 Mar 2023 17:38:43 -0500 Subject: [PATCH 03/97] tidy output; don't patch unless ssl-passthrough disabled --- .../learn/quickstarts/network/miniziti.bash | 236 ++++++++++-------- 1 file changed, 133 insertions(+), 103 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 73f261e62..784d7efbe 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -2,83 +2,104 @@ set -o errexit set -o nounset set -o pipefail -set -o xtrace +# set -o xtrace + +# TODO ensure grep is grep +unalias grep 2>/dev/null || true # require commands declare -a BINS=(jq ziti minikube kubectl helm) -for BIN in ${BINS[*]}; do - if ! command -v $BIN &>/dev/null; then +for BIN in "${BINS[@]}"; do + if ! command -v "$BIN" &>/dev/null; then echo "ERROR: this script requires '$BIN'. Please install it on the search PATH and try again." >&2 $BIN || exit 1 fi done # start unless running -if ! minikube --profile miniziti status | grep -q "apiserver: Running"; then - minikube --profile miniziti start +echo "INFO: waiting for minikube to be ready" +if ! minikube --profile miniziti status 2>/dev/null | grep -q "apiserver: Running"; then + minikube --profile miniziti start >/dev/null fi # verify current context can connect to apiserver -kubectl cluster-info - -# enable minikube addons for ingress-nginx -minikube --profile miniziti addons enable ingress -minikube --profile miniziti addons enable ingress-dns +kubectl cluster-info >/dev/null # enable ssl-passthrough for OpenZiti ingresses -kubectl patch deployment \ - --namespace ingress-nginx "ingress-nginx-controller" \ - --type='json' \ - --patch='[{"op": "add", - "path": "/spec/template/spec/containers/0/args/-", - "value":"--enable-ssl-passthrough" - }]' +if kubectl get deployment "ingress-nginx-controller" \ + --namespace ingress-nginx \ + --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ + | grep -q enable-ssl-passthrough; then + echo "INFO: ingress-nginx has ssl-passthrough enabled" +else + echo "INFO: installing ingress-nginx" + # enable minikube addons for ingress-nginx + minikube --profile miniziti addons enable ingress >/dev/null + minikube --profile miniziti addons enable ingress-dns >/dev/null + + echo "INFO: patching ingress-nginx deployment to enable ssl-passthrough" + kubectl patch deployment "ingress-nginx-controller" \ + --namespace ingress-nginx \ + --type='json' \ + --patch='[{"op": "add", + "path": "/spec/template/spec/containers/0/args/-", + "value":"--enable-ssl-passthrough" + }]' >/dev/null +fi + +echo "INFO: waiting for ingress-nginx to be ready" # wait for ingress-nginx kubectl wait jobs "ingress-nginx-admission-patch" \ --namespace ingress-nginx \ --for condition=complete \ - --timeout=120s + --timeout=120s >/dev/null kubectl wait pods \ --namespace ingress-nginx \ --for=condition=ready \ --selector=app.kubernetes.io/component=controller \ - --timeout=120s + --timeout=120s >/dev/null -if grep -qi "microsoft" /proc/sys/kernel/osrelease; then +if [[ -n "${DEBUG:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease; then echo "INFO: detected WSL. Privileged minikube tunnel required."\ - "You may be prompted for your WSL user's password to proceed."\ - "minikube tunnel will write log messages in /tmp/minitunnel.log" - # this approach allows us to grab stdin and prompt for password before proceeding in the background - sudo --background bash -c " - MINIKUBE_HOME=${HOME}/.minikube \ - KUBECONFIG=${HOME}/.kube/config \ - minikube --profile miniziti tunnel &> /tmp/minitunnel.log - " + "You may be prompted for your WSL user's password to proceed."\ + "minikube tunnel will write log messages in /tmp/minitunnel.log" + (set -x; + # ensure stale tunnels are not running + sudo pkill -f 'minikube --profile miniziti tunnel' + # this approach allows us to grab stdin and prompt for password before + # proceeding in the background + sudo --background bash -c \ + "MINIKUBE_HOME=${MINIKUBE_HOME:-${HOME}/.minikube} "\ + "KUBECONFIG=${KUBECONFIG:-${HOME}/.kube/config} "\ + "minikube --profile miniziti tunnel &> /tmp/minitunnel.log" + ) fi kubectl apply \ - --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml + --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null kubectl apply \ - --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml + --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null if helm list --namespace ziti-controller --all | grep -q minicontroller; then helm upgrade "minicontroller" openziti/ziti-controller \ --namespace ziti-controller \ --set clientApi.advertisedHost="minicontroller.ziti" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null else helm install "minicontroller" openziti/ziti-controller \ --namespace ziti-controller --create-namespace \ --set clientApi.advertisedHost="minicontroller.ziti" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null fi +echo "INFO: waiting for minicontroller to be ready" + kubectl wait deployments "minicontroller" \ --namespace ziti-controller \ --for condition=Available=True \ - --timeout=240s + --timeout=240s >/dev/null MINIKUBE_EXTERNAL_IP=$(minikube --profile miniziti ip) @@ -93,6 +114,8 @@ fi MINIKUBE_INTERNAL_HOST=$(minikube --profile miniziti ssh 'grep host.minikube.internal /etc/hosts') if [[ -n "${MINIKUBE_INTERNAL_HOST:-}" ]]; then + # strip surrounding whitespace + MINIKUBE_INTERNAL_HOST=$(xargs <<< "${MINIKUBE_INTERNAL_HOST}") echo "INFO: the minikube internal host record is \"${MINIKUBE_INTERNAL_HOST}\"" else echo "ERROR: failed to find minikube internal IP" >&2 @@ -103,48 +126,50 @@ kubectl patch configmap "coredns" \ --namespace kube-system \ --patch=" data: - Corefile: | - .:53 { - log - errors - health { - lameduck 5s + Corefile: | + .:53 { + log + errors + health { + lameduck 5s + } + ready + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + ttl 30 + } + prometheus :9153 + hosts { + ${MINIKUBE_INTERNAL_HOST} + fallthrough + } + forward . /etc/resolv.conf { + max_concurrent 1000 + } + cache 30 + loop + reload + loadbalance } - ready - kubernetes cluster.local in-addr.arpa ip6.arpa { - pods insecure - fallthrough in-addr.arpa ip6.arpa - ttl 30 + ziti:53 { + errors + cache 30 + forward . ${MINIKUBE_EXTERNAL_IP} } - prometheus :9153 - hosts { - ${MINIKUBE_INTERNAL_HOST} - fallthrough - } - forward . /etc/resolv.conf { - max_concurrent 1000 - } - cache 30 - loop - reload - loadbalance - } - ziti:53 { - errors - cache 30 - forward . ${MINIKUBE_EXTERNAL_IP} - } -" +" >/dev/null kubectl get pods \ --namespace kube-system \ | awk '/^coredns-/ {print $1}' \ - | xargs -rl kubectl delete pods \ - --namespace kube-system + | xargs -l kubectl delete pods \ + --namespace kube-system >/dev/null + +echo "INFO: waiting for coredns to be ready" kubectl wait deployments "coredns" \ --namespace kube-system \ - --for condition=Available=True + --for condition=Available=True >/dev/null if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ nslookup minicontroller.ziti | grep "${MINIKUBE_EXTERNAL_IP}" >/dev/null; then @@ -155,20 +180,20 @@ else fi kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ - --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs -rl ziti edge login minicontroller.ziti:443 \ + --namespace ziti-controller \ + --output go-template='{{index .data "admin-password" | base64decode }}' \ + | xargs -l ziti edge login minicontroller.ziti:443 \ --yes --username "admin" \ - --password + --password >/dev/null if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then ziti edge update edge-router "minirouter" \ - --role-attributes "public-routers" + --role-attributes "public-routers" >/dev/null else ziti edge create edge-router "minirouter" \ --role-attributes "public-routers" \ --tunneler-enabled \ - --jwt-output-file /tmp/minirouter.jwt + --jwt-output-file /tmp/minirouter.jwt >/dev/null fi if helm list --all --namespace ziti-router | grep -q minirouter; then @@ -177,19 +202,21 @@ if helm list --all --namespace ziti-router | grep -q minirouter; then --set enrollmentJwt=\ \ --set edge.advertisedHost=minirouter.ziti \ --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null else helm install "minirouter" openziti/ziti-router \ --namespace ziti-router --create-namespace \ --set-file enrollmentJwt=/tmp/minirouter.jwt \ --set edge.advertisedHost=minirouter.ziti \ --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null fi +echo "INFO: waiting for minirouter to be ready" + kubectl wait deployments "minirouter" \ --namespace ziti-router \ - --for condition=Available=True + --for condition=Available=True >/dev/null if ziti edge list edge-routers 'name="minirouter"' \ | awk '/minirouter/ {print $6}' \ @@ -205,83 +232,86 @@ if helm --namespace ziti-console list --all | grep -q miniconsole; then --namespace ziti-console \ --set ingress.advertisedHost=miniconsole.ziti \ --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null else helm install "miniconsole" openziti/ziti-console \ --namespace ziti-console --create-namespace \ --set ingress.advertisedHost=miniconsole.ziti \ --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null fi +echo "INFO: waiting for miniconsole to be ready" + kubectl wait deployments "miniconsole" \ --namespace ziti-console \ --for condition=Available=True \ - --timeout=240s + --timeout=240s >/dev/null -if ! ziti edge list identities 'name="edge-client"' | grep -q "edge-client"; then +if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then ziti edge create identity device "edge-client" \ - --jwt-output-file /tmp/edge-client.jwt --role-attributes testapi-clients + --jwt-output-file /tmp/edge-client.jwt --role-attributes testapi-clients >/dev/null fi -if ! ziti edge list identities 'name="testapi-host"' | grep -q "testapi-host"; then +if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then ziti edge create identity device "testapi-host" \ - --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts + --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null fi -if ! ziti edge list configs 'name="testapi-intercept-config"' | grep -q "testapi-intercept-config"; then +if ! ziti edge list configs 'name="testapi-intercept-config"' --csv | grep -q "testapi-intercept-config"; then ziti edge create config "testapi-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' + '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null fi -if ! ziti edge list configs 'name="testapi-host-config"' | grep -q "testapi-host-config"; then +if ! ziti edge list configs 'name="testapi-host-config"' --csv | grep -q "testapi-host-config"; then ziti edge create config "testapi-host-config" host.v1 \ - '{"protocol":"tcp", "address":"httpbin","port":8080}' + '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null fi -if ! ziti edge list services 'name="testapi-service"' | grep -q "testapi-service"; then - ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config +if ! ziti edge list services 'name="testapi-service"' --csv | grep -q "testapi-service"; then + ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null fi -if ! ziti edge list service-policies 'name="testapi-bind-policy"' | grep -q "testapi-bind-policy"; then +if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv | grep -q "testapi-bind-policy"; then ziti edge create service-policy "testapi-bind-policy" Bind \ - --service-roles '@testapi-service' --identity-roles '#testapi-hosts' + --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null fi -if ! ziti edge list service-policies 'name="testapi-dial-policy"' | grep -q "testapi-dial-policy"; then +if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv | grep -q "testapi-dial-policy"; then ziti edge create service-policy "testapi-dial-policy" Dial \ - --service-roles '@testapi-service' --identity-roles '#testapi-clients' + --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null fi -if ! ziti edge list edge-router-policies 'name="public-routers"' | grep -q "public-routers"; then +if ! ziti edge list edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then ziti edge create edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --identity-roles '#all' + --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null fi -if ! ziti edge list service-edge-router-policies 'name="public-routers"' | grep -q "public-routers"; then +if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then ziti edge create service-edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --service-roles '#all' + --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null fi if [[ -s /tmp/testapi-host.json ]]; then echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ - "If the file was left over from a prior exercise and is no longer"\ - "working then delete it and re-run this script." >&2 + "If the file was left over from a prior run"\ + " then delete it and re-run this script." >&2 else - ziti edge enroll /tmp/testapi-host.jwt + ziti edge enroll /tmp/testapi-host.jwt >/dev/null fi if helm list --all --namespace default | grep -q testapi-host; then helm upgrade "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service >/dev/null else helm install "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service >/dev/null fi kubectl get secrets "minicontroller-admin-secret" \ --namespace ziti-controller \ --output go-template='{{"\nINFO: Your OpenZiti Console http://miniconsole.ziti password for \"admin\" is: "}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' +echo "INFO: Success! Remember to add your edge client identity '/tmp/edge-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." From 8da4ec8f810b91f51695a842f30b5884d3f1e116 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sun, 5 Mar 2023 11:31:24 -0500 Subject: [PATCH 04/97] wait for cert-manager --- .../learn/quickstarts/network/miniziti.bash | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 784d7efbe..a8ff997a8 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -48,7 +48,6 @@ else fi echo "INFO: waiting for ingress-nginx to be ready" - # wait for ingress-nginx kubectl wait jobs "ingress-nginx-admission-patch" \ --namespace ingress-nginx \ @@ -61,7 +60,7 @@ kubectl wait pods \ --selector=app.kubernetes.io/component=controller \ --timeout=120s >/dev/null -if [[ -n "${DEBUG:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease; then +if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease; then echo "INFO: detected WSL. Privileged minikube tunnel required."\ "You may be prompted for your WSL user's password to proceed."\ "minikube tunnel will write log messages in /tmp/minitunnel.log" @@ -77,29 +76,33 @@ if [[ -n "${DEBUG:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease; the ) fi +echo "INFO: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" kubectl apply \ --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null kubectl apply \ --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null if helm list --namespace ziti-controller --all | grep -q minicontroller; then + echo "INFO: upgrading OpenZiti Controller, Cert Manager, Trust Manager" helm upgrade "minicontroller" openziti/ziti-controller \ --namespace ziti-controller \ --set clientApi.advertisedHost="minicontroller.ziti" \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null else + echo "INFO: installing OpenZiti Controller, Cert Manager, Trust Manager" helm install "minicontroller" openziti/ziti-controller \ --namespace ziti-controller --create-namespace \ --set clientApi.advertisedHost="minicontroller.ziti" \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null fi -echo "INFO: waiting for minicontroller to be ready" - -kubectl wait deployments "minicontroller" \ - --namespace ziti-controller \ - --for condition=Available=True \ - --timeout=240s >/dev/null +for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do + echo "INFO: waiting for $DEPLOYMENT to be ready" + kubectl wait deployments "$DEPLOYMENT" \ + --namespace ziti-controller \ + --for condition=Available=True \ + --timeout=240s >/dev/null +done MINIKUBE_EXTERNAL_IP=$(minikube --profile miniziti ip) From c162c58fc01f4000e3bcd650a46a8e7ea04bfd8d Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sun, 5 Mar 2023 21:42:02 -0500 Subject: [PATCH 05/97] refresh charts --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index a8ff997a8..2b2fb2b3d 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -82,6 +82,14 @@ kubectl apply \ kubectl apply \ --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null +if helm repo list | grep -q openziti; then + echo "INFO: refreshing OpenZiti Helm Charts" + helm repo update openziti +else + echo "INFO: subscribing to OpenZiti Helm Charts" + helm repo add openziti https://docs.openziti.io/helm-charts/ +fi + if helm list --namespace ziti-controller --all | grep -q minicontroller; then echo "INFO: upgrading OpenZiti Controller, Cert Manager, Trust Manager" helm upgrade "minicontroller" openziti/ziti-controller \ From 101989e18f394a6952c6b150a84a83a2c9641fcc Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 6 Mar 2023 15:35:03 -0500 Subject: [PATCH 06/97] add checkDns function to improve WSL and macOS hosts file checking --- .../learn/quickstarts/network/miniziti.bash | 74 +++++++++++++------ 1 file changed, 50 insertions(+), 24 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 2b2fb2b3d..63d0533cc 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -1,17 +1,32 @@ #!/usr/bin/env bash + set -o errexit set -o nounset set -o pipefail -# set -o xtrace -# TODO ensure grep is grep -unalias grep 2>/dev/null || true +function checkDns(){ + # only param is an IPv4 + [[ $# -eq 1 && $1 =~ ([0-9]{1,3}\.){3}[0-9]{1,3} ]] || { + echo "ERROR: need IPv4 of miniziti ingress as only param to checkDns()" >&2 + return 1 + } + if grep -q "$1.*minicontroller.ziti" /etc/hosts \ + || nslookup minicontroller.ziti | grep -q "$1"; then + echo "INFO: host DNS found expected minikube ingress IP '$1'" + return 0 + else + echo "ERROR: /etc/hosts does not contain the miniziti record."\ + " Consult docs for Windows (WSL), macOS, and Linux solutions"\ + " before re-running this script." + return 1 + fi +} # require commands declare -a BINS=(jq ziti minikube kubectl helm) for BIN in "${BINS[@]}"; do if ! command -v "$BIN" &>/dev/null; then - echo "ERROR: this script requires '$BIN'. Please install it on the search PATH and try again." >&2 + echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 $BIN || exit 1 fi done @@ -22,6 +37,15 @@ if ! minikube --profile miniziti status 2>/dev/null | grep -q "apiserver: Runnin minikube --profile miniziti start >/dev/null fi +MINIKUBE_NODE_EXTERNAL=$(minikube --profile miniziti ip) + +if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then + echo "INFO: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" +else + echo "ERROR: failed to find minikube external IP" >&2 + exit 1 +fi + # verify current context can connect to apiserver kubectl cluster-info >/dev/null @@ -60,7 +84,7 @@ kubectl wait pods \ --selector=app.kubernetes.io/component=controller \ --timeout=120s >/dev/null -if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease; then +if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then echo "INFO: detected WSL. Privileged minikube tunnel required."\ "You may be prompted for your WSL user's password to proceed."\ "minikube tunnel will write log messages in /tmp/minitunnel.log" @@ -72,8 +96,19 @@ if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease; sudo --background bash -c \ "MINIKUBE_HOME=${MINIKUBE_HOME:-${HOME}/.minikube} "\ "KUBECONFIG=${KUBECONFIG:-${HOME}/.kube/config} "\ - "minikube --profile miniziti tunnel &> /tmp/minitunnel.log" + "minikube --profile miniziti tunnel &>> /tmp/minitunnel.log" ) + # recommend /etc/hosts change unless DNS is configured to reach the minikube node IP + checkDns "127.0.0.1" +else + if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then + # Like WSL, macOS uses localhost port forwarding to reach the minikube node IP + checkDns "127.0.0.1" + else + # Exceptions notwithstanding, Linux, etc. presumably have an IP route to + # the minikube node IP + checkDns "$MINIKUBE_NODE_EXTERNAL" + fi fi echo "INFO: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" @@ -112,22 +147,13 @@ for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do --timeout=240s >/dev/null done -MINIKUBE_EXTERNAL_IP=$(minikube --profile miniziti ip) - -if [[ -n "${MINIKUBE_EXTERNAL_IP:-}" ]]; then - echo "INFO: the minikube external IP is ${MINIKUBE_EXTERNAL_IP}" -else - echo "ERROR: failed to find minikube external IP" >&2 - exit 1 -fi - # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output -MINIKUBE_INTERNAL_HOST=$(minikube --profile miniziti ssh 'grep host.minikube.internal /etc/hosts') +MINIKUBE_NODE_INTERNAL=$(minikube --profile miniziti ssh 'grep host.minikube.internal /etc/hosts') -if [[ -n "${MINIKUBE_INTERNAL_HOST:-}" ]]; then +if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then # strip surrounding whitespace - MINIKUBE_INTERNAL_HOST=$(xargs <<< "${MINIKUBE_INTERNAL_HOST}") - echo "INFO: the minikube internal host record is \"${MINIKUBE_INTERNAL_HOST}\"" + MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") + echo "INFO: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" else echo "ERROR: failed to find minikube internal IP" >&2 exit 1 @@ -152,7 +178,7 @@ data: } prometheus :9153 hosts { - ${MINIKUBE_INTERNAL_HOST} + ${MINIKUBE_NODE_INTERNAL} fallthrough } forward . /etc/resolv.conf { @@ -166,14 +192,14 @@ data: ziti:53 { errors cache 30 - forward . ${MINIKUBE_EXTERNAL_IP} + forward . ${MINIKUBE_NODE_EXTERNAL} } " >/dev/null kubectl get pods \ --namespace kube-system \ | awk '/^coredns-/ {print $1}' \ - | xargs -l kubectl delete pods \ + | xargs kubectl delete pods \ --namespace kube-system >/dev/null echo "INFO: waiting for coredns to be ready" @@ -183,7 +209,7 @@ kubectl wait deployments "coredns" \ --for condition=Available=True >/dev/null if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ - nslookup minicontroller.ziti | grep "${MINIKUBE_EXTERNAL_IP}" >/dev/null; then + nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then echo "INFO: cluster DNS is working" else echo "ERROR: cluster DNS test failed" >&2 @@ -193,7 +219,7 @@ fi kubectl get secrets "minicontroller-admin-secret" \ --namespace ziti-controller \ --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs -l ziti edge login minicontroller.ziti:443 \ + | xargs ziti edge login minicontroller.ziti:443 \ --yes --username "admin" \ --password >/dev/null From 026127898de65674cdd224debf883557bad6bc10 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 6 Mar 2023 19:40:24 -0500 Subject: [PATCH 07/97] organize the miniziti quickstart around the script --- .../learn/quickstarts/network/miniziti.bash | 705 ++++++++++-------- 1 file changed, 398 insertions(+), 307 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 63d0533cc..6a5c2a5dc 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -4,351 +4,442 @@ set -o errexit set -o nounset set -o pipefail +function banner(){ + cat <&2 return 1 } - if grep -q "$1.*minicontroller.ziti" /etc/hosts \ - || nslookup minicontroller.ziti | grep -q "$1"; then + echo "DEBUG: checking DNS to ensure minicontroller.ziti resolves to $1" >&3 + if grep -qE "^${1//./\\.}.*minicontroller.ziti" /etc/hosts \ + || nslookup minicontroller.ziti | grep -q "${1//./\\.}"; then echo "INFO: host DNS found expected minikube ingress IP '$1'" return 0 else - echo "ERROR: /etc/hosts does not contain the miniziti record."\ - " Consult docs for Windows (WSL), macOS, and Linux solutions"\ - " before re-running this script." + echo "ERROR: minicontroller.ziti does not resolve. Did you add the record in /etc/hosts?" return 1 fi } -# require commands -declare -a BINS=(jq ziti minikube kubectl helm) -for BIN in "${BINS[@]}"; do - if ! command -v "$BIN" &>/dev/null; then - echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 - $BIN || exit 1 +function deleteMiniziti(){ + if (( $# )) && [[ $1 =~ ^[0-9]+$ ]]; then + WAIT="$1" + shift + else + WAIT=10 fi -done + (( $# )) && { + echo "WARN: ignorring extra params '$*'" >&2 + } + echo "WARN: deleting miniziti in ${WAIT}s" >&2 + sleep "$WAIT" + echo "INFO: waiting for miniziti to be deleted" + minikube --profile miniziti delete >/dev/null +} -# start unless running -echo "INFO: waiting for minikube to be ready" -if ! minikube --profile miniziti status 2>/dev/null | grep -q "apiserver: Running"; then - minikube --profile miniziti start >/dev/null -fi +function main(){ + # require commands + declare -a BINS=(jq ziti minikube kubectl helm) + for BIN in "${BINS[@]}"; do + if ! command -v "$BIN" &>/dev/null; then + echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 + $BIN || exit 1 + fi + done -MINIKUBE_NODE_EXTERNAL=$(minikube --profile miniziti ip) + # open a descriptor for debug messages + exec 3>/dev/null -if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then - echo "INFO: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" -else - echo "ERROR: failed to find minikube external IP" >&2 - exit 1 -fi + while (( $# )); do + case "$1" in + --delete) deleteMiniziti 10 + shift + ;; + --quiet) exec > /dev/null + shift + ;; + --verbose) exec 3>&1 + shift + ;; + --help) _usage + exit + ;; + esac + done -# verify current context can connect to apiserver -kubectl cluster-info >/dev/null + banner -# enable ssl-passthrough for OpenZiti ingresses -if kubectl get deployment "ingress-nginx-controller" \ - --namespace ingress-nginx \ - --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ - | grep -q enable-ssl-passthrough; then - echo "INFO: ingress-nginx has ssl-passthrough enabled" -else - echo "INFO: installing ingress-nginx" - # enable minikube addons for ingress-nginx - minikube --profile miniziti addons enable ingress >/dev/null - minikube --profile miniziti addons enable ingress-dns >/dev/null + # start unless running + echo "INFO: waiting for miniziti to be ready" + if ! minikube --profile miniziti status 2>/dev/null | grep -q "apiserver: Running"; then + minikube --profile miniziti start >/dev/null + fi - echo "INFO: patching ingress-nginx deployment to enable ssl-passthrough" - kubectl patch deployment "ingress-nginx-controller" \ + MINIKUBE_NODE_EXTERNAL=$(minikube --profile miniziti ip) + + if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then + echo "DEBUG: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" >&3 + else + echo "ERROR: failed to find minikube external IP" >&2 + exit 1 + fi + + # verify current context can connect to apiserver + kubectl cluster-info >/dev/null + echo "DEBUG: kubectl successfully obtained cluster-info from apiserver" >&3 + + # enable ssl-passthrough for OpenZiti ingresses + if kubectl get deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ - --type='json' \ - --patch='[{"op": "add", - "path": "/spec/template/spec/containers/0/args/-", - "value":"--enable-ssl-passthrough" - }]' >/dev/null -fi + --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ + | grep -q enable-ssl-passthrough; then + echo "DEBUG: ingress-nginx has ssl-passthrough enabled" >&3 + else + echo "DEBUG: installing ingress-nginx" >&3 + # enable minikube addons for ingress-nginx + minikube --profile miniziti addons enable ingress >/dev/null + minikube --profile miniziti addons enable ingress-dns >/dev/null -echo "INFO: waiting for ingress-nginx to be ready" -# wait for ingress-nginx -kubectl wait jobs "ingress-nginx-admission-patch" \ - --namespace ingress-nginx \ - --for condition=complete \ + echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 + kubectl patch deployment "ingress-nginx-controller" \ + --namespace ingress-nginx \ + --type='json' \ + --patch='[{"op": "add", + "path": "/spec/template/spec/containers/0/args/-", + "value":"--enable-ssl-passthrough" + }]' >/dev/null + fi + + echo "INFO: waiting for ingress-nginx to be ready" + # wait for ingress-nginx + kubectl wait jobs "ingress-nginx-admission-patch" \ + --namespace ingress-nginx \ + --for condition=complete \ + --timeout=120s >/dev/null + + kubectl wait pods \ + --namespace ingress-nginx \ + --for=condition=ready \ + --selector=app.kubernetes.io/component=controller \ --timeout=120s >/dev/null -kubectl wait pods \ - --namespace ingress-nginx \ - --for=condition=ready \ - --selector=app.kubernetes.io/component=controller \ - --timeout=120s >/dev/null - -if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then - echo "INFO: detected WSL. Privileged minikube tunnel required."\ - "You may be prompted for your WSL user's password to proceed."\ - "minikube tunnel will write log messages in /tmp/minitunnel.log" - (set -x; - # ensure stale tunnels are not running - sudo pkill -f 'minikube --profile miniziti tunnel' - # this approach allows us to grab stdin and prompt for password before - # proceeding in the background - sudo --background bash -c \ - "MINIKUBE_HOME=${MINIKUBE_HOME:-${HOME}/.minikube} "\ - "KUBECONFIG=${KUBECONFIG:-${HOME}/.kube/config} "\ - "minikube --profile miniziti tunnel &>> /tmp/minitunnel.log" - ) - # recommend /etc/hosts change unless DNS is configured to reach the minikube node IP - checkDns "127.0.0.1" -else - if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then - # Like WSL, macOS uses localhost port forwarding to reach the minikube node IP + if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then + echo "DEBUG: detected WSL, probing for running minikube tunnel" >&3 + if ! pgrep -f 'minikube --profile miniziti tunnel' >/dev/null; then + echo -e "INFO: detected WSL. minikube tunnel required."\ + " In another terminal, run the following command. Then re-run this script."\ + "\n\n\tminikube --profile miniziti tunnel" + exit 1 + fi + # recommend /etc/hosts change unless DNS is configured to reach the minikube node IP checkDns "127.0.0.1" else - # Exceptions notwithstanding, Linux, etc. presumably have an IP route to - # the minikube node IP - checkDns "$MINIKUBE_NODE_EXTERNAL" + if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then + # Like WSL, macOS uses localhost port forwarding to reach the minikube node IP + checkDns "127.0.0.1" + else + # Exceptions notwithstanding, Linux, etc. presumably have an IP route to + # the minikube node IP + checkDns "$MINIKUBE_NODE_EXTERNAL" + fi fi -fi -echo "INFO: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" -kubectl apply \ - --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null -kubectl apply \ - --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null + echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 + kubectl apply \ + --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null + kubectl apply \ + --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null -if helm repo list | grep -q openziti; then - echo "INFO: refreshing OpenZiti Helm Charts" - helm repo update openziti -else - echo "INFO: subscribing to OpenZiti Helm Charts" - helm repo add openziti https://docs.openziti.io/helm-charts/ -fi + if helm repo list | grep -q openziti; then + echo "DEBUG: refreshing OpenZiti Helm Charts" >&3 + helm repo update openziti >/dev/null + else + echo "INFO: subscribing to OpenZiti Helm Charts" + helm repo add openziti https://docs.openziti.io/helm-charts/ >/dev/null + fi -if helm list --namespace ziti-controller --all | grep -q minicontroller; then - echo "INFO: upgrading OpenZiti Controller, Cert Manager, Trust Manager" - helm upgrade "minicontroller" openziti/ziti-controller \ + if helm list --namespace ziti-controller --all | grep -q minicontroller; then + echo "INFO: upgrading OpenZiti Controller, Cert Manager, Trust Manager" + helm upgrade "minicontroller" openziti/ziti-controller \ + --namespace ziti-controller \ + --set clientApi.advertisedHost="minicontroller.ziti" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null + else + echo "INFO: installing OpenZiti Controller, Cert Manager, Trust Manager" + helm install "minicontroller" openziti/ziti-controller \ + --namespace ziti-controller --create-namespace \ + --set clientApi.advertisedHost="minicontroller.ziti" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null + fi + + for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do + echo "INFO: waiting for $DEPLOYMENT to be ready" + kubectl wait deployments "$DEPLOYMENT" \ + --namespace ziti-controller \ + --for condition=Available=True \ + --timeout=240s >/dev/null + done + + # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output + echo "DEBUG: probing minikube node for internal host record" >&3 + MINIKUBE_NODE_INTERNAL=$(minikube --profile miniziti ssh 'grep host.minikube.internal /etc/hosts') + + if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then + # strip surrounding whitespace + MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") + echo "DEBUG: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" >&3 + else + echo "ERROR: failed to find minikube internal IP" >&2 + exit 1 + fi + + echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 + kubectl patch configmap "coredns" \ + --namespace kube-system \ + --patch=" + data: + Corefile: | + .:53 { + log + errors + health { + lameduck 5s + } + ready + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + ttl 30 + } + prometheus :9153 + hosts { + ${MINIKUBE_NODE_INTERNAL} + fallthrough + } + forward . /etc/resolv.conf { + max_concurrent 1000 + } + cache 30 + loop + reload + loadbalance + } + ziti:53 { + errors + cache 30 + forward . ${MINIKUBE_NODE_EXTERNAL} + } + " >/dev/null + + echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 + kubectl get pods \ + --namespace kube-system \ + | awk '/^coredns-/ {print $1}' \ + | xargs kubectl delete pods \ + --namespace kube-system >/dev/null + + echo "DEBUG: waiting for cluster DNS to be ready" >&3 + kubectl wait deployments "coredns" \ + --namespace kube-system \ + --for condition=Available=True >/dev/null + + if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ + nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then + echo "INFO: cluster DNS is working" + else + echo "ERROR: cluster DNS test failed" >&2 + exit 1 + fi + + echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 + kubectl get secrets "minicontroller-admin-secret" \ --namespace ziti-controller \ - --set clientApi.advertisedHost="minicontroller.ziti" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null -else - echo "INFO: installing OpenZiti Controller, Cert Manager, Trust Manager" - helm install "minicontroller" openziti/ziti-controller \ - --namespace ziti-controller --create-namespace \ - --set clientApi.advertisedHost="minicontroller.ziti" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null -fi + --output go-template='{{index .data "admin-password" | base64decode }}' \ + | xargs ziti edge login minicontroller.ziti:443 \ + --yes --username "admin" \ + --password >/dev/null -for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do - echo "INFO: waiting for $DEPLOYMENT to be ready" - kubectl wait deployments "$DEPLOYMENT" \ - --namespace ziti-controller \ + if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then + echo "DEBUG: updating minirouter" >&3 + ziti edge update edge-router "minirouter" \ + --role-attributes "public-routers" >/dev/null + else + echo "DEBUG: creating minirouter" >&3 + ziti edge create edge-router "minirouter" \ + --role-attributes "public-routers" \ + --tunneler-enabled \ + --jwt-output-file /tmp/minirouter.jwt >/dev/null + fi + + if helm list --all --namespace ziti-router | grep -q minirouter; then + echo "DEBUG: upgrading minirouter release" >&3 + helm upgrade "minirouter" openziti/ziti-router \ + --namespace ziti-router \ + --set enrollmentJwt=\ \ + --set edge.advertisedHost=minirouter.ziti \ + --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null + else + echo "DEBUG: installing minirouter release" >&3 + helm install "minirouter" openziti/ziti-router \ + --namespace ziti-router --create-namespace \ + --set-file enrollmentJwt=/tmp/minirouter.jwt \ + --set edge.advertisedHost=minirouter.ziti \ + --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null + fi + + echo "INFO: waiting for minirouter to be ready" + kubectl wait deployments "minirouter" \ + --namespace ziti-router \ + --for condition=Available=True >/dev/null + + echo "DEBUG: probing minirouter for online status" >&3 + if ziti edge list edge-routers 'name="minirouter"' \ + | awk '/minirouter/ {print $6}' \ + | grep -q true; then + echo "INFO: minirouter is online" + else + echo "ERROR: minirouter is offline" >&2 + exit 1 + fi + + if helm --namespace ziti-console list --all | grep -q miniconsole; then + echo "DEBUG: upgrading miniconsole release" >&3 + helm upgrade "miniconsole" openziti/ziti-console \ + --namespace ziti-console \ + --set ingress.advertisedHost=miniconsole.ziti \ + --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null + else + echo "DEBUG: installing miniconsole release" >&3 + helm install "miniconsole" openziti/ziti-console \ + --namespace ziti-console --create-namespace \ + --set ingress.advertisedHost=miniconsole.ziti \ + --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null + fi + + echo "INFO: waiting for miniconsole to be ready" + kubectl wait deployments "miniconsole" \ + --namespace ziti-console \ --for condition=Available=True \ --timeout=240s >/dev/null -done -# xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output -MINIKUBE_NODE_INTERNAL=$(minikube --profile miniziti ssh 'grep host.minikube.internal /etc/hosts') + if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then + echo "DEBUG: creating identity edge-client" >&3 + ziti edge create identity device "edge-client" \ + --jwt-output-file /tmp/edge-client.jwt --role-attributes testapi-clients >/dev/null + else + echo "DEBUG: ignoring identity edge-client" >&3 + fi -if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then - # strip surrounding whitespace - MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") - echo "INFO: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" -else - echo "ERROR: failed to find minikube internal IP" >&2 - exit 1 -fi + if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then + echo "DEBUG: creating identity testapi-host" >&3 + ziti edge create identity device "testapi-host" \ + --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null + else + echo "DEBUG: ignoring identity testapi-host" >&3 + fi + + if ! ziti edge list configs 'name="testapi-intercept-config"' --csv | grep -q "testapi-intercept-config"; then + echo "DEBUG: creating config testapi-intercept-config" >&3 + ziti edge create config "testapi-intercept-config" intercept.v1 \ + '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null + else + echo "DEBUG: ignoring config testapi-intercept-config" >&3 + fi + + if ! ziti edge list configs 'name="testapi-host-config"' --csv | grep -q "testapi-host-config"; then + echo "DEBUG: creating config testapi-host-config" >&3 + ziti edge create config "testapi-host-config" host.v1 \ + '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null + else + echo "DEBUG: ignoring config testapi-host-config" >&3 + fi + + if ! ziti edge list services 'name="testapi-service"' --csv | grep -q "testapi-service"; then + echo "DEBUG: creating service testapi-service" >&3 + ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null + else + echo "DEBUG: ignoring service testapi-service" >&3 + fi + + if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv | grep -q "testapi-bind-policy"; then + echo "DEBUG: creating service-policy testapi-bind-policy" >&3 + ziti edge create service-policy "testapi-bind-policy" Bind \ + --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null + else + echo "DEBUG: ignoring service-policy testapi-bind-policy" >&3 + fi + + if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv | grep -q "testapi-dial-policy"; then + echo "DEBUG: creating service-policy testapi-dial-policy" >&3 + ziti edge create service-policy "testapi-dial-policy" Dial \ + --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null + else + echo "DEBUG: ignoring service-policy testapi-dial-policy" >&3 + fi + + if ! ziti edge list edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then + echo "DEBUG: creating edge-router-policy public-routers" >&3 + ziti edge create edge-router-policy "public-routers" \ + --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null + else + echo "DEBUG: ignoring edge-router-policy public-routers" >&3 + fi + + if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then + echo "DEBUG: creating service-edge-router-policy public-routers" >&3 + ziti edge create service-edge-router-policy "public-routers" \ + --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null + else + echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 + fi -kubectl patch configmap "coredns" \ - --namespace kube-system \ - --patch=" -data: - Corefile: | - .:53 { - log - errors - health { - lameduck 5s - } - ready - kubernetes cluster.local in-addr.arpa ip6.arpa { - pods insecure - fallthrough in-addr.arpa ip6.arpa - ttl 30 - } - prometheus :9153 - hosts { - ${MINIKUBE_NODE_INTERNAL} - fallthrough - } - forward . /etc/resolv.conf { - max_concurrent 1000 - } - cache 30 - loop - reload - loadbalance - } - ziti:53 { - errors - cache 30 - forward . ${MINIKUBE_NODE_EXTERNAL} - } -" >/dev/null + if [[ -s /tmp/testapi-host.json ]]; then + echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ + "If the file was left over from a prior run"\ + " then delete it and re-run this script." >&2 + else + echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 + ziti edge enroll /tmp/testapi-host.jwt >/dev/null + fi -kubectl get pods \ - --namespace kube-system \ - | awk '/^coredns-/ {print $1}' \ - | xargs kubectl delete pods \ - --namespace kube-system >/dev/null + if helm list --all --namespace default | grep -q testapi-host; then + echo "DEBUG: upgrading testapi-host release" >&3 + helm upgrade "testapi-host" openziti/httpbin \ + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service >/dev/null + else + echo "DEBUG: installing testapi-host release" >&3 + helm install "testapi-host" openziti/httpbin \ + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service >/dev/null + fi -echo "INFO: waiting for coredns to be ready" + kubectl get secrets "minicontroller-admin-secret" \ + --namespace ziti-controller \ + --output go-template='{{"\nINFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\nINFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' -kubectl wait deployments "coredns" \ - --namespace kube-system \ - --for condition=Available=True >/dev/null + echo "INFO: Success! Remember to add your edge client identity '/tmp/edge-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." +} -if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ - nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then - echo "INFO: cluster DNS is working" -else - echo "ERROR: cluster DNS test failed" >&2 - exit 1 -fi - -kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ - --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs ziti edge login minicontroller.ziti:443 \ - --yes --username "admin" \ - --password >/dev/null - -if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then - ziti edge update edge-router "minirouter" \ - --role-attributes "public-routers" >/dev/null -else - ziti edge create edge-router "minirouter" \ - --role-attributes "public-routers" \ - --tunneler-enabled \ - --jwt-output-file /tmp/minirouter.jwt >/dev/null -fi - -if helm list --all --namespace ziti-router | grep -q minirouter; then - helm upgrade "minirouter" openziti/ziti-router \ - --namespace ziti-router \ - --set enrollmentJwt=\ \ - --set edge.advertisedHost=minirouter.ziti \ - --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null -else - helm install "minirouter" openziti/ziti-router \ - --namespace ziti-router --create-namespace \ - --set-file enrollmentJwt=/tmp/minirouter.jwt \ - --set edge.advertisedHost=minirouter.ziti \ - --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null -fi - -echo "INFO: waiting for minirouter to be ready" - -kubectl wait deployments "minirouter" \ - --namespace ziti-router \ - --for condition=Available=True >/dev/null - -if ziti edge list edge-routers 'name="minirouter"' \ - | awk '/minirouter/ {print $6}' \ - | grep -q true; then - echo "INFO: minirouter is online" -else - echo "ERROR: minirouter is offline" >&2 - exit 1 -fi - -if helm --namespace ziti-console list --all | grep -q miniconsole; then - helm upgrade "miniconsole" openziti/ziti-console \ - --namespace ziti-console \ - --set ingress.advertisedHost=miniconsole.ziti \ - --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null -else - helm install "miniconsole" openziti/ziti-console \ - --namespace ziti-console --create-namespace \ - --set ingress.advertisedHost=miniconsole.ziti \ - --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null -fi - -echo "INFO: waiting for miniconsole to be ready" - -kubectl wait deployments "miniconsole" \ - --namespace ziti-console \ - --for condition=Available=True \ - --timeout=240s >/dev/null - -if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then - ziti edge create identity device "edge-client" \ - --jwt-output-file /tmp/edge-client.jwt --role-attributes testapi-clients >/dev/null -fi - -if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then - ziti edge create identity device "testapi-host" \ - --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null -fi - -if ! ziti edge list configs 'name="testapi-intercept-config"' --csv | grep -q "testapi-intercept-config"; then - ziti edge create config "testapi-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null -fi - -if ! ziti edge list configs 'name="testapi-host-config"' --csv | grep -q "testapi-host-config"; then - ziti edge create config "testapi-host-config" host.v1 \ - '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null -fi - -if ! ziti edge list services 'name="testapi-service"' --csv | grep -q "testapi-service"; then - ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null -fi - -if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv | grep -q "testapi-bind-policy"; then - ziti edge create service-policy "testapi-bind-policy" Bind \ - --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null -fi - -if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv | grep -q "testapi-dial-policy"; then - ziti edge create service-policy "testapi-dial-policy" Dial \ - --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null -fi - -if ! ziti edge list edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then - ziti edge create edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null -fi - -if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then - ziti edge create service-edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null -fi - -if [[ -s /tmp/testapi-host.json ]]; then - echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ - "If the file was left over from a prior run"\ - " then delete it and re-run this script." >&2 -else - ziti edge enroll /tmp/testapi-host.jwt >/dev/null -fi - -if helm list --all --namespace default | grep -q testapi-host; then - helm upgrade "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >/dev/null -else - helm install "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >/dev/null -fi - -kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ - --output go-template='{{"\nINFO: Your OpenZiti Console http://miniconsole.ziti password for \"admin\" is: "}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' - -echo "INFO: Success! Remember to add your edge client identity '/tmp/edge-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." +main "$@" From 63bb181ddea3f02ea5e516ca3070b64af7aaa4d8 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 6 Mar 2023 19:52:30 -0500 Subject: [PATCH 08/97] fix optind --- .../learn/quickstarts/network/miniziti.bash | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 6a5c2a5dc..9568ddec7 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -69,21 +69,26 @@ function main(){ while (( $# )); do case "$1" in - --delete) deleteMiniziti 10 - shift + -d|--delete) DELETE_MINIZITI=1 + shift ;; - --quiet) exec > /dev/null - shift + -q|--quiet) exec > /dev/null + shift ;; - --verbose) exec 3>&1 - shift + -v|--verbose|--debug) + exec 3>&1 + shift ;; - --help) _usage - exit + *) _usage + exit ;; esac done + (( ${DELETE_MINIZITI:-0} )) && { + deleteMiniziti 10 + } + banner # start unless running From 2b80bffb2f3cf8afc61ee981759eae5b66714171 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 6 Mar 2023 20:40:32 -0500 Subject: [PATCH 09/97] groom logs --- .../learn/quickstarts/network/miniziti.bash | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 9568ddec7..e2644e6de 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -27,13 +27,13 @@ function checkDns(){ echo "ERROR: need IPv4 of miniziti ingress as only param to checkDns()" >&2 return 1 } - echo "DEBUG: checking DNS to ensure minicontroller.ziti resolves to $1" >&3 + echo "DEBUG: checking dns to ensure minicontroller.ziti resolves to $1" >&3 if grep -qE "^${1//./\\.}.*minicontroller.ziti" /etc/hosts \ || nslookup minicontroller.ziti | grep -q "${1//./\\.}"; then - echo "INFO: host DNS found expected minikube ingress IP '$1'" + echo "DEBUG: host dns found expected minikube ingress IP '$1'" >&3 return 0 else - echo "ERROR: minicontroller.ziti does not resolve. Did you add the record in /etc/hosts?" + echo "ERROR: minicontroller.ziti does not resolve. Did you add the record in /etc/hosts?" return 1 fi } @@ -153,7 +153,7 @@ function main(){ "\n\n\tminikube --profile miniziti tunnel" exit 1 fi - # recommend /etc/hosts change unless DNS is configured to reach the minikube node IP + # recommend /etc/hosts change unless dns is configured to reach the minikube node IP checkDns "127.0.0.1" else if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then @@ -181,13 +181,13 @@ function main(){ fi if helm list --namespace ziti-controller --all | grep -q minicontroller; then - echo "INFO: upgrading OpenZiti Controller, Cert Manager, Trust Manager" + echo "INFO: upgrading openZiti controller" helm upgrade "minicontroller" openziti/ziti-controller \ --namespace ziti-controller \ --set clientApi.advertisedHost="minicontroller.ziti" \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null else - echo "INFO: installing OpenZiti Controller, Cert Manager, Trust Manager" + echo "INFO: installing openZiti controller" helm install "minicontroller" openziti/ziti-controller \ --namespace ziti-controller --create-namespace \ --set clientApi.advertisedHost="minicontroller.ziti" \ @@ -260,16 +260,16 @@ function main(){ | xargs kubectl delete pods \ --namespace kube-system >/dev/null - echo "DEBUG: waiting for cluster DNS to be ready" >&3 + echo "DEBUG: waiting for cluster dns to be ready" >&3 kubectl wait deployments "coredns" \ --namespace kube-system \ --for condition=Available=True >/dev/null if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then - echo "INFO: cluster DNS is working" + echo "INFO: cluster dns is working" else - echo "ERROR: cluster DNS test failed" >&2 + echo "ERROR: cluster dns test failed" >&2 exit 1 fi @@ -294,7 +294,7 @@ function main(){ fi if helm list --all --namespace ziti-router | grep -q minirouter; then - echo "DEBUG: upgrading minirouter release" >&3 + echo "DEBUG: upgrading router chart as 'minirouter'" >&3 helm upgrade "minirouter" openziti/ziti-router \ --namespace ziti-router \ --set enrollmentJwt=\ \ @@ -302,7 +302,7 @@ function main(){ --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null else - echo "DEBUG: installing minirouter release" >&3 + echo "DEBUG: installing router chart as 'minirouter'" >&3 helm install "minirouter" openziti/ziti-router \ --namespace ziti-router --create-namespace \ --set-file enrollmentJwt=/tmp/minirouter.jwt \ @@ -327,14 +327,14 @@ function main(){ fi if helm --namespace ziti-console list --all | grep -q miniconsole; then - echo "DEBUG: upgrading miniconsole release" >&3 + echo "DEBUG: upgrading console chart as 'miniconsole'" >&3 helm upgrade "miniconsole" openziti/ziti-console \ --namespace ziti-console \ --set ingress.advertisedHost=miniconsole.ziti \ --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null else - echo "DEBUG: installing miniconsole release" >&3 + echo "DEBUG: installing console chart as 'miniconsole'" >&3 helm install "miniconsole" openziti/ziti-console \ --namespace ziti-console --create-namespace \ --set ingress.advertisedHost=miniconsole.ziti \ @@ -429,12 +429,12 @@ function main(){ fi if helm list --all --namespace default | grep -q testapi-host; then - echo "DEBUG: upgrading testapi-host release" >&3 + echo "DEBUG: upgrading httpbin chart as 'testapi-host'" >&3 helm upgrade "testapi-host" openziti/httpbin \ --set-file zitiIdentity=/tmp/testapi-host.json \ --set zitiServiceName=testapi-service >/dev/null else - echo "DEBUG: installing testapi-host release" >&3 + echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 helm install "testapi-host" openziti/httpbin \ --set-file zitiIdentity=/tmp/testapi-host.json \ --set zitiServiceName=testapi-service >/dev/null From 96e2cb8c75540bf1947481a1972667d11db7aa51 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 6 Mar 2023 21:44:10 -0500 Subject: [PATCH 10/97] consistent caps --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index e2644e6de..0735262cd 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -181,13 +181,13 @@ function main(){ fi if helm list --namespace ziti-controller --all | grep -q minicontroller; then - echo "INFO: upgrading openZiti controller" + echo "INFO: upgrading openziti controller" helm upgrade "minicontroller" openziti/ziti-controller \ --namespace ziti-controller \ --set clientApi.advertisedHost="minicontroller.ziti" \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null else - echo "INFO: installing openZiti controller" + echo "INFO: installing openziti controller" helm install "minicontroller" openziti/ziti-controller \ --namespace ziti-controller --create-namespace \ --set clientApi.advertisedHost="minicontroller.ziti" \ From c76dafd1adc8b74137f45656ed1d247aee528b41 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 6 Mar 2023 23:47:35 -0500 Subject: [PATCH 11/97] add --profile option --- .../learn/quickstarts/network/miniziti.bash | 60 ++++++++++++------- 1 file changed, 40 insertions(+), 20 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 0735262cd..2676a14e5 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -11,6 +11,10 @@ function banner(){ | | | | \| | /_ | | | BANNER + + if (( $# )); then + echo -e " .: $* edition :.\n" + fi } function _usage(){ @@ -18,7 +22,8 @@ function _usage(){ echo -e "\n"\ "\t --quiet\tsuppress INFO messages\n"\ "\t --verbose\tshow DEBUG messages\n"\ - "\t --delete\tre-create miniziti" + "\t --delete\tdelete miniziti\n"\ + "\t --profile\tMINIKUBE_PROFILE" } function checkDns(){ @@ -48,10 +53,10 @@ function deleteMiniziti(){ (( $# )) && { echo "WARN: ignorring extra params '$*'" >&2 } - echo "WARN: deleting miniziti in ${WAIT}s" >&2 + echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 sleep "$WAIT" - echo "INFO: waiting for miniziti to be deleted" - minikube --profile miniziti delete >/dev/null + echo "INFO: waiting for ${MINIKUBE_PROFILE} to be deleted" + minikube --profile "${MINIKUBE_PROFILE}" delete >/dev/null } function main(){ @@ -69,6 +74,9 @@ function main(){ while (( $# )); do case "$1" in + -p|--profile) MINIKUBE_PROFILE="$2" + shift 2 + ;; -d|--delete) DELETE_MINIZITI=1 shift ;; @@ -85,19 +93,31 @@ function main(){ esac done - (( ${DELETE_MINIZITI:-0} )) && { - deleteMiniziti 10 - } - - banner - - # start unless running - echo "INFO: waiting for miniziti to be ready" - if ! minikube --profile miniziti status 2>/dev/null | grep -q "apiserver: Running"; then - minikube --profile miniziti start >/dev/null + if [[ ${MINIKUBE_PROFILE:="miniziti"} == "miniziti" ]]; then + banner + else + # sanity check the profile name input + if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then + # in case the arg value is another option instead of the profile name + echo "ERROR: --profile needs a profile name not starting with a hyphen" >&2 + _usage; exit 1 + fi + # print the alternative profile name if not default "miniziti" + banner "$MINIKUBE_PROFILE" fi - MINIKUBE_NODE_EXTERNAL=$(minikube --profile miniziti ip) + (( ${DELETE_MINIZITI:-0} )) && { + deleteMiniziti 10 + exit 0 + } + + # start unless running + echo "INFO: waiting for minikube to be ready" + if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null | grep -q "apiserver: Running"; then + minikube --profile "${MINIKUBE_PROFILE}" start >/dev/null + fi + + MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then echo "DEBUG: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" >&3 @@ -119,8 +139,8 @@ function main(){ else echo "DEBUG: installing ingress-nginx" >&3 # enable minikube addons for ingress-nginx - minikube --profile miniziti addons enable ingress >/dev/null - minikube --profile miniziti addons enable ingress-dns >/dev/null + minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress >/dev/null + minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress-dns >/dev/null echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 kubectl patch deployment "ingress-nginx-controller" \ @@ -147,10 +167,10 @@ function main(){ if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then echo "DEBUG: detected WSL, probing for running minikube tunnel" >&3 - if ! pgrep -f 'minikube --profile miniziti tunnel' >/dev/null; then + if ! pgrep -f 'minikube --profile "${MINIKUBE_PROFILE}" tunnel' >/dev/null; then echo -e "INFO: detected WSL. minikube tunnel required."\ " In another terminal, run the following command. Then re-run this script."\ - "\n\n\tminikube --profile miniziti tunnel" + "\n\n\tminikube --profile "${MINIKUBE_PROFILE}" tunnel" exit 1 fi # recommend /etc/hosts change unless dns is configured to reach the minikube node IP @@ -204,7 +224,7 @@ function main(){ # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output echo "DEBUG: probing minikube node for internal host record" >&3 - MINIKUBE_NODE_INTERNAL=$(minikube --profile miniziti ssh 'grep host.minikube.internal /etc/hosts') + MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then # strip surrounding whitespace From 7efa74c8b7a63a7295e21d8ea2c00f4971d233b9 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 7 Mar 2023 08:27:07 -0500 Subject: [PATCH 12/97] say the correct IP if DNS fails --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 2676a14e5..1b14ed4c8 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -38,7 +38,7 @@ function checkDns(){ echo "DEBUG: host dns found expected minikube ingress IP '$1'" >&3 return 0 else - echo "ERROR: minicontroller.ziti does not resolve. Did you add the record in /etc/hosts?" + echo "ERROR: minicontroller.ziti does not resolve to '$1'. Did you add the record in /etc/hosts?" return 1 fi } From f71b04f32b9f9f08a0bb14f533f249318feb7924 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 7 Mar 2023 12:37:04 -0500 Subject: [PATCH 13/97] fix pgrep tunnel profile quotes; call the client identity "miniziti-client" --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 1b14ed4c8..77f2bfc7f 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -167,10 +167,10 @@ function main(){ if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then echo "DEBUG: detected WSL, probing for running minikube tunnel" >&3 - if ! pgrep -f 'minikube --profile "${MINIKUBE_PROFILE}" tunnel' >/dev/null; then + if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then echo -e "INFO: detected WSL. minikube tunnel required."\ " In another terminal, run the following command. Then re-run this script."\ - "\n\n\tminikube --profile "${MINIKUBE_PROFILE}" tunnel" + "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel" exit 1 fi # recommend /etc/hosts change unless dns is configured to reach the minikube node IP @@ -371,7 +371,7 @@ function main(){ if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then echo "DEBUG: creating identity edge-client" >&3 ziti edge create identity device "edge-client" \ - --jwt-output-file /tmp/edge-client.jwt --role-attributes testapi-clients >/dev/null + --jwt-output-file /tmp/miniziti-client.jwt --role-attributes testapi-clients >/dev/null else echo "DEBUG: ignoring identity edge-client" >&3 fi @@ -464,7 +464,7 @@ function main(){ --namespace ziti-controller \ --output go-template='{{"\nINFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\nINFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' - echo "INFO: Success! Remember to add your edge client identity '/tmp/edge-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." + echo "INFO: Success! Remember to add your edge client identity '/tmp/miniziti-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." } main "$@" From 86f0881c01179533d7155885e8afbfefddea373e Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 7 Mar 2023 12:38:36 -0500 Subject: [PATCH 14/97] move miniziti.bash to static assets --- .../learn/quickstarts/network/miniziti.bash | 470 ------------------ 1 file changed, 470 deletions(-) delete mode 100644 docusaurus/docs/learn/quickstarts/network/miniziti.bash diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash deleted file mode 100644 index 77f2bfc7f..000000000 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ /dev/null @@ -1,470 +0,0 @@ -#!/usr/bin/env bash - -set -o errexit -set -o nounset -set -o pipefail - -function banner(){ - cat <&2 - return 1 - } - echo "DEBUG: checking dns to ensure minicontroller.ziti resolves to $1" >&3 - if grep -qE "^${1//./\\.}.*minicontroller.ziti" /etc/hosts \ - || nslookup minicontroller.ziti | grep -q "${1//./\\.}"; then - echo "DEBUG: host dns found expected minikube ingress IP '$1'" >&3 - return 0 - else - echo "ERROR: minicontroller.ziti does not resolve to '$1'. Did you add the record in /etc/hosts?" - return 1 - fi -} - -function deleteMiniziti(){ - if (( $# )) && [[ $1 =~ ^[0-9]+$ ]]; then - WAIT="$1" - shift - else - WAIT=10 - fi - (( $# )) && { - echo "WARN: ignorring extra params '$*'" >&2 - } - echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 - sleep "$WAIT" - echo "INFO: waiting for ${MINIKUBE_PROFILE} to be deleted" - minikube --profile "${MINIKUBE_PROFILE}" delete >/dev/null -} - -function main(){ - # require commands - declare -a BINS=(jq ziti minikube kubectl helm) - for BIN in "${BINS[@]}"; do - if ! command -v "$BIN" &>/dev/null; then - echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 - $BIN || exit 1 - fi - done - - # open a descriptor for debug messages - exec 3>/dev/null - - while (( $# )); do - case "$1" in - -p|--profile) MINIKUBE_PROFILE="$2" - shift 2 - ;; - -d|--delete) DELETE_MINIZITI=1 - shift - ;; - -q|--quiet) exec > /dev/null - shift - ;; - -v|--verbose|--debug) - exec 3>&1 - shift - ;; - *) _usage - exit - ;; - esac - done - - if [[ ${MINIKUBE_PROFILE:="miniziti"} == "miniziti" ]]; then - banner - else - # sanity check the profile name input - if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then - # in case the arg value is another option instead of the profile name - echo "ERROR: --profile needs a profile name not starting with a hyphen" >&2 - _usage; exit 1 - fi - # print the alternative profile name if not default "miniziti" - banner "$MINIKUBE_PROFILE" - fi - - (( ${DELETE_MINIZITI:-0} )) && { - deleteMiniziti 10 - exit 0 - } - - # start unless running - echo "INFO: waiting for minikube to be ready" - if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null | grep -q "apiserver: Running"; then - minikube --profile "${MINIKUBE_PROFILE}" start >/dev/null - fi - - MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) - - if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then - echo "DEBUG: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" >&3 - else - echo "ERROR: failed to find minikube external IP" >&2 - exit 1 - fi - - # verify current context can connect to apiserver - kubectl cluster-info >/dev/null - echo "DEBUG: kubectl successfully obtained cluster-info from apiserver" >&3 - - # enable ssl-passthrough for OpenZiti ingresses - if kubectl get deployment "ingress-nginx-controller" \ - --namespace ingress-nginx \ - --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ - | grep -q enable-ssl-passthrough; then - echo "DEBUG: ingress-nginx has ssl-passthrough enabled" >&3 - else - echo "DEBUG: installing ingress-nginx" >&3 - # enable minikube addons for ingress-nginx - minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress >/dev/null - minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress-dns >/dev/null - - echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 - kubectl patch deployment "ingress-nginx-controller" \ - --namespace ingress-nginx \ - --type='json' \ - --patch='[{"op": "add", - "path": "/spec/template/spec/containers/0/args/-", - "value":"--enable-ssl-passthrough" - }]' >/dev/null - fi - - echo "INFO: waiting for ingress-nginx to be ready" - # wait for ingress-nginx - kubectl wait jobs "ingress-nginx-admission-patch" \ - --namespace ingress-nginx \ - --for condition=complete \ - --timeout=120s >/dev/null - - kubectl wait pods \ - --namespace ingress-nginx \ - --for=condition=ready \ - --selector=app.kubernetes.io/component=controller \ - --timeout=120s >/dev/null - - if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then - echo "DEBUG: detected WSL, probing for running minikube tunnel" >&3 - if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then - echo -e "INFO: detected WSL. minikube tunnel required."\ - " In another terminal, run the following command. Then re-run this script."\ - "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel" - exit 1 - fi - # recommend /etc/hosts change unless dns is configured to reach the minikube node IP - checkDns "127.0.0.1" - else - if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then - # Like WSL, macOS uses localhost port forwarding to reach the minikube node IP - checkDns "127.0.0.1" - else - # Exceptions notwithstanding, Linux, etc. presumably have an IP route to - # the minikube node IP - checkDns "$MINIKUBE_NODE_EXTERNAL" - fi - fi - - echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 - kubectl apply \ - --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null - kubectl apply \ - --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null - - if helm repo list | grep -q openziti; then - echo "DEBUG: refreshing OpenZiti Helm Charts" >&3 - helm repo update openziti >/dev/null - else - echo "INFO: subscribing to OpenZiti Helm Charts" - helm repo add openziti https://docs.openziti.io/helm-charts/ >/dev/null - fi - - if helm list --namespace ziti-controller --all | grep -q minicontroller; then - echo "INFO: upgrading openziti controller" - helm upgrade "minicontroller" openziti/ziti-controller \ - --namespace ziti-controller \ - --set clientApi.advertisedHost="minicontroller.ziti" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null - else - echo "INFO: installing openziti controller" - helm install "minicontroller" openziti/ziti-controller \ - --namespace ziti-controller --create-namespace \ - --set clientApi.advertisedHost="minicontroller.ziti" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null - fi - - for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do - echo "INFO: waiting for $DEPLOYMENT to be ready" - kubectl wait deployments "$DEPLOYMENT" \ - --namespace ziti-controller \ - --for condition=Available=True \ - --timeout=240s >/dev/null - done - - # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output - echo "DEBUG: probing minikube node for internal host record" >&3 - MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') - - if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then - # strip surrounding whitespace - MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") - echo "DEBUG: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" >&3 - else - echo "ERROR: failed to find minikube internal IP" >&2 - exit 1 - fi - - echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 - kubectl patch configmap "coredns" \ - --namespace kube-system \ - --patch=" - data: - Corefile: | - .:53 { - log - errors - health { - lameduck 5s - } - ready - kubernetes cluster.local in-addr.arpa ip6.arpa { - pods insecure - fallthrough in-addr.arpa ip6.arpa - ttl 30 - } - prometheus :9153 - hosts { - ${MINIKUBE_NODE_INTERNAL} - fallthrough - } - forward . /etc/resolv.conf { - max_concurrent 1000 - } - cache 30 - loop - reload - loadbalance - } - ziti:53 { - errors - cache 30 - forward . ${MINIKUBE_NODE_EXTERNAL} - } - " >/dev/null - - echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 - kubectl get pods \ - --namespace kube-system \ - | awk '/^coredns-/ {print $1}' \ - | xargs kubectl delete pods \ - --namespace kube-system >/dev/null - - echo "DEBUG: waiting for cluster dns to be ready" >&3 - kubectl wait deployments "coredns" \ - --namespace kube-system \ - --for condition=Available=True >/dev/null - - if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ - nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then - echo "INFO: cluster dns is working" - else - echo "ERROR: cluster dns test failed" >&2 - exit 1 - fi - - echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 - kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ - --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs ziti edge login minicontroller.ziti:443 \ - --yes --username "admin" \ - --password >/dev/null - - if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then - echo "DEBUG: updating minirouter" >&3 - ziti edge update edge-router "minirouter" \ - --role-attributes "public-routers" >/dev/null - else - echo "DEBUG: creating minirouter" >&3 - ziti edge create edge-router "minirouter" \ - --role-attributes "public-routers" \ - --tunneler-enabled \ - --jwt-output-file /tmp/minirouter.jwt >/dev/null - fi - - if helm list --all --namespace ziti-router | grep -q minirouter; then - echo "DEBUG: upgrading router chart as 'minirouter'" >&3 - helm upgrade "minirouter" openziti/ziti-router \ - --namespace ziti-router \ - --set enrollmentJwt=\ \ - --set edge.advertisedHost=minirouter.ziti \ - --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null - else - echo "DEBUG: installing router chart as 'minirouter'" >&3 - helm install "minirouter" openziti/ziti-router \ - --namespace ziti-router --create-namespace \ - --set-file enrollmentJwt=/tmp/minirouter.jwt \ - --set edge.advertisedHost=minirouter.ziti \ - --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null - fi - - echo "INFO: waiting for minirouter to be ready" - kubectl wait deployments "minirouter" \ - --namespace ziti-router \ - --for condition=Available=True >/dev/null - - echo "DEBUG: probing minirouter for online status" >&3 - if ziti edge list edge-routers 'name="minirouter"' \ - | awk '/minirouter/ {print $6}' \ - | grep -q true; then - echo "INFO: minirouter is online" - else - echo "ERROR: minirouter is offline" >&2 - exit 1 - fi - - if helm --namespace ziti-console list --all | grep -q miniconsole; then - echo "DEBUG: upgrading console chart as 'miniconsole'" >&3 - helm upgrade "miniconsole" openziti/ziti-console \ - --namespace ziti-console \ - --set ingress.advertisedHost=miniconsole.ziti \ - --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null - else - echo "DEBUG: installing console chart as 'miniconsole'" >&3 - helm install "miniconsole" openziti/ziti-console \ - --namespace ziti-console --create-namespace \ - --set ingress.advertisedHost=miniconsole.ziti \ - --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null - fi - - echo "INFO: waiting for miniconsole to be ready" - kubectl wait deployments "miniconsole" \ - --namespace ziti-console \ - --for condition=Available=True \ - --timeout=240s >/dev/null - - if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then - echo "DEBUG: creating identity edge-client" >&3 - ziti edge create identity device "edge-client" \ - --jwt-output-file /tmp/miniziti-client.jwt --role-attributes testapi-clients >/dev/null - else - echo "DEBUG: ignoring identity edge-client" >&3 - fi - - if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then - echo "DEBUG: creating identity testapi-host" >&3 - ziti edge create identity device "testapi-host" \ - --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null - else - echo "DEBUG: ignoring identity testapi-host" >&3 - fi - - if ! ziti edge list configs 'name="testapi-intercept-config"' --csv | grep -q "testapi-intercept-config"; then - echo "DEBUG: creating config testapi-intercept-config" >&3 - ziti edge create config "testapi-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null - else - echo "DEBUG: ignoring config testapi-intercept-config" >&3 - fi - - if ! ziti edge list configs 'name="testapi-host-config"' --csv | grep -q "testapi-host-config"; then - echo "DEBUG: creating config testapi-host-config" >&3 - ziti edge create config "testapi-host-config" host.v1 \ - '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null - else - echo "DEBUG: ignoring config testapi-host-config" >&3 - fi - - if ! ziti edge list services 'name="testapi-service"' --csv | grep -q "testapi-service"; then - echo "DEBUG: creating service testapi-service" >&3 - ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null - else - echo "DEBUG: ignoring service testapi-service" >&3 - fi - - if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv | grep -q "testapi-bind-policy"; then - echo "DEBUG: creating service-policy testapi-bind-policy" >&3 - ziti edge create service-policy "testapi-bind-policy" Bind \ - --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null - else - echo "DEBUG: ignoring service-policy testapi-bind-policy" >&3 - fi - - if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv | grep -q "testapi-dial-policy"; then - echo "DEBUG: creating service-policy testapi-dial-policy" >&3 - ziti edge create service-policy "testapi-dial-policy" Dial \ - --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null - else - echo "DEBUG: ignoring service-policy testapi-dial-policy" >&3 - fi - - if ! ziti edge list edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then - echo "DEBUG: creating edge-router-policy public-routers" >&3 - ziti edge create edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null - else - echo "DEBUG: ignoring edge-router-policy public-routers" >&3 - fi - - if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then - echo "DEBUG: creating service-edge-router-policy public-routers" >&3 - ziti edge create service-edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null - else - echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 - fi - - if [[ -s /tmp/testapi-host.json ]]; then - echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ - "If the file was left over from a prior run"\ - " then delete it and re-run this script." >&2 - else - echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 - ziti edge enroll /tmp/testapi-host.jwt >/dev/null - fi - - if helm list --all --namespace default | grep -q testapi-host; then - echo "DEBUG: upgrading httpbin chart as 'testapi-host'" >&3 - helm upgrade "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >/dev/null - else - echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 - helm install "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >/dev/null - fi - - kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ - --output go-template='{{"\nINFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\nINFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' - - echo "INFO: Success! Remember to add your edge client identity '/tmp/miniziti-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." -} - -main "$@" From d0f726690d88eef4bee773b99a01e866a8f5607e Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 7 Mar 2023 12:55:58 -0500 Subject: [PATCH 15/97] Revert "move miniziti.bash to static assets" This reverts commit a4edd34f7f6efd2c2fa5a703d6f08546a48bf61c. --- .../learn/quickstarts/network/miniziti.bash | 470 ++++++++++++++++++ 1 file changed, 470 insertions(+) create mode 100644 docusaurus/docs/learn/quickstarts/network/miniziti.bash diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash new file mode 100644 index 000000000..77f2bfc7f --- /dev/null +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -0,0 +1,470 @@ +#!/usr/bin/env bash + +set -o errexit +set -o nounset +set -o pipefail + +function banner(){ + cat <&2 + return 1 + } + echo "DEBUG: checking dns to ensure minicontroller.ziti resolves to $1" >&3 + if grep -qE "^${1//./\\.}.*minicontroller.ziti" /etc/hosts \ + || nslookup minicontroller.ziti | grep -q "${1//./\\.}"; then + echo "DEBUG: host dns found expected minikube ingress IP '$1'" >&3 + return 0 + else + echo "ERROR: minicontroller.ziti does not resolve to '$1'. Did you add the record in /etc/hosts?" + return 1 + fi +} + +function deleteMiniziti(){ + if (( $# )) && [[ $1 =~ ^[0-9]+$ ]]; then + WAIT="$1" + shift + else + WAIT=10 + fi + (( $# )) && { + echo "WARN: ignorring extra params '$*'" >&2 + } + echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 + sleep "$WAIT" + echo "INFO: waiting for ${MINIKUBE_PROFILE} to be deleted" + minikube --profile "${MINIKUBE_PROFILE}" delete >/dev/null +} + +function main(){ + # require commands + declare -a BINS=(jq ziti minikube kubectl helm) + for BIN in "${BINS[@]}"; do + if ! command -v "$BIN" &>/dev/null; then + echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 + $BIN || exit 1 + fi + done + + # open a descriptor for debug messages + exec 3>/dev/null + + while (( $# )); do + case "$1" in + -p|--profile) MINIKUBE_PROFILE="$2" + shift 2 + ;; + -d|--delete) DELETE_MINIZITI=1 + shift + ;; + -q|--quiet) exec > /dev/null + shift + ;; + -v|--verbose|--debug) + exec 3>&1 + shift + ;; + *) _usage + exit + ;; + esac + done + + if [[ ${MINIKUBE_PROFILE:="miniziti"} == "miniziti" ]]; then + banner + else + # sanity check the profile name input + if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then + # in case the arg value is another option instead of the profile name + echo "ERROR: --profile needs a profile name not starting with a hyphen" >&2 + _usage; exit 1 + fi + # print the alternative profile name if not default "miniziti" + banner "$MINIKUBE_PROFILE" + fi + + (( ${DELETE_MINIZITI:-0} )) && { + deleteMiniziti 10 + exit 0 + } + + # start unless running + echo "INFO: waiting for minikube to be ready" + if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null | grep -q "apiserver: Running"; then + minikube --profile "${MINIKUBE_PROFILE}" start >/dev/null + fi + + MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) + + if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then + echo "DEBUG: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" >&3 + else + echo "ERROR: failed to find minikube external IP" >&2 + exit 1 + fi + + # verify current context can connect to apiserver + kubectl cluster-info >/dev/null + echo "DEBUG: kubectl successfully obtained cluster-info from apiserver" >&3 + + # enable ssl-passthrough for OpenZiti ingresses + if kubectl get deployment "ingress-nginx-controller" \ + --namespace ingress-nginx \ + --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ + | grep -q enable-ssl-passthrough; then + echo "DEBUG: ingress-nginx has ssl-passthrough enabled" >&3 + else + echo "DEBUG: installing ingress-nginx" >&3 + # enable minikube addons for ingress-nginx + minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress >/dev/null + minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress-dns >/dev/null + + echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 + kubectl patch deployment "ingress-nginx-controller" \ + --namespace ingress-nginx \ + --type='json' \ + --patch='[{"op": "add", + "path": "/spec/template/spec/containers/0/args/-", + "value":"--enable-ssl-passthrough" + }]' >/dev/null + fi + + echo "INFO: waiting for ingress-nginx to be ready" + # wait for ingress-nginx + kubectl wait jobs "ingress-nginx-admission-patch" \ + --namespace ingress-nginx \ + --for condition=complete \ + --timeout=120s >/dev/null + + kubectl wait pods \ + --namespace ingress-nginx \ + --for=condition=ready \ + --selector=app.kubernetes.io/component=controller \ + --timeout=120s >/dev/null + + if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then + echo "DEBUG: detected WSL, probing for running minikube tunnel" >&3 + if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then + echo -e "INFO: detected WSL. minikube tunnel required."\ + " In another terminal, run the following command. Then re-run this script."\ + "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel" + exit 1 + fi + # recommend /etc/hosts change unless dns is configured to reach the minikube node IP + checkDns "127.0.0.1" + else + if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then + # Like WSL, macOS uses localhost port forwarding to reach the minikube node IP + checkDns "127.0.0.1" + else + # Exceptions notwithstanding, Linux, etc. presumably have an IP route to + # the minikube node IP + checkDns "$MINIKUBE_NODE_EXTERNAL" + fi + fi + + echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 + kubectl apply \ + --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null + kubectl apply \ + --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null + + if helm repo list | grep -q openziti; then + echo "DEBUG: refreshing OpenZiti Helm Charts" >&3 + helm repo update openziti >/dev/null + else + echo "INFO: subscribing to OpenZiti Helm Charts" + helm repo add openziti https://docs.openziti.io/helm-charts/ >/dev/null + fi + + if helm list --namespace ziti-controller --all | grep -q minicontroller; then + echo "INFO: upgrading openziti controller" + helm upgrade "minicontroller" openziti/ziti-controller \ + --namespace ziti-controller \ + --set clientApi.advertisedHost="minicontroller.ziti" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null + else + echo "INFO: installing openziti controller" + helm install "minicontroller" openziti/ziti-controller \ + --namespace ziti-controller --create-namespace \ + --set clientApi.advertisedHost="minicontroller.ziti" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null + fi + + for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do + echo "INFO: waiting for $DEPLOYMENT to be ready" + kubectl wait deployments "$DEPLOYMENT" \ + --namespace ziti-controller \ + --for condition=Available=True \ + --timeout=240s >/dev/null + done + + # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output + echo "DEBUG: probing minikube node for internal host record" >&3 + MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') + + if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then + # strip surrounding whitespace + MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") + echo "DEBUG: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" >&3 + else + echo "ERROR: failed to find minikube internal IP" >&2 + exit 1 + fi + + echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 + kubectl patch configmap "coredns" \ + --namespace kube-system \ + --patch=" + data: + Corefile: | + .:53 { + log + errors + health { + lameduck 5s + } + ready + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + ttl 30 + } + prometheus :9153 + hosts { + ${MINIKUBE_NODE_INTERNAL} + fallthrough + } + forward . /etc/resolv.conf { + max_concurrent 1000 + } + cache 30 + loop + reload + loadbalance + } + ziti:53 { + errors + cache 30 + forward . ${MINIKUBE_NODE_EXTERNAL} + } + " >/dev/null + + echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 + kubectl get pods \ + --namespace kube-system \ + | awk '/^coredns-/ {print $1}' \ + | xargs kubectl delete pods \ + --namespace kube-system >/dev/null + + echo "DEBUG: waiting for cluster dns to be ready" >&3 + kubectl wait deployments "coredns" \ + --namespace kube-system \ + --for condition=Available=True >/dev/null + + if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ + nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then + echo "INFO: cluster dns is working" + else + echo "ERROR: cluster dns test failed" >&2 + exit 1 + fi + + echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 + kubectl get secrets "minicontroller-admin-secret" \ + --namespace ziti-controller \ + --output go-template='{{index .data "admin-password" | base64decode }}' \ + | xargs ziti edge login minicontroller.ziti:443 \ + --yes --username "admin" \ + --password >/dev/null + + if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then + echo "DEBUG: updating minirouter" >&3 + ziti edge update edge-router "minirouter" \ + --role-attributes "public-routers" >/dev/null + else + echo "DEBUG: creating minirouter" >&3 + ziti edge create edge-router "minirouter" \ + --role-attributes "public-routers" \ + --tunneler-enabled \ + --jwt-output-file /tmp/minirouter.jwt >/dev/null + fi + + if helm list --all --namespace ziti-router | grep -q minirouter; then + echo "DEBUG: upgrading router chart as 'minirouter'" >&3 + helm upgrade "minirouter" openziti/ziti-router \ + --namespace ziti-router \ + --set enrollmentJwt=\ \ + --set edge.advertisedHost=minirouter.ziti \ + --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null + else + echo "DEBUG: installing router chart as 'minirouter'" >&3 + helm install "minirouter" openziti/ziti-router \ + --namespace ziti-router --create-namespace \ + --set-file enrollmentJwt=/tmp/minirouter.jwt \ + --set edge.advertisedHost=minirouter.ziti \ + --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null + fi + + echo "INFO: waiting for minirouter to be ready" + kubectl wait deployments "minirouter" \ + --namespace ziti-router \ + --for condition=Available=True >/dev/null + + echo "DEBUG: probing minirouter for online status" >&3 + if ziti edge list edge-routers 'name="minirouter"' \ + | awk '/minirouter/ {print $6}' \ + | grep -q true; then + echo "INFO: minirouter is online" + else + echo "ERROR: minirouter is offline" >&2 + exit 1 + fi + + if helm --namespace ziti-console list --all | grep -q miniconsole; then + echo "DEBUG: upgrading console chart as 'miniconsole'" >&3 + helm upgrade "miniconsole" openziti/ziti-console \ + --namespace ziti-console \ + --set ingress.advertisedHost=miniconsole.ziti \ + --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null + else + echo "DEBUG: installing console chart as 'miniconsole'" >&3 + helm install "miniconsole" openziti/ziti-console \ + --namespace ziti-console --create-namespace \ + --set ingress.advertisedHost=miniconsole.ziti \ + --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null + fi + + echo "INFO: waiting for miniconsole to be ready" + kubectl wait deployments "miniconsole" \ + --namespace ziti-console \ + --for condition=Available=True \ + --timeout=240s >/dev/null + + if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then + echo "DEBUG: creating identity edge-client" >&3 + ziti edge create identity device "edge-client" \ + --jwt-output-file /tmp/miniziti-client.jwt --role-attributes testapi-clients >/dev/null + else + echo "DEBUG: ignoring identity edge-client" >&3 + fi + + if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then + echo "DEBUG: creating identity testapi-host" >&3 + ziti edge create identity device "testapi-host" \ + --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null + else + echo "DEBUG: ignoring identity testapi-host" >&3 + fi + + if ! ziti edge list configs 'name="testapi-intercept-config"' --csv | grep -q "testapi-intercept-config"; then + echo "DEBUG: creating config testapi-intercept-config" >&3 + ziti edge create config "testapi-intercept-config" intercept.v1 \ + '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null + else + echo "DEBUG: ignoring config testapi-intercept-config" >&3 + fi + + if ! ziti edge list configs 'name="testapi-host-config"' --csv | grep -q "testapi-host-config"; then + echo "DEBUG: creating config testapi-host-config" >&3 + ziti edge create config "testapi-host-config" host.v1 \ + '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null + else + echo "DEBUG: ignoring config testapi-host-config" >&3 + fi + + if ! ziti edge list services 'name="testapi-service"' --csv | grep -q "testapi-service"; then + echo "DEBUG: creating service testapi-service" >&3 + ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null + else + echo "DEBUG: ignoring service testapi-service" >&3 + fi + + if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv | grep -q "testapi-bind-policy"; then + echo "DEBUG: creating service-policy testapi-bind-policy" >&3 + ziti edge create service-policy "testapi-bind-policy" Bind \ + --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null + else + echo "DEBUG: ignoring service-policy testapi-bind-policy" >&3 + fi + + if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv | grep -q "testapi-dial-policy"; then + echo "DEBUG: creating service-policy testapi-dial-policy" >&3 + ziti edge create service-policy "testapi-dial-policy" Dial \ + --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null + else + echo "DEBUG: ignoring service-policy testapi-dial-policy" >&3 + fi + + if ! ziti edge list edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then + echo "DEBUG: creating edge-router-policy public-routers" >&3 + ziti edge create edge-router-policy "public-routers" \ + --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null + else + echo "DEBUG: ignoring edge-router-policy public-routers" >&3 + fi + + if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then + echo "DEBUG: creating service-edge-router-policy public-routers" >&3 + ziti edge create service-edge-router-policy "public-routers" \ + --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null + else + echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 + fi + + if [[ -s /tmp/testapi-host.json ]]; then + echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ + "If the file was left over from a prior run"\ + " then delete it and re-run this script." >&2 + else + echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 + ziti edge enroll /tmp/testapi-host.jwt >/dev/null + fi + + if helm list --all --namespace default | grep -q testapi-host; then + echo "DEBUG: upgrading httpbin chart as 'testapi-host'" >&3 + helm upgrade "testapi-host" openziti/httpbin \ + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service >/dev/null + else + echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 + helm install "testapi-host" openziti/httpbin \ + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service >/dev/null + fi + + kubectl get secrets "minicontroller-admin-secret" \ + --namespace ziti-controller \ + --output go-template='{{"\nINFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\nINFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' + + echo "INFO: Success! Remember to add your edge client identity '/tmp/miniziti-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." +} + +main "$@" From 98610525729f8ba745ddf9d113ae633a1a74d6f9 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 7 Mar 2023 14:48:45 -0500 Subject: [PATCH 16/97] call it miniziti-client --- .../learn/quickstarts/network/miniziti.bash | 470 ------------------ 1 file changed, 470 deletions(-) delete mode 100644 docusaurus/docs/learn/quickstarts/network/miniziti.bash diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash deleted file mode 100644 index 77f2bfc7f..000000000 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ /dev/null @@ -1,470 +0,0 @@ -#!/usr/bin/env bash - -set -o errexit -set -o nounset -set -o pipefail - -function banner(){ - cat <&2 - return 1 - } - echo "DEBUG: checking dns to ensure minicontroller.ziti resolves to $1" >&3 - if grep -qE "^${1//./\\.}.*minicontroller.ziti" /etc/hosts \ - || nslookup minicontroller.ziti | grep -q "${1//./\\.}"; then - echo "DEBUG: host dns found expected minikube ingress IP '$1'" >&3 - return 0 - else - echo "ERROR: minicontroller.ziti does not resolve to '$1'. Did you add the record in /etc/hosts?" - return 1 - fi -} - -function deleteMiniziti(){ - if (( $# )) && [[ $1 =~ ^[0-9]+$ ]]; then - WAIT="$1" - shift - else - WAIT=10 - fi - (( $# )) && { - echo "WARN: ignorring extra params '$*'" >&2 - } - echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 - sleep "$WAIT" - echo "INFO: waiting for ${MINIKUBE_PROFILE} to be deleted" - minikube --profile "${MINIKUBE_PROFILE}" delete >/dev/null -} - -function main(){ - # require commands - declare -a BINS=(jq ziti minikube kubectl helm) - for BIN in "${BINS[@]}"; do - if ! command -v "$BIN" &>/dev/null; then - echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 - $BIN || exit 1 - fi - done - - # open a descriptor for debug messages - exec 3>/dev/null - - while (( $# )); do - case "$1" in - -p|--profile) MINIKUBE_PROFILE="$2" - shift 2 - ;; - -d|--delete) DELETE_MINIZITI=1 - shift - ;; - -q|--quiet) exec > /dev/null - shift - ;; - -v|--verbose|--debug) - exec 3>&1 - shift - ;; - *) _usage - exit - ;; - esac - done - - if [[ ${MINIKUBE_PROFILE:="miniziti"} == "miniziti" ]]; then - banner - else - # sanity check the profile name input - if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then - # in case the arg value is another option instead of the profile name - echo "ERROR: --profile needs a profile name not starting with a hyphen" >&2 - _usage; exit 1 - fi - # print the alternative profile name if not default "miniziti" - banner "$MINIKUBE_PROFILE" - fi - - (( ${DELETE_MINIZITI:-0} )) && { - deleteMiniziti 10 - exit 0 - } - - # start unless running - echo "INFO: waiting for minikube to be ready" - if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null | grep -q "apiserver: Running"; then - minikube --profile "${MINIKUBE_PROFILE}" start >/dev/null - fi - - MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) - - if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then - echo "DEBUG: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" >&3 - else - echo "ERROR: failed to find minikube external IP" >&2 - exit 1 - fi - - # verify current context can connect to apiserver - kubectl cluster-info >/dev/null - echo "DEBUG: kubectl successfully obtained cluster-info from apiserver" >&3 - - # enable ssl-passthrough for OpenZiti ingresses - if kubectl get deployment "ingress-nginx-controller" \ - --namespace ingress-nginx \ - --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ - | grep -q enable-ssl-passthrough; then - echo "DEBUG: ingress-nginx has ssl-passthrough enabled" >&3 - else - echo "DEBUG: installing ingress-nginx" >&3 - # enable minikube addons for ingress-nginx - minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress >/dev/null - minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress-dns >/dev/null - - echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 - kubectl patch deployment "ingress-nginx-controller" \ - --namespace ingress-nginx \ - --type='json' \ - --patch='[{"op": "add", - "path": "/spec/template/spec/containers/0/args/-", - "value":"--enable-ssl-passthrough" - }]' >/dev/null - fi - - echo "INFO: waiting for ingress-nginx to be ready" - # wait for ingress-nginx - kubectl wait jobs "ingress-nginx-admission-patch" \ - --namespace ingress-nginx \ - --for condition=complete \ - --timeout=120s >/dev/null - - kubectl wait pods \ - --namespace ingress-nginx \ - --for=condition=ready \ - --selector=app.kubernetes.io/component=controller \ - --timeout=120s >/dev/null - - if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then - echo "DEBUG: detected WSL, probing for running minikube tunnel" >&3 - if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then - echo -e "INFO: detected WSL. minikube tunnel required."\ - " In another terminal, run the following command. Then re-run this script."\ - "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel" - exit 1 - fi - # recommend /etc/hosts change unless dns is configured to reach the minikube node IP - checkDns "127.0.0.1" - else - if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then - # Like WSL, macOS uses localhost port forwarding to reach the minikube node IP - checkDns "127.0.0.1" - else - # Exceptions notwithstanding, Linux, etc. presumably have an IP route to - # the minikube node IP - checkDns "$MINIKUBE_NODE_EXTERNAL" - fi - fi - - echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 - kubectl apply \ - --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null - kubectl apply \ - --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null - - if helm repo list | grep -q openziti; then - echo "DEBUG: refreshing OpenZiti Helm Charts" >&3 - helm repo update openziti >/dev/null - else - echo "INFO: subscribing to OpenZiti Helm Charts" - helm repo add openziti https://docs.openziti.io/helm-charts/ >/dev/null - fi - - if helm list --namespace ziti-controller --all | grep -q minicontroller; then - echo "INFO: upgrading openziti controller" - helm upgrade "minicontroller" openziti/ziti-controller \ - --namespace ziti-controller \ - --set clientApi.advertisedHost="minicontroller.ziti" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null - else - echo "INFO: installing openziti controller" - helm install "minicontroller" openziti/ziti-controller \ - --namespace ziti-controller --create-namespace \ - --set clientApi.advertisedHost="minicontroller.ziti" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null - fi - - for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do - echo "INFO: waiting for $DEPLOYMENT to be ready" - kubectl wait deployments "$DEPLOYMENT" \ - --namespace ziti-controller \ - --for condition=Available=True \ - --timeout=240s >/dev/null - done - - # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output - echo "DEBUG: probing minikube node for internal host record" >&3 - MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') - - if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then - # strip surrounding whitespace - MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") - echo "DEBUG: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" >&3 - else - echo "ERROR: failed to find minikube internal IP" >&2 - exit 1 - fi - - echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 - kubectl patch configmap "coredns" \ - --namespace kube-system \ - --patch=" - data: - Corefile: | - .:53 { - log - errors - health { - lameduck 5s - } - ready - kubernetes cluster.local in-addr.arpa ip6.arpa { - pods insecure - fallthrough in-addr.arpa ip6.arpa - ttl 30 - } - prometheus :9153 - hosts { - ${MINIKUBE_NODE_INTERNAL} - fallthrough - } - forward . /etc/resolv.conf { - max_concurrent 1000 - } - cache 30 - loop - reload - loadbalance - } - ziti:53 { - errors - cache 30 - forward . ${MINIKUBE_NODE_EXTERNAL} - } - " >/dev/null - - echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 - kubectl get pods \ - --namespace kube-system \ - | awk '/^coredns-/ {print $1}' \ - | xargs kubectl delete pods \ - --namespace kube-system >/dev/null - - echo "DEBUG: waiting for cluster dns to be ready" >&3 - kubectl wait deployments "coredns" \ - --namespace kube-system \ - --for condition=Available=True >/dev/null - - if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ - nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then - echo "INFO: cluster dns is working" - else - echo "ERROR: cluster dns test failed" >&2 - exit 1 - fi - - echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 - kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ - --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs ziti edge login minicontroller.ziti:443 \ - --yes --username "admin" \ - --password >/dev/null - - if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then - echo "DEBUG: updating minirouter" >&3 - ziti edge update edge-router "minirouter" \ - --role-attributes "public-routers" >/dev/null - else - echo "DEBUG: creating minirouter" >&3 - ziti edge create edge-router "minirouter" \ - --role-attributes "public-routers" \ - --tunneler-enabled \ - --jwt-output-file /tmp/minirouter.jwt >/dev/null - fi - - if helm list --all --namespace ziti-router | grep -q minirouter; then - echo "DEBUG: upgrading router chart as 'minirouter'" >&3 - helm upgrade "minirouter" openziti/ziti-router \ - --namespace ziti-router \ - --set enrollmentJwt=\ \ - --set edge.advertisedHost=minirouter.ziti \ - --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null - else - echo "DEBUG: installing router chart as 'minirouter'" >&3 - helm install "minirouter" openziti/ziti-router \ - --namespace ziti-router --create-namespace \ - --set-file enrollmentJwt=/tmp/minirouter.jwt \ - --set edge.advertisedHost=minirouter.ziti \ - --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null - fi - - echo "INFO: waiting for minirouter to be ready" - kubectl wait deployments "minirouter" \ - --namespace ziti-router \ - --for condition=Available=True >/dev/null - - echo "DEBUG: probing minirouter for online status" >&3 - if ziti edge list edge-routers 'name="minirouter"' \ - | awk '/minirouter/ {print $6}' \ - | grep -q true; then - echo "INFO: minirouter is online" - else - echo "ERROR: minirouter is offline" >&2 - exit 1 - fi - - if helm --namespace ziti-console list --all | grep -q miniconsole; then - echo "DEBUG: upgrading console chart as 'miniconsole'" >&3 - helm upgrade "miniconsole" openziti/ziti-console \ - --namespace ziti-console \ - --set ingress.advertisedHost=miniconsole.ziti \ - --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null - else - echo "DEBUG: installing console chart as 'miniconsole'" >&3 - helm install "miniconsole" openziti/ziti-console \ - --namespace ziti-console --create-namespace \ - --set ingress.advertisedHost=miniconsole.ziti \ - --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null - fi - - echo "INFO: waiting for miniconsole to be ready" - kubectl wait deployments "miniconsole" \ - --namespace ziti-console \ - --for condition=Available=True \ - --timeout=240s >/dev/null - - if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then - echo "DEBUG: creating identity edge-client" >&3 - ziti edge create identity device "edge-client" \ - --jwt-output-file /tmp/miniziti-client.jwt --role-attributes testapi-clients >/dev/null - else - echo "DEBUG: ignoring identity edge-client" >&3 - fi - - if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then - echo "DEBUG: creating identity testapi-host" >&3 - ziti edge create identity device "testapi-host" \ - --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null - else - echo "DEBUG: ignoring identity testapi-host" >&3 - fi - - if ! ziti edge list configs 'name="testapi-intercept-config"' --csv | grep -q "testapi-intercept-config"; then - echo "DEBUG: creating config testapi-intercept-config" >&3 - ziti edge create config "testapi-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null - else - echo "DEBUG: ignoring config testapi-intercept-config" >&3 - fi - - if ! ziti edge list configs 'name="testapi-host-config"' --csv | grep -q "testapi-host-config"; then - echo "DEBUG: creating config testapi-host-config" >&3 - ziti edge create config "testapi-host-config" host.v1 \ - '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null - else - echo "DEBUG: ignoring config testapi-host-config" >&3 - fi - - if ! ziti edge list services 'name="testapi-service"' --csv | grep -q "testapi-service"; then - echo "DEBUG: creating service testapi-service" >&3 - ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null - else - echo "DEBUG: ignoring service testapi-service" >&3 - fi - - if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv | grep -q "testapi-bind-policy"; then - echo "DEBUG: creating service-policy testapi-bind-policy" >&3 - ziti edge create service-policy "testapi-bind-policy" Bind \ - --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null - else - echo "DEBUG: ignoring service-policy testapi-bind-policy" >&3 - fi - - if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv | grep -q "testapi-dial-policy"; then - echo "DEBUG: creating service-policy testapi-dial-policy" >&3 - ziti edge create service-policy "testapi-dial-policy" Dial \ - --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null - else - echo "DEBUG: ignoring service-policy testapi-dial-policy" >&3 - fi - - if ! ziti edge list edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then - echo "DEBUG: creating edge-router-policy public-routers" >&3 - ziti edge create edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null - else - echo "DEBUG: ignoring edge-router-policy public-routers" >&3 - fi - - if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then - echo "DEBUG: creating service-edge-router-policy public-routers" >&3 - ziti edge create service-edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null - else - echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 - fi - - if [[ -s /tmp/testapi-host.json ]]; then - echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ - "If the file was left over from a prior run"\ - " then delete it and re-run this script." >&2 - else - echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 - ziti edge enroll /tmp/testapi-host.jwt >/dev/null - fi - - if helm list --all --namespace default | grep -q testapi-host; then - echo "DEBUG: upgrading httpbin chart as 'testapi-host'" >&3 - helm upgrade "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >/dev/null - else - echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 - helm install "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >/dev/null - fi - - kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ - --output go-template='{{"\nINFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\nINFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' - - echo "INFO: Success! Remember to add your edge client identity '/tmp/miniziti-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." -} - -main "$@" From 6d454f701833cb40b8b5b317b49ceba54fdca87e Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 7 Mar 2023 14:51:56 -0500 Subject: [PATCH 17/97] readd miniziti.bash in old location --- .../learn/quickstarts/network/miniziti.bash | 470 ++++++++++++++++++ 1 file changed, 470 insertions(+) create mode 100644 docusaurus/docs/learn/quickstarts/network/miniziti.bash diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash new file mode 100644 index 000000000..89b6b6379 --- /dev/null +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -0,0 +1,470 @@ +#!/usr/bin/env bash + +set -o errexit +set -o nounset +set -o pipefail + +function banner(){ + cat <&2 + return 1 + } + echo "DEBUG: checking dns to ensure minicontroller.ziti resolves to $1" >&3 + if grep -qE "^${1//./\\.}.*minicontroller.ziti" /etc/hosts \ + || nslookup minicontroller.ziti | grep -q "${1//./\\.}"; then + echo "DEBUG: host dns found expected minikube ingress IP '$1'" >&3 + return 0 + else + echo "ERROR: minicontroller.ziti does not resolve to '$1'. Did you add the record in /etc/hosts?" + return 1 + fi +} + +function deleteMiniziti(){ + if (( $# )) && [[ $1 =~ ^[0-9]+$ ]]; then + WAIT="$1" + shift + else + WAIT=10 + fi + (( $# )) && { + echo "WARN: ignorring extra params '$*'" >&2 + } + echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 + sleep "$WAIT" + echo "INFO: waiting for ${MINIKUBE_PROFILE} to be deleted" + minikube --profile "${MINIKUBE_PROFILE}" delete >/dev/null +} + +function main(){ + # require commands + declare -a BINS=(jq ziti minikube kubectl helm) + for BIN in "${BINS[@]}"; do + if ! command -v "$BIN" &>/dev/null; then + echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 + $BIN || exit 1 + fi + done + + # open a descriptor for debug messages + exec 3>/dev/null + + while (( $# )); do + case "$1" in + -p|--profile) MINIKUBE_PROFILE="$2" + shift 2 + ;; + -d|--delete) DELETE_MINIZITI=1 + shift + ;; + -q|--quiet) exec > /dev/null + shift + ;; + -v|--verbose|--debug) + exec 3>&1 + shift + ;; + *) _usage + exit + ;; + esac + done + + if [[ ${MINIKUBE_PROFILE:="miniziti"} == "miniziti" ]]; then + banner + else + # sanity check the profile name input + if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then + # in case the arg value is another option instead of the profile name + echo "ERROR: --profile needs a profile name not starting with a hyphen" >&2 + _usage; exit 1 + fi + # print the alternative profile name if not default "miniziti" + banner "$MINIKUBE_PROFILE" + fi + + (( ${DELETE_MINIZITI:-0} )) && { + deleteMiniziti 10 + exit 0 + } + + # start unless running + echo "INFO: waiting for minikube to be ready" + if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null | grep -q "apiserver: Running"; then + minikube --profile "${MINIKUBE_PROFILE}" start >/dev/null + fi + + MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) + + if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then + echo "DEBUG: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" >&3 + else + echo "ERROR: failed to find minikube external IP" >&2 + exit 1 + fi + + # verify current context can connect to apiserver + kubectl cluster-info >/dev/null + echo "DEBUG: kubectl successfully obtained cluster-info from apiserver" >&3 + + # enable ssl-passthrough for OpenZiti ingresses + if kubectl get deployment "ingress-nginx-controller" \ + --namespace ingress-nginx \ + --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ + | grep -q enable-ssl-passthrough; then + echo "DEBUG: ingress-nginx has ssl-passthrough enabled" >&3 + else + echo "DEBUG: installing ingress-nginx" >&3 + # enable minikube addons for ingress-nginx + minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress >/dev/null + minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress-dns >/dev/null + + echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 + kubectl patch deployment "ingress-nginx-controller" \ + --namespace ingress-nginx \ + --type='json' \ + --patch='[{"op": "add", + "path": "/spec/template/spec/containers/0/args/-", + "value":"--enable-ssl-passthrough" + }]' >/dev/null + fi + + echo "INFO: waiting for ingress-nginx to be ready" + # wait for ingress-nginx + kubectl wait jobs "ingress-nginx-admission-patch" \ + --namespace ingress-nginx \ + --for condition=complete \ + --timeout=120s >/dev/null + + kubectl wait pods \ + --namespace ingress-nginx \ + --for=condition=ready \ + --selector=app.kubernetes.io/component=controller \ + --timeout=120s >/dev/null + + if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then + echo "DEBUG: detected WSL, probing for running minikube tunnel" >&3 + if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then + echo -e "INFO: detected WSL. minikube tunnel required."\ + " In another terminal, run the following command. Then re-run this script."\ + "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel" + exit 1 + fi + # recommend /etc/hosts change unless dns is configured to reach the minikube node IP + checkDns "127.0.0.1" + else + if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then + # Like WSL, macOS uses localhost port forwarding to reach the minikube node IP + checkDns "127.0.0.1" + else + # Exceptions notwithstanding, Linux, etc. presumably have an IP route to + # the minikube node IP + checkDns "$MINIKUBE_NODE_EXTERNAL" + fi + fi + + echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 + kubectl apply \ + --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null + kubectl apply \ + --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null + + if helm repo list | grep -q openziti; then + echo "DEBUG: refreshing OpenZiti Helm Charts" >&3 + helm repo update openziti >/dev/null + else + echo "INFO: subscribing to OpenZiti Helm Charts" + helm repo add openziti https://docs.openziti.io/helm-charts/ >/dev/null + fi + + if helm list --namespace ziti-controller --all | grep -q minicontroller; then + echo "INFO: upgrading openziti controller" + helm upgrade "minicontroller" openziti/ziti-controller \ + --namespace ziti-controller \ + --set clientApi.advertisedHost="minicontroller.ziti" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null + else + echo "INFO: installing openziti controller" + helm install "minicontroller" openziti/ziti-controller \ + --namespace ziti-controller --create-namespace \ + --set clientApi.advertisedHost="minicontroller.ziti" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null + fi + + for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do + echo "INFO: waiting for $DEPLOYMENT to be ready" + kubectl wait deployments "$DEPLOYMENT" \ + --namespace ziti-controller \ + --for condition=Available=True \ + --timeout=240s >/dev/null + done + + # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output + echo "DEBUG: probing minikube node for internal host record" >&3 + MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') + + if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then + # strip surrounding whitespace + MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") + echo "DEBUG: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" >&3 + else + echo "ERROR: failed to find minikube internal IP" >&2 + exit 1 + fi + + echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 + kubectl patch configmap "coredns" \ + --namespace kube-system \ + --patch=" + data: + Corefile: | + .:53 { + log + errors + health { + lameduck 5s + } + ready + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + ttl 30 + } + prometheus :9153 + hosts { + ${MINIKUBE_NODE_INTERNAL} + fallthrough + } + forward . /etc/resolv.conf { + max_concurrent 1000 + } + cache 30 + loop + reload + loadbalance + } + ziti:53 { + errors + cache 30 + forward . ${MINIKUBE_NODE_EXTERNAL} + } + " >/dev/null + + echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 + kubectl get pods \ + --namespace kube-system \ + | awk '/^coredns-/ {print $1}' \ + | xargs kubectl delete pods \ + --namespace kube-system >/dev/null + + echo "DEBUG: waiting for cluster dns to be ready" >&3 + kubectl wait deployments "coredns" \ + --namespace kube-system \ + --for condition=Available=True >/dev/null + + if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ + nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then + echo "INFO: cluster dns is working" + else + echo "ERROR: cluster dns test failed" >&2 + exit 1 + fi + + echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 + kubectl get secrets "minicontroller-admin-secret" \ + --namespace ziti-controller \ + --output go-template='{{index .data "admin-password" | base64decode }}' \ + | xargs ziti edge login minicontroller.ziti:443 \ + --yes --username "admin" \ + --password >/dev/null + + if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then + echo "DEBUG: updating minirouter" >&3 + ziti edge update edge-router "minirouter" \ + --role-attributes "public-routers" >/dev/null + else + echo "DEBUG: creating minirouter" >&3 + ziti edge create edge-router "minirouter" \ + --role-attributes "public-routers" \ + --tunneler-enabled \ + --jwt-output-file /tmp/minirouter.jwt >/dev/null + fi + + if helm list --all --namespace ziti-router | grep -q minirouter; then + echo "DEBUG: upgrading router chart as 'minirouter'" >&3 + helm upgrade "minirouter" openziti/ziti-router \ + --namespace ziti-router \ + --set enrollmentJwt=\ \ + --set edge.advertisedHost=minirouter.ziti \ + --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null + else + echo "DEBUG: installing router chart as 'minirouter'" >&3 + helm install "minirouter" openziti/ziti-router \ + --namespace ziti-router --create-namespace \ + --set-file enrollmentJwt=/tmp/minirouter.jwt \ + --set edge.advertisedHost=minirouter.ziti \ + --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null + fi + + echo "INFO: waiting for minirouter to be ready" + kubectl wait deployments "minirouter" \ + --namespace ziti-router \ + --for condition=Available=True >/dev/null + + echo "DEBUG: probing minirouter for online status" >&3 + if ziti edge list edge-routers 'name="minirouter"' \ + | awk '/minirouter/ {print $6}' \ + | grep -q true; then + echo "INFO: minirouter is online" + else + echo "ERROR: minirouter is offline" >&2 + exit 1 + fi + + if helm --namespace ziti-console list --all | grep -q miniconsole; then + echo "DEBUG: upgrading console chart as 'miniconsole'" >&3 + helm upgrade "miniconsole" openziti/ziti-console \ + --namespace ziti-console \ + --set ingress.advertisedHost=miniconsole.ziti \ + --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null + else + echo "DEBUG: installing console chart as 'miniconsole'" >&3 + helm install "miniconsole" openziti/ziti-console \ + --namespace ziti-console --create-namespace \ + --set ingress.advertisedHost=miniconsole.ziti \ + --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null + fi + + echo "INFO: waiting for miniconsole to be ready" + kubectl wait deployments "miniconsole" \ + --namespace ziti-console \ + --for condition=Available=True \ + --timeout=240s >/dev/null + + if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then + echo "DEBUG: creating identity edge-client" >&3 + ziti edge create identity device "edge-client" \ + --jwt-output-file /tmp/miniziti-client.jwt --role-attributes testapi-clients >/dev/null + else + echo "DEBUG: ignoring identity edge-client" >&3 + fi + + if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then + echo "DEBUG: creating identity testapi-host" >&3 + ziti edge create identity device "testapi-host" \ + --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null + else + echo "DEBUG: ignoring identity testapi-host" >&3 + fi + + if ! ziti edge list configs 'name="testapi-intercept-config"' --csv | grep -q "testapi-intercept-config"; then + echo "DEBUG: creating config testapi-intercept-config" >&3 + ziti edge create config "testapi-intercept-config" intercept.v1 \ + '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null + else + echo "DEBUG: ignoring config testapi-intercept-config" >&3 + fi + + if ! ziti edge list configs 'name="testapi-host-config"' --csv | grep -q "testapi-host-config"; then + echo "DEBUG: creating config testapi-host-config" >&3 + ziti edge create config "testapi-host-config" host.v1 \ + '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null + else + echo "DEBUG: ignoring config testapi-host-config" >&3 + fi + + if ! ziti edge list services 'name="testapi-service"' --csv | grep -q "testapi-service"; then + echo "DEBUG: creating service testapi-service" >&3 + ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null + else + echo "DEBUG: ignoring service testapi-service" >&3 + fi + + if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv | grep -q "testapi-bind-policy"; then + echo "DEBUG: creating service-policy testapi-bind-policy" >&3 + ziti edge create service-policy "testapi-bind-policy" Bind \ + --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null + else + echo "DEBUG: ignoring service-policy testapi-bind-policy" >&3 + fi + + if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv | grep -q "testapi-dial-policy"; then + echo "DEBUG: creating service-policy testapi-dial-policy" >&3 + ziti edge create service-policy "testapi-dial-policy" Dial \ + --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null + else + echo "DEBUG: ignoring service-policy testapi-dial-policy" >&3 + fi + + if ! ziti edge list edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then + echo "DEBUG: creating edge-router-policy public-routers" >&3 + ziti edge create edge-router-policy "public-routers" \ + --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null + else + echo "DEBUG: ignoring edge-router-policy public-routers" >&3 + fi + + if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then + echo "DEBUG: creating service-edge-router-policy public-routers" >&3 + ziti edge create service-edge-router-policy "public-routers" \ + --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null + else + echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 + fi + + if [[ -s /tmp/testapi-host.json ]]; then + echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ + "If the file was left over from a prior run"\ + " then delete it and re-run this script." >&2 + else + echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 + ziti edge enroll /tmp/testapi-host.jwt >/dev/null + fi + + if helm list --all --namespace default | grep -q testapi-host; then + echo "DEBUG: upgrading httpbin chart as 'testapi-host'" >&3 + helm upgrade "testapi-host" openziti/httpbin \ + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service >/dev/null + else + echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 + helm install "testapi-host" openziti/httpbin \ + --set-file zitiIdentity=/tmp/testapi-host.json \ + --set zitiServiceName=testapi-service >/dev/null + fi + + kubectl get secrets "minicontroller-admin-secret" \ + --namespace ziti-controller \ + --output go-template='{{"\nINFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\nINFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' + + echo "INFO: Success! Remember to add your edge client identity '/tmp/miniziti-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." +} + +main "$@" From 46b73e3b7177f340ab1937b665760bc0e58ef088 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 7 Mar 2023 20:15:08 -0500 Subject: [PATCH 18/97] stop requiring jq --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 89b6b6379..54884637d 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -61,7 +61,7 @@ function deleteMiniziti(){ function main(){ # require commands - declare -a BINS=(jq ziti minikube kubectl helm) + declare -a BINS=(ziti minikube kubectl helm) for BIN in "${BINS[@]}"; do if ! command -v "$BIN" &>/dev/null; then echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 From 37ccf3e250483f6ca3c7bf02dc63083c8dfd4c0a Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 7 Mar 2023 21:31:56 -0500 Subject: [PATCH 19/97] manage the OTT and identity files for testapi-host Signed-off-by: Kenneth Bingham --- .../learn/quickstarts/network/miniziti.bash | 255 +++++++++++------- 1 file changed, 151 insertions(+), 104 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 54884637d..30b10b91a 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -44,21 +44,65 @@ function checkDns(){ } function deleteMiniziti(){ + local WAIT=10 if (( $# )) && [[ $1 =~ ^[0-9]+$ ]]; then WAIT="$1" shift + elif (( $# )); then + echo "WARN: ignoring extra params '$*', using default wait time ${WAIT}s" >&2 else - WAIT=10 + echo "DEBUG: no integer param detected to deleteMiniziti(), using default wait time ${WAIT}s" >&3 fi - (( $# )) && { - echo "WARN: ignorring extra params '$*'" >&2 - } echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 sleep "$WAIT" echo "INFO: waiting for ${MINIKUBE_PROFILE} to be deleted" minikube --profile "${MINIKUBE_PROFILE}" delete >/dev/null } +function detectOs(){ + if grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then + echo "DEBUG: detected Windows OS" >&3 + echo "Windows" + elif [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then + echo "DEBUG: detected macOS OS" >&3 + echo "macOS" + elif [[ ${OSTYPE:-} =~ [Ll]inux ]]; then + echo "DEBUG: detected Linux OS" >&3 + echo "Linux" + else + echo "ERROR: failed to detect OS" >&2 + return 1 + fi +} + +function getClientOttPath(){ + local ID_PATH=/tmp/miniziti-client.jwt + if [[ $# -eq 1 ]]; then + case $1 in + macOS|linux) echo "$ID_PATH" + ;; + Windows) echo "$(wslpath -w $ID_PATH)" + ;; + esac + else + echo "ERROR: getClientOttPath() takes one param, DETECTED_OS" >&2 + return 1 + fi + +} + +function testClusterDns(){ + + if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ + nslookup minicontroller.ziti | grep "$1" >/dev/null; then + echo "INFO: cluster dns is working" + else + echo "ERROR: cluster dns test failed" >&2 + return 1 + fi + +} + function main(){ # require commands declare -a BINS=(ziti minikube kubectl helm) @@ -72,6 +116,14 @@ function main(){ # open a descriptor for debug messages exec 3>/dev/null + declare DETECTED_OS=$(detectOs) \ + MINIKUBE_PROFILE \ + DELETE_MINIZITI \ + MINIKUBE_PROFILE \ + MINIKUBE_NODE_EXTERNAL \ + DEBUG_MINIKUBE_TUNNEL + + while (( $# )); do case "$1" in -p|--profile) MINIKUBE_PROFILE="$2" @@ -106,6 +158,7 @@ function main(){ banner "$MINIKUBE_PROFILE" fi + # delete and exit if --delete (( ${DELETE_MINIZITI:-0} )) && { deleteMiniziti 10 exit 0 @@ -114,7 +167,10 @@ function main(){ # start unless running echo "INFO: waiting for minikube to be ready" if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null | grep -q "apiserver: Running"; then + echo "DEBUG: apiserver not running, starting minikube" >&3 minikube --profile "${MINIKUBE_PROFILE}" start >/dev/null + else + echo "DEBUG: apiserver is running, not starting minikube" >&3 fi MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) @@ -165,27 +221,6 @@ function main(){ --selector=app.kubernetes.io/component=controller \ --timeout=120s >/dev/null - if [[ -n "${DEBUG_WSL:-}" ]] || grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then - echo "DEBUG: detected WSL, probing for running minikube tunnel" >&3 - if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then - echo -e "INFO: detected WSL. minikube tunnel required."\ - " In another terminal, run the following command. Then re-run this script."\ - "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel" - exit 1 - fi - # recommend /etc/hosts change unless dns is configured to reach the minikube node IP - checkDns "127.0.0.1" - else - if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then - # Like WSL, macOS uses localhost port forwarding to reach the minikube node IP - checkDns "127.0.0.1" - else - # Exceptions notwithstanding, Linux, etc. presumably have an IP route to - # the minikube node IP - checkDns "$MINIKUBE_NODE_EXTERNAL" - fi - fi - echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 kubectl apply \ --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null @@ -222,75 +257,92 @@ function main(){ --timeout=240s >/dev/null done - # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output - echo "DEBUG: probing minikube node for internal host record" >&3 - MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') - - if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then - # strip surrounding whitespace - MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") - echo "DEBUG: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" >&3 + # wait to probe for the minikube tunnel until after controller deployment so there's at least one + # ingress causing minikube to immediately prompt for sudo password + if [[ -n "${DEBUG_MINIKUBE_TUNNEL:-}" ]] || [[ "${DETECTED_OS}" =~ Windows|macOS ]]; then + echo "DEBUG: detected OS is ${DETECTED_OS}, probing for minikube tunnel" >&3 + if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then + echo -e "ERROR: ${DETECTED_OS} OS requires a running minikube tunnel for ingresses."\ + " In another terminal, run the following command. Then re-run this script."\ + "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel\n" >&2 + exit 1 + else + echo "DEBUG: minikube tunnel is running" >&3 + fi + # recommend /etc/hosts change unless dns is configured to reach the minikube node IP + checkDns "127.0.0.1" else - echo "ERROR: failed to find minikube internal IP" >&2 - exit 1 + checkDns "$MINIKUBE_NODE_EXTERNAL" fi - echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 - kubectl patch configmap "coredns" \ - --namespace kube-system \ - --patch=" - data: - Corefile: | - .:53 { - log - errors - health { - lameduck 5s - } - ready - kubernetes cluster.local in-addr.arpa ip6.arpa { - pods insecure - fallthrough in-addr.arpa ip6.arpa - ttl 30 - } - prometheus :9153 - hosts { - ${MINIKUBE_NODE_INTERNAL} - fallthrough - } - forward . /etc/resolv.conf { - max_concurrent 1000 - } - cache 30 - loop - reload - loadbalance - } - ziti:53 { - errors - cache 30 - forward . ${MINIKUBE_NODE_EXTERNAL} - } - " >/dev/null + if ! testClusterDns "${MINIKUBE_NODE_EXTERNAL}" 2>/dev/null; then + echo "DEBUG: initial cluster dns test failed, doing cluster dns setup" >&3 - echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 - kubectl get pods \ - --namespace kube-system \ - | awk '/^coredns-/ {print $1}' \ - | xargs kubectl delete pods \ - --namespace kube-system >/dev/null + # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output + echo "DEBUG: probing minikube node for internal host record" >&3 + MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') - echo "DEBUG: waiting for cluster dns to be ready" >&3 - kubectl wait deployments "coredns" \ - --namespace kube-system \ - --for condition=Available=True >/dev/null + if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then + # strip surrounding whitespace + MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") + echo "DEBUG: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" >&3 + else + echo "ERROR: failed to find minikube internal IP" >&2 + exit 1 + fi - if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ - nslookup minicontroller.ziti | grep "${MINIKUBE_NODE_EXTERNAL}" >/dev/null; then - echo "INFO: cluster dns is working" - else - echo "ERROR: cluster dns test failed" >&2 - exit 1 + echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 + kubectl patch configmap "coredns" \ + --namespace kube-system \ + --patch=" + data: + Corefile: | + .:53 { + log + errors + health { + lameduck 5s + } + ready + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + ttl 30 + } + prometheus :9153 + hosts { + ${MINIKUBE_NODE_INTERNAL} + fallthrough + } + forward . /etc/resolv.conf { + max_concurrent 1000 + } + cache 30 + loop + reload + loadbalance + } + ziti:53 { + errors + cache 30 + forward . ${MINIKUBE_NODE_EXTERNAL} + } + " >/dev/null + + echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 + kubectl get pods \ + --namespace kube-system \ + | awk '/^coredns-/ {print $1}' \ + | xargs kubectl delete pods \ + --namespace kube-system >/dev/null + + echo "DEBUG: waiting for cluster dns to be ready" >&3 + kubectl wait deployments "coredns" \ + --namespace kube-system \ + --for condition=Available=True >/dev/null + + # perform a DNS query in a pod so we know ingress-dns is working inside the cluster + testClusterDns "${MINIKUBE_NODE_EXTERNAL}" fi echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 @@ -368,12 +420,12 @@ function main(){ --for condition=Available=True \ --timeout=240s >/dev/null - if ! ziti edge list identities 'name="edge-client"' --csv | grep -q "edge-client"; then - echo "DEBUG: creating identity edge-client" >&3 - ziti edge create identity device "edge-client" \ + if ! ziti edge list identities 'name="miniziti-client"' --csv | grep -q "miniziti-client"; then + echo "DEBUG: creating identity miniziti-client" >&3 + ziti edge create identity device "miniziti-client" \ --jwt-output-file /tmp/miniziti-client.jwt --role-attributes testapi-clients >/dev/null else - echo "DEBUG: ignoring identity edge-client" >&3 + echo "DEBUG: ignoring identity miniziti-client" >&3 fi if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then @@ -439,32 +491,27 @@ function main(){ echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 fi - if [[ -s /tmp/testapi-host.json ]]; then - echo "WARN: /tmp/testapi-host.json exists, not enrolling 'testapi-host'."\ - "If the file was left over from a prior run"\ - " then delete it and re-run this script." >&2 - else + if [[ -s /tmp/testapi-host.jwt ]]; then echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 ziti edge enroll /tmp/testapi-host.jwt >/dev/null + rm -f /tmp/testapi-host.jwt + echo "DEBUG: deleted /tmp/testapi-host.jwt after enrolling successfully" >&3 fi - if helm list --all --namespace default | grep -q testapi-host; then - echo "DEBUG: upgrading httpbin chart as 'testapi-host'" >&3 - helm upgrade "testapi-host" openziti/httpbin \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >/dev/null - else + if [[ -s /tmp/testapi-host.json ]]; then echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 helm install "testapi-host" openziti/httpbin \ --set-file zitiIdentity=/tmp/testapi-host.json \ --set zitiServiceName=testapi-service >/dev/null + rm -f /tmp/testapi-host.json + echo "DEBUG: deleted /tmp/testapi-host.json after installing successfully with testapi-host chart" >&3 fi kubectl get secrets "minicontroller-admin-secret" \ --namespace ziti-controller \ --output go-template='{{"\nINFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\nINFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' - echo "INFO: Success! Remember to add your edge client identity '/tmp/miniziti-client.jwt' in your client tunneler, e.g. Ziti Desktop Edge." + echo "INFO: Success! Remember to add your edge client identity '$(getClientOttPath ${DETECTED_OS})' in your tunneler, e.g. Ziti Desktop Edge." } main "$@" From 27255ff442a413e20f6fb3533592c511adb2f995 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Wed, 8 Mar 2023 06:36:27 -0500 Subject: [PATCH 20/97] fix "Linux" caps --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 30b10b91a..bc876cc86 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -79,7 +79,7 @@ function getClientOttPath(){ local ID_PATH=/tmp/miniziti-client.jwt if [[ $# -eq 1 ]]; then case $1 in - macOS|linux) echo "$ID_PATH" + macOS|Linux) echo "$ID_PATH" ;; Windows) echo "$(wslpath -w $ID_PATH)" ;; From a078c394371fb22a05c3c6421e2404c19ea21ca7 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 11 Mar 2023 12:47:40 -0500 Subject: [PATCH 21/97] use a single k8s namespace for miniziti deployments --- .../learn/quickstarts/network/miniziti.bash | 187 +++++++++++------- 1 file changed, 119 insertions(+), 68 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index bc876cc86..b72eee1f3 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -19,11 +19,16 @@ BANNER function _usage(){ banner - echo -e "\n"\ + echo -e " COMMANDS\n"\ + "\t start\t\tstart miniziti (default)\n"\ + "\t delete\t\tdelete miniziti\n"\ + "\n OPTIONS\n"\ "\t --quiet\tsuppress INFO messages\n"\ "\t --verbose\tshow DEBUG messages\n"\ - "\t --delete\tdelete miniziti\n"\ - "\t --profile\tMINIKUBE_PROFILE (default is \"miniziti\")" + "\t --profile\tMINIKUBE_PROFILE (miniziti)\n"\ + "\t --namespace\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ + "\n DEBUG\n"\ + "\t --charts\tZITI_CHARTS (openziti) alternative charts repo\n" } function checkDns(){ @@ -92,15 +97,13 @@ function getClientOttPath(){ } function testClusterDns(){ - - if kubectl run "dnstest" --rm --tty --stdin --image=busybox --restart=Never -- \ + if kubectl run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ nslookup minicontroller.ziti | grep "$1" >/dev/null; then - echo "INFO: cluster dns is working" + echo "INFO: cluster dns test succeeded" else echo "ERROR: cluster dns test failed" >&2 return 1 fi - } function main(){ @@ -116,21 +119,35 @@ function main(){ # open a descriptor for debug messages exec 3>/dev/null - declare DETECTED_OS=$(detectOs) \ - MINIKUBE_PROFILE \ - DELETE_MINIZITI \ - MINIKUBE_PROFILE \ + # locals with defaults that never produce an error + declare DETECTED_OS \ + MINIKUBE_PROFILE="miniziti" \ + ZITI_NAMESPACE="miniziti" \ + DELETE_MINIZITI=0 \ MINIKUBE_NODE_EXTERNAL \ - DEBUG_MINIKUBE_TUNNEL + DEBUG_MINIKUBE_TUNNEL \ + ZITI_CHARTS="openziti" + + # local defaults that are inherited or may error + DETECTED_OS="$(detectOs)" + : "${DEBUG_MINIKUBE_TUNNEL:=0}" # set env = 1 to trigger the minikube tunnel probe while (( $# )); do case "$1" in + start) shift + ;; + delete) DELETE_MINIZITI=1 + shift + ;; -p|--profile) MINIKUBE_PROFILE="$2" shift 2 ;; - -d|--delete) DELETE_MINIZITI=1 - shift + -n|--namespace) ZITI_NAMESPACE="$2" + shift 2 + ;; + --charts) ZITI_CHARTS="$2" + shift 2 ;; -q|--quiet) exec > /dev/null shift @@ -145,7 +162,7 @@ function main(){ esac done - if [[ ${MINIKUBE_PROFILE:="miniziti"} == "miniziti" ]]; then + if [[ ${MINIKUBE_PROFILE} == "miniziti" ]]; then banner else # sanity check the profile name input @@ -159,14 +176,22 @@ function main(){ fi # delete and exit if --delete - (( ${DELETE_MINIZITI:-0} )) && { + (( DELETE_MINIZITI )) && { deleteMiniziti 10 exit 0 } + : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" + + echo "DEBUG: setting default " + minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ + config set-context "${MINIKUBE_PROFILE}" \ + --namespace "${ZITI_NAMESPACE}" >/dev/null + # start unless running echo "INFO: waiting for minikube to be ready" - if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null | grep -q "apiserver: Running"; then + if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null \ + | grep -q "apiserver: Running"; then echo "DEBUG: apiserver not running, starting minikube" >&3 minikube --profile "${MINIKUBE_PROFILE}" start >/dev/null else @@ -195,14 +220,16 @@ function main(){ else echo "DEBUG: installing ingress-nginx" >&3 # enable minikube addons for ingress-nginx - minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress >/dev/null - minikube --profile "${MINIKUBE_PROFILE}" addons enable ingress-dns >/dev/null + minikube addons enable ingress \ + --profile "${MINIKUBE_PROFILE}" >/dev/null + minikube addons enable ingress-dns \ + --profile "${MINIKUBE_PROFILE}" >/dev/null echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 kubectl patch deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ - --type='json' \ - --patch='[{"op": "add", + --type json \ + --patch '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--enable-ssl-passthrough" }]' >/dev/null @@ -212,14 +239,14 @@ function main(){ # wait for ingress-nginx kubectl wait jobs "ingress-nginx-admission-patch" \ --namespace ingress-nginx \ - --for condition=complete \ - --timeout=120s >/dev/null + --for condition=complete \ + --timeout 120s >/dev/null kubectl wait pods \ --namespace ingress-nginx \ - --for=condition=ready \ - --selector=app.kubernetes.io/component=controller \ - --timeout=120s >/dev/null + --for condition=ready \ + --selector app.kubernetes.io/component=controller \ + --timeout 120s >/dev/null echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 kubectl apply \ @@ -235,31 +262,38 @@ function main(){ helm repo add openziti https://docs.openziti.io/helm-charts/ >/dev/null fi - if helm list --namespace ziti-controller --all | grep -q minicontroller; then + if helm list --namespace "${ZITI_NAMESPACE}" --all | grep -q minicontroller; then echo "INFO: upgrading openziti controller" - helm upgrade "minicontroller" openziti/ziti-controller \ - --namespace ziti-controller \ + helm upgrade "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ + --namespace "${ZITI_NAMESPACE}" \ --set clientApi.advertisedHost="minicontroller.ziti" \ + --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null else echo "INFO: installing openziti controller" - helm install "minicontroller" openziti/ziti-controller \ - --namespace ziti-controller --create-namespace \ + helm install "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ + --namespace "${ZITI_NAMESPACE}" --create-namespace \ --set clientApi.advertisedHost="minicontroller.ziti" \ + --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null fi + echo "DEBUG: setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" + minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ + config set-context "${MINIKUBE_PROFILE}" \ + --namespace "${ZITI_NAMESPACE}" >/dev/null + for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do echo "INFO: waiting for $DEPLOYMENT to be ready" kubectl wait deployments "$DEPLOYMENT" \ - --namespace ziti-controller \ + --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ - --timeout=240s >/dev/null + --timeout 240s >/dev/null done # wait to probe for the minikube tunnel until after controller deployment so there's at least one # ingress causing minikube to immediately prompt for sudo password - if [[ -n "${DEBUG_MINIKUBE_TUNNEL:-}" ]] || [[ "${DETECTED_OS}" =~ Windows|macOS ]]; then + if (( DEBUG_MINIKUBE_TUNNEL )) || [[ "${DETECTED_OS}" =~ Windows|macOS ]]; then echo "DEBUG: detected OS is ${DETECTED_OS}, probing for minikube tunnel" >&3 if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then echo -e "ERROR: ${DETECTED_OS} OS requires a running minikube tunnel for ingresses."\ @@ -294,7 +328,7 @@ function main(){ echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 kubectl patch configmap "coredns" \ --namespace kube-system \ - --patch=" + --patch " data: Corefile: | .:53 { @@ -347,13 +381,14 @@ function main(){ echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ + --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{index .data "admin-password" | base64decode }}' \ | xargs ziti edge login minicontroller.ziti:443 \ --yes --username "admin" \ --password >/dev/null - if ziti edge list edge-routers 'name="minirouter"' | grep -q minirouter; then + if ziti edge list edge-routers 'name="minirouter"' \ + | grep -q minirouter; then echo "DEBUG: updating minirouter" >&3 ziti edge update edge-router "minirouter" \ --role-attributes "public-routers" >/dev/null @@ -365,27 +400,28 @@ function main(){ --jwt-output-file /tmp/minirouter.jwt >/dev/null fi - if helm list --all --namespace ziti-router | grep -q minirouter; then + if helm list --all --namespace "${ZITI_NAMESPACE}" \ + | grep -q minirouter; then echo "DEBUG: upgrading router chart as 'minirouter'" >&3 - helm upgrade "minirouter" openziti/ziti-router \ - --namespace ziti-router \ + helm upgrade "minirouter" "${ZITI_CHARTS}/ziti-router" \ + --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ --set edge.advertisedHost=minirouter.ziti \ - --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:6262" \ --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null else echo "DEBUG: installing router chart as 'minirouter'" >&3 - helm install "minirouter" openziti/ziti-router \ - --namespace ziti-router --create-namespace \ + helm install "minirouter" "${ZITI_CHARTS}/ziti-router" \ + --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt=/tmp/minirouter.jwt \ --set edge.advertisedHost=minirouter.ziti \ - --set ctrl.endpoint=minicontroller-ctrl.ziti-controller.svc:6262 \ + --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:6262" \ --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null fi echo "INFO: waiting for minirouter to be ready" kubectl wait deployments "minirouter" \ - --namespace ziti-router \ + --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True >/dev/null echo "DEBUG: probing minirouter for online status" >&3 @@ -398,29 +434,31 @@ function main(){ exit 1 fi - if helm --namespace ziti-console list --all | grep -q miniconsole; then + if helm --namespace "${ZITI_NAMESPACE}" list --all \ + | grep -q miniconsole; then echo "DEBUG: upgrading console chart as 'miniconsole'" >&3 - helm upgrade "miniconsole" openziti/ziti-console \ - --namespace ziti-console \ + helm upgrade "miniconsole" "${ZITI_CHARTS}/ziti-console" \ + --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniconsole.ziti \ - --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --set "settings.edgeControllers[0].url=https://minicontroller-client.${ZITI_NAMESPACE}.svc:443" \ --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null else echo "DEBUG: installing console chart as 'miniconsole'" >&3 - helm install "miniconsole" openziti/ziti-console \ - --namespace ziti-console --create-namespace \ + helm install "miniconsole" "${ZITI_CHARTS}/ziti-console" \ + --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniconsole.ziti \ - --set settings.edgeControllers[0].url=https://minicontroller-client.ziti-controller.svc:443 \ + --set "settings.edgeControllers[0].url=https://minicontroller-client.${ZITI_NAMESPACE}.svc:443" \ --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null fi echo "INFO: waiting for miniconsole to be ready" kubectl wait deployments "miniconsole" \ - --namespace ziti-console \ + --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ - --timeout=240s >/dev/null + --timeout 240s >/dev/null - if ! ziti edge list identities 'name="miniziti-client"' --csv | grep -q "miniziti-client"; then + if ! ziti edge list identities 'name="miniziti-client"' --csv \ + | grep -q "miniziti-client"; then echo "DEBUG: creating identity miniziti-client" >&3 ziti edge create identity device "miniziti-client" \ --jwt-output-file /tmp/miniziti-client.jwt --role-attributes testapi-clients >/dev/null @@ -428,7 +466,8 @@ function main(){ echo "DEBUG: ignoring identity miniziti-client" >&3 fi - if ! ziti edge list identities 'name="testapi-host"' --csv | grep -q "testapi-host"; then + if ! ziti edge list identities 'name="testapi-host"' --csv \ + | grep -q "testapi-host"; then echo "DEBUG: creating identity testapi-host" >&3 ziti edge create identity device "testapi-host" \ --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null @@ -436,7 +475,8 @@ function main(){ echo "DEBUG: ignoring identity testapi-host" >&3 fi - if ! ziti edge list configs 'name="testapi-intercept-config"' --csv | grep -q "testapi-intercept-config"; then + if ! ziti edge list configs 'name="testapi-intercept-config"' --csv \ + | grep -q "testapi-intercept-config"; then echo "DEBUG: creating config testapi-intercept-config" >&3 ziti edge create config "testapi-intercept-config" intercept.v1 \ '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null @@ -444,7 +484,8 @@ function main(){ echo "DEBUG: ignoring config testapi-intercept-config" >&3 fi - if ! ziti edge list configs 'name="testapi-host-config"' --csv | grep -q "testapi-host-config"; then + if ! ziti edge list configs 'name="testapi-host-config"' --csv \ + | grep -q "testapi-host-config"; then echo "DEBUG: creating config testapi-host-config" >&3 ziti edge create config "testapi-host-config" host.v1 \ '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null @@ -452,14 +493,16 @@ function main(){ echo "DEBUG: ignoring config testapi-host-config" >&3 fi - if ! ziti edge list services 'name="testapi-service"' --csv | grep -q "testapi-service"; then + if ! ziti edge list services 'name="testapi-service"' --csv \ + | grep -q "testapi-service"; then echo "DEBUG: creating service testapi-service" >&3 ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null else echo "DEBUG: ignoring service testapi-service" >&3 fi - if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv | grep -q "testapi-bind-policy"; then + if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv \ + | grep -q "testapi-bind-policy"; then echo "DEBUG: creating service-policy testapi-bind-policy" >&3 ziti edge create service-policy "testapi-bind-policy" Bind \ --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null @@ -467,7 +510,8 @@ function main(){ echo "DEBUG: ignoring service-policy testapi-bind-policy" >&3 fi - if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv | grep -q "testapi-dial-policy"; then + if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv \ + | grep -q "testapi-dial-policy"; then echo "DEBUG: creating service-policy testapi-dial-policy" >&3 ziti edge create service-policy "testapi-dial-policy" Dial \ --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null @@ -475,7 +519,8 @@ function main(){ echo "DEBUG: ignoring service-policy testapi-dial-policy" >&3 fi - if ! ziti edge list edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then + if ! ziti edge list edge-router-policies 'name="public-routers"' --csv \ + | grep -q "public-routers"; then echo "DEBUG: creating edge-router-policy public-routers" >&3 ziti edge create edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null @@ -483,7 +528,8 @@ function main(){ echo "DEBUG: ignoring edge-router-policy public-routers" >&3 fi - if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv | grep -q "public-routers"; then + if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv \ + | grep -q "public-routers"; then echo "DEBUG: creating service-edge-router-policy public-routers" >&3 ziti edge create service-edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null @@ -493,14 +539,16 @@ function main(){ if [[ -s /tmp/testapi-host.jwt ]]; then echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 - ziti edge enroll /tmp/testapi-host.jwt >/dev/null + # discard expected output that normally flows to stderr + ziti edge enroll /tmp/testapi-host.jwt 2>&1 \ + grep -vE '^INFO\s+(generating.*key|enrolled\s+successfully)' rm -f /tmp/testapi-host.jwt echo "DEBUG: deleted /tmp/testapi-host.jwt after enrolling successfully" >&3 fi if [[ -s /tmp/testapi-host.json ]]; then echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 - helm install "testapi-host" openziti/httpbin \ + helm install "testapi-host" "${ZITI_CHARTS}/httpbin" \ --set-file zitiIdentity=/tmp/testapi-host.json \ --set zitiServiceName=testapi-service >/dev/null rm -f /tmp/testapi-host.json @@ -508,10 +556,13 @@ function main(){ fi kubectl get secrets "minicontroller-admin-secret" \ - --namespace ziti-controller \ - --output go-template='{{"\nINFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\nINFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}{{"\n\n"}}' + --namespace "${ZITI_NAMESPACE}" \ + --output go-template='{{"\n'\ +'INFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\n'\ +'INFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}'\ +'{{"\n\n"}}' - echo "INFO: Success! Remember to add your edge client identity '$(getClientOttPath ${DETECTED_OS})' in your tunneler, e.g. Ziti Desktop Edge." + echo "INFO: Success! Remember to add your edge client identity '$(getClientOttPath "${DETECTED_OS}")' in your tunneler, e.g. Ziti Desktop Edge." } main "$@" From 79a43945119b1f73351f36cbcb15f05695e45c69 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 11 Mar 2023 20:57:38 -0500 Subject: [PATCH 22/97] pass extra positional params to minikube start --- .../learn/quickstarts/network/miniziti.bash | 24 +++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index b72eee1f3..14c26c1df 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -22,6 +22,7 @@ function _usage(){ echo -e " COMMANDS\n"\ "\t start\t\tstart miniziti (default)\n"\ "\t delete\t\tdelete miniziti\n"\ + "\t help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ "\t --quiet\tsuppress INFO messages\n"\ "\t --verbose\tshow DEBUG messages\n"\ @@ -119,7 +120,7 @@ function main(){ # open a descriptor for debug messages exec 3>/dev/null - # locals with defaults that never produce an error + # local strings with defaults that never produce an error declare DETECTED_OS \ MINIKUBE_PROFILE="miniziti" \ ZITI_NAMESPACE="miniziti" \ @@ -127,6 +128,8 @@ function main(){ MINIKUBE_NODE_EXTERNAL \ DEBUG_MINIKUBE_TUNNEL \ ZITI_CHARTS="openziti" + # local arrays with defaults that never produce an error + declare -a MINIKUBE_START_ARGS=() # local defaults that are inherited or may error DETECTED_OS="$(detectOs)" @@ -156,9 +159,12 @@ function main(){ exec 3>&1 shift ;; - *) _usage + -h|*help) _usage exit ;; + *) MINIKUBE_START_ARGS+=("$1") + shift + ;; esac done @@ -188,12 +194,16 @@ function main(){ config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >/dev/null - # start unless running + # run 'minikube start' if not running or any extra start args are present echo "INFO: waiting for minikube to be ready" - if ! minikube --profile "${MINIKUBE_PROFILE}" status 2>/dev/null \ - | grep -q "apiserver: Running"; then + if ! minikube status \ + --profile "${MINIKUBE_PROFILE}" 2>/dev/null \ + | grep -q "apiserver: Running" \ + || (( ${#MINIKUBE_START_ARGS[*]} )); then echo "DEBUG: apiserver not running, starting minikube" >&3 - minikube --profile "${MINIKUBE_PROFILE}" start >/dev/null + minikube start \ + --profile "${MINIKUBE_PROFILE}" \ + "${MINIKUBE_START_ARGS[@]}" >/dev/null else echo "DEBUG: apiserver is running, not starting minikube" >&3 fi @@ -541,7 +551,7 @@ function main(){ echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 # discard expected output that normally flows to stderr ziti edge enroll /tmp/testapi-host.jwt 2>&1 \ - grep -vE '^INFO\s+(generating.*key|enrolled\s+successfully)' + | grep -vE '(generating.*key|enrolled\s+successfully)' rm -f /tmp/testapi-host.jwt echo "DEBUG: deleted /tmp/testapi-host.jwt after enrolling successfully" >&3 fi From 92781bde9f5bd84f231bfb8e3e48efc4e5989217 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 11 Mar 2023 21:15:48 -0500 Subject: [PATCH 23/97] set kubeconfig default namespace last --- .../learn/quickstarts/network/miniziti.bash | 40 ++++++++++++++++--- 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 14c26c1df..6b0a92cce 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -189,10 +189,9 @@ function main(){ : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" - echo "DEBUG: setting default " - minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ - config set-context "${MINIKUBE_PROFILE}" \ - --namespace "${ZITI_NAMESPACE}" >/dev/null + # + ## Ensure Minikube is Started and Configured + # # run 'minikube start' if not running or any extra start args are present echo "INFO: waiting for minikube to be ready" @@ -200,7 +199,7 @@ function main(){ --profile "${MINIKUBE_PROFILE}" 2>/dev/null \ | grep -q "apiserver: Running" \ || (( ${#MINIKUBE_START_ARGS[*]} )); then - echo "DEBUG: apiserver not running, starting minikube" >&3 + echo "DEBUG: apiserver not running or got extra start args, running 'minikube start'" >&3 minikube start \ --profile "${MINIKUBE_PROFILE}" \ "${MINIKUBE_START_ARGS[@]}" >/dev/null @@ -272,6 +271,10 @@ function main(){ helm repo add openziti https://docs.openziti.io/helm-charts/ >/dev/null fi + # + ## Ensure OpenZiti Controller is Upgraded and Ready + # + if helm list --namespace "${ZITI_NAMESPACE}" --all | grep -q minicontroller; then echo "INFO: upgrading openziti controller" helm upgrade "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ @@ -288,7 +291,7 @@ function main(){ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null fi - echo "DEBUG: setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" + echo "DEBUG: setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" >&3 minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >/dev/null @@ -301,6 +304,10 @@ function main(){ --timeout 240s >/dev/null done + # + ## Ensure Minikube Tunnel is Running on macOS and WSL + # + # wait to probe for the minikube tunnel until after controller deployment so there's at least one # ingress causing minikube to immediately prompt for sudo password if (( DEBUG_MINIKUBE_TUNNEL )) || [[ "${DETECTED_OS}" =~ Windows|macOS ]]; then @@ -319,6 +326,10 @@ function main(){ checkDns "$MINIKUBE_NODE_EXTERNAL" fi + # + ## Ensure Cluster DNS is Resolving minicontroller.ziti + # + if ! testClusterDns "${MINIKUBE_NODE_EXTERNAL}" 2>/dev/null; then echo "DEBUG: initial cluster dns test failed, doing cluster dns setup" >&3 @@ -389,6 +400,10 @@ function main(){ testClusterDns "${MINIKUBE_NODE_EXTERNAL}" fi + # + ## Ensure OpenZiti Router is Enrolled and Ready + # + echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 kubectl get secrets "minicontroller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ @@ -444,6 +459,10 @@ function main(){ exit 1 fi + # + ## Ensure OpenZiti Console is Configured and Ready + # + if helm --namespace "${ZITI_NAMESPACE}" list --all \ | grep -q miniconsole; then echo "DEBUG: upgrading console chart as 'miniconsole'" >&3 @@ -467,6 +486,15 @@ function main(){ --for condition=Available=True \ --timeout 240s >/dev/null + echo "DEBUG: setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" >&3 + minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ + config set-context "${MINIKUBE_PROFILE}" \ + --namespace "${ZITI_NAMESPACE}" >/dev/null + + # + ## Ensure OpenZiti Identities and Services are Created + # + if ! ziti edge list identities 'name="miniziti-client"' --csv \ | grep -q "miniziti-client"; then echo "DEBUG: creating identity miniziti-client" >&3 From 03effbee78ac0716b8d6ea333d2c59de4649cfc0 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 11 Mar 2023 22:10:22 -0500 Subject: [PATCH 24/97] use the miniziti profile name when naming the Ziti client identity --- .../learn/quickstarts/network/miniziti.bash | 35 +++++++++++++------ 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 6b0a92cce..8bb4c7eb0 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -51,11 +51,9 @@ function checkDns(){ function deleteMiniziti(){ local WAIT=10 - if (( $# )) && [[ $1 =~ ^[0-9]+$ ]]; then + if [[ $1 =~ ^[0-9]+$ ]]; then WAIT="$1" shift - elif (( $# )); then - echo "WARN: ignoring extra params '$*', using default wait time ${WAIT}s" >&2 else echo "DEBUG: no integer param detected to deleteMiniziti(), using default wait time ${WAIT}s" >&3 fi @@ -82,7 +80,7 @@ function detectOs(){ } function getClientOttPath(){ - local ID_PATH=/tmp/miniziti-client.jwt + local ID_PATH="/tmp/${MINIKUBE_PROFILE}-client.jwt" if [[ $# -eq 1 ]]; then case $1 in macOS|Linux) echo "$ID_PATH" @@ -107,6 +105,20 @@ function testClusterDns(){ fi } +function validateDnsName(){ + if ! [[ $# -eq 1 ]]; then + echo "ERROR: validateDnsName() takes one string param" >&2 + return 1 + fi + if grep -qP '(?=^.{4,253}$)(^(?:[a-zA-Z0-9](?:(?:[a-zA-Z0-9\-]){0,61}[a-zA-Z0-9])?)+[a-zA-Z0-9]$)' <<< "$1"; then + echo "DEBUG: '$1' is a valid DNS name" >&3 + return 0 + else + echo "ERROR: '$1' could not be validated as an unqualified DNS name which is limited to at least four alphanumeric and hyphen characters, starts with a letter, and does not end with a hyphen." >&2 + return 1 + fi +} + function main(){ # require commands declare -a BINS=(ziti minikube kubectl helm) @@ -143,7 +155,8 @@ function main(){ delete) DELETE_MINIZITI=1 shift ;; - -p|--profile) MINIKUBE_PROFILE="$2" + -p|--profile) validateDnsName "$2" + MINIKUBE_PROFILE="$2" shift 2 ;; -n|--namespace) ZITI_NAMESPACE="$2" @@ -495,13 +508,13 @@ function main(){ ## Ensure OpenZiti Identities and Services are Created # - if ! ziti edge list identities 'name="miniziti-client"' --csv \ - | grep -q "miniziti-client"; then - echo "DEBUG: creating identity miniziti-client" >&3 - ziti edge create identity device "miniziti-client" \ - --jwt-output-file /tmp/miniziti-client.jwt --role-attributes testapi-clients >/dev/null + if ! ziti edge list identities "name=\"${MINIKUBE_PROFILE}-client\"" --csv \ + | grep -q "${MINIKUBE_PROFILE}-client"; then + echo "DEBUG: creating identity ${MINIKUBE_PROFILE}-client" >&3 + ziti edge create identity device "${MINIKUBE_PROFILE}-client" \ + --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes testapi-clients >/dev/null else - echo "DEBUG: ignoring identity miniziti-client" >&3 + echo "DEBUG: ignoring identity ${MINIKUBE_PROFILE}-client" >&3 fi if ! ziti edge list identities 'name="testapi-host"' --csv \ From 01aa294d3454c0f24310c485091a26efe05d6cf8 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 11 Mar 2023 23:31:56 -0500 Subject: [PATCH 25/97] capture the stderr from ziti edge enroll and filter out the expected lines and treat anything else as an error --- .../learn/quickstarts/network/miniziti.bash | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 8bb4c7eb0..387c60413 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -591,10 +591,19 @@ function main(){ if [[ -s /tmp/testapi-host.jwt ]]; then echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 # discard expected output that normally flows to stderr - ziti edge enroll /tmp/testapi-host.jwt 2>&1 \ - | grep -vE '(generating.*key|enrolled\s+successfully)' - rm -f /tmp/testapi-host.jwt - echo "DEBUG: deleted /tmp/testapi-host.jwt after enrolling successfully" >&3 + ENROLL_OUT="$( + ziti edge enroll /tmp/testapi-host.jwt 2>&1 \ + | grep -vE '(generating.*key|enrolled\s+successfully)' \ + || true + )" + if [[ -z "${ENROLL_OUT}" ]]; then + rm -f /tmp/testapi-host.jwt + echo "DEBUG: deleted /tmp/testapi-host.jwt after enrolling successfully" >&3 + else + echo -e "ERROR: unexpected result during OpenZiti Identity enrollment\n"\ + "${ENROLL_OUT}" + exit 1 + fi fi if [[ -s /tmp/testapi-host.json ]]; then From 3b114f4374727f7f72e9b157f2b808f072848f69 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 11 Mar 2023 23:33:41 -0500 Subject: [PATCH 26/97] stop setting default value for ziti namespace in declare statement because it's assigned later during arg parsing --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 387c60413..58a7f07e6 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -135,7 +135,7 @@ function main(){ # local strings with defaults that never produce an error declare DETECTED_OS \ MINIKUBE_PROFILE="miniziti" \ - ZITI_NAMESPACE="miniziti" \ + ZITI_NAMESPACE \ DELETE_MINIZITI=0 \ MINIKUBE_NODE_EXTERNAL \ DEBUG_MINIKUBE_TUNNEL \ From 9ac330582bff8dcca1377cd195ac2c01abaa96ba Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sat, 11 Mar 2023 23:34:12 -0500 Subject: [PATCH 27/97] stop declaring a local for an env var that's intended to be exported by parent process --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 1 - 1 file changed, 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 58a7f07e6..e1b9c570a 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -138,7 +138,6 @@ function main(){ ZITI_NAMESPACE \ DELETE_MINIZITI=0 \ MINIKUBE_NODE_EXTERNAL \ - DEBUG_MINIKUBE_TUNNEL \ ZITI_CHARTS="openziti" # local arrays with defaults that never produce an error declare -a MINIKUBE_START_ARGS=() From 4e231d85eb7735c916cac0900adfdbd3847dcb0e Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Sun, 12 Mar 2023 00:57:23 -0500 Subject: [PATCH 28/97] send most commands' stdout to the debug descriptor --- .../learn/quickstarts/network/miniziti.bash | 129 ++++++++++-------- 1 file changed, 72 insertions(+), 57 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index e1b9c570a..586e0af8c 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -13,23 +13,28 @@ function banner(){ BANNER if (( $# )); then - echo -e " .: $* edition :.\n" + echo -e " .: $* :.\n" fi } function _usage(){ - banner - echo -e " COMMANDS\n"\ - "\t start\t\tstart miniziti (default)\n"\ - "\t delete\t\tdelete miniziti\n"\ - "\t help\t\tshow these usage hints\n"\ + if (( $# )); then + echo -e "\nERROR: unexpected arg '$1'" >&2 + else + banner + fi + echo -e "\n COMMANDS\n"\ + " start\t\tstart miniziti (default)\n"\ + " delete\t\tdelete miniziti\n"\ + " help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ - "\t --quiet\tsuppress INFO messages\n"\ - "\t --verbose\tshow DEBUG messages\n"\ - "\t --profile\tMINIKUBE_PROFILE (miniziti)\n"\ - "\t --namespace\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ + " --quiet\t\tsuppress INFO messages\n"\ + " --verbose\t\tshow DEBUG messages\n"\ + " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ + " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ "\n DEBUG\n"\ - "\t --charts\tZITI_CHARTS (openziti) alternative charts repo\n" + " --charts\t\tZITI_CHARTS (openziti) alternative charts repo\n"\ + " --\t\t\tMINIKUBE_START_ARGS args after -- passed to minikube start\n" } function checkDns(){ @@ -60,7 +65,7 @@ function deleteMiniziti(){ echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 sleep "$WAIT" echo "INFO: waiting for ${MINIKUBE_PROFILE} to be deleted" - minikube --profile "${MINIKUBE_PROFILE}" delete >/dev/null + minikube --profile "${MINIKUBE_PROFILE}" delete >&3 } function detectOs(){ @@ -85,7 +90,7 @@ function getClientOttPath(){ case $1 in macOS|Linux) echo "$ID_PATH" ;; - Windows) echo "$(wslpath -w $ID_PATH)" + Windows) wslpath -w "$ID_PATH" ;; esac else @@ -97,7 +102,7 @@ function getClientOttPath(){ function testClusterDns(){ if kubectl run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ - nslookup minicontroller.ziti | grep "$1" >/dev/null; then + nslookup minicontroller.ziti | grep "$1" >&3; then echo "INFO: cluster dns test succeeded" else echo "ERROR: cluster dns test failed" >&2 @@ -171,11 +176,20 @@ function main(){ exec 3>&1 shift ;; - -h|*help) _usage - exit + --) shift + mapfile -t -n1 MINIKUBE_START_ARGS <<< "$*" + shift $# + if (( ${#MINIKUBE_START_ARGS[*]} )) && [[ -n "${MINIKUBE_START_ARGS[0]}" ]]; then + echo "DEBUG: passing ${#MINIKUBE_START_ARGS[*]} args to minikube start: '${MINIKUBE_START_ARGS[*]}'" >&3 + else + MINIKUBE_START_ARGS=() + fi ;; - *) MINIKUBE_START_ARGS+=("$1") - shift + -h|*help) _usage + exit 0 + ;; + *) _usage "$1" + exit ;; esac done @@ -214,7 +228,7 @@ function main(){ echo "DEBUG: apiserver not running or got extra start args, running 'minikube start'" >&3 minikube start \ --profile "${MINIKUBE_PROFILE}" \ - "${MINIKUBE_START_ARGS[@]}" >/dev/null + "${MINIKUBE_START_ARGS[@]}" >&3 else echo "DEBUG: apiserver is running, not starting minikube" >&3 fi @@ -229,7 +243,7 @@ function main(){ fi # verify current context can connect to apiserver - kubectl cluster-info >/dev/null + kubectl cluster-info >&3 echo "DEBUG: kubectl successfully obtained cluster-info from apiserver" >&3 # enable ssl-passthrough for OpenZiti ingresses @@ -242,9 +256,9 @@ function main(){ echo "DEBUG: installing ingress-nginx" >&3 # enable minikube addons for ingress-nginx minikube addons enable ingress \ - --profile "${MINIKUBE_PROFILE}" >/dev/null + --profile "${MINIKUBE_PROFILE}" >&3 minikube addons enable ingress-dns \ - --profile "${MINIKUBE_PROFILE}" >/dev/null + --profile "${MINIKUBE_PROFILE}" >&3 echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 kubectl patch deployment "ingress-nginx-controller" \ @@ -253,7 +267,7 @@ function main(){ --patch '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--enable-ssl-passthrough" - }]' >/dev/null + }]' >&3 fi echo "INFO: waiting for ingress-nginx to be ready" @@ -261,26 +275,26 @@ function main(){ kubectl wait jobs "ingress-nginx-admission-patch" \ --namespace ingress-nginx \ --for condition=complete \ - --timeout 120s >/dev/null + --timeout 120s >&3 kubectl wait pods \ --namespace ingress-nginx \ --for condition=ready \ --selector app.kubernetes.io/component=controller \ - --timeout 120s >/dev/null + --timeout 120s >&3 echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 kubectl apply \ - --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >/dev/null + --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >&3 kubectl apply \ - --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >/dev/null + --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >&3 if helm repo list | grep -q openziti; then echo "DEBUG: refreshing OpenZiti Helm Charts" >&3 - helm repo update openziti >/dev/null + helm repo update openziti >&3 else echo "INFO: subscribing to OpenZiti Helm Charts" - helm repo add openziti https://docs.openziti.io/helm-charts/ >/dev/null + helm repo add openziti https://docs.openziti.io/helm-charts/ >&3 fi # @@ -293,27 +307,27 @@ function main(){ --namespace "${ZITI_NAMESPACE}" \ --set clientApi.advertisedHost="minicontroller.ziti" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 else echo "INFO: installing openziti controller" helm install "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ --set clientApi.advertisedHost="minicontroller.ziti" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >/dev/null + --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 fi echo "DEBUG: setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" >&3 minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ config set-context "${MINIKUBE_PROFILE}" \ - --namespace "${ZITI_NAMESPACE}" >/dev/null + --namespace "${ZITI_NAMESPACE}" >&3 for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do echo "INFO: waiting for $DEPLOYMENT to be ready" kubectl wait deployments "$DEPLOYMENT" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ - --timeout 240s >/dev/null + --timeout 240s >&3 done # @@ -324,7 +338,7 @@ function main(){ # ingress causing minikube to immediately prompt for sudo password if (( DEBUG_MINIKUBE_TUNNEL )) || [[ "${DETECTED_OS}" =~ Windows|macOS ]]; then echo "DEBUG: detected OS is ${DETECTED_OS}, probing for minikube tunnel" >&3 - if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >/dev/null; then + if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >&3; then echo -e "ERROR: ${DETECTED_OS} OS requires a running minikube tunnel for ingresses."\ " In another terminal, run the following command. Then re-run this script."\ "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel\n" >&2 @@ -394,19 +408,19 @@ function main(){ cache 30 forward . ${MINIKUBE_NODE_EXTERNAL} } - " >/dev/null + " >&3 echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 kubectl get pods \ --namespace kube-system \ | awk '/^coredns-/ {print $1}' \ | xargs kubectl delete pods \ - --namespace kube-system >/dev/null + --namespace kube-system >&3 echo "DEBUG: waiting for cluster dns to be ready" >&3 kubectl wait deployments "coredns" \ --namespace kube-system \ - --for condition=Available=True >/dev/null + --for condition=Available=True >&3 # perform a DNS query in a pod so we know ingress-dns is working inside the cluster testClusterDns "${MINIKUBE_NODE_EXTERNAL}" @@ -422,19 +436,19 @@ function main(){ --output go-template='{{index .data "admin-password" | base64decode }}' \ | xargs ziti edge login minicontroller.ziti:443 \ --yes --username "admin" \ - --password >/dev/null + --password >&3 if ziti edge list edge-routers 'name="minirouter"' \ | grep -q minirouter; then echo "DEBUG: updating minirouter" >&3 ziti edge update edge-router "minirouter" \ - --role-attributes "public-routers" >/dev/null + --role-attributes "public-routers" >&3 else echo "DEBUG: creating minirouter" >&3 ziti edge create edge-router "minirouter" \ --role-attributes "public-routers" \ --tunneler-enabled \ - --jwt-output-file /tmp/minirouter.jwt >/dev/null + --jwt-output-file /tmp/minirouter.jwt >&3 fi if helm list --all --namespace "${ZITI_NAMESPACE}" \ @@ -445,7 +459,7 @@ function main(){ --set enrollmentJwt=\ \ --set edge.advertisedHost=minirouter.ziti \ --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:6262" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 else echo "DEBUG: installing router chart as 'minirouter'" >&3 helm install "minirouter" "${ZITI_CHARTS}/ziti-router" \ @@ -453,13 +467,13 @@ function main(){ --set-file enrollmentJwt=/tmp/minirouter.jwt \ --set edge.advertisedHost=minirouter.ziti \ --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:6262" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >/dev/null + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 fi echo "INFO: waiting for minirouter to be ready" kubectl wait deployments "minirouter" \ --namespace "${ZITI_NAMESPACE}" \ - --for condition=Available=True >/dev/null + --for condition=Available=True >&3 echo "DEBUG: probing minirouter for online status" >&3 if ziti edge list edge-routers 'name="minirouter"' \ @@ -482,26 +496,26 @@ function main(){ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniconsole.ziti \ --set "settings.edgeControllers[0].url=https://minicontroller-client.${ZITI_NAMESPACE}.svc:443" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 else echo "DEBUG: installing console chart as 'miniconsole'" >&3 helm install "miniconsole" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniconsole.ziti \ --set "settings.edgeControllers[0].url=https://minicontroller-client.${ZITI_NAMESPACE}.svc:443" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >/dev/null + --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 fi echo "INFO: waiting for miniconsole to be ready" kubectl wait deployments "miniconsole" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ - --timeout 240s >/dev/null + --timeout 240s >&3 echo "DEBUG: setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" >&3 minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ config set-context "${MINIKUBE_PROFILE}" \ - --namespace "${ZITI_NAMESPACE}" >/dev/null + --namespace "${ZITI_NAMESPACE}" >&3 # ## Ensure OpenZiti Identities and Services are Created @@ -511,7 +525,7 @@ function main(){ | grep -q "${MINIKUBE_PROFILE}-client"; then echo "DEBUG: creating identity ${MINIKUBE_PROFILE}-client" >&3 ziti edge create identity device "${MINIKUBE_PROFILE}-client" \ - --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes testapi-clients >/dev/null + --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes testapi-clients >&3 else echo "DEBUG: ignoring identity ${MINIKUBE_PROFILE}-client" >&3 fi @@ -520,7 +534,7 @@ function main(){ | grep -q "testapi-host"; then echo "DEBUG: creating identity testapi-host" >&3 ziti edge create identity device "testapi-host" \ - --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >/dev/null + --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >&3 else echo "DEBUG: ignoring identity testapi-host" >&3 fi @@ -529,7 +543,7 @@ function main(){ | grep -q "testapi-intercept-config"; then echo "DEBUG: creating config testapi-intercept-config" >&3 ziti edge create config "testapi-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >/dev/null + '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 else echo "DEBUG: ignoring config testapi-intercept-config" >&3 fi @@ -538,7 +552,7 @@ function main(){ | grep -q "testapi-host-config"; then echo "DEBUG: creating config testapi-host-config" >&3 ziti edge create config "testapi-host-config" host.v1 \ - '{"protocol":"tcp", "address":"httpbin","port":8080}' >/dev/null + '{"protocol":"tcp", "address":"httpbin","port":8080}' >&3 else echo "DEBUG: ignoring config testapi-host-config" >&3 fi @@ -546,7 +560,8 @@ function main(){ if ! ziti edge list services 'name="testapi-service"' --csv \ | grep -q "testapi-service"; then echo "DEBUG: creating service testapi-service" >&3 - ziti edge create service "testapi-service" --configs testapi-intercept-config,testapi-host-config >/dev/null + ziti edge create service "testapi-service" \ + --configs testapi-intercept-config,testapi-host-config >&3 else echo "DEBUG: ignoring service testapi-service" >&3 fi @@ -555,7 +570,7 @@ function main(){ | grep -q "testapi-bind-policy"; then echo "DEBUG: creating service-policy testapi-bind-policy" >&3 ziti edge create service-policy "testapi-bind-policy" Bind \ - --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >/dev/null + --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >&3 else echo "DEBUG: ignoring service-policy testapi-bind-policy" >&3 fi @@ -564,7 +579,7 @@ function main(){ | grep -q "testapi-dial-policy"; then echo "DEBUG: creating service-policy testapi-dial-policy" >&3 ziti edge create service-policy "testapi-dial-policy" Dial \ - --service-roles '@testapi-service' --identity-roles '#testapi-clients' >/dev/null + --service-roles '@testapi-service' --identity-roles '#testapi-clients' >&3 else echo "DEBUG: ignoring service-policy testapi-dial-policy" >&3 fi @@ -573,7 +588,7 @@ function main(){ | grep -q "public-routers"; then echo "DEBUG: creating edge-router-policy public-routers" >&3 ziti edge create edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --identity-roles '#all' >/dev/null + --edge-router-roles '#public-routers' --identity-roles '#all' >&3 else echo "DEBUG: ignoring edge-router-policy public-routers" >&3 fi @@ -582,7 +597,7 @@ function main(){ | grep -q "public-routers"; then echo "DEBUG: creating service-edge-router-policy public-routers" >&3 ziti edge create service-edge-router-policy "public-routers" \ - --edge-router-roles '#public-routers' --service-roles '#all' >/dev/null + --edge-router-roles '#public-routers' --service-roles '#all' >&3 else echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 fi @@ -609,7 +624,7 @@ function main(){ echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 helm install "testapi-host" "${ZITI_CHARTS}/httpbin" \ --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >/dev/null + --set zitiServiceName=testapi-service >&3 rm -f /tmp/testapi-host.json echo "DEBUG: deleted /tmp/testapi-host.json after installing successfully with testapi-host chart" >&3 fi From 294cf31c3a6476218f80de5320e0b1d762bec0d3 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 13 Mar 2023 09:48:46 -0400 Subject: [PATCH 29/97] rename miniapi service --- .../learn/quickstarts/network/miniziti.bash | 96 +++++++++---------- 1 file changed, 48 insertions(+), 48 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 586e0af8c..aa81067f7 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -525,63 +525,63 @@ function main(){ | grep -q "${MINIKUBE_PROFILE}-client"; then echo "DEBUG: creating identity ${MINIKUBE_PROFILE}-client" >&3 ziti edge create identity device "${MINIKUBE_PROFILE}-client" \ - --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes testapi-clients >&3 + --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes miniapi-clients >&3 else echo "DEBUG: ignoring identity ${MINIKUBE_PROFILE}-client" >&3 fi - if ! ziti edge list identities 'name="testapi-host"' --csv \ - | grep -q "testapi-host"; then - echo "DEBUG: creating identity testapi-host" >&3 - ziti edge create identity device "testapi-host" \ - --jwt-output-file /tmp/testapi-host.jwt --role-attributes testapi-hosts >&3 + if ! ziti edge list identities 'name="miniapi-host"' --csv \ + | grep -q "miniapi-host"; then + echo "DEBUG: creating identity miniapi-host" >&3 + ziti edge create identity device "miniapi-host" \ + --jwt-output-file /tmp/miniapi-host.jwt --role-attributes miniapi-hosts >&3 else - echo "DEBUG: ignoring identity testapi-host" >&3 + echo "DEBUG: ignoring identity miniapi-host" >&3 fi - if ! ziti edge list configs 'name="testapi-intercept-config"' --csv \ - | grep -q "testapi-intercept-config"; then - echo "DEBUG: creating config testapi-intercept-config" >&3 - ziti edge create config "testapi-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["testapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 + if ! ziti edge list configs 'name="miniapi-intercept-config"' --csv \ + | grep -q "miniapi-intercept-config"; then + echo "DEBUG: creating config miniapi-intercept-config" >&3 + ziti edge create config "miniapi-intercept-config" intercept.v1 \ + '{"protocols":["tcp"],"addresses":["miniapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 else - echo "DEBUG: ignoring config testapi-intercept-config" >&3 + echo "DEBUG: ignoring config miniapi-intercept-config" >&3 fi - if ! ziti edge list configs 'name="testapi-host-config"' --csv \ - | grep -q "testapi-host-config"; then - echo "DEBUG: creating config testapi-host-config" >&3 - ziti edge create config "testapi-host-config" host.v1 \ + if ! ziti edge list configs 'name="miniapi-host-config"' --csv \ + | grep -q "miniapi-host-config"; then + echo "DEBUG: creating config miniapi-host-config" >&3 + ziti edge create config "miniapi-host-config" host.v1 \ '{"protocol":"tcp", "address":"httpbin","port":8080}' >&3 else - echo "DEBUG: ignoring config testapi-host-config" >&3 + echo "DEBUG: ignoring config miniapi-host-config" >&3 fi - if ! ziti edge list services 'name="testapi-service"' --csv \ - | grep -q "testapi-service"; then - echo "DEBUG: creating service testapi-service" >&3 - ziti edge create service "testapi-service" \ - --configs testapi-intercept-config,testapi-host-config >&3 + if ! ziti edge list services 'name="miniapi-service"' --csv \ + | grep -q "miniapi-service"; then + echo "DEBUG: creating service miniapi-service" >&3 + ziti edge create service "miniapi-service" \ + --configs miniapi-intercept-config,miniapi-host-config >&3 else - echo "DEBUG: ignoring service testapi-service" >&3 + echo "DEBUG: ignoring service miniapi-service" >&3 fi - if ! ziti edge list service-policies 'name="testapi-bind-policy"' --csv \ - | grep -q "testapi-bind-policy"; then - echo "DEBUG: creating service-policy testapi-bind-policy" >&3 - ziti edge create service-policy "testapi-bind-policy" Bind \ - --service-roles '@testapi-service' --identity-roles '#testapi-hosts' >&3 + if ! ziti edge list service-policies 'name="miniapi-bind-policy"' --csv \ + | grep -q "miniapi-bind-policy"; then + echo "DEBUG: creating service-policy miniapi-bind-policy" >&3 + ziti edge create service-policy "miniapi-bind-policy" Bind \ + --service-roles '@miniapi-service' --identity-roles '#miniapi-hosts' >&3 else - echo "DEBUG: ignoring service-policy testapi-bind-policy" >&3 + echo "DEBUG: ignoring service-policy miniapi-bind-policy" >&3 fi - if ! ziti edge list service-policies 'name="testapi-dial-policy"' --csv \ - | grep -q "testapi-dial-policy"; then - echo "DEBUG: creating service-policy testapi-dial-policy" >&3 - ziti edge create service-policy "testapi-dial-policy" Dial \ - --service-roles '@testapi-service' --identity-roles '#testapi-clients' >&3 + if ! ziti edge list service-policies 'name="miniapi-dial-policy"' --csv \ + | grep -q "miniapi-dial-policy"; then + echo "DEBUG: creating service-policy miniapi-dial-policy" >&3 + ziti edge create service-policy "miniapi-dial-policy" Dial \ + --service-roles '@miniapi-service' --identity-roles '#miniapi-clients' >&3 else - echo "DEBUG: ignoring service-policy testapi-dial-policy" >&3 + echo "DEBUG: ignoring service-policy miniapi-dial-policy" >&3 fi if ! ziti edge list edge-router-policies 'name="public-routers"' --csv \ @@ -602,17 +602,17 @@ function main(){ echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 fi - if [[ -s /tmp/testapi-host.jwt ]]; then - echo "DEBUG: enrolling /tmp/testapi-host.jwt" >&3 + if [[ -s /tmp/miniapi-host.jwt ]]; then + echo "DEBUG: enrolling /tmp/miniapi-host.jwt" >&3 # discard expected output that normally flows to stderr ENROLL_OUT="$( - ziti edge enroll /tmp/testapi-host.jwt 2>&1 \ + ziti edge enroll /tmp/miniapi-host.jwt 2>&1 \ | grep -vE '(generating.*key|enrolled\s+successfully)' \ || true )" if [[ -z "${ENROLL_OUT}" ]]; then - rm -f /tmp/testapi-host.jwt - echo "DEBUG: deleted /tmp/testapi-host.jwt after enrolling successfully" >&3 + rm -f /tmp/miniapi-host.jwt + echo "DEBUG: deleted /tmp/miniapi-host.jwt after enrolling successfully" >&3 else echo -e "ERROR: unexpected result during OpenZiti Identity enrollment\n"\ "${ENROLL_OUT}" @@ -620,13 +620,13 @@ function main(){ fi fi - if [[ -s /tmp/testapi-host.json ]]; then - echo "DEBUG: installing httpbin chart as 'testapi-host'" >&3 - helm install "testapi-host" "${ZITI_CHARTS}/httpbin" \ - --set-file zitiIdentity=/tmp/testapi-host.json \ - --set zitiServiceName=testapi-service >&3 - rm -f /tmp/testapi-host.json - echo "DEBUG: deleted /tmp/testapi-host.json after installing successfully with testapi-host chart" >&3 + if [[ -s /tmp/miniapi-host.json ]]; then + echo "DEBUG: installing httpbin chart as 'miniapi-host'" >&3 + helm install "miniapi-host" "${ZITI_CHARTS}/httpbin" \ + --set-file zitiIdentity=/tmp/miniapi-host.json \ + --set zitiServiceName=miniapi-service >&3 + rm -f /tmp/miniapi-host.json + echo "DEBUG: deleted /tmp/miniapi-host.json after installing successfully with miniapi-host chart" >&3 fi kubectl get secrets "minicontroller-admin-secret" \ From c2a4118aba2afc1e0cacb05a832c446ce452e2b6 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 13 Mar 2023 09:49:08 -0400 Subject: [PATCH 30/97] explicitly enable needed sub-charts for the miniziti scenario --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index aa81067f7..54893eeec 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -307,6 +307,8 @@ function main(){ --namespace "${ZITI_NAMESPACE}" \ --set clientApi.advertisedHost="minicontroller.ziti" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ + --set trust-manager.enabled=true \ + --set cert-manager.enabled=true \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 else echo "INFO: installing openziti controller" @@ -314,6 +316,8 @@ function main(){ --namespace "${ZITI_NAMESPACE}" --create-namespace \ --set clientApi.advertisedHost="minicontroller.ziti" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ + --set trust-manager.enabled=true \ + --set cert-manager.enabled=true \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 fi From d6669100f251c5adafd7e79f89a22f67c285fe4a Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 13 Mar 2023 11:26:17 -0400 Subject: [PATCH 31/97] add log functions --- .../learn/quickstarts/network/miniziti.bash | 202 ++++++++++-------- 1 file changed, 113 insertions(+), 89 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 54893eeec..b8de520ac 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -4,7 +4,7 @@ set -o errexit set -o nounset set -o pipefail -function banner(){ +banner(){ cat <&2 else @@ -37,16 +37,16 @@ function _usage(){ " --\t\t\tMINIKUBE_START_ARGS args after -- passed to minikube start\n" } -function checkDns(){ +checkDns(){ # only param is an IPv4 [[ $# -eq 1 && $1 =~ ([0-9]{1,3}\.){3}[0-9]{1,3} ]] || { - echo "ERROR: need IPv4 of miniziti ingress as only param to checkDns()" >&2 + logError "need IPv4 of miniziti ingress as only param to checkDns()" return 1 } - echo "DEBUG: checking dns to ensure minicontroller.ziti resolves to $1" >&3 + logDebug "checking dns to ensure minicontroller.ziti resolves to $1" if grep -qE "^${1//./\\.}.*minicontroller.ziti" /etc/hosts \ || nslookup minicontroller.ziti | grep -q "${1//./\\.}"; then - echo "DEBUG: host dns found expected minikube ingress IP '$1'" >&3 + logDebug "host dns found expected minikube ingress IP '$1'" return 0 else echo "ERROR: minicontroller.ziti does not resolve to '$1'. Did you add the record in /etc/hosts?" @@ -54,37 +54,37 @@ function checkDns(){ fi } -function deleteMiniziti(){ +deleteMiniziti(){ local WAIT=10 if [[ $1 =~ ^[0-9]+$ ]]; then WAIT="$1" shift else - echo "DEBUG: no integer param detected to deleteMiniziti(), using default wait time ${WAIT}s" >&3 + logDebug "no integer param detected to deleteMiniziti(), using default wait time ${WAIT}s" fi echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 sleep "$WAIT" - echo "INFO: waiting for ${MINIKUBE_PROFILE} to be deleted" + logInfo "waiting for ${MINIKUBE_PROFILE} to be deleted" minikube --profile "${MINIKUBE_PROFILE}" delete >&3 } -function detectOs(){ +detectOs(){ if grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then - echo "DEBUG: detected Windows OS" >&3 + logDebug "detected Windows OS" echo "Windows" elif [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then - echo "DEBUG: detected macOS OS" >&3 + logDebug "detected macOS OS" echo "macOS" elif [[ ${OSTYPE:-} =~ [Ll]inux ]]; then - echo "DEBUG: detected Linux OS" >&3 + logDebug "detected Linux OS" echo "Linux" else - echo "ERROR: failed to detect OS" >&2 + logError "failed to detect OS" return 1 fi } -function getClientOttPath(){ +getClientOttPath(){ local ID_PATH="/tmp/${MINIKUBE_PROFILE}-client.jwt" if [[ $# -eq 1 ]]; then case $1 in @@ -94,42 +94,66 @@ function getClientOttPath(){ ;; esac else - echo "ERROR: getClientOttPath() takes one param, DETECTED_OS" >&2 + logError "getClientOttPath() takes one param, DETECTED_OS" return 1 fi } -function testClusterDns(){ +testClusterDns(){ if kubectl run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ nslookup minicontroller.ziti | grep "$1" >&3; then - echo "INFO: cluster dns test succeeded" + logInfo "cluster dns test succeeded" else - echo "ERROR: cluster dns test failed" >&2 + logError "cluster dns test failed" return 1 fi } -function validateDnsName(){ +validateDnsName(){ if ! [[ $# -eq 1 ]]; then - echo "ERROR: validateDnsName() takes one string param" >&2 + logError "validateDnsName() takes one string param" return 1 fi if grep -qP '(?=^.{4,253}$)(^(?:[a-zA-Z0-9](?:(?:[a-zA-Z0-9\-]){0,61}[a-zA-Z0-9])?)+[a-zA-Z0-9]$)' <<< "$1"; then - echo "DEBUG: '$1' is a valid DNS name" >&3 + logDebug "'$1' is a valid DNS name" return 0 else - echo "ERROR: '$1' could not be validated as an unqualified DNS name which is limited to at least four alphanumeric and hyphen characters, starts with a letter, and does not end with a hyphen." >&2 + logError "'$1' could not be validated as an unqualified DNS name which is limited to at least four alphanumeric and hyphen characters, starts with a letter, and does not end with a hyphen." return 1 fi } -function main(){ +logInfo() { + (( $# )) || { + logError "logInfo() takes 1 or more args" + return 1 + } + echo "INFO: $*" +} + +logError() { + (( $# )) || { + echo "ERROR: logError() takes 1 or more args" >&2 + return 1 + } + echo "ERROR: $*" >&2 +} + +logDebug() { + (( $# )) || { + logError "logDebug() takes 1 or more args" + return 1 + } + echo "DEBUG: $*" >&3 +} + +main(){ # require commands declare -a BINS=(ziti minikube kubectl helm) for BIN in "${BINS[@]}"; do if ! command -v "$BIN" &>/dev/null; then - echo "ERROR: this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." >&2 + logError "this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." $BIN || exit 1 fi done @@ -180,7 +204,7 @@ function main(){ mapfile -t -n1 MINIKUBE_START_ARGS <<< "$*" shift $# if (( ${#MINIKUBE_START_ARGS[*]} )) && [[ -n "${MINIKUBE_START_ARGS[0]}" ]]; then - echo "DEBUG: passing ${#MINIKUBE_START_ARGS[*]} args to minikube start: '${MINIKUBE_START_ARGS[*]}'" >&3 + logDebug "passing ${#MINIKUBE_START_ARGS[*]} args to minikube start: '${MINIKUBE_START_ARGS[*]}'" else MINIKUBE_START_ARGS=() fi @@ -200,7 +224,7 @@ function main(){ # sanity check the profile name input if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then # in case the arg value is another option instead of the profile name - echo "ERROR: --profile needs a profile name not starting with a hyphen" >&2 + logError "--profile needs a profile name not starting with a hyphen" _usage; exit 1 fi # print the alternative profile name if not default "miniziti" @@ -220,47 +244,47 @@ function main(){ # # run 'minikube start' if not running or any extra start args are present - echo "INFO: waiting for minikube to be ready" + logInfo "waiting for minikube to be ready" if ! minikube status \ --profile "${MINIKUBE_PROFILE}" 2>/dev/null \ | grep -q "apiserver: Running" \ || (( ${#MINIKUBE_START_ARGS[*]} )); then - echo "DEBUG: apiserver not running or got extra start args, running 'minikube start'" >&3 + logDebug "apiserver not running or got extra start args, running 'minikube start'" minikube start \ --profile "${MINIKUBE_PROFILE}" \ "${MINIKUBE_START_ARGS[@]}" >&3 else - echo "DEBUG: apiserver is running, not starting minikube" >&3 + logDebug "apiserver is running, not starting minikube" fi MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then - echo "DEBUG: the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" >&3 + logDebug "the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" else - echo "ERROR: failed to find minikube external IP" >&2 + logError "failed to find minikube external IP" exit 1 fi # verify current context can connect to apiserver kubectl cluster-info >&3 - echo "DEBUG: kubectl successfully obtained cluster-info from apiserver" >&3 + logDebug "kubectl successfully obtained cluster-info from apiserver" # enable ssl-passthrough for OpenZiti ingresses if kubectl get deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ | grep -q enable-ssl-passthrough; then - echo "DEBUG: ingress-nginx has ssl-passthrough enabled" >&3 + logDebug "ingress-nginx has ssl-passthrough enabled" else - echo "DEBUG: installing ingress-nginx" >&3 + logDebug "installing ingress-nginx" # enable minikube addons for ingress-nginx minikube addons enable ingress \ --profile "${MINIKUBE_PROFILE}" >&3 minikube addons enable ingress-dns \ --profile "${MINIKUBE_PROFILE}" >&3 - echo "DEBUG: patching ingress-nginx deployment to enable ssl-passthrough" >&3 + logDebug "patching ingress-nginx deployment to enable ssl-passthrough" kubectl patch deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ --type json \ @@ -270,7 +294,7 @@ function main(){ }]' >&3 fi - echo "INFO: waiting for ingress-nginx to be ready" + logInfo "waiting for ingress-nginx to be ready" # wait for ingress-nginx kubectl wait jobs "ingress-nginx-admission-patch" \ --namespace ingress-nginx \ @@ -283,17 +307,17 @@ function main(){ --selector app.kubernetes.io/component=controller \ --timeout 120s >&3 - echo "DEBUG: applying Custom Resource Definitions: Certificate, Issuer, and Bundle" >&3 + logDebug "applying Custom Resource Definitions: Certificate, Issuer, and Bundle" kubectl apply \ --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >&3 kubectl apply \ --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >&3 if helm repo list | grep -q openziti; then - echo "DEBUG: refreshing OpenZiti Helm Charts" >&3 + logDebug "refreshing OpenZiti Helm Charts" helm repo update openziti >&3 else - echo "INFO: subscribing to OpenZiti Helm Charts" + logInfo "subscribing to OpenZiti Helm Charts" helm repo add openziti https://docs.openziti.io/helm-charts/ >&3 fi @@ -302,7 +326,7 @@ function main(){ # if helm list --namespace "${ZITI_NAMESPACE}" --all | grep -q minicontroller; then - echo "INFO: upgrading openziti controller" + logInfo "upgrading openziti controller" helm upgrade "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" \ --set clientApi.advertisedHost="minicontroller.ziti" \ @@ -311,7 +335,7 @@ function main(){ --set cert-manager.enabled=true \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 else - echo "INFO: installing openziti controller" + logInfo "installing openziti controller" helm install "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ --set clientApi.advertisedHost="minicontroller.ziti" \ @@ -321,13 +345,13 @@ function main(){ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 fi - echo "DEBUG: setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" >&3 + logDebug "setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >&3 for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do - echo "INFO: waiting for $DEPLOYMENT to be ready" + logInfo "waiting for $DEPLOYMENT to be ready" kubectl wait deployments "$DEPLOYMENT" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ @@ -341,14 +365,14 @@ function main(){ # wait to probe for the minikube tunnel until after controller deployment so there's at least one # ingress causing minikube to immediately prompt for sudo password if (( DEBUG_MINIKUBE_TUNNEL )) || [[ "${DETECTED_OS}" =~ Windows|macOS ]]; then - echo "DEBUG: detected OS is ${DETECTED_OS}, probing for minikube tunnel" >&3 + logDebug "detected OS is ${DETECTED_OS}, probing for minikube tunnel" if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >&3; then echo -e "ERROR: ${DETECTED_OS} OS requires a running minikube tunnel for ingresses."\ " In another terminal, run the following command. Then re-run this script."\ "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel\n" >&2 exit 1 else - echo "DEBUG: minikube tunnel is running" >&3 + logDebug "minikube tunnel is running" fi # recommend /etc/hosts change unless dns is configured to reach the minikube node IP checkDns "127.0.0.1" @@ -361,22 +385,22 @@ function main(){ # if ! testClusterDns "${MINIKUBE_NODE_EXTERNAL}" 2>/dev/null; then - echo "DEBUG: initial cluster dns test failed, doing cluster dns setup" >&3 + logDebug "initial cluster dns test failed, doing cluster dns setup" # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output - echo "DEBUG: probing minikube node for internal host record" >&3 + logDebug "probing minikube node for internal host record" MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then # strip surrounding whitespace MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") - echo "DEBUG: the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" >&3 + logDebug "the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" else - echo "ERROR: failed to find minikube internal IP" >&2 + logError "failed to find minikube internal IP" exit 1 fi - echo "DEBUG: patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" >&3 + logDebug "patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" kubectl patch configmap "coredns" \ --namespace kube-system \ --patch " @@ -414,14 +438,14 @@ function main(){ } " >&3 - echo "DEBUG: deleting coredns pod so a new one will have modified Corefile" >&3 + logDebug "deleting coredns pod so a new one will have modified Corefile" kubectl get pods \ --namespace kube-system \ | awk '/^coredns-/ {print $1}' \ | xargs kubectl delete pods \ --namespace kube-system >&3 - echo "DEBUG: waiting for cluster dns to be ready" >&3 + logDebug "waiting for cluster dns to be ready" kubectl wait deployments "coredns" \ --namespace kube-system \ --for condition=Available=True >&3 @@ -434,7 +458,7 @@ function main(){ ## Ensure OpenZiti Router is Enrolled and Ready # - echo "DEBUG: fetching admin password from k8s secret to log in to ziti mgmt" >&3 + logDebug "fetching admin password from k8s secret to log in to ziti mgmt" kubectl get secrets "minicontroller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{index .data "admin-password" | base64decode }}' \ @@ -444,11 +468,11 @@ function main(){ if ziti edge list edge-routers 'name="minirouter"' \ | grep -q minirouter; then - echo "DEBUG: updating minirouter" >&3 + logDebug "updating minirouter" ziti edge update edge-router "minirouter" \ --role-attributes "public-routers" >&3 else - echo "DEBUG: creating minirouter" >&3 + logDebug "creating minirouter" ziti edge create edge-router "minirouter" \ --role-attributes "public-routers" \ --tunneler-enabled \ @@ -457,7 +481,7 @@ function main(){ if helm list --all --namespace "${ZITI_NAMESPACE}" \ | grep -q minirouter; then - echo "DEBUG: upgrading router chart as 'minirouter'" >&3 + logDebug "upgrading router chart as 'minirouter'" helm upgrade "minirouter" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ @@ -465,7 +489,7 @@ function main(){ --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:6262" \ --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 else - echo "DEBUG: installing router chart as 'minirouter'" >&3 + logDebug "installing router chart as 'minirouter'" helm install "minirouter" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt=/tmp/minirouter.jwt \ @@ -474,18 +498,18 @@ function main(){ --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 fi - echo "INFO: waiting for minirouter to be ready" + logInfo "waiting for minirouter to be ready" kubectl wait deployments "minirouter" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True >&3 - echo "DEBUG: probing minirouter for online status" >&3 + logDebug "probing minirouter for online status" if ziti edge list edge-routers 'name="minirouter"' \ | awk '/minirouter/ {print $6}' \ | grep -q true; then - echo "INFO: minirouter is online" + logInfo "minirouter is online" else - echo "ERROR: minirouter is offline" >&2 + logError "minirouter is offline" exit 1 fi @@ -495,14 +519,14 @@ function main(){ if helm --namespace "${ZITI_NAMESPACE}" list --all \ | grep -q miniconsole; then - echo "DEBUG: upgrading console chart as 'miniconsole'" >&3 + logDebug "upgrading console chart as 'miniconsole'" helm upgrade "miniconsole" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniconsole.ziti \ --set "settings.edgeControllers[0].url=https://minicontroller-client.${ZITI_NAMESPACE}.svc:443" \ --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 else - echo "DEBUG: installing console chart as 'miniconsole'" >&3 + logDebug "installing console chart as 'miniconsole'" helm install "miniconsole" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniconsole.ziti \ @@ -510,13 +534,13 @@ function main(){ --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 fi - echo "INFO: waiting for miniconsole to be ready" + logInfo "waiting for miniconsole to be ready" kubectl wait deployments "miniconsole" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ --timeout 240s >&3 - echo "DEBUG: setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" >&3 + logDebug "setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >&3 @@ -527,87 +551,87 @@ function main(){ if ! ziti edge list identities "name=\"${MINIKUBE_PROFILE}-client\"" --csv \ | grep -q "${MINIKUBE_PROFILE}-client"; then - echo "DEBUG: creating identity ${MINIKUBE_PROFILE}-client" >&3 + logDebug "creating identity ${MINIKUBE_PROFILE}-client" ziti edge create identity device "${MINIKUBE_PROFILE}-client" \ --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes miniapi-clients >&3 else - echo "DEBUG: ignoring identity ${MINIKUBE_PROFILE}-client" >&3 + logDebug "ignoring identity ${MINIKUBE_PROFILE}-client" fi if ! ziti edge list identities 'name="miniapi-host"' --csv \ | grep -q "miniapi-host"; then - echo "DEBUG: creating identity miniapi-host" >&3 + logDebug "creating identity miniapi-host" ziti edge create identity device "miniapi-host" \ --jwt-output-file /tmp/miniapi-host.jwt --role-attributes miniapi-hosts >&3 else - echo "DEBUG: ignoring identity miniapi-host" >&3 + logDebug "ignoring identity miniapi-host" fi if ! ziti edge list configs 'name="miniapi-intercept-config"' --csv \ | grep -q "miniapi-intercept-config"; then - echo "DEBUG: creating config miniapi-intercept-config" >&3 + logDebug "creating config miniapi-intercept-config" ziti edge create config "miniapi-intercept-config" intercept.v1 \ '{"protocols":["tcp"],"addresses":["miniapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 else - echo "DEBUG: ignoring config miniapi-intercept-config" >&3 + logDebug "ignoring config miniapi-intercept-config" fi if ! ziti edge list configs 'name="miniapi-host-config"' --csv \ | grep -q "miniapi-host-config"; then - echo "DEBUG: creating config miniapi-host-config" >&3 + logDebug "creating config miniapi-host-config" ziti edge create config "miniapi-host-config" host.v1 \ '{"protocol":"tcp", "address":"httpbin","port":8080}' >&3 else - echo "DEBUG: ignoring config miniapi-host-config" >&3 + logDebug "ignoring config miniapi-host-config" fi if ! ziti edge list services 'name="miniapi-service"' --csv \ | grep -q "miniapi-service"; then - echo "DEBUG: creating service miniapi-service" >&3 + logDebug "creating service miniapi-service" ziti edge create service "miniapi-service" \ --configs miniapi-intercept-config,miniapi-host-config >&3 else - echo "DEBUG: ignoring service miniapi-service" >&3 + logDebug "ignoring service miniapi-service" fi if ! ziti edge list service-policies 'name="miniapi-bind-policy"' --csv \ | grep -q "miniapi-bind-policy"; then - echo "DEBUG: creating service-policy miniapi-bind-policy" >&3 + logDebug "creating service-policy miniapi-bind-policy" ziti edge create service-policy "miniapi-bind-policy" Bind \ --service-roles '@miniapi-service' --identity-roles '#miniapi-hosts' >&3 else - echo "DEBUG: ignoring service-policy miniapi-bind-policy" >&3 + logDebug "ignoring service-policy miniapi-bind-policy" fi if ! ziti edge list service-policies 'name="miniapi-dial-policy"' --csv \ | grep -q "miniapi-dial-policy"; then - echo "DEBUG: creating service-policy miniapi-dial-policy" >&3 + logDebug "creating service-policy miniapi-dial-policy" ziti edge create service-policy "miniapi-dial-policy" Dial \ --service-roles '@miniapi-service' --identity-roles '#miniapi-clients' >&3 else - echo "DEBUG: ignoring service-policy miniapi-dial-policy" >&3 + logDebug "ignoring service-policy miniapi-dial-policy" fi if ! ziti edge list edge-router-policies 'name="public-routers"' --csv \ | grep -q "public-routers"; then - echo "DEBUG: creating edge-router-policy public-routers" >&3 + logDebug "creating edge-router-policy public-routers" ziti edge create edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --identity-roles '#all' >&3 else - echo "DEBUG: ignoring edge-router-policy public-routers" >&3 + logDebug "ignoring edge-router-policy public-routers" fi if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv \ | grep -q "public-routers"; then - echo "DEBUG: creating service-edge-router-policy public-routers" >&3 + logDebug "creating service-edge-router-policy public-routers" ziti edge create service-edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --service-roles '#all' >&3 else - echo "DEBUG: ignoring service-edge-router-policy public-routers" >&3 + logDebug "ignoring service-edge-router-policy public-routers" fi if [[ -s /tmp/miniapi-host.jwt ]]; then - echo "DEBUG: enrolling /tmp/miniapi-host.jwt" >&3 + logDebug "enrolling /tmp/miniapi-host.jwt" # discard expected output that normally flows to stderr ENROLL_OUT="$( ziti edge enroll /tmp/miniapi-host.jwt 2>&1 \ @@ -616,7 +640,7 @@ function main(){ )" if [[ -z "${ENROLL_OUT}" ]]; then rm -f /tmp/miniapi-host.jwt - echo "DEBUG: deleted /tmp/miniapi-host.jwt after enrolling successfully" >&3 + logDebug "deleted /tmp/miniapi-host.jwt after enrolling successfully" else echo -e "ERROR: unexpected result during OpenZiti Identity enrollment\n"\ "${ENROLL_OUT}" @@ -625,12 +649,12 @@ function main(){ fi if [[ -s /tmp/miniapi-host.json ]]; then - echo "DEBUG: installing httpbin chart as 'miniapi-host'" >&3 + logDebug "installing httpbin chart as 'miniapi-host'" helm install "miniapi-host" "${ZITI_CHARTS}/httpbin" \ --set-file zitiIdentity=/tmp/miniapi-host.json \ --set zitiServiceName=miniapi-service >&3 rm -f /tmp/miniapi-host.json - echo "DEBUG: deleted /tmp/miniapi-host.json after installing successfully with miniapi-host chart" >&3 + logDebug "deleted /tmp/miniapi-host.json after installing successfully with miniapi-host chart" fi kubectl get secrets "minicontroller-admin-secret" \ @@ -640,7 +664,7 @@ function main(){ 'INFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}'\ '{{"\n\n"}}' - echo "INFO: Success! Remember to add your edge client identity '$(getClientOttPath "${DETECTED_OS}")' in your tunneler, e.g. Ziti Desktop Edge." + logInfo "Success! Remember to add your edge client identity '$(getClientOttPath "${DETECTED_OS}")' in your tunneler, e.g. Ziti Desktop Edge." } main "$@" From be25624af035905d9ca8b535673f9f64a317969b Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Thu, 16 Mar 2023 23:17:48 -0400 Subject: [PATCH 32/97] add router transport ingress; check helm status properly --- .../learn/quickstarts/network/miniziti.bash | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index b8de520ac..91eb63abf 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -325,7 +325,7 @@ main(){ ## Ensure OpenZiti Controller is Upgraded and Ready # - if helm list --namespace "${ZITI_NAMESPACE}" --all | grep -q minicontroller; then + if helm status minicontroller --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logInfo "upgrading openziti controller" helm upgrade "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" \ @@ -479,23 +479,26 @@ main(){ --jwt-output-file /tmp/minirouter.jwt >&3 fi - if helm list --all --namespace "${ZITI_NAMESPACE}" \ - | grep -q minirouter; then + if helm status minirouter --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logDebug "upgrading router chart as 'minirouter'" helm upgrade "minirouter" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ --set edge.advertisedHost=minirouter.ziti \ - --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:6262" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + --set linkListeners.transport.advertisedHost=minirouter-transport.ziti \ + --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:443" \ + --values /home/kbingham/Sites/netfoundry/github/openziti-helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + # --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 else logDebug "installing router chart as 'minirouter'" helm install "minirouter" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt=/tmp/minirouter.jwt \ --set edge.advertisedHost=minirouter.ziti \ - --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:6262" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + --set linkListeners.transport.advertisedHost=minirouter-transport.ziti \ + --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:443" \ + --values /home/kbingham/Sites/netfoundry/github/openziti-helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + # --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 fi logInfo "waiting for minirouter to be ready" From dda04ea616f2e40b099d1e1b047439c62e9e81f9 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 7 Jul 2023 10:11:15 -0400 Subject: [PATCH 33/97] use HTTPS to reach miniziti.console --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 91eb63abf..1451013cd 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -663,7 +663,7 @@ main(){ kubectl get secrets "minicontroller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{"\n'\ -'INFO: Your OpenZiti Console is here:\thttp://miniconsole.ziti\n'\ +'INFO: Your OpenZiti Console is here:\thttps://miniconsole.ziti\n'\ 'INFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}'\ '{{"\n\n"}}' From ee1c3ccf9914bd039ba05ad7da274edd85066cbe Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 20 Jul 2023 00:20:35 -0400 Subject: [PATCH 34/97] Fixes chart values paths. Consistent docs and branding. Lintfix. --- .../learn/quickstarts/network/miniziti.bash | 322 +++++++++--------- 1 file changed, 160 insertions(+), 162 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 1451013cd..8bd2d50aa 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -6,9 +6,9 @@ set -o pipefail banner(){ cat <&2 sleep "$WAIT" @@ -70,16 +70,16 @@ deleteMiniziti(){ detectOs(){ if grep -qi "microsoft" /proc/sys/kernel/osrelease 2>/dev/null; then - logDebug "detected Windows OS" + logDebug "detected Windows OS" echo "Windows" elif [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then - logDebug "detected macOS OS" + logDebug "detected macOS OS" echo "macOS" elif [[ ${OSTYPE:-} =~ [Ll]inux ]]; then - logDebug "detected Linux OS" + logDebug "detected Linux OS" echo "Linux" else - logError "failed to detect OS" + logError "failed to detect OS" return 1 fi } @@ -94,7 +94,7 @@ getClientOttPath(){ ;; esac else - logError "getClientOttPath() takes one param, DETECTED_OS" + logError "getClientOttPath() takes one param, DETECTED_OS" return 1 fi @@ -102,31 +102,31 @@ getClientOttPath(){ testClusterDns(){ if kubectl run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ - nslookup minicontroller.ziti | grep "$1" >&3; then + nslookup miniziti-controller.ziti | grep "$1" >&3; then logInfo "cluster dns test succeeded" else - logError "cluster dns test failed" + logError "cluster dns test failed" return 1 fi } validateDnsName(){ if ! [[ $# -eq 1 ]]; then - logError "validateDnsName() takes one string param" + logError "validateDnsName() takes one string param" return 1 fi if grep -qP '(?=^.{4,253}$)(^(?:[a-zA-Z0-9](?:(?:[a-zA-Z0-9\-]){0,61}[a-zA-Z0-9])?)+[a-zA-Z0-9]$)' <<< "$1"; then - logDebug "'$1' is a valid DNS name" + logDebug "'$1' is a valid DNS name" return 0 else - logError "'$1' could not be validated as an unqualified DNS name which is limited to at least four alphanumeric and hyphen characters, starts with a letter, and does not end with a hyphen." + logError "'$1' could not be validated as an unqualified DNS name which is limited to at least four alphanumeric and hyphen characters, starts with a letter, and does not end with a hyphen." return 1 fi } logInfo() { (( $# )) || { - logError "logInfo() takes 1 or more args" + logError "logInfo() takes 1 or more args" return 1 } echo "INFO: $*" @@ -137,12 +137,12 @@ logError() { echo "ERROR: logError() takes 1 or more args" >&2 return 1 } - echo "ERROR: $*" >&2 + echo "ERROR: $*" >&2 } logDebug() { (( $# )) || { - logError "logDebug() takes 1 or more args" + logError "logDebug() takes 1 or more args" return 1 } echo "DEBUG: $*" >&3 @@ -153,7 +153,7 @@ main(){ declare -a BINS=(ziti minikube kubectl helm) for BIN in "${BINS[@]}"; do if ! command -v "$BIN" &>/dev/null; then - logError "this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." + logError "this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." $BIN || exit 1 fi done @@ -204,7 +204,7 @@ main(){ mapfile -t -n1 MINIKUBE_START_ARGS <<< "$*" shift $# if (( ${#MINIKUBE_START_ARGS[*]} )) && [[ -n "${MINIKUBE_START_ARGS[0]}" ]]; then - logDebug "passing ${#MINIKUBE_START_ARGS[*]} args to minikube start: '${MINIKUBE_START_ARGS[*]}'" + logDebug "passing ${#MINIKUBE_START_ARGS[*]} args to minikube start: '${MINIKUBE_START_ARGS[*]}'" else MINIKUBE_START_ARGS=() fi @@ -224,7 +224,7 @@ main(){ # sanity check the profile name input if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then # in case the arg value is another option instead of the profile name - logError "--profile needs a profile name not starting with a hyphen" + logError "--profile needs a profile name not starting with a hyphen" _usage; exit 1 fi # print the alternative profile name if not default "miniziti" @@ -249,42 +249,42 @@ main(){ --profile "${MINIKUBE_PROFILE}" 2>/dev/null \ | grep -q "apiserver: Running" \ || (( ${#MINIKUBE_START_ARGS[*]} )); then - logDebug "apiserver not running or got extra start args, running 'minikube start'" + logDebug "apiserver not running or got extra start args, running 'minikube start'" minikube start \ --profile "${MINIKUBE_PROFILE}" \ "${MINIKUBE_START_ARGS[@]}" >&3 else - logDebug "apiserver is running, not starting minikube" + logDebug "apiserver is running, not starting minikube" fi MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then - logDebug "the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" + logDebug "the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" else - logError "failed to find minikube external IP" + logError "failed to find minikube external IP" exit 1 fi # verify current context can connect to apiserver kubectl cluster-info >&3 - logDebug "kubectl successfully obtained cluster-info from apiserver" + logDebug "kubectl successfully obtained cluster-info from apiserver" # enable ssl-passthrough for OpenZiti ingresses if kubectl get deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ | grep -q enable-ssl-passthrough; then - logDebug "ingress-nginx has ssl-passthrough enabled" + logDebug "ingress-nginx has ssl-passthrough enabled" else - logDebug "installing ingress-nginx" + logDebug "installing ingress-nginx" # enable minikube addons for ingress-nginx minikube addons enable ingress \ --profile "${MINIKUBE_PROFILE}" >&3 minikube addons enable ingress-dns \ --profile "${MINIKUBE_PROFILE}" >&3 - logDebug "patching ingress-nginx deployment to enable ssl-passthrough" + logDebug "patching ingress-nginx deployment to enable ssl-passthrough" kubectl patch deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ --type json \ @@ -307,14 +307,14 @@ main(){ --selector app.kubernetes.io/component=controller \ --timeout 120s >&3 - logDebug "applying Custom Resource Definitions: Certificate, Issuer, and Bundle" + logDebug "applying Custom Resource Definitions: Certificate, Issuer, and Bundle" kubectl apply \ --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >&3 kubectl apply \ --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >&3 if helm repo list | grep -q openziti; then - logDebug "refreshing OpenZiti Helm Charts" + logDebug "refreshing OpenZiti Helm Charts" helm repo update openziti >&3 else logInfo "subscribing to OpenZiti Helm Charts" @@ -325,32 +325,32 @@ main(){ ## Ensure OpenZiti Controller is Upgraded and Ready # - if helm status minicontroller --namespace "${ZITI_NAMESPACE}" &>/dev/null; then + if helm status ziti-controller --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logInfo "upgrading openziti controller" - helm upgrade "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ + helm upgrade "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" \ - --set clientApi.advertisedHost="minicontroller.ziti" \ + --set clientApi.advertisedHost="miniziti-controller.ziti" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 else logInfo "installing openziti controller" - helm install "minicontroller" "${ZITI_CHARTS}/ziti-controller" \ + helm install "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ - --set clientApi.advertisedHost="minicontroller.ziti" \ + --set clientApi.advertisedHost="miniziti-controller.ziti" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 fi - logDebug "setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" + logDebug "setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >&3 - for DEPLOYMENT in minicontroller-cert-manager trust-manager minicontroller; do + for DEPLOYMENT in ziti-controller-cert-manager trust-manager ziti-controller; do logInfo "waiting for $DEPLOYMENT to be ready" kubectl wait deployments "$DEPLOYMENT" \ --namespace "${ZITI_NAMESPACE}" \ @@ -365,14 +365,14 @@ main(){ # wait to probe for the minikube tunnel until after controller deployment so there's at least one # ingress causing minikube to immediately prompt for sudo password if (( DEBUG_MINIKUBE_TUNNEL )) || [[ "${DETECTED_OS}" =~ Windows|macOS ]]; then - logDebug "detected OS is ${DETECTED_OS}, probing for minikube tunnel" + logDebug "detected OS is ${DETECTED_OS}, probing for minikube tunnel" if ! pgrep -f "minikube --profile ${MINIKUBE_PROFILE} tunnel" >&3; then echo -e "ERROR: ${DETECTED_OS} OS requires a running minikube tunnel for ingresses."\ " In another terminal, run the following command. Then re-run this script."\ "\n\n\tminikube --profile ${MINIKUBE_PROFILE} tunnel\n" >&2 exit 1 else - logDebug "minikube tunnel is running" + logDebug "minikube tunnel is running" fi # recommend /etc/hosts change unless dns is configured to reach the minikube node IP checkDns "127.0.0.1" @@ -381,26 +381,26 @@ main(){ fi # - ## Ensure Cluster DNS is Resolving minicontroller.ziti + ## Ensure Cluster DNS is Resolving miniziti-controller.ziti # if ! testClusterDns "${MINIKUBE_NODE_EXTERNAL}" 2>/dev/null; then - logDebug "initial cluster dns test failed, doing cluster dns setup" + logDebug "initial cluster dns test failed, doing cluster dns setup" # xargs trims whitespace because minikube ssh returns a stray trailing '\r' after remote command output - logDebug "probing minikube node for internal host record" + logDebug "probing minikube node for internal host record" MINIKUBE_NODE_INTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ssh 'grep host.minikube.internal /etc/hosts') if [[ -n "${MINIKUBE_NODE_INTERNAL:-}" ]]; then # strip surrounding whitespace MINIKUBE_NODE_INTERNAL=$(xargs <<< "${MINIKUBE_NODE_INTERNAL}") - logDebug "the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" + logDebug "the minikube internal host record is \"${MINIKUBE_NODE_INTERNAL}\"" else - logError "failed to find minikube internal IP" + logError "failed to find minikube internal IP" exit 1 fi - logDebug "patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" + logDebug "patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" kubectl patch configmap "coredns" \ --namespace kube-system \ --patch " @@ -438,14 +438,14 @@ main(){ } " >&3 - logDebug "deleting coredns pod so a new one will have modified Corefile" + logDebug "deleting coredns pod so a new one will have modified Corefile" kubectl get pods \ --namespace kube-system \ | awk '/^coredns-/ {print $1}' \ | xargs kubectl delete pods \ --namespace kube-system >&3 - logDebug "waiting for cluster dns to be ready" + logDebug "waiting for cluster dns to be ready" kubectl wait deployments "coredns" \ --namespace kube-system \ --for condition=Available=True >&3 @@ -458,61 +458,59 @@ main(){ ## Ensure OpenZiti Router is Enrolled and Ready # - logDebug "fetching admin password from k8s secret to log in to ziti mgmt" - kubectl get secrets "minicontroller-admin-secret" \ + logDebug "fetching admin password from k8s secret to log in to ziti mgmt" + kubectl get secrets "ziti-controller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs ziti edge login minicontroller.ziti:443 \ + | xargs ziti edge login miniziti-controller.ziti:443 \ --yes --username "admin" \ --password >&3 - if ziti edge list edge-routers 'name="minirouter"' \ - | grep -q minirouter; then - logDebug "updating minirouter" - ziti edge update edge-router "minirouter" \ + if ziti edge list edge-routers 'name="miniziti-router"' \ + | grep -q miniziti-router; then + logDebug "updating miniziti-router" + ziti edge update edge-router "miniziti-router" \ --role-attributes "public-routers" >&3 else - logDebug "creating minirouter" - ziti edge create edge-router "minirouter" \ + logDebug "creating miniziti-router" + ziti edge create edge-router "miniziti-router" \ --role-attributes "public-routers" \ --tunneler-enabled \ - --jwt-output-file /tmp/minirouter.jwt >&3 + --jwt-output-file /tmp/miniziti-router.jwt >&3 fi - if helm status minirouter --namespace "${ZITI_NAMESPACE}" &>/dev/null; then - logDebug "upgrading router chart as 'minirouter'" - helm upgrade "minirouter" "${ZITI_CHARTS}/ziti-router" \ + if helm status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then + logDebug "upgrading router chart as 'ziti-router'" + helm upgrade "ziti-router" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ - --set edge.advertisedHost=minirouter.ziti \ - --set linkListeners.transport.advertisedHost=minirouter-transport.ziti \ - --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:443" \ - --values /home/kbingham/Sites/netfoundry/github/openziti-helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 - # --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + --set edge.advertisedHost=miniziti-router.ziti \ + --set linkListeners.transport.advertisedHost=miniziti-router-transport.ziti \ + --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 else - logDebug "installing router chart as 'minirouter'" - helm install "minirouter" "${ZITI_CHARTS}/ziti-router" \ + logDebug "installing router chart as 'ziti-router'" + helm install "ziti-router" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ - --set-file enrollmentJwt=/tmp/minirouter.jwt \ - --set edge.advertisedHost=minirouter.ziti \ - --set linkListeners.transport.advertisedHost=minirouter-transport.ziti \ - --set "ctrl.endpoint=minicontroller-ctrl.${ZITI_NAMESPACE}.svc:443" \ - --values /home/kbingham/Sites/netfoundry/github/openziti-helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 - # --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + --set-file enrollmentJwt=/tmp/miniziti-router.jwt \ + --set edge.advertisedHost=miniziti-router.ziti \ + --set linkListeners.transport.advertisedHost=miniziti-router-transport.ziti \ + --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ + --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 fi - logInfo "waiting for minirouter to be ready" - kubectl wait deployments "minirouter" \ + logInfo "waiting for ziti-router to be ready" + kubectl wait deployments "ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True >&3 - logDebug "probing minirouter for online status" - if ziti edge list edge-routers 'name="minirouter"' \ - | awk '/minirouter/ {print $6}' \ + logDebug "probing miniziti-router for online status" + if ziti edge list edge-routers 'name="miniziti-router"' \ + | awk '/miniziti-router/ {print $6}' \ | grep -q true; then - logInfo "minirouter is online" + logInfo "miniziti-router is online" else - logError "minirouter is offline" + logError "miniziti-router is offline" exit 1 fi @@ -521,29 +519,29 @@ main(){ # if helm --namespace "${ZITI_NAMESPACE}" list --all \ - | grep -q miniconsole; then - logDebug "upgrading console chart as 'miniconsole'" - helm upgrade "miniconsole" "${ZITI_CHARTS}/ziti-console" \ + | grep -q ziti-console; then + logDebug "upgrading console chart as 'ziti-console'" + helm upgrade "ziti-console" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ - --set ingress.advertisedHost=miniconsole.ziti \ - --set "settings.edgeControllers[0].url=https://minicontroller-client.${ZITI_NAMESPACE}.svc:443" \ + --set ingress.advertisedHost=miniziti-console.ziti \ + --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 else - logDebug "installing console chart as 'miniconsole'" - helm install "miniconsole" "${ZITI_CHARTS}/ziti-console" \ + logDebug "installing console chart as 'ziti-console'" + helm install "ziti-console" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ - --set ingress.advertisedHost=miniconsole.ziti \ - --set "settings.edgeControllers[0].url=https://minicontroller-client.${ZITI_NAMESPACE}.svc:443" \ + --set ingress.advertisedHost=miniziti-console.ziti \ + --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 fi - logInfo "waiting for miniconsole to be ready" - kubectl wait deployments "miniconsole" \ + logInfo "waiting for ziti-console to be ready" + kubectl wait deployments "ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ --timeout 240s >&3 - logDebug "setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" + logDebug "setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >&3 @@ -554,96 +552,96 @@ main(){ if ! ziti edge list identities "name=\"${MINIKUBE_PROFILE}-client\"" --csv \ | grep -q "${MINIKUBE_PROFILE}-client"; then - logDebug "creating identity ${MINIKUBE_PROFILE}-client" + logDebug "creating identity ${MINIKUBE_PROFILE}-client" ziti edge create identity device "${MINIKUBE_PROFILE}-client" \ - --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes miniapi-clients >&3 + --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes miniziti-httpbin-clients >&3 else - logDebug "ignoring identity ${MINIKUBE_PROFILE}-client" + logDebug "ignoring identity ${MINIKUBE_PROFILE}-client" fi - if ! ziti edge list identities 'name="miniapi-host"' --csv \ - | grep -q "miniapi-host"; then - logDebug "creating identity miniapi-host" - ziti edge create identity device "miniapi-host" \ - --jwt-output-file /tmp/miniapi-host.jwt --role-attributes miniapi-hosts >&3 + if ! ziti edge list identities 'name="miniziti-httpbin-host"' --csv \ + | grep -q "miniziti-httpbin-host"; then + logDebug "creating identity miniziti-httpbin-host" + ziti edge create identity device "miniziti-httpbin-host" \ + --jwt-output-file /tmp/miniziti-httpbin-host.jwt --role-attributes miniziti-httpbin-hosts >&3 else - logDebug "ignoring identity miniapi-host" + logDebug "ignoring identity miniziti-httpbin-host" fi - - if ! ziti edge list configs 'name="miniapi-intercept-config"' --csv \ - | grep -q "miniapi-intercept-config"; then - logDebug "creating config miniapi-intercept-config" - ziti edge create config "miniapi-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["miniapi.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 + + if ! ziti edge list configs 'name="miniziti-httpbin-intercept-config"' --csv \ + | grep -q "miniziti-httpbin-intercept-config"; then + logDebug "creating config miniziti-httpbin-intercept-config" + ziti edge create config "miniziti-httpbin-intercept-config" intercept.v1 \ + '{"protocols":["tcp"],"addresses":["miniziti-httpbin.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 else - logDebug "ignoring config miniapi-intercept-config" + logDebug "ignoring config miniziti-httpbin-intercept-config" fi - - if ! ziti edge list configs 'name="miniapi-host-config"' --csv \ - | grep -q "miniapi-host-config"; then - logDebug "creating config miniapi-host-config" - ziti edge create config "miniapi-host-config" host.v1 \ + + if ! ziti edge list configs 'name="miniziti-httpbin-host-config"' --csv \ + | grep -q "miniziti-httpbin-host-config"; then + logDebug "creating config miniziti-httpbin-host-config" + ziti edge create config "miniziti-httpbin-host-config" host.v1 \ '{"protocol":"tcp", "address":"httpbin","port":8080}' >&3 else - logDebug "ignoring config miniapi-host-config" + logDebug "ignoring config miniziti-httpbin-host-config" fi - - if ! ziti edge list services 'name="miniapi-service"' --csv \ - | grep -q "miniapi-service"; then - logDebug "creating service miniapi-service" - ziti edge create service "miniapi-service" \ - --configs miniapi-intercept-config,miniapi-host-config >&3 + + if ! ziti edge list services 'name="miniziti-httpbin-service"' --csv \ + | grep -q "miniziti-httpbin-service"; then + logDebug "creating service miniziti-httpbin-service" + ziti edge create service "miniziti-httpbin-service" \ + --configs miniziti-httpbin-intercept-config,miniziti-httpbin-host-config >&3 else - logDebug "ignoring service miniapi-service" + logDebug "ignoring service miniziti-httpbin-service" fi - - if ! ziti edge list service-policies 'name="miniapi-bind-policy"' --csv \ - | grep -q "miniapi-bind-policy"; then - logDebug "creating service-policy miniapi-bind-policy" - ziti edge create service-policy "miniapi-bind-policy" Bind \ - --service-roles '@miniapi-service' --identity-roles '#miniapi-hosts' >&3 + + if ! ziti edge list service-policies 'name="miniziti-httpbin-bind-policy"' --csv \ + | grep -q "miniziti-httpbin-bind-policy"; then + logDebug "creating service-policy miniziti-httpbin-bind-policy" + ziti edge create service-policy "miniziti-httpbin-bind-policy" Bind \ + --service-roles '@miniziti-httpbin-service' --identity-roles '#miniziti-httpbin-hosts' >&3 else - logDebug "ignoring service-policy miniapi-bind-policy" + logDebug "ignoring service-policy miniziti-httpbin-bind-policy" fi - - if ! ziti edge list service-policies 'name="miniapi-dial-policy"' --csv \ - | grep -q "miniapi-dial-policy"; then - logDebug "creating service-policy miniapi-dial-policy" - ziti edge create service-policy "miniapi-dial-policy" Dial \ - --service-roles '@miniapi-service' --identity-roles '#miniapi-clients' >&3 + + if ! ziti edge list service-policies 'name="miniziti-httpbin-dial-policy"' --csv \ + | grep -q "miniziti-httpbin-dial-policy"; then + logDebug "creating service-policy miniziti-httpbin-dial-policy" + ziti edge create service-policy "miniziti-httpbin-dial-policy" Dial \ + --service-roles '@miniziti-httpbin-service' --identity-roles '#miniziti-httpbin-clients' >&3 else - logDebug "ignoring service-policy miniapi-dial-policy" + logDebug "ignoring service-policy miniziti-httpbin-dial-policy" fi - + if ! ziti edge list edge-router-policies 'name="public-routers"' --csv \ | grep -q "public-routers"; then - logDebug "creating edge-router-policy public-routers" + logDebug "creating edge-router-policy public-routers" ziti edge create edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --identity-roles '#all' >&3 else - logDebug "ignoring edge-router-policy public-routers" + logDebug "ignoring edge-router-policy public-routers" fi - + if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv \ | grep -q "public-routers"; then - logDebug "creating service-edge-router-policy public-routers" + logDebug "creating service-edge-router-policy public-routers" ziti edge create service-edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --service-roles '#all' >&3 else - logDebug "ignoring service-edge-router-policy public-routers" + logDebug "ignoring service-edge-router-policy public-routers" fi - if [[ -s /tmp/miniapi-host.jwt ]]; then - logDebug "enrolling /tmp/miniapi-host.jwt" + if [[ -s /tmp/miniziti-httpbin-host.jwt ]]; then + logDebug "enrolling /tmp/miniziti-httpbin-host.jwt" # discard expected output that normally flows to stderr ENROLL_OUT="$( - ziti edge enroll /tmp/miniapi-host.jwt 2>&1 \ + ziti edge enroll /tmp/miniziti-httpbin-host.jwt 2>&1 \ | grep -vE '(generating.*key|enrolled\s+successfully)' \ || true )" if [[ -z "${ENROLL_OUT}" ]]; then - rm -f /tmp/miniapi-host.jwt - logDebug "deleted /tmp/miniapi-host.jwt after enrolling successfully" + rm -f /tmp/miniziti-httpbin-host.jwt + logDebug "deleted /tmp/miniziti-httpbin-host.jwt after enrolling successfully" else echo -e "ERROR: unexpected result during OpenZiti Identity enrollment\n"\ "${ENROLL_OUT}" @@ -651,19 +649,19 @@ main(){ fi fi - if [[ -s /tmp/miniapi-host.json ]]; then - logDebug "installing httpbin chart as 'miniapi-host'" - helm install "miniapi-host" "${ZITI_CHARTS}/httpbin" \ - --set-file zitiIdentity=/tmp/miniapi-host.json \ - --set zitiServiceName=miniapi-service >&3 - rm -f /tmp/miniapi-host.json - logDebug "deleted /tmp/miniapi-host.json after installing successfully with miniapi-host chart" + if [[ -s /tmp/miniziti-httpbin-host.json ]]; then + logDebug "installing httpbin chart as 'miniziti-httpbin-host'" + helm install "miniziti-httpbin-host" "${ZITI_CHARTS}/httpbin" \ + --set-file zitiIdentity=/tmp/miniziti-httpbin-host.json \ + --set zitiServiceName=miniziti-httpbin-service >&3 + rm -f /tmp/miniziti-httpbin-host.json + logDebug "deleted /tmp/miniziti-httpbin-host.json after installing successfully with miniziti-httpbin-host chart" fi - kubectl get secrets "minicontroller-admin-secret" \ + kubectl get secrets "ziti-controller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{"\n'\ -'INFO: Your OpenZiti Console is here:\thttps://miniconsole.ziti\n'\ +'INFO: Your OpenZiti Console is here:\thttps://miniziti-console.ziti\n'\ 'INFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}'\ '{{"\n\n"}}' From 9cfe53f35834db3336ad2265a77fa5bfbd98a2ce Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Fri, 21 Jul 2023 01:23:24 -0400 Subject: [PATCH 35/97] Rebrand to httpbin for edge concepts --- .../learn/quickstarts/network/miniziti.bash | 96 +++++++++---------- 1 file changed, 48 insertions(+), 48 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 8bd2d50aa..063702936 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -554,63 +554,63 @@ main(){ | grep -q "${MINIKUBE_PROFILE}-client"; then logDebug "creating identity ${MINIKUBE_PROFILE}-client" ziti edge create identity device "${MINIKUBE_PROFILE}-client" \ - --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes miniziti-httpbin-clients >&3 + --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes httpbin-clients >&3 else logDebug "ignoring identity ${MINIKUBE_PROFILE}-client" fi - if ! ziti edge list identities 'name="miniziti-httpbin-host"' --csv \ - | grep -q "miniziti-httpbin-host"; then - logDebug "creating identity miniziti-httpbin-host" - ziti edge create identity device "miniziti-httpbin-host" \ - --jwt-output-file /tmp/miniziti-httpbin-host.jwt --role-attributes miniziti-httpbin-hosts >&3 + if ! ziti edge list identities 'name="httpbin-host"' --csv \ + | grep -q "httpbin-host"; then + logDebug "creating identity httpbin-host" + ziti edge create identity device "httpbin-host" \ + --jwt-output-file /tmp/httpbin-host.jwt --role-attributes httpbin-hosts >&3 else - logDebug "ignoring identity miniziti-httpbin-host" + logDebug "ignoring identity httpbin-host" fi - if ! ziti edge list configs 'name="miniziti-httpbin-intercept-config"' --csv \ - | grep -q "miniziti-httpbin-intercept-config"; then - logDebug "creating config miniziti-httpbin-intercept-config" - ziti edge create config "miniziti-httpbin-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["miniziti-httpbin.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 + if ! ziti edge list configs 'name="httpbin-intercept-config"' --csv \ + | grep -q "httpbin-intercept-config"; then + logDebug "creating config httpbin-intercept-config" + ziti edge create config "httpbin-intercept-config" intercept.v1 \ + '{"protocols":["tcp"],"addresses":["httpbin.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 else - logDebug "ignoring config miniziti-httpbin-intercept-config" + logDebug "ignoring config httpbin-intercept-config" fi - if ! ziti edge list configs 'name="miniziti-httpbin-host-config"' --csv \ - | grep -q "miniziti-httpbin-host-config"; then - logDebug "creating config miniziti-httpbin-host-config" - ziti edge create config "miniziti-httpbin-host-config" host.v1 \ + if ! ziti edge list configs 'name="httpbin-host-config"' --csv \ + | grep -q "httpbin-host-config"; then + logDebug "creating config httpbin-host-config" + ziti edge create config "httpbin-host-config" host.v1 \ '{"protocol":"tcp", "address":"httpbin","port":8080}' >&3 else - logDebug "ignoring config miniziti-httpbin-host-config" + logDebug "ignoring config httpbin-host-config" fi - if ! ziti edge list services 'name="miniziti-httpbin-service"' --csv \ - | grep -q "miniziti-httpbin-service"; then - logDebug "creating service miniziti-httpbin-service" - ziti edge create service "miniziti-httpbin-service" \ - --configs miniziti-httpbin-intercept-config,miniziti-httpbin-host-config >&3 + if ! ziti edge list services 'name="httpbin-service"' --csv \ + | grep -q "httpbin-service"; then + logDebug "creating service httpbin-service" + ziti edge create service "httpbin-service" \ + --configs httpbin-intercept-config,httpbin-host-config >&3 else - logDebug "ignoring service miniziti-httpbin-service" + logDebug "ignoring service httpbin-service" fi - if ! ziti edge list service-policies 'name="miniziti-httpbin-bind-policy"' --csv \ - | grep -q "miniziti-httpbin-bind-policy"; then - logDebug "creating service-policy miniziti-httpbin-bind-policy" - ziti edge create service-policy "miniziti-httpbin-bind-policy" Bind \ - --service-roles '@miniziti-httpbin-service' --identity-roles '#miniziti-httpbin-hosts' >&3 + if ! ziti edge list service-policies 'name="httpbin-bind-policy"' --csv \ + | grep -q "httpbin-bind-policy"; then + logDebug "creating service-policy httpbin-bind-policy" + ziti edge create service-policy "httpbin-bind-policy" Bind \ + --service-roles '@httpbin-service' --identity-roles '#httpbin-hosts' >&3 else - logDebug "ignoring service-policy miniziti-httpbin-bind-policy" + logDebug "ignoring service-policy httpbin-bind-policy" fi - if ! ziti edge list service-policies 'name="miniziti-httpbin-dial-policy"' --csv \ - | grep -q "miniziti-httpbin-dial-policy"; then - logDebug "creating service-policy miniziti-httpbin-dial-policy" - ziti edge create service-policy "miniziti-httpbin-dial-policy" Dial \ - --service-roles '@miniziti-httpbin-service' --identity-roles '#miniziti-httpbin-clients' >&3 + if ! ziti edge list service-policies 'name="httpbin-dial-policy"' --csv \ + | grep -q "httpbin-dial-policy"; then + logDebug "creating service-policy httpbin-dial-policy" + ziti edge create service-policy "httpbin-dial-policy" Dial \ + --service-roles '@httpbin-service' --identity-roles '#httpbin-clients' >&3 else - logDebug "ignoring service-policy miniziti-httpbin-dial-policy" + logDebug "ignoring service-policy httpbin-dial-policy" fi if ! ziti edge list edge-router-policies 'name="public-routers"' --csv \ @@ -631,17 +631,17 @@ main(){ logDebug "ignoring service-edge-router-policy public-routers" fi - if [[ -s /tmp/miniziti-httpbin-host.jwt ]]; then - logDebug "enrolling /tmp/miniziti-httpbin-host.jwt" + if [[ -s /tmp/httpbin-host.jwt ]]; then + logDebug "enrolling /tmp/httpbin-host.jwt" # discard expected output that normally flows to stderr ENROLL_OUT="$( - ziti edge enroll /tmp/miniziti-httpbin-host.jwt 2>&1 \ + ziti edge enroll /tmp/httpbin-host.jwt 2>&1 \ | grep -vE '(generating.*key|enrolled\s+successfully)' \ || true )" if [[ -z "${ENROLL_OUT}" ]]; then - rm -f /tmp/miniziti-httpbin-host.jwt - logDebug "deleted /tmp/miniziti-httpbin-host.jwt after enrolling successfully" + rm -f /tmp/httpbin-host.jwt + logDebug "deleted /tmp/httpbin-host.jwt after enrolling successfully" else echo -e "ERROR: unexpected result during OpenZiti Identity enrollment\n"\ "${ENROLL_OUT}" @@ -649,13 +649,13 @@ main(){ fi fi - if [[ -s /tmp/miniziti-httpbin-host.json ]]; then - logDebug "installing httpbin chart as 'miniziti-httpbin-host'" - helm install "miniziti-httpbin-host" "${ZITI_CHARTS}/httpbin" \ - --set-file zitiIdentity=/tmp/miniziti-httpbin-host.json \ - --set zitiServiceName=miniziti-httpbin-service >&3 - rm -f /tmp/miniziti-httpbin-host.json - logDebug "deleted /tmp/miniziti-httpbin-host.json after installing successfully with miniziti-httpbin-host chart" + if [[ -s /tmp/httpbin-host.json ]]; then + logDebug "installing httpbin chart as 'miniziti-httpbin'" + helm install "miniziti-httpbin" "${ZITI_CHARTS}/httpbin" \ + --set-file zitiIdentity=/tmp/httpbin-host.json \ + --set zitiServiceName=httpbin-service >&3 + rm -f /tmp/httpbin-host.json + logDebug "deleted /tmp/httpbin-host.json after installing successfully with miniziti-httpbin chart" fi kubectl get secrets "ziti-controller-admin-secret" \ From 3bf08c1ab952be75af77e6d22b1a82a6fe532cd6 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Wed, 2 Aug 2023 08:52:17 -0400 Subject: [PATCH 36/97] remove docs.openziti refs --- .../docs/learn/quickstarts/network/miniziti.bash | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 063702936..33c8feb8d 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -318,7 +318,7 @@ main(){ helm repo update openziti >&3 else logInfo "subscribing to OpenZiti Helm Charts" - helm repo add openziti https://docs.openziti.io/helm-charts/ >&3 + helm repo add openziti https://openziti.io/helm-charts/ >&3 fi # @@ -333,7 +333,7 @@ main(){ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 + --values https://openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 else logInfo "installing openziti controller" helm install "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ @@ -342,7 +342,7 @@ main(){ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ - --values https://docs.openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 + --values https://openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 fi logDebug "setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" @@ -487,7 +487,7 @@ main(){ --set edge.advertisedHost=miniziti-router.ziti \ --set linkListeners.transport.advertisedHost=miniziti-router-transport.ziti \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + --values https://openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 else logDebug "installing router chart as 'ziti-router'" helm install "ziti-router" "${ZITI_CHARTS}/ziti-router" \ @@ -496,7 +496,7 @@ main(){ --set edge.advertisedHost=miniziti-router.ziti \ --set linkListeners.transport.advertisedHost=miniziti-router-transport.ziti \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + --values https://openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 fi logInfo "waiting for ziti-router to be ready" @@ -525,14 +525,14 @@ main(){ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniziti-console.ziti \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 + --values https://openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 else logDebug "installing console chart as 'ziti-console'" helm install "ziti-console" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniziti-console.ziti \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ - --values https://docs.openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 + --values https://openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 fi logInfo "waiting for ziti-console to be ready" From 06981b0b2b4ab75220c178bbfb36f30e9cb70b0b Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 4 Aug 2023 17:05:23 -0400 Subject: [PATCH 37/97] use Helm values files from filesystem if alt charts path --- .../docs/learn/quickstarts/network/miniziti.bash | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 33c8feb8d..dc97cade6 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -333,7 +333,7 @@ main(){ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ - --values https://openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 + --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-controller/values-ingress-nginx.yaml" >&3 else logInfo "installing openziti controller" helm install "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ @@ -342,7 +342,7 @@ main(){ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ - --values https://openziti.io/helm-charts/charts/ziti-controller/values-ingress-nginx.yaml >&3 + --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-controller/values-ingress-nginx.yaml" >&3 fi logDebug "setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" @@ -487,7 +487,7 @@ main(){ --set edge.advertisedHost=miniziti-router.ziti \ --set linkListeners.transport.advertisedHost=miniziti-router-transport.ziti \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ - --values https://openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-router/values-ingress-nginx.yaml" >&3 else logDebug "installing router chart as 'ziti-router'" helm install "ziti-router" "${ZITI_CHARTS}/ziti-router" \ @@ -496,7 +496,7 @@ main(){ --set edge.advertisedHost=miniziti-router.ziti \ --set linkListeners.transport.advertisedHost=miniziti-router-transport.ziti \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ - --values https://openziti.io/helm-charts/charts/ziti-router/values-ingress-nginx.yaml >&3 + --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-router/values-ingress-nginx.yaml" >&3 fi logInfo "waiting for ziti-router to be ready" @@ -525,14 +525,14 @@ main(){ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniziti-console.ziti \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ - --values https://openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 + --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-console/values-ingress-nginx.yaml" >&3 else logDebug "installing console chart as 'ziti-console'" helm install "ziti-console" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost=miniziti-console.ziti \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ - --values https://openziti.io/helm-charts/charts/ziti-console/values-ingress-nginx.yaml >&3 + --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-console/values-ingress-nginx.yaml" >&3 fi logInfo "waiting for ziti-console to be ready" From 1f7ccd5b55dd65fdd6752277c2b832ac399c2b87 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 4 Aug 2023 17:05:56 -0400 Subject: [PATCH 38/97] add --no-hosts option to avoid setting up hosts DB or ingress-dns --- .../learn/quickstarts/network/miniziti.bash | 73 ++++++++++++------- 1 file changed, 48 insertions(+), 25 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index dc97cade6..69293f7a6 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -32,8 +32,10 @@ _usage(){ " --verbose\t\tshow DEBUG messages\n"\ " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ + " --no-dns\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ "\n DEBUG\n"\ " --charts\t\tZITI_CHARTS (openziti) alternative charts repo\n"\ + " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ " --\t\t\tMINIKUBE_START_ARGS args after -- passed to minikube start\n" } @@ -43,13 +45,13 @@ checkDns(){ logError "need IPv4 of miniziti ingress as only param to checkDns()" return 1 } - logDebug "checking dns to ensure miniziti-controller.ziti resolves to $1" - if grep -qE "^${1//./\\.}.*miniziti-controller.ziti" /etc/hosts \ - || nslookup miniziti-controller.ziti | grep -q "${1//./\\.}"; then + logDebug "checking dns to ensure miniziti-controller.${MINIZITI_ZONE} resolves to $1" + if grep -qE "^${1//./\\.}.*miniziti-controller.${MINIZITI_ZONE}" /etc/hosts \ + || nslookup "miniziti-controller.${MINIZITI_ZONE}" | grep -q "${1//./\\.}"; then logDebug "host dns found expected minikube ingress IP '$1'" return 0 else - echo "ERROR: miniziti-controller.ziti does not resolve to '$1'. Did you add the record in /etc/hosts?" + logError "miniziti-controller.${MINIZITI_ZONE} does not resolve to '$1'. Did you add the record in /etc/hosts?" return 1 fi } @@ -62,8 +64,10 @@ deleteMiniziti(){ else logDebug "no integer param detected to deleteMiniziti(), using default wait time ${WAIT}s" fi - echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 - sleep "$WAIT" + (( SAFETY_WAIT )) && { + echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 + sleep "$WAIT" + } logInfo "waiting for ${MINIKUBE_PROFILE} to be deleted" minikube --profile "${MINIKUBE_PROFILE}" delete >&3 } @@ -102,7 +106,7 @@ getClientOttPath(){ testClusterDns(){ if kubectl run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ - nslookup miniziti-controller.ziti | grep "$1" >&3; then + nslookup "miniziti-controller.${MINIZITI_ZONE}" | grep "$1" >&3; then logInfo "cluster dns test succeeded" else logError "cluster dns test failed" @@ -166,8 +170,11 @@ main(){ MINIKUBE_PROFILE="miniziti" \ ZITI_NAMESPACE \ DELETE_MINIZITI=0 \ + SAFETY_WAIT=1 \ MINIKUBE_NODE_EXTERNAL \ - ZITI_CHARTS="openziti" + ZITI_CHARTS="openziti" \ + MINIZITI_HOSTS=1 \ + MINIZITI_ZONE="ziti" # local arrays with defaults that never produce an error declare -a MINIKUBE_START_ARGS=() @@ -200,6 +207,12 @@ main(){ exec 3>&1 shift ;; + --now) SAFETY_WAIT=0 + shift + ;; + --no-hosts) MINIZITI_HOSTS=0 + shift + ;; --) shift mapfile -t -n1 MINIKUBE_START_ARGS <<< "$*" shift $# @@ -258,7 +271,11 @@ main(){ fi MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) - + # if --no-hosts then build a new zone name for RFC-1918 wildcard DNS + (( MINIZITI_HOSTS )) || { + MINIZITI_ZONE="${MINIKUBE_NODE_EXTERNAL}.mini.openziti.io" + logDebug "DNS wildcard zone for ingresses is ${MINIZITI_ZONE}" + } if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then logDebug "the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" else @@ -281,9 +298,11 @@ main(){ # enable minikube addons for ingress-nginx minikube addons enable ingress \ --profile "${MINIKUBE_PROFILE}" >&3 - minikube addons enable ingress-dns \ - --profile "${MINIKUBE_PROFILE}" >&3 - + # enable minikube addon ingress-dns unless --no-hosts + (( MINIZITI_HOSTS )) && { + minikube addons enable ingress-dns \ + --profile "${MINIKUBE_PROFILE}" >&3 + } logDebug "patching ingress-nginx deployment to enable ssl-passthrough" kubectl patch deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ @@ -329,16 +348,17 @@ main(){ logInfo "upgrading openziti controller" helm upgrade "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" \ - --set clientApi.advertisedHost="miniziti-controller.ziti" \ + --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-controller/values-ingress-nginx.yaml" >&3 else logInfo "installing openziti controller" + helm dependency build "${ZITI_CHARTS}/ziti-controller" >&3 helm install "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ - --set clientApi.advertisedHost="miniziti-controller.ziti" \ + --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ @@ -381,7 +401,7 @@ main(){ fi # - ## Ensure Cluster DNS is Resolving miniziti-controller.ziti + ## Ensure Cluster DNS is Resolving miniziti-controller.${MINIZITI_ZONE} # if ! testClusterDns "${MINIKUBE_NODE_EXTERNAL}" 2>/dev/null; then @@ -400,7 +420,7 @@ main(){ exit 1 fi - logDebug "patching coredns configmap with *.ziti forwarder to minikube ingress-dns nameserver" + logDebug "patching coredns configmap with *.${MINIZITI_ZONE} forwarder to minikube ingress-dns nameserver" kubectl patch configmap "coredns" \ --namespace kube-system \ --patch " @@ -462,7 +482,7 @@ main(){ kubectl get secrets "ziti-controller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs ziti edge login miniziti-controller.ziti:443 \ + | xargs ziti edge login "miniziti-controller.${MINIZITI_ZONE}:443" \ --yes --username "admin" \ --password >&3 @@ -484,17 +504,18 @@ main(){ helm upgrade "ziti-router" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ - --set edge.advertisedHost=miniziti-router.ziti \ - --set linkListeners.transport.advertisedHost=miniziti-router-transport.ziti \ + --set edge.advertisedHost="miniziti-router.${MINIZITI_ZONE}" \ + --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_ZONE}" \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-router/values-ingress-nginx.yaml" >&3 else logDebug "installing router chart as 'ziti-router'" + helm dependency build "${ZITI_CHARTS}/ziti-router" >&3 helm install "ziti-router" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt=/tmp/miniziti-router.jwt \ - --set edge.advertisedHost=miniziti-router.ziti \ - --set linkListeners.transport.advertisedHost=miniziti-router-transport.ziti \ + --set edge.advertisedHost="miniziti-router.${MINIZITI_ZONE}" \ + --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_ZONE}" \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-router/values-ingress-nginx.yaml" >&3 fi @@ -523,14 +544,15 @@ main(){ logDebug "upgrading console chart as 'ziti-console'" helm upgrade "ziti-console" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ - --set ingress.advertisedHost=miniziti-console.ziti \ + --set ingress.advertisedHost="miniziti-console.${MINIZITI_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-console/values-ingress-nginx.yaml" >&3 else logDebug "installing console chart as 'ziti-console'" + helm dependency build "${ZITI_CHARTS}/ziti-console" >&3 helm install "ziti-console" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ - --set ingress.advertisedHost=miniziti-console.ziti \ + --set ingress.advertisedHost="miniziti-console.${MINIZITI_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-console/values-ingress-nginx.yaml" >&3 fi @@ -572,7 +594,7 @@ main(){ | grep -q "httpbin-intercept-config"; then logDebug "creating config httpbin-intercept-config" ziti edge create config "httpbin-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["httpbin.ziti"], "portRanges":[{"low":80, "high":80}]}' >&3 + '{"protocols":["tcp"],"addresses":["httpbin.'"${MINIZITI_ZONE}"'"], "portRanges":[{"low":80, "high":80}]}' >&3 else logDebug "ignoring config httpbin-intercept-config" fi @@ -651,6 +673,7 @@ main(){ if [[ -s /tmp/httpbin-host.json ]]; then logDebug "installing httpbin chart as 'miniziti-httpbin'" + helm dependency build "${ZITI_CHARTS}/httpbin" >&3 helm install "miniziti-httpbin" "${ZITI_CHARTS}/httpbin" \ --set-file zitiIdentity=/tmp/httpbin-host.json \ --set zitiServiceName=httpbin-service >&3 @@ -661,7 +684,7 @@ main(){ kubectl get secrets "ziti-controller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{"\n'\ -'INFO: Your OpenZiti Console is here:\thttps://miniziti-console.ziti\n'\ +'INFO: Your OpenZiti Console is here:\thttps://miniziti-console.'"${MINIZITI_ZONE}"'\n'\ 'INFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}'\ '{{"\n\n"}}' From 6a2b583b1ca57b1b3489c26eb1eeb743a10f3c9c Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 4 Aug 2023 17:53:34 -0400 Subject: [PATCH 39/97] sync miniziti from charts repo --- .../learn/quickstarts/network/miniziti.bash | 63 ++++++++++--------- 1 file changed, 35 insertions(+), 28 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 69293f7a6..3637868e5 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -45,13 +45,13 @@ checkDns(){ logError "need IPv4 of miniziti ingress as only param to checkDns()" return 1 } - logDebug "checking dns to ensure miniziti-controller.${MINIZITI_ZONE} resolves to $1" - if grep -qE "^${1//./\\.}.*miniziti-controller.${MINIZITI_ZONE}" /etc/hosts \ - || nslookup "miniziti-controller.${MINIZITI_ZONE}" | grep -q "${1//./\\.}"; then + logDebug "checking dns to ensure miniziti-controller.${MINIZITI_INGRESS_ZONE} resolves to $1" + if grep -qE "^${1//./\\.}.*miniziti-controller.${MINIZITI_INGRESS_ZONE}" /etc/hosts \ + || nslookup "miniziti-controller.${MINIZITI_INGRESS_ZONE}" | grep -q "${1//./\\.}"; then logDebug "host dns found expected minikube ingress IP '$1'" return 0 else - logError "miniziti-controller.${MINIZITI_ZONE} does not resolve to '$1'. Did you add the record in /etc/hosts?" + logError "miniziti-controller.${MINIZITI_INGRESS_ZONE} does not resolve to '$1'. Did you add the record in /etc/hosts?" return 1 fi } @@ -106,7 +106,7 @@ getClientOttPath(){ testClusterDns(){ if kubectl run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ - nslookup "miniziti-controller.${MINIZITI_ZONE}" | grep "$1" >&3; then + nslookup "miniziti-controller.${MINIZITI_INGRESS_ZONE}" | grep "$1" >&3; then logInfo "cluster dns test succeeded" else logError "cluster dns test failed" @@ -174,7 +174,8 @@ main(){ MINIKUBE_NODE_EXTERNAL \ ZITI_CHARTS="openziti" \ MINIZITI_HOSTS=1 \ - MINIZITI_ZONE="ziti" + MINIZITI_INGRESS_ZONE="ziti" \ + MINIZITI_INTERCEPT_ZONE="miniziti" # local arrays with defaults that never produce an error declare -a MINIKUBE_START_ARGS=() @@ -273,8 +274,8 @@ main(){ MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) # if --no-hosts then build a new zone name for RFC-1918 wildcard DNS (( MINIZITI_HOSTS )) || { - MINIZITI_ZONE="${MINIKUBE_NODE_EXTERNAL}.mini.openziti.io" - logDebug "DNS wildcard zone for ingresses is ${MINIZITI_ZONE}" + MINIZITI_INGRESS_ZONE="${MINIKUBE_NODE_EXTERNAL}.mini.openziti.io" + logDebug "DNS wildcard zone for ingresses is ${MINIZITI_INGRESS_ZONE}" } if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then logDebug "the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" @@ -332,13 +333,19 @@ main(){ kubectl apply \ --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >&3 - if helm repo list | grep -q openziti; then - logDebug "refreshing OpenZiti Helm Charts" - helm repo update openziti >&3 - else - logInfo "subscribing to OpenZiti Helm Charts" - helm repo add openziti https://openziti.io/helm-charts/ >&3 - fi + declare -A HELM_REPOS + HELM_REPOS[openziti]="openziti.io/helm-charts" + HELM_REPOS[jetstack]="charts.jetstack.io" + HELM_REPOS[ingress-nginx]="kubernetes.github.io/ingress-nginx" + for REPO in "${!HELM_REPOS[@]}"; do + if helm repo list | cut -f1 | grep -qE "^${REPO}(\s+)?$"; then + logDebug "refreshing ${REPO} Helm Charts" + helm repo update "${REPO}" >&3 + else + logInfo "subscribing to ${REPO} Helm Charts" + helm repo add "${REPO}" "https://${HELM_REPOS[${REPO}]}" >&3 + fi + done # ## Ensure OpenZiti Controller is Upgraded and Ready @@ -348,7 +355,7 @@ main(){ logInfo "upgrading openziti controller" helm upgrade "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" \ - --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_ZONE}" \ + --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ @@ -358,7 +365,7 @@ main(){ helm dependency build "${ZITI_CHARTS}/ziti-controller" >&3 helm install "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ - --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_ZONE}" \ + --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ @@ -401,7 +408,7 @@ main(){ fi # - ## Ensure Cluster DNS is Resolving miniziti-controller.${MINIZITI_ZONE} + ## Ensure Cluster DNS is Resolving miniziti-controller.${MINIZITI_INGRESS_ZONE} # if ! testClusterDns "${MINIKUBE_NODE_EXTERNAL}" 2>/dev/null; then @@ -420,7 +427,7 @@ main(){ exit 1 fi - logDebug "patching coredns configmap with *.${MINIZITI_ZONE} forwarder to minikube ingress-dns nameserver" + logDebug "patching coredns configmap with *.${MINIZITI_INGRESS_ZONE} forwarder to minikube ingress-dns nameserver" kubectl patch configmap "coredns" \ --namespace kube-system \ --patch " @@ -482,7 +489,7 @@ main(){ kubectl get secrets "ziti-controller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs ziti edge login "miniziti-controller.${MINIZITI_ZONE}:443" \ + | xargs ziti edge login "miniziti-controller.${MINIZITI_INGRESS_ZONE}:443" \ --yes --username "admin" \ --password >&3 @@ -504,8 +511,8 @@ main(){ helm upgrade "ziti-router" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ - --set edge.advertisedHost="miniziti-router.${MINIZITI_ZONE}" \ - --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_ZONE}" \ + --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ + --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_INGRESS_ZONE}" \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-router/values-ingress-nginx.yaml" >&3 else @@ -514,8 +521,8 @@ main(){ helm install "ziti-router" "${ZITI_CHARTS}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt=/tmp/miniziti-router.jwt \ - --set edge.advertisedHost="miniziti-router.${MINIZITI_ZONE}" \ - --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_ZONE}" \ + --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ + --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_INGRESS_ZONE}" \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-router/values-ingress-nginx.yaml" >&3 fi @@ -544,7 +551,7 @@ main(){ logDebug "upgrading console chart as 'ziti-console'" helm upgrade "ziti-console" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ - --set ingress.advertisedHost="miniziti-console.${MINIZITI_ZONE}" \ + --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-console/values-ingress-nginx.yaml" >&3 else @@ -552,7 +559,7 @@ main(){ helm dependency build "${ZITI_CHARTS}/ziti-console" >&3 helm install "ziti-console" "${ZITI_CHARTS}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ - --set ingress.advertisedHost="miniziti-console.${MINIZITI_ZONE}" \ + --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-console/values-ingress-nginx.yaml" >&3 fi @@ -594,7 +601,7 @@ main(){ | grep -q "httpbin-intercept-config"; then logDebug "creating config httpbin-intercept-config" ziti edge create config "httpbin-intercept-config" intercept.v1 \ - '{"protocols":["tcp"],"addresses":["httpbin.'"${MINIZITI_ZONE}"'"], "portRanges":[{"low":80, "high":80}]}' >&3 + '{"protocols":["tcp"],"addresses":["httpbin.'"${MINIZITI_INTERCEPT_ZONE}"'"], "portRanges":[{"low":80, "high":80}]}' >&3 else logDebug "ignoring config httpbin-intercept-config" fi @@ -684,7 +691,7 @@ main(){ kubectl get secrets "ziti-controller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{"\n'\ -'INFO: Your OpenZiti Console is here:\thttps://miniziti-console.'"${MINIZITI_ZONE}"'\n'\ +'INFO: Your OpenZiti Console is here:\thttps://miniziti-console.'"${MINIZITI_INGRESS_ZONE}"'\n'\ 'INFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}'\ '{{"\n\n"}}' From 4c1aa5303ec6317352dbbd4f06c060f40d2d601d Mon Sep 17 00:00:00 2001 From: Ken Bingham Date: Fri, 4 Aug 2023 19:11:40 -0400 Subject: [PATCH 40/97] correct usage hint --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 3637868e5..e1ac73143 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -32,7 +32,7 @@ _usage(){ " --verbose\t\tshow DEBUG messages\n"\ " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ - " --no-dns\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ + " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ "\n DEBUG\n"\ " --charts\t\tZITI_CHARTS (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ From 0ab2cead522f77913a8fa43ecffc3726c5e0edb6 Mon Sep 17 00:00:00 2001 From: Ken Bingham Date: Fri, 4 Aug 2023 19:12:19 -0400 Subject: [PATCH 41/97] use logWarn() --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index e1ac73143..8a78d4986 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -65,7 +65,7 @@ deleteMiniziti(){ logDebug "no integer param detected to deleteMiniziti(), using default wait time ${WAIT}s" fi (( SAFETY_WAIT )) && { - echo "WARN: deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 + logWarn "deleting ${MINIKUBE_PROFILE} in ${WAIT}s" >&2 sleep "$WAIT" } logInfo "waiting for ${MINIKUBE_PROFILE} to be deleted" From 1c08054f396f219e509e06f93035f45be49d554e Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 4 Aug 2023 21:55:04 -0400 Subject: [PATCH 42/97] only patch coredns if offline hosts are configured --- .../learn/quickstarts/network/miniziti.bash | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 8a78d4986..1a2aea4a0 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -427,10 +427,11 @@ main(){ exit 1 fi - logDebug "patching coredns configmap with *.${MINIZITI_INGRESS_ZONE} forwarder to minikube ingress-dns nameserver" - kubectl patch configmap "coredns" \ - --namespace kube-system \ - --patch " + (( MINIZITI_HOSTS )) && { + logDebug "patching coredns configmap with *.${MINIZITI_INGRESS_ZONE} forwarder to minikube ingress-dns nameserver" + kubectl patch configmap "coredns" \ + --namespace kube-system \ + --patch " data: Corefile: | .:53 { @@ -458,24 +459,25 @@ main(){ reload loadbalance } - ziti:53 { + ${MINIZITI_INGRESS_ZONE}:53 { errors cache 30 forward . ${MINIKUBE_NODE_EXTERNAL} } " >&3 - logDebug "deleting coredns pod so a new one will have modified Corefile" - kubectl get pods \ - --namespace kube-system \ - | awk '/^coredns-/ {print $1}' \ - | xargs kubectl delete pods \ - --namespace kube-system >&3 + logDebug "deleting coredns pod so a new one will have modified Corefile" + kubectl get pods \ + --namespace kube-system \ + | awk '/^coredns-/ {print $1}' \ + | xargs kubectl delete pods \ + --namespace kube-system >&3 - logDebug "waiting for cluster dns to be ready" - kubectl wait deployments "coredns" \ - --namespace kube-system \ - --for condition=Available=True >&3 + logDebug "waiting for cluster dns to be ready" + kubectl wait deployments "coredns" \ + --namespace kube-system \ + --for condition=Available=True >&3 + } # perform a DNS query in a pod so we know ingress-dns is working inside the cluster testClusterDns "${MINIKUBE_NODE_EXTERNAL}" From 134d47baabd93ca60e168341e94ea8fba4545a80 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Tue, 8 Aug 2023 10:38:11 -0400 Subject: [PATCH 43/97] fix the Helm chart URL for values files --- .../learn/quickstarts/network/miniziti.bash | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 1a2aea4a0..74fc7fb0d 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -34,7 +34,7 @@ _usage(){ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ "\n DEBUG\n"\ - " --charts\t\tZITI_CHARTS (openziti) alternative charts repo\n"\ + " --charts\t\tZITI_CHARTS_REF (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ " --\t\t\tMINIKUBE_START_ARGS args after -- passed to minikube start\n" } @@ -172,7 +172,8 @@ main(){ DELETE_MINIZITI=0 \ SAFETY_WAIT=1 \ MINIKUBE_NODE_EXTERNAL \ - ZITI_CHARTS="openziti" \ + ZITI_CHARTS_REF="openziti" \ + ZITI_CHARTS_URL="https://openziti.io/helm-charts/charts" \ MINIZITI_HOSTS=1 \ MINIZITI_INGRESS_ZONE="ziti" \ MINIZITI_INTERCEPT_ZONE="miniziti" @@ -198,7 +199,8 @@ main(){ -n|--namespace) ZITI_NAMESPACE="$2" shift 2 ;; - --charts) ZITI_CHARTS="$2" + --charts) ZITI_CHARTS_REF="$2" + ZITI_CHARTS_URL="$2" shift 2 ;; -q|--quiet) exec > /dev/null @@ -353,23 +355,23 @@ main(){ if helm status ziti-controller --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logInfo "upgrading openziti controller" - helm upgrade "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ + helm upgrade "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" \ --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ - --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-controller/values-ingress-nginx.yaml" >&3 + --values "${ZITI_CHARTS_URL}/ziti-controller/values-ingress-nginx.yaml" >&3 else logInfo "installing openziti controller" - helm dependency build "${ZITI_CHARTS}/ziti-controller" >&3 - helm install "ziti-controller" "${ZITI_CHARTS}/ziti-controller" \ + helm dependency build "${ZITI_CHARTS_REF}/ziti-controller" >&3 + helm install "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ --set trust-manager.enabled=true \ --set cert-manager.enabled=true \ - --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-controller/values-ingress-nginx.yaml" >&3 + --values "${ZITI_CHARTS_URL}/ziti-controller/values-ingress-nginx.yaml" >&3 fi logDebug "setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" @@ -510,23 +512,23 @@ main(){ if helm status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logDebug "upgrading router chart as 'ziti-router'" - helm upgrade "ziti-router" "${ZITI_CHARTS}/ziti-router" \ + helm upgrade "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_INGRESS_ZONE}" \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ - --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-router/values-ingress-nginx.yaml" >&3 + --values "${ZITI_CHARTS_URL}/ziti-router/values-ingress-nginx.yaml" >&3 else logDebug "installing router chart as 'ziti-router'" - helm dependency build "${ZITI_CHARTS}/ziti-router" >&3 - helm install "ziti-router" "${ZITI_CHARTS}/ziti-router" \ + helm dependency build "${ZITI_CHARTS_REF}/ziti-router" >&3 + helm install "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt=/tmp/miniziti-router.jwt \ --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_INGRESS_ZONE}" \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ - --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-router/values-ingress-nginx.yaml" >&3 + --values "${ZITI_CHARTS_URL}/ziti-router/values-ingress-nginx.yaml" >&3 fi logInfo "waiting for ziti-router to be ready" @@ -551,19 +553,19 @@ main(){ if helm --namespace "${ZITI_NAMESPACE}" list --all \ | grep -q ziti-console; then logDebug "upgrading console chart as 'ziti-console'" - helm upgrade "ziti-console" "${ZITI_CHARTS}/ziti-console" \ + helm upgrade "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ - --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-console/values-ingress-nginx.yaml" >&3 + --values "${ZITI_CHARTS_URL}/ziti-console/values-ingress-nginx.yaml" >&3 else logDebug "installing console chart as 'ziti-console'" - helm dependency build "${ZITI_CHARTS}/ziti-console" >&3 - helm install "ziti-console" "${ZITI_CHARTS}/ziti-console" \ + helm dependency build "${ZITI_CHARTS_REF}/ziti-console" >&3 + helm install "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ - --values "${ZITI_CHARTS:-https://openziti.io/helm-charts/charts}/ziti-console/values-ingress-nginx.yaml" >&3 + --values "${ZITI_CHARTS_URL}/ziti-console/values-ingress-nginx.yaml" >&3 fi logInfo "waiting for ziti-console to be ready" @@ -682,8 +684,8 @@ main(){ if [[ -s /tmp/httpbin-host.json ]]; then logDebug "installing httpbin chart as 'miniziti-httpbin'" - helm dependency build "${ZITI_CHARTS}/httpbin" >&3 - helm install "miniziti-httpbin" "${ZITI_CHARTS}/httpbin" \ + helm dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 + helm install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ --set-file zitiIdentity=/tmp/httpbin-host.json \ --set zitiServiceName=httpbin-service >&3 rm -f /tmp/httpbin-host.json From f83206b31722c50a3cdb0bf500fdaf6162a7a2f1 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Wed, 9 Aug 2023 09:48:54 -0400 Subject: [PATCH 44/97] only build helm deps when alt charts dir --- .../learn/quickstarts/network/miniziti.bash | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 74fc7fb0d..05c028d4b 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -172,6 +172,7 @@ main(){ DELETE_MINIZITI=0 \ SAFETY_WAIT=1 \ MINIKUBE_NODE_EXTERNAL \ + ZITI_CHARTS_ALT=0 \ ZITI_CHARTS_REF="openziti" \ ZITI_CHARTS_URL="https://openziti.io/helm-charts/charts" \ MINIZITI_HOSTS=1 \ @@ -201,6 +202,7 @@ main(){ ;; --charts) ZITI_CHARTS_REF="$2" ZITI_CHARTS_URL="$2" + ZITI_CHARTS_ALT=1 shift 2 ;; -q|--quiet) exec > /dev/null @@ -364,7 +366,9 @@ main(){ --values "${ZITI_CHARTS_URL}/ziti-controller/values-ingress-nginx.yaml" >&3 else logInfo "installing openziti controller" - helm dependency build "${ZITI_CHARTS_REF}/ziti-controller" >&3 + (( ZITI_CHARTS_ALT )) && { + helm dependency build "${ZITI_CHARTS_REF}/ziti-controller" >&3 + } helm install "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ @@ -521,7 +525,9 @@ main(){ --values "${ZITI_CHARTS_URL}/ziti-router/values-ingress-nginx.yaml" >&3 else logDebug "installing router chart as 'ziti-router'" - helm dependency build "${ZITI_CHARTS_REF}/ziti-router" >&3 + (( ZITI_CHARTS_ALT )) && { + helm dependency build "${ZITI_CHARTS_REF}/ziti-router" >&3 + } helm install "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt=/tmp/miniziti-router.jwt \ @@ -560,7 +566,9 @@ main(){ --values "${ZITI_CHARTS_URL}/ziti-console/values-ingress-nginx.yaml" >&3 else logDebug "installing console chart as 'ziti-console'" - helm dependency build "${ZITI_CHARTS_REF}/ziti-console" >&3 + (( ZITI_CHARTS_ALT )) && { + helm dependency build "${ZITI_CHARTS_REF}/ziti-console" >&3 + } helm install "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ @@ -684,7 +692,9 @@ main(){ if [[ -s /tmp/httpbin-host.json ]]; then logDebug "installing httpbin chart as 'miniziti-httpbin'" - helm dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 + (( ZITI_CHARTS_ALT )) && { + helm dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 + } helm install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ --set-file zitiIdentity=/tmp/httpbin-host.json \ --set zitiServiceName=httpbin-service >&3 From 5e5561f0559af1073e1838be729271cc683124cb Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Wed, 9 Aug 2023 12:52:10 -0400 Subject: [PATCH 45/97] use sslip.io --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 05c028d4b..071052543 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -32,7 +32,6 @@ _usage(){ " --verbose\t\tshow DEBUG messages\n"\ " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ - " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ "\n DEBUG\n"\ " --charts\t\tZITI_CHARTS_REF (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ @@ -278,7 +277,7 @@ main(){ MINIKUBE_NODE_EXTERNAL=$(minikube --profile "${MINIKUBE_PROFILE}" ip) # if --no-hosts then build a new zone name for RFC-1918 wildcard DNS (( MINIZITI_HOSTS )) || { - MINIZITI_INGRESS_ZONE="${MINIKUBE_NODE_EXTERNAL}.mini.openziti.io" + MINIZITI_INGRESS_ZONE="${MINIKUBE_NODE_EXTERNAL}.sslip.io" logDebug "DNS wildcard zone for ingresses is ${MINIZITI_INGRESS_ZONE}" } if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then From f90c7b1774ed1cc03f6c6d5773aa0f99eb4d6277 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Wed, 9 Aug 2023 13:34:19 -0400 Subject: [PATCH 46/97] restore usage hint for --no-hosts --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 1 + 1 file changed, 1 insertion(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 071052543..929306c85 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -32,6 +32,7 @@ _usage(){ " --verbose\t\tshow DEBUG messages\n"\ " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ + " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ "\n DEBUG\n"\ " --charts\t\tZITI_CHARTS_REF (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ From aeaebaf186c1828cc18e14b859fe7f60865f1265 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 31 Aug 2023 14:01:28 -0400 Subject: [PATCH 47/97] Adds option to manage miniziti hosts file entries. Adds missing log function. --- .../learn/quickstarts/network/miniziti.bash | 69 ++++++++++++++++++- 1 file changed, 67 insertions(+), 2 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 929306c85..c676d3d55 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -33,6 +33,7 @@ _usage(){ " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ + " --modify-hosts\t\tadd local hosts to /etc/hosts. Requires sudo it not running as root. Linux only.\n"\ "\n DEBUG\n"\ " --charts\t\tZITI_CHARTS_REF (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ @@ -128,6 +129,51 @@ validateDnsName(){ fi } +HOSTS_FILE='/etc/hosts' +MINIZITI_MARKER='miniziti-' + + +checkSudoRequired() { + (( EUID != 0 )) && logInfo "sudo is required when not running as root" +} + +cleanHosts() { + (( MINIZITI_MODIFY_HOSTS )) || return + + checkSudoRequired + + if grep -q "$MINIZITI_MARKER" "$HOSTS_FILE"; then + logInfo "Removing stale miniziti entries from $HOSTS_FILE" + if (( EUID != 0 )); then + sudo sed -i "/${MINIZITI_MARKER}/d" "$HOSTS_FILE" + else + sed -i "/${MINIZITI_MARKER}/d" "$HOSTS_FILE" + fi + fi +} + +installHosts() { + (( MINIZITI_MODIFY_HOSTS )) || return + + hosts=( + "miniziti-controller.${MINIZITI_INGRESS_ZONE}" + "miniziti-router.${MINIZITI_INGRESS_ZONE}" + "miniziti-console.${MINIZITI_INGRESS_ZONE}" + ) + + hosts_line="${MINIKUBE_NODE_EXTERNAL} ${hosts[*]}" + + if ! grep -q "$hosts_line" "$HOSTS_FILE"; then + cleanHosts + logInfo "Adding miniziti entries to $HOSTS_FILE" + if (( EUID != 0 )); then + echo "$hosts_line" | sudo tee -a "$HOSTS_FILE" > /dev/null + else + echo "$hosts_line" | tee -a "$HOSTS_FILE" > /dev/null + fi + fi +} + logInfo() { (( $# )) || { logError "logInfo() takes 1 or more args" @@ -136,6 +182,14 @@ logInfo() { echo "INFO: $*" } +logWarn() { + (( $# )) || { + logError "logWarn() takes 1 or more args" + return 1 + } + echo "WARN: $*" +} + logError() { (( $# )) || { echo "ERROR: logError() takes 1 or more args" >&2 @@ -154,7 +208,7 @@ logDebug() { main(){ # require commands - declare -a BINS=(ziti minikube kubectl helm) + declare -a BINS=(ziti minikube kubectl helm sed) for BIN in "${BINS[@]}"; do if ! command -v "$BIN" &>/dev/null; then logError "this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." @@ -176,6 +230,7 @@ main(){ ZITI_CHARTS_REF="openziti" \ ZITI_CHARTS_URL="https://openziti.io/helm-charts/charts" \ MINIZITI_HOSTS=1 \ + MINIZITI_MODIFY_HOSTS=0 \ MINIZITI_INGRESS_ZONE="ziti" \ MINIZITI_INTERCEPT_ZONE="miniziti" # local arrays with defaults that never produce an error @@ -215,7 +270,14 @@ main(){ --now) SAFETY_WAIT=0 shift ;; - --no-hosts) MINIZITI_HOSTS=0 + --no-hosts) MINIZITI_HOSTS=1 + shift + ;; + --modify-hosts) if [[ "$DETECTED_OS" != "Linux" ]]; then + logError "The '--modify-hosts' option is only available for Linux" + exit 1 + fi + MINIZITI_MODIFY_HOSTS=1 shift ;; --) shift @@ -252,6 +314,7 @@ main(){ # delete and exit if --delete (( DELETE_MINIZITI )) && { deleteMiniziti 10 + cleanHosts exit 0 } @@ -288,6 +351,8 @@ main(){ exit 1 fi + installHosts + # verify current context can connect to apiserver kubectl cluster-info >&3 logDebug "kubectl successfully obtained cluster-info from apiserver" From d39aeac3f58ad1447011ab88e679da2e6147a641 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 31 Aug 2023 15:38:04 -0400 Subject: [PATCH 48/97] Send warn logs to stderr --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index c676d3d55..fcd1ccaf2 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -187,7 +187,7 @@ logWarn() { logError "logWarn() takes 1 or more args" return 1 } - echo "WARN: $*" + echo "WARN: $*" >&2 } logError() { From b0aef2613a1d454ae06acaf19624d6048112b23c Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 31 Aug 2023 16:09:02 -0400 Subject: [PATCH 49/97] Move flag check responsability to caller --- .../docs/learn/quickstarts/network/miniziti.bash | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index fcd1ccaf2..c2283f47c 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -138,8 +138,6 @@ checkSudoRequired() { } cleanHosts() { - (( MINIZITI_MODIFY_HOSTS )) || return - checkSudoRequired if grep -q "$MINIZITI_MARKER" "$HOSTS_FILE"; then @@ -153,8 +151,6 @@ cleanHosts() { } installHosts() { - (( MINIZITI_MODIFY_HOSTS )) || return - hosts=( "miniziti-controller.${MINIZITI_INGRESS_ZONE}" "miniziti-router.${MINIZITI_INGRESS_ZONE}" @@ -314,7 +310,9 @@ main(){ # delete and exit if --delete (( DELETE_MINIZITI )) && { deleteMiniziti 10 - cleanHosts + if (( MINIZITI_MODIFY_HOSTS )); then + cleanHosts + fi exit 0 } @@ -351,7 +349,9 @@ main(){ exit 1 fi - installHosts + if (( MINIZITI_MODIFY_HOSTS )); then + installHosts + fi # verify current context can connect to apiserver kubectl cluster-info >&3 From d21d57eff26098f886d351a4882885bd8845ae22 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Fri, 1 Sep 2023 14:08:37 -0400 Subject: [PATCH 50/97] fixup var value and tab spacing --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index c2283f47c..c0c5f6322 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -33,7 +33,7 @@ _usage(){ " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ - " --modify-hosts\t\tadd local hosts to /etc/hosts. Requires sudo it not running as root. Linux only.\n"\ + " --modify-hosts\tadd local hosts to /etc/hosts. Requires sudo it not running as root. Linux only.\n"\ "\n DEBUG\n"\ " --charts\t\tZITI_CHARTS_REF (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ @@ -266,7 +266,7 @@ main(){ --now) SAFETY_WAIT=0 shift ;; - --no-hosts) MINIZITI_HOSTS=1 + --no-hosts) MINIZITI_HOSTS=0 shift ;; --modify-hosts) if [[ "$DETECTED_OS" != "Linux" ]]; then From ca852bf34450aec112e116eb7288d2e52698c8b3 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Tue, 5 Sep 2023 11:03:34 -0400 Subject: [PATCH 51/97] Only delete duplicate hosts entry when found --- .../learn/quickstarts/network/miniziti.bash | 38 +++++++++---------- 1 file changed, 17 insertions(+), 21 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index c0c5f6322..d12fed422 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -33,7 +33,7 @@ _usage(){ " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ - " --modify-hosts\tadd local hosts to /etc/hosts. Requires sudo it not running as root. Linux only.\n"\ + " --modify-hosts\tadd entries to local hosts database. Requires sudo if not running as root. Linux only.\n"\ "\n DEBUG\n"\ " --charts\t\tZITI_CHARTS_REF (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ @@ -130,23 +130,13 @@ validateDnsName(){ } HOSTS_FILE='/etc/hosts' -MINIZITI_MARKER='miniziti-' - - -checkSudoRequired() { - (( EUID != 0 )) && logInfo "sudo is required when not running as root" -} cleanHosts() { - checkSudoRequired - - if grep -q "$MINIZITI_MARKER" "$HOSTS_FILE"; then - logInfo "Removing stale miniziti entries from $HOSTS_FILE" - if (( EUID != 0 )); then - sudo sed -i "/${MINIZITI_MARKER}/d" "$HOSTS_FILE" - else - sed -i "/${MINIZITI_MARKER}/d" "$HOSTS_FILE" - fi + local miniziti_marker="$1" + if (( EUID != 0 )); then + sudo sed -i "/${miniziti_marker}/d" "$HOSTS_FILE" + else + sed -i "/${miniziti_marker}/d" "$HOSTS_FILE" fi } @@ -157,10 +147,19 @@ installHosts() { "miniziti-console.${MINIZITI_INGRESS_ZONE}" ) - hosts_line="${MINIKUBE_NODE_EXTERNAL} ${hosts[*]}" + hosts_suffix="${hosts[*]}" + hosts_line="${MINIKUBE_NODE_EXTERNAL} $hosts_suffix" if ! grep -q "$hosts_line" "$HOSTS_FILE"; then - cleanHosts + if (( EUID != 0 )); then + logInfo "sudo is required when not running as root" + fi + + if grep -q "$hosts_suffix" "$HOSTS_FILE"; then + logWarn "Removing stale miniziti entries from $HOSTS_FILE" + cleanHosts "$hosts_suffix" + fi + logInfo "Adding miniziti entries to $HOSTS_FILE" if (( EUID != 0 )); then echo "$hosts_line" | sudo tee -a "$HOSTS_FILE" > /dev/null @@ -310,9 +309,6 @@ main(){ # delete and exit if --delete (( DELETE_MINIZITI )) && { deleteMiniziti 10 - if (( MINIZITI_MODIFY_HOSTS )); then - cleanHosts - fi exit 0 } From 7867438d33fa2181fb38ef81853101b087084776 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Tue, 5 Sep 2023 22:01:16 -0400 Subject: [PATCH 52/97] Facilitate multiple miniziti profile coexistence --- .../learn/quickstarts/network/miniziti.bash | 298 ++++++++++++------ 1 file changed, 195 insertions(+), 103 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index d12fed422..4a4a73494 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -5,6 +5,9 @@ set -o nounset set -o pipefail banner(){ + + local profile="${1-}" + cat <&2 return 1 - } - echo "INFO: $*" + fi + + caller_level="${caller##log}" + echo -e "${caller_level^^}:${FUNCNAME[2]}:${BASH_LINENO[1]}: $*" +} + +logInfo() { + logger "$*" } logWarn() { - (( $# )) || { - logError "logWarn() takes 1 or more args" - return 1 - } - echo "WARN: $*" >&2 + logger "$*" >&2 } logError() { - (( $# )) || { - echo "ERROR: logError() takes 1 or more args" >&2 - return 1 - } - echo "ERROR: $*" >&2 + logger "$*" >&2 } logDebug() { - (( $# )) || { - logError "logDebug() takes 1 or more args" - return 1 - } - echo "DEBUG: $*" >&3 + logger "$*" >&3 } main(){ @@ -216,18 +258,20 @@ main(){ # local strings with defaults that never produce an error declare DETECTED_OS \ - MINIKUBE_PROFILE="miniziti" \ - ZITI_NAMESPACE \ DELETE_MINIZITI=0 \ - SAFETY_WAIT=1 \ MINIKUBE_NODE_EXTERNAL \ + MINIKUBE_PROFILE="miniziti" \ + MINIZITI_HOSTS=1 \ + MINIZITI_INTERCEPT_ZONE="miniziti" \ + MINIZITI_MODIFY_HOSTS=0 \ + MINIZITI_YES=0 \ + SAFETY_WAIT=1 \ + SHOW_ADMIN_CREDS=0 \ ZITI_CHARTS_ALT=0 \ ZITI_CHARTS_REF="openziti" \ ZITI_CHARTS_URL="https://openziti.io/helm-charts/charts" \ - MINIZITI_HOSTS=1 \ - MINIZITI_MODIFY_HOSTS=0 \ - MINIZITI_INGRESS_ZONE="ziti" \ - MINIZITI_INTERCEPT_ZONE="miniziti" + ZITI_NAMESPACE + # local arrays with defaults that never produce an error declare -a MINIKUBE_START_ARGS=() @@ -243,8 +287,19 @@ main(){ delete) DELETE_MINIZITI=1 shift ;; + show-admin) SHOW_ADMIN_CREDS=1 + shift + ;; -p|--profile) validateDnsName "$2" MINIKUBE_PROFILE="$2" + # sanity check the profile name input + if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then + # in case the arg value is another option instead of the profile name + logError "--profile needs a profile name not starting with a hyphen" + _usage + exit 1 + fi + shift 2 ;; -n|--namespace) ZITI_NAMESPACE="$2" @@ -272,9 +327,13 @@ main(){ logError "The '--modify-hosts' option is only available for Linux" exit 1 fi + MINIZITI_PROFILE_MARKER="# miniziti:profile:$MINIKUBE_PROFILE" MINIZITI_MODIFY_HOSTS=1 shift ;; + --yes) MINIZITI_YES=1 + shift + ;; --) shift mapfile -t -n1 MINIKUBE_START_ARGS <<< "$*" shift $# @@ -293,26 +352,50 @@ main(){ esac done - if [[ ${MINIKUBE_PROFILE} == "miniziti" ]]; then - banner - else - # sanity check the profile name input - if [[ ${MINIKUBE_PROFILE} =~ ^- ]]; then - # in case the arg value is another option instead of the profile name - logError "--profile needs a profile name not starting with a hyphen" - _usage; exit 1 - fi - # print the alternative profile name if not default "miniziti" - banner "$MINIKUBE_PROFILE" + : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" + + MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.ziti" + state_dir="$(makeMinizitiXDGStateDir "$DETECTED_OS")" + profile_dir="$state_dir/profiles/${MINIKUBE_PROFILE}" + identities_dir="$profile_dir/identities" + + if (( SHOW_ADMIN_CREDS )); then + showAdminCreds + exit 0 fi - # delete and exit if --delete + banner "$MINIKUBE_PROFILE" + (( DELETE_MINIZITI )) && { deleteMiniziti 10 + + if (( MINIZITI_MODIFY_HOSTS )) && grep -q "$MINIZITI_PROFILE_MARKER" "$HOSTS_FILE"; then + checkSudoRequired + cleanHosts + fi + + if [[ -d "$profile_dir" ]]; then + if (( MINIZITI_YES )) || askConfirmation "Delete profile state directory ($profile_dir)?"; then + logDebug "Deleting miniziti profile directory: $profile_dir" + rm -rf "$profile_dir" + fi + fi + + cert_file="$(find "$HOME/.config/ziti/certs" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit)" + if [[ -n "$cert_file" ]]; then + if (( MINIZITI_YES )) || askConfirmation "Delete certiicate file ($cert_file)?"; then + logDebug "Deleting miniziti certificate file: $cert_file" + rm -f "$cert_file" + fi + fi + exit 0 } - : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" + if [[ ! -d "$identities_dir" ]]; then + logDebug "Creating miniziti identities directory: ($identities_dir)" + mkdir -p "$identities_dir" + fi # ## Ensure Minikube is Started and Configured @@ -555,24 +638,28 @@ main(){ # logDebug "fetching admin password from k8s secret to log in to ziti mgmt" - kubectl get secrets "ziti-controller-admin-secret" \ - --namespace "${ZITI_NAMESPACE}" \ - --output go-template='{{index .data "admin-password" | base64decode }}' \ - | xargs ziti edge login "miniziti-controller.${MINIZITI_INGRESS_ZONE}:443" \ - --yes --username "admin" \ + getAdminSecret | xargs ziti edge login "miniziti-controller.${MINIZITI_INGRESS_ZONE}:443" \ + --yes \ + --cli-identity "$MINIKUBE_PROFILE" \ + --username "admin" \ --password >&3 - if ziti edge list edge-routers 'name="miniziti-router"' \ + logDebug "setting ziti cli default identity" + ziti edge use "$MINIKUBE_PROFILE" + + router_name='miniziti-router' + router_ott="$identities_dir/$router_name.jwt" + if ziti edge list edge-routers "name=\"$router_name\"" \ | grep -q miniziti-router; then - logDebug "updating miniziti-router" - ziti edge update edge-router "miniziti-router" \ + logDebug "updating $router_name" + ziti edge update edge-router "$router_name" \ --role-attributes "public-routers" >&3 else - logDebug "creating miniziti-router" - ziti edge create edge-router "miniziti-router" \ + logDebug "creating $router_name" + ziti edge create edge-router "$router_name" \ --role-attributes "public-routers" \ --tunneler-enabled \ - --jwt-output-file /tmp/miniziti-router.jwt >&3 + --jwt-output-file "$router_ott" >&3 fi if helm status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then @@ -591,7 +678,7 @@ main(){ } helm install "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ - --set-file enrollmentJwt=/tmp/miniziti-router.jwt \ + --set-file enrollmentJwt="$router_ott" \ --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_INGRESS_ZONE}" \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ @@ -604,7 +691,7 @@ main(){ --for condition=Available=True >&3 logDebug "probing miniziti-router for online status" - if ziti edge list edge-routers 'name="miniziti-router"' \ + if ziti edge list edge-routers "name=\"$router_name\"" \ | awk '/miniziti-router/ {print $6}' \ | grep -q true; then logInfo "miniziti-router is online" @@ -652,22 +739,29 @@ main(){ ## Ensure OpenZiti Identities and Services are Created # - if ! ziti edge list identities "name=\"${MINIKUBE_PROFILE}-client\"" --csv \ - | grep -q "${MINIKUBE_PROFILE}-client"; then - logDebug "creating identity ${MINIKUBE_PROFILE}-client" - ziti edge create identity device "${MINIKUBE_PROFILE}-client" \ - --jwt-output-file "/tmp/${MINIKUBE_PROFILE}-client.jwt" --role-attributes httpbin-clients >&3 + client_name="${MINIKUBE_PROFILE}-client" + client_ott="$identities_dir/$client_name.jwt" + + if ! ziti edge list identities "name=\"$client_name\"" --csv \ + | grep -q "$client_name"; then + logDebug "creating identity $client_name" + ziti edge create identity device "$client_name" \ + --jwt-output-file "$client_ott" --role-attributes httpbin-clients >&3 else - logDebug "ignoring identity ${MINIKUBE_PROFILE}-client" + logDebug "ignoring identity $client_name" fi - if ! ziti edge list identities 'name="httpbin-host"' --csv \ - | grep -q "httpbin-host"; then - logDebug "creating identity httpbin-host" - ziti edge create identity device "httpbin-host" \ - --jwt-output-file /tmp/httpbin-host.jwt --role-attributes httpbin-hosts >&3 + httpbin_name="httpbin-host" + httpbin_ott="$identities_dir/$httpbin_name.jwt" + httpbin_json="$identities_dir/$httpbin_name.json" + + if ! ziti edge list identities "name=\"$httpbin_name\"" --csv \ + | grep -q "$httpbin_name"; then + logDebug "creating identity $httpbin_name" + ziti edge create identity device "$httpbin_name" \ + --jwt-output-file "$httpbin_ott" --role-attributes httpbin-hosts >&3 else - logDebug "ignoring identity httpbin-host" + logDebug "ignoring identity $httpbin_name" fi if ! ziti edge list configs 'name="httpbin-intercept-config"' --csv \ @@ -733,17 +827,17 @@ main(){ logDebug "ignoring service-edge-router-policy public-routers" fi - if [[ -s /tmp/httpbin-host.jwt ]]; then - logDebug "enrolling /tmp/httpbin-host.jwt" + if [[ -s "$httpbin_ott" ]]; then + logDebug "enrolling $httpbin_ott" # discard expected output that normally flows to stderr ENROLL_OUT="$( - ziti edge enroll /tmp/httpbin-host.jwt 2>&1 \ + ziti edge enroll "$httpbin_ott" 2>&1 \ | grep -vE '(generating.*key|enrolled\s+successfully)' \ || true )" if [[ -z "${ENROLL_OUT}" ]]; then - rm -f /tmp/httpbin-host.jwt - logDebug "deleted /tmp/httpbin-host.jwt after enrolling successfully" + rm -f "$httpbin_ott" + logDebug "deleted $httpbin_ott after enrolling successfully" else echo -e "ERROR: unexpected result during OpenZiti Identity enrollment\n"\ "${ENROLL_OUT}" @@ -751,26 +845,24 @@ main(){ fi fi - if [[ -s /tmp/httpbin-host.json ]]; then + if [[ -s "$httpbin_json" ]]; then logDebug "installing httpbin chart as 'miniziti-httpbin'" (( ZITI_CHARTS_ALT )) && { helm dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 } helm install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ - --set-file zitiIdentity=/tmp/httpbin-host.json \ + --set-file zitiIdentity="$httpbin_json" \ --set zitiServiceName=httpbin-service >&3 - rm -f /tmp/httpbin-host.json - logDebug "deleted /tmp/httpbin-host.json after installing successfully with miniziti-httpbin chart" + rm -f "$httpbin_json" + logDebug "deleted $httpbin_json after installing successfully with miniziti-httpbin chart" fi - kubectl get secrets "ziti-controller-admin-secret" \ - --namespace "${ZITI_NAMESPACE}" \ - --output go-template='{{"\n'\ -'INFO: Your OpenZiti Console is here:\thttps://miniziti-console.'"${MINIZITI_INGRESS_ZONE}"'\n'\ -'INFO: The password for \"admin\" is:\t"}}{{index .data "admin-password" | base64decode }}'\ -'{{"\n\n"}}' + echo -e "\n\n" + logInfo "Your OpenZiti Console is here: https://miniziti-console.${MINIZITI_INGRESS_ZONE}" + showAdminCreds + echo -e "\n\n" - logInfo "Success! Remember to add your edge client identity '$(getClientOttPath "${DETECTED_OS}")' in your tunneler, e.g. Ziti Desktop Edge." + logInfo "Success! Remember to add your edge client identity '$client_ott' in your tunneler, e.g. Ziti Desktop Edge." } main "$@" From 40cc99ba47a12c66971973c56646615449e2fc88 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 6 Sep 2023 10:18:49 -0400 Subject: [PATCH 53/97] Remove marker, use profile. --- .../learn/quickstarts/network/miniziti.bash | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 4a4a73494..95276cc05 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -187,7 +187,7 @@ installHosts() { "miniziti-console.${MINIZITI_INGRESS_ZONE}" ) - hosts_line="${MINIKUBE_NODE_EXTERNAL} ${hosts[*]} $MINIZITI_PROFILE_MARKER" + hosts_line="${MINIKUBE_NODE_EXTERNAL} ${hosts[*]}" if ! grep -q "$hosts_line" "$HOSTS_FILE"; then @@ -224,7 +224,11 @@ logger() { fi caller_level="${caller##log}" - echo -e "${caller_level^^}:${FUNCNAME[2]}:${BASH_LINENO[1]}: $*" + if (( MINIZITI_DEBUG )); then + echo -e "${caller_level^^} ${FUNCNAME[2]}:${BASH_LINENO[1]}: $*" + else + echo -e "${caller_level^^} $*" + fi } logInfo() { @@ -261,6 +265,7 @@ main(){ DELETE_MINIZITI=0 \ MINIKUBE_NODE_EXTERNAL \ MINIKUBE_PROFILE="miniziti" \ + MINIZITI_DEBUG=0 \ MINIZITI_HOSTS=1 \ MINIZITI_INTERCEPT_ZONE="miniziti" \ MINIZITI_MODIFY_HOSTS=0 \ @@ -314,6 +319,7 @@ main(){ shift ;; -v|--verbose|--debug) + MINIZITI_DEBUG=1 exec 3>&1 shift ;; @@ -327,7 +333,6 @@ main(){ logError "The '--modify-hosts' option is only available for Linux" exit 1 fi - MINIZITI_PROFILE_MARKER="# miniziti:profile:$MINIKUBE_PROFILE" MINIZITI_MODIFY_HOSTS=1 shift ;; @@ -354,6 +359,7 @@ main(){ : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" + MINIZITI_PROFILE_MARKER="miniziti-controller.$MINIKUBE_PROFILE" MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.ziti" state_dir="$(makeMinizitiXDGStateDir "$DETECTED_OS")" profile_dir="$state_dir/profiles/${MINIKUBE_PROFILE}" @@ -389,6 +395,9 @@ main(){ fi fi + logDebug "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" + ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 + exit 0 } @@ -644,8 +653,8 @@ main(){ --username "admin" \ --password >&3 - logDebug "setting ziti cli default identity" - ziti edge use "$MINIKUBE_PROFILE" + logInfo "setting ziti cli default identity to '$MINIKUBE_PROFILE'" + ziti edge use "$MINIKUBE_PROFILE" >&3 router_name='miniziti-router' router_ott="$identities_dir/$router_name.jwt" From 6e3f113eba6c0775a775c05e01f00ce8a7e7badd Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 6 Sep 2023 10:39:15 -0400 Subject: [PATCH 54/97] Remove confirmation prompts --- .../learn/quickstarts/network/miniziti.bash | 37 +++---------------- 1 file changed, 5 insertions(+), 32 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 95276cc05..6ac877beb 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -38,7 +38,6 @@ _usage(){ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ " --modify-hosts\tadd entries to local hosts database. Requires sudo if not running as root. Linux only.\n"\ - " --yes\t\tanswer 'yes' to all prompts"\ "\n DEBUG\n"\ " --charts\t\tZITI_CHARTS_REF (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ @@ -151,24 +150,6 @@ checkSudoRequired() { fi } -askConfirmation() { - local question="$1" - - while true; do - read -r -p "$question (yes/no): " choice - case "$choice" in - [Yy]|[Yy][Ee][Ss]) - return 0 - ;; - [Nn]|[Nn][Oo]) - return 1 - ;; - *) - ;; - esac - done -} - HOSTS_FILE='/etc/hosts' cleanHosts() { @@ -269,7 +250,6 @@ main(){ MINIZITI_HOSTS=1 \ MINIZITI_INTERCEPT_ZONE="miniziti" \ MINIZITI_MODIFY_HOSTS=0 \ - MINIZITI_YES=0 \ SAFETY_WAIT=1 \ SHOW_ADMIN_CREDS=0 \ ZITI_CHARTS_ALT=0 \ @@ -336,9 +316,6 @@ main(){ MINIZITI_MODIFY_HOSTS=1 shift ;; - --yes) MINIZITI_YES=1 - shift - ;; --) shift mapfile -t -n1 MINIKUBE_START_ARGS <<< "$*" shift $# @@ -381,21 +358,17 @@ main(){ fi if [[ -d "$profile_dir" ]]; then - if (( MINIZITI_YES )) || askConfirmation "Delete profile state directory ($profile_dir)?"; then - logDebug "Deleting miniziti profile directory: $profile_dir" - rm -rf "$profile_dir" - fi + logWarn "Deleting miniziti profile directory: $profile_dir" + rm -rf "$profile_dir" fi cert_file="$(find "$HOME/.config/ziti/certs" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit)" if [[ -n "$cert_file" ]]; then - if (( MINIZITI_YES )) || askConfirmation "Delete certiicate file ($cert_file)?"; then - logDebug "Deleting miniziti certificate file: $cert_file" - rm -f "$cert_file" - fi + logWarn "Deleting miniziti certificate file: $cert_file" + rm -f "$cert_file" fi - logDebug "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" + logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 exit 0 From c01cac7ef70efdbdcf21b02dfcdcc25b2683e896 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 6 Sep 2023 14:51:52 -0400 Subject: [PATCH 55/97] Migrates to wrappers to forward context. Adds login command and ziti wrapper. --- .../learn/quickstarts/network/miniziti.bash | 126 +++++++++++------- 1 file changed, 81 insertions(+), 45 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 6ac877beb..44e3c96ae 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -29,7 +29,9 @@ _usage(){ echo -e "\n COMMANDS\n"\ " start\t\tstart miniziti (default)\n"\ " delete\t\tdelete miniziti\n"\ + " login\t\trun ziti edge login with miniziti context\n"\ " show-admin\t\tprints admin user updb credentials\n"\ + " ziti\t\tziti cli wrapper with miniziti context\n"\ " help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ " --quiet\t\tsuppress INFO messages\n"\ @@ -121,7 +123,7 @@ makeMinizitiXDGStateDir() { } testClusterDns(){ - if kubectl run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ + if kubectl_wrapper run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ nslookup "miniziti-controller.${MINIZITI_INGRESS_ZONE}" | grep "$1" >&3; then logInfo "cluster dns test succeeded" else @@ -188,7 +190,7 @@ installHosts() { } getAdminSecret() { - kubectl get secrets "ziti-controller-admin-secret" \ + kubectl_wrapper get secrets "ziti-controller-admin-secret" \ --namespace "${ZITI_NAMESPACE}" \ --output go-template='{{index .data "admin-password" | base64decode }}' } @@ -197,6 +199,13 @@ showAdminCreds() { logInfo "The password for 'admin' is: '$(getAdminSecret)'" } +miniziti_login() { + getAdminSecret | xargs ziti edge login \ + --cli-identity "$MINIKUBE_PROFILE" \ + --username "admin" \ + --password +} + logger() { local caller="${FUNCNAME[1]}" if (( $# < 1 )); then @@ -228,6 +237,14 @@ logDebug() { logger "$*" >&3 } +ziti_wrapper() { + ziti "$@" --cli-identity "$MINIKUBE_PROFILE" +} + +kubectl_wrapper() { + minikube kubectl --profile "$MINIKUBE_PROFILE" -- --context "$MINIKUBE_PROFILE" "$@" +} + main(){ # require commands declare -a BINS=(ziti minikube kubectl helm sed) @@ -244,12 +261,14 @@ main(){ # local strings with defaults that never produce an error declare DETECTED_OS \ DELETE_MINIZITI=0 \ + DO_ZITI_LOGIN=0 \ MINIKUBE_NODE_EXTERNAL \ MINIKUBE_PROFILE="miniziti" \ MINIZITI_DEBUG=0 \ MINIZITI_HOSTS=1 \ MINIZITI_INTERCEPT_ZONE="miniziti" \ MINIZITI_MODIFY_HOSTS=0 \ + RUN_ZITI_CLI=0 \ SAFETY_WAIT=1 \ SHOW_ADMIN_CREDS=0 \ ZITI_CHARTS_ALT=0 \ @@ -272,9 +291,17 @@ main(){ delete) DELETE_MINIZITI=1 shift ;; + login) DO_ZITI_LOGIN=1 + shift + ;; show-admin) SHOW_ADMIN_CREDS=1 shift ;; + ziti) RUN_ZITI_CLI=1 + shift + ziti_cli_args=("$@") + shift "${#ziti_cli_args[@]}" + ;; -p|--profile) validateDnsName "$2" MINIKUBE_PROFILE="$2" # sanity check the profile name input @@ -336,17 +363,27 @@ main(){ : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" - MINIZITI_PROFILE_MARKER="miniziti-controller.$MINIKUBE_PROFILE" + MINIZITI_PROFILE_MARKER="miniziti-controller.$MINIKUBE_PROFILE." MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.ziti" state_dir="$(makeMinizitiXDGStateDir "$DETECTED_OS")" profile_dir="$state_dir/profiles/${MINIKUBE_PROFILE}" identities_dir="$profile_dir/identities" + if (( DO_ZITI_LOGIN )); then + miniziti_login + exit 0 + fi if (( SHOW_ADMIN_CREDS )); then showAdminCreds exit 0 fi + if (( RUN_ZITI_CLI )); then + ziti_wrapper "${ziti_cli_args[@]}" + exit 0 + fi + + banner "$MINIKUBE_PROFILE" (( DELETE_MINIZITI )) && { @@ -369,7 +406,7 @@ main(){ fi logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" - ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 + ziti_wrapper edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 exit 0 } @@ -415,11 +452,11 @@ main(){ fi # verify current context can connect to apiserver - kubectl cluster-info >&3 + kubectl_wrapper cluster-info >&3 logDebug "kubectl successfully obtained cluster-info from apiserver" # enable ssl-passthrough for OpenZiti ingresses - if kubectl get deployment "ingress-nginx-controller" \ + if kubectl_wrapper get deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ | grep -q enable-ssl-passthrough; then @@ -435,7 +472,7 @@ main(){ --profile "${MINIKUBE_PROFILE}" >&3 } logDebug "patching ingress-nginx deployment to enable ssl-passthrough" - kubectl patch deployment "ingress-nginx-controller" \ + kubectl_wrapper patch deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ --type json \ --patch '[{"op": "add", @@ -446,21 +483,21 @@ main(){ logInfo "waiting for ingress-nginx to be ready" # wait for ingress-nginx - kubectl wait jobs "ingress-nginx-admission-patch" \ + kubectl_wrapper wait jobs "ingress-nginx-admission-patch" \ --namespace ingress-nginx \ --for condition=complete \ --timeout 120s >&3 - kubectl wait pods \ + kubectl_wrapper wait pods \ --namespace ingress-nginx \ --for condition=ready \ --selector app.kubernetes.io/component=controller \ --timeout 120s >&3 logDebug "applying Custom Resource Definitions: Certificate, Issuer, and Bundle" - kubectl apply \ + kubectl_wrapper apply \ --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >&3 - kubectl apply \ + kubectl_wrapper apply \ --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >&3 declare -A HELM_REPOS @@ -505,13 +542,12 @@ main(){ fi logDebug "setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" - minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ - config set-context "${MINIKUBE_PROFILE}" \ + kubectl_wrapper config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >&3 for DEPLOYMENT in ziti-controller-cert-manager trust-manager ziti-controller; do logInfo "waiting for $DEPLOYMENT to be ready" - kubectl wait deployments "$DEPLOYMENT" \ + kubectl_wrapper wait deployments "$DEPLOYMENT" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ --timeout 240s >&3 @@ -561,7 +597,7 @@ main(){ (( MINIZITI_HOSTS )) && { logDebug "patching coredns configmap with *.${MINIZITI_INGRESS_ZONE} forwarder to minikube ingress-dns nameserver" - kubectl patch configmap "coredns" \ + kubectl_wrapper patch configmap "coredns" \ --namespace kube-system \ --patch " data: @@ -599,14 +635,15 @@ main(){ " >&3 logDebug "deleting coredns pod so a new one will have modified Corefile" - kubectl get pods \ + kubectl_wrapper get pods \ --namespace kube-system \ | awk '/^coredns-/ {print $1}' \ | xargs kubectl delete pods \ + --context "$MINIKUBE_PROFILE" \ --namespace kube-system >&3 logDebug "waiting for cluster dns to be ready" - kubectl wait deployments "coredns" \ + kubectl_wrapper wait deployments "coredns" \ --namespace kube-system \ --for condition=Available=True >&3 } @@ -626,19 +663,19 @@ main(){ --username "admin" \ --password >&3 - logInfo "setting ziti cli default identity to '$MINIKUBE_PROFILE'" - ziti edge use "$MINIKUBE_PROFILE" >&3 + logInfo "Setting default ziti identity to: $MINIKUBE_PROFILE" + ziti_wrapper edge use "$MINIKUBE_PROFILE" >&3 router_name='miniziti-router' router_ott="$identities_dir/$router_name.jwt" - if ziti edge list edge-routers "name=\"$router_name\"" \ + if ziti_wrapper edge list edge-routers "name=\"$router_name\"" \ | grep -q miniziti-router; then logDebug "updating $router_name" - ziti edge update edge-router "$router_name" \ + ziti_wrapper edge update edge-router "$router_name" \ --role-attributes "public-routers" >&3 else logDebug "creating $router_name" - ziti edge create edge-router "$router_name" \ + ziti_wrapper edge create edge-router "$router_name" \ --role-attributes "public-routers" \ --tunneler-enabled \ --jwt-output-file "$router_ott" >&3 @@ -668,12 +705,12 @@ main(){ fi logInfo "waiting for ziti-router to be ready" - kubectl wait deployments "ziti-router" \ + kubectl_wrapper wait deployments "ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True >&3 logDebug "probing miniziti-router for online status" - if ziti edge list edge-routers "name=\"$router_name\"" \ + if ziti_wrapper edge list edge-routers "name=\"$router_name\"" \ | awk '/miniziti-router/ {print $6}' \ | grep -q true; then logInfo "miniziti-router is online" @@ -707,14 +744,13 @@ main(){ fi logInfo "waiting for ziti-console to be ready" - kubectl wait deployments "ziti-console" \ + kubectl_wrapper wait deployments "ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ --timeout 240s >&3 logDebug "setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" - minikube kubectl --profile "${MINIKUBE_PROFILE}" -- \ - config set-context "${MINIKUBE_PROFILE}" \ + kubectl_wrapper config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >&3 # @@ -724,10 +760,10 @@ main(){ client_name="${MINIKUBE_PROFILE}-client" client_ott="$identities_dir/$client_name.jwt" - if ! ziti edge list identities "name=\"$client_name\"" --csv \ + if ! ziti_wrapper edge list identities "name=\"$client_name\"" --csv \ | grep -q "$client_name"; then logDebug "creating identity $client_name" - ziti edge create identity device "$client_name" \ + ziti_wrapper edge create identity device "$client_name" \ --jwt-output-file "$client_ott" --role-attributes httpbin-clients >&3 else logDebug "ignoring identity $client_name" @@ -737,73 +773,73 @@ main(){ httpbin_ott="$identities_dir/$httpbin_name.jwt" httpbin_json="$identities_dir/$httpbin_name.json" - if ! ziti edge list identities "name=\"$httpbin_name\"" --csv \ + if ! ziti_wrapper edge list identities "name=\"$httpbin_name\"" --csv \ | grep -q "$httpbin_name"; then logDebug "creating identity $httpbin_name" - ziti edge create identity device "$httpbin_name" \ + ziti_wrapper edge create identity device "$httpbin_name" \ --jwt-output-file "$httpbin_ott" --role-attributes httpbin-hosts >&3 else logDebug "ignoring identity $httpbin_name" fi - if ! ziti edge list configs 'name="httpbin-intercept-config"' --csv \ + if ! ziti_wrapper edge list configs 'name="httpbin-intercept-config"' --csv \ | grep -q "httpbin-intercept-config"; then logDebug "creating config httpbin-intercept-config" - ziti edge create config "httpbin-intercept-config" intercept.v1 \ + ziti_wrapper edge create config "httpbin-intercept-config" intercept.v1 \ '{"protocols":["tcp"],"addresses":["httpbin.'"${MINIZITI_INTERCEPT_ZONE}"'"], "portRanges":[{"low":80, "high":80}]}' >&3 else logDebug "ignoring config httpbin-intercept-config" fi - if ! ziti edge list configs 'name="httpbin-host-config"' --csv \ + if ! ziti_wrapper edge list configs 'name="httpbin-host-config"' --csv \ | grep -q "httpbin-host-config"; then logDebug "creating config httpbin-host-config" - ziti edge create config "httpbin-host-config" host.v1 \ + ziti_wrapper edge create config "httpbin-host-config" host.v1 \ '{"protocol":"tcp", "address":"httpbin","port":8080}' >&3 else logDebug "ignoring config httpbin-host-config" fi - if ! ziti edge list services 'name="httpbin-service"' --csv \ + if ! ziti_wrapper edge list services 'name="httpbin-service"' --csv \ | grep -q "httpbin-service"; then logDebug "creating service httpbin-service" - ziti edge create service "httpbin-service" \ + ziti_wrapper edge create service "httpbin-service" \ --configs httpbin-intercept-config,httpbin-host-config >&3 else logDebug "ignoring service httpbin-service" fi - if ! ziti edge list service-policies 'name="httpbin-bind-policy"' --csv \ + if ! ziti_wrapper edge list service-policies 'name="httpbin-bind-policy"' --csv \ | grep -q "httpbin-bind-policy"; then logDebug "creating service-policy httpbin-bind-policy" - ziti edge create service-policy "httpbin-bind-policy" Bind \ + ziti_wrapper edge create service-policy "httpbin-bind-policy" Bind \ --service-roles '@httpbin-service' --identity-roles '#httpbin-hosts' >&3 else logDebug "ignoring service-policy httpbin-bind-policy" fi - if ! ziti edge list service-policies 'name="httpbin-dial-policy"' --csv \ + if ! ziti_wrapper edge list service-policies 'name="httpbin-dial-policy"' --csv \ | grep -q "httpbin-dial-policy"; then logDebug "creating service-policy httpbin-dial-policy" - ziti edge create service-policy "httpbin-dial-policy" Dial \ + ziti_wrapper edge create service-policy "httpbin-dial-policy" Dial \ --service-roles '@httpbin-service' --identity-roles '#httpbin-clients' >&3 else logDebug "ignoring service-policy httpbin-dial-policy" fi - if ! ziti edge list edge-router-policies 'name="public-routers"' --csv \ + if ! ziti_wrapper edge list edge-router-policies 'name="public-routers"' --csv \ | grep -q "public-routers"; then logDebug "creating edge-router-policy public-routers" - ziti edge create edge-router-policy "public-routers" \ + ziti_wrapper edge create edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --identity-roles '#all' >&3 else logDebug "ignoring edge-router-policy public-routers" fi - if ! ziti edge list service-edge-router-policies 'name="public-routers"' --csv \ + if ! ziti_wrapper edge list service-edge-router-policies 'name="public-routers"' --csv \ | grep -q "public-routers"; then logDebug "creating service-edge-router-policy public-routers" - ziti edge create service-edge-router-policy "public-routers" \ + ziti_wrapper edge create service-edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --service-roles '#all' >&3 else logDebug "ignoring service-edge-router-policy public-routers" From f77f3cf37c5d8d7d6bc99afba3392bea516dbaeb Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 6 Sep 2023 16:24:31 -0400 Subject: [PATCH 56/97] capitalize pseudo-constants and use compount statement --- .../learn/quickstarts/network/miniziti.bash | 102 +++++++++--------- 1 file changed, 51 insertions(+), 51 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 44e3c96ae..4780dbdec 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -15,7 +15,7 @@ banner(){ BANNER - if [[ -n "$profile" ]] && [[ "$profile" != "miniziti" ]]; then + if [[ -n "$profile" && "$profile" != "miniziti" ]]; then echo -e " .: $* :.\n" fi } @@ -365,9 +365,9 @@ main(){ MINIZITI_PROFILE_MARKER="miniziti-controller.$MINIKUBE_PROFILE." MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.ziti" - state_dir="$(makeMinizitiXDGStateDir "$DETECTED_OS")" - profile_dir="$state_dir/profiles/${MINIKUBE_PROFILE}" - identities_dir="$profile_dir/identities" + STATE_DIR="$(makeMinizitiXDGStateDir "$DETECTED_OS")" + PROFILE_DIR="$STATE_DIR/profiles/${MINIKUBE_PROFILE}" + IDENTITIES_DIR="$PROFILE_DIR/identities" if (( DO_ZITI_LOGIN )); then miniziti_login @@ -394,15 +394,15 @@ main(){ cleanHosts fi - if [[ -d "$profile_dir" ]]; then - logWarn "Deleting miniziti profile directory: $profile_dir" - rm -rf "$profile_dir" + if [[ -d "$PROFILE_DIR" ]]; then + logWarn "Deleting miniziti profile directory: $PROFILE_DIR" + rm -rf "$PROFILE_DIR" fi - cert_file="$(find "$HOME/.config/ziti/certs" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit)" - if [[ -n "$cert_file" ]]; then - logWarn "Deleting miniziti certificate file: $cert_file" - rm -f "$cert_file" + CERT_FILE="$(find "$HOME/.config/ziti/certs" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit)" + if [[ -n "$CERT_FILE" ]]; then + logWarn "Deleting miniziti certificate file: $CERT_FILE" + rm -f "$CERT_FILE" fi logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" @@ -411,9 +411,9 @@ main(){ exit 0 } - if [[ ! -d "$identities_dir" ]]; then - logDebug "Creating miniziti identities directory: ($identities_dir)" - mkdir -p "$identities_dir" + if [[ ! -d "$IDENTITIES_DIR" ]]; then + logDebug "Creating miniziti identities directory: ($IDENTITIES_DIR)" + mkdir -p "$IDENTITIES_DIR" fi # @@ -666,19 +666,19 @@ main(){ logInfo "Setting default ziti identity to: $MINIKUBE_PROFILE" ziti_wrapper edge use "$MINIKUBE_PROFILE" >&3 - router_name='miniziti-router' - router_ott="$identities_dir/$router_name.jwt" - if ziti_wrapper edge list edge-routers "name=\"$router_name\"" \ + ROUTER_NAME='miniziti-router' + ROUTER_OTT="$IDENTITIES_DIR/$ROUTER_NAME.jwt" + if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ | grep -q miniziti-router; then - logDebug "updating $router_name" - ziti_wrapper edge update edge-router "$router_name" \ + logDebug "updating $ROUTER_NAME" + ziti_wrapper edge update edge-router "$ROUTER_NAME" \ --role-attributes "public-routers" >&3 else - logDebug "creating $router_name" - ziti_wrapper edge create edge-router "$router_name" \ + logDebug "creating $ROUTER_NAME" + ziti_wrapper edge create edge-router "$ROUTER_NAME" \ --role-attributes "public-routers" \ --tunneler-enabled \ - --jwt-output-file "$router_ott" >&3 + --jwt-output-file "$ROUTER_OTT" >&3 fi if helm status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then @@ -697,7 +697,7 @@ main(){ } helm install "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ - --set-file enrollmentJwt="$router_ott" \ + --set-file enrollmentJwt="$ROUTER_OTT" \ --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ --set linkListeners.transport.advertisedHost="miniziti-router-transport.${MINIZITI_INGRESS_ZONE}" \ --set "ctrl.endpoint=ziti-controller-ctrl.${ZITI_NAMESPACE}.svc:443" \ @@ -710,7 +710,7 @@ main(){ --for condition=Available=True >&3 logDebug "probing miniziti-router for online status" - if ziti_wrapper edge list edge-routers "name=\"$router_name\"" \ + if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ | awk '/miniziti-router/ {print $6}' \ | grep -q true; then logInfo "miniziti-router is online" @@ -757,29 +757,29 @@ main(){ ## Ensure OpenZiti Identities and Services are Created # - client_name="${MINIKUBE_PROFILE}-client" - client_ott="$identities_dir/$client_name.jwt" + CLIENT_NAME="${MINIKUBE_PROFILE}-client" + CLIENT_OTT="$IDENTITIES_DIR/$CLIENT_NAME.jwt" - if ! ziti_wrapper edge list identities "name=\"$client_name\"" --csv \ - | grep -q "$client_name"; then - logDebug "creating identity $client_name" - ziti_wrapper edge create identity device "$client_name" \ - --jwt-output-file "$client_ott" --role-attributes httpbin-clients >&3 + if ! ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" --csv \ + | grep -q "$CLIENT_NAME"; then + logDebug "creating identity $CLIENT_NAME" + ziti_wrapper edge create identity device "$CLIENT_NAME" \ + --jwt-output-file "$CLIENT_OTT" --role-attributes httpbin-clients >&3 else - logDebug "ignoring identity $client_name" + logDebug "ignoring identity $CLIENT_NAME" fi - httpbin_name="httpbin-host" - httpbin_ott="$identities_dir/$httpbin_name.jwt" - httpbin_json="$identities_dir/$httpbin_name.json" + HTTPBIN_NAME="httpbin-host" + HTTPBIN_OTT="$IDENTITIES_DIR/$HTTPBIN_NAME.jwt" + HTTPBIN_JSON="$IDENTITIES_DIR/$HTTPBIN_NAME.json" - if ! ziti_wrapper edge list identities "name=\"$httpbin_name\"" --csv \ - | grep -q "$httpbin_name"; then - logDebug "creating identity $httpbin_name" - ziti_wrapper edge create identity device "$httpbin_name" \ - --jwt-output-file "$httpbin_ott" --role-attributes httpbin-hosts >&3 + if ! ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" --csv \ + | grep -q "$HTTPBIN_NAME"; then + logDebug "creating identity $HTTPBIN_NAME" + ziti_wrapper edge create identity device "$HTTPBIN_NAME" \ + --jwt-output-file "$HTTPBIN_OTT" --role-attributes httpbin-hosts >&3 else - logDebug "ignoring identity $httpbin_name" + logDebug "ignoring identity $HTTPBIN_NAME" fi if ! ziti_wrapper edge list configs 'name="httpbin-intercept-config"' --csv \ @@ -845,17 +845,17 @@ main(){ logDebug "ignoring service-edge-router-policy public-routers" fi - if [[ -s "$httpbin_ott" ]]; then - logDebug "enrolling $httpbin_ott" + if [[ -s "$HTTPBIN_OTT" ]]; then + logDebug "enrolling $HTTPBIN_OTT" # discard expected output that normally flows to stderr ENROLL_OUT="$( - ziti edge enroll "$httpbin_ott" 2>&1 \ + ziti edge enroll "$HTTPBIN_OTT" 2>&1 \ | grep -vE '(generating.*key|enrolled\s+successfully)' \ || true )" if [[ -z "${ENROLL_OUT}" ]]; then - rm -f "$httpbin_ott" - logDebug "deleted $httpbin_ott after enrolling successfully" + rm -f "$HTTPBIN_OTT" + logDebug "deleted $HTTPBIN_OTT after enrolling successfully" else echo -e "ERROR: unexpected result during OpenZiti Identity enrollment\n"\ "${ENROLL_OUT}" @@ -863,16 +863,16 @@ main(){ fi fi - if [[ -s "$httpbin_json" ]]; then + if [[ -s "$HTTPBIN_JSON" ]]; then logDebug "installing httpbin chart as 'miniziti-httpbin'" (( ZITI_CHARTS_ALT )) && { helm dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 } helm install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ - --set-file zitiIdentity="$httpbin_json" \ + --set-file zitiIdentity="$HTTPBIN_JSON" \ --set zitiServiceName=httpbin-service >&3 - rm -f "$httpbin_json" - logDebug "deleted $httpbin_json after installing successfully with miniziti-httpbin chart" + rm -f "$HTTPBIN_JSON" + logDebug "deleted $HTTPBIN_JSON after installing successfully with miniziti-httpbin chart" fi echo -e "\n\n" @@ -880,7 +880,7 @@ main(){ showAdminCreds echo -e "\n\n" - logInfo "Success! Remember to add your edge client identity '$client_ott' in your tunneler, e.g. Ziti Desktop Edge." + logInfo "Success! Remember to add your edge client identity '$CLIENT_OTT' in your tunneler, e.g. Ziti Desktop Edge." } main "$@" From 80e130acae693c1a4945017edae5f2204ef27e7b Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 6 Sep 2023 18:08:39 -0400 Subject: [PATCH 57/97] Better casing --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 4780dbdec..c44be9a20 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -30,7 +30,7 @@ _usage(){ " start\t\tstart miniziti (default)\n"\ " delete\t\tdelete miniziti\n"\ " login\t\trun ziti edge login with miniziti context\n"\ - " show-admin\t\tprints admin user updb credentials\n"\ + " admin-creds\t\tprints admin user updb credentials\n"\ " ziti\t\tziti cli wrapper with miniziti context\n"\ " help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ @@ -95,7 +95,7 @@ detectOs(){ fi } -makeMinizitiXDGStateDir() { +makeMinizitiStateDir() { local detected_os="$1" case "$detected_os" in @@ -294,7 +294,7 @@ main(){ login) DO_ZITI_LOGIN=1 shift ;; - show-admin) SHOW_ADMIN_CREDS=1 + admin-creds) SHOW_ADMIN_CREDS=1 shift ;; ziti) RUN_ZITI_CLI=1 @@ -365,7 +365,7 @@ main(){ MINIZITI_PROFILE_MARKER="miniziti-controller.$MINIKUBE_PROFILE." MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.ziti" - STATE_DIR="$(makeMinizitiXDGStateDir "$DETECTED_OS")" + STATE_DIR="$(makeMinizitiStateDir "$DETECTED_OS")" PROFILE_DIR="$STATE_DIR/profiles/${MINIKUBE_PROFILE}" IDENTITIES_DIR="$PROFILE_DIR/identities" From e62cef73582d83345c33a0f3eaab037004d3f7fa Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 6 Sep 2023 23:45:58 -0400 Subject: [PATCH 58/97] Fix Windows path --- .../learn/quickstarts/network/miniziti.bash | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index c44be9a20..d42794b23 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -96,21 +96,15 @@ detectOs(){ } makeMinizitiStateDir() { - local detected_os="$1" - - case "$detected_os" in + case "$DETECTED_OS" in MacOS) state_dir="${XDG_STATE_DIR:-$HOME/Library/Application Support}/miniziti" ;; - Linux) + Linux|Windows) state_dir="${XDG_STATE_DIR:-$HOME/.local/state}/miniziti" ;; - Windows) - wsl_state_dir="${XDG_STATE_DIR:-$HOME/.local/state}/miniziti" - state_dir="$(wslpath -w "$wsl_state_dir")" - ;; *) - logError "Unknown os: $detected_os" + logError "Unknown os: $DETECTED_OS" exit 1 esac @@ -122,6 +116,14 @@ makeMinizitiStateDir() { echo "$state_dir" } +pathToNative() { + local path="$1" + case "$DETECTED_OS" in + Windows) wslpath -w "$path" ;; + *) echo "$path" ;; + esac +} + testClusterDns(){ if kubectl_wrapper run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ nslookup "miniziti-controller.${MINIZITI_INGRESS_ZONE}" | grep "$1" >&3; then @@ -365,7 +367,7 @@ main(){ MINIZITI_PROFILE_MARKER="miniziti-controller.$MINIKUBE_PROFILE." MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.ziti" - STATE_DIR="$(makeMinizitiStateDir "$DETECTED_OS")" + STATE_DIR="$(makeMinizitiStateDir)" PROFILE_DIR="$STATE_DIR/profiles/${MINIKUBE_PROFILE}" IDENTITIES_DIR="$PROFILE_DIR/identities" @@ -880,7 +882,7 @@ main(){ showAdminCreds echo -e "\n\n" - logInfo "Success! Remember to add your edge client identity '$CLIENT_OTT' in your tunneler, e.g. Ziti Desktop Edge." + logInfo "Success! Remember to add your edge client identity '$(pathToNative "$CLIENT_OTT")' in your tunneler, e.g. Ziti Desktop Edge." } main "$@" From 4dfb2dfc9b98a5fc72c80dafc479ec204151b170 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 7 Sep 2023 00:27:09 -0400 Subject: [PATCH 59/97] Restore marker comment --- .../docs/learn/quickstarts/network/miniziti.bash | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index d42794b23..c753c9d1d 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -159,20 +159,20 @@ HOSTS_FILE='/etc/hosts' cleanHosts() { logWarn "Removing stale miniziti entries from $HOSTS_FILE" if (( EUID != 0 )); then - sudo sed -i "/${MINIZITI_PROFILE_MARKER}/d" "$HOSTS_FILE" + sudo sed -i "/$MINIZITI_PROFILE_MARKER/d" "$HOSTS_FILE" else - sed -i "/${MINIZITI_PROFILE_MARKER}/d" "$HOSTS_FILE" + sed -i "/$MINIZITI_PROFILE_MARKER/d" "$HOSTS_FILE" fi } installHosts() { hosts=( - "miniziti-controller.${MINIZITI_INGRESS_ZONE}" - "miniziti-router.${MINIZITI_INGRESS_ZONE}" - "miniziti-console.${MINIZITI_INGRESS_ZONE}" + "miniziti-controller.$MINIZITI_INGRESS_ZONE" + "miniziti-router.$MINIZITI_INGRESS_ZONE" + "miniziti-console.$MINIZITI_INGRESS_ZONE" ) - hosts_line="${MINIKUBE_NODE_EXTERNAL} ${hosts[*]}" + hosts_line="$MINIKUBE_NODE_EXTERNAL ${hosts[*]} $MINIZITI_PROFILE_MARKER" if ! grep -q "$hosts_line" "$HOSTS_FILE"; then @@ -193,7 +193,7 @@ installHosts() { getAdminSecret() { kubectl_wrapper get secrets "ziti-controller-admin-secret" \ - --namespace "${ZITI_NAMESPACE}" \ + --namespace "$ZITI_NAMESPACE" \ --output go-template='{{index .data "admin-password" | base64decode }}' } @@ -365,7 +365,7 @@ main(){ : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" - MINIZITI_PROFILE_MARKER="miniziti-controller.$MINIKUBE_PROFILE." + MINIZITI_PROFILE_MARKER="# miniziti:profile:$MINIKUBE_PROFILE" MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.ziti" STATE_DIR="$(makeMinizitiStateDir)" PROFILE_DIR="$STATE_DIR/profiles/${MINIKUBE_PROFILE}" From 3ce77398223f8fc7939c0fdd676b82472ae7d42b Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 7 Sep 2023 00:51:03 -0400 Subject: [PATCH 60/97] Call show-admin just creds --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index c753c9d1d..394e2fa71 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -29,8 +29,8 @@ _usage(){ echo -e "\n COMMANDS\n"\ " start\t\tstart miniziti (default)\n"\ " delete\t\tdelete miniziti\n"\ + " creds\t\tprints admin user updb credentials\n"\ " login\t\trun ziti edge login with miniziti context\n"\ - " admin-creds\t\tprints admin user updb credentials\n"\ " ziti\t\tziti cli wrapper with miniziti context\n"\ " help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ @@ -293,10 +293,10 @@ main(){ delete) DELETE_MINIZITI=1 shift ;; - login) DO_ZITI_LOGIN=1 + creds) SHOW_ADMIN_CREDS=1 shift ;; - admin-creds) SHOW_ADMIN_CREDS=1 + login) DO_ZITI_LOGIN=1 shift ;; ziti) RUN_ZITI_CLI=1 From a245ca4181712b34b5f0b9e640f64e2012cb418d Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 7 Sep 2023 10:08:55 -0400 Subject: [PATCH 61/97] Add raw log mode --- .../learn/quickstarts/network/miniziti.bash | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 394e2fa71..acb2c5cda 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -210,16 +210,30 @@ miniziti_login() { logger() { local caller="${FUNCNAME[1]}" + if (( $# < 1 )); then echo "ERROR: $caller() takes 1 or more args" >&2 return 1 fi + local message="$*" + + if [[ "$message" =~ ^r\'(.+)\'$ ]]; then + raw_message="${BASH_REMATCH[1]}" + message="$raw_message" + fi + caller_level="${caller##log}" if (( MINIZITI_DEBUG )); then - echo -e "${caller_level^^} ${FUNCNAME[2]}:${BASH_LINENO[1]}: $*" + line="${caller_level^^} ${FUNCNAME[2]}:${BASH_LINENO[1]}: $message" else - echo -e "${caller_level^^} $*" + line="${caller_level^^} $message" + fi + + if [[ -n "${raw_message-}" ]]; then + echo -E "${line}" + else + echo -e "${line}" fi } @@ -882,7 +896,7 @@ main(){ showAdminCreds echo -e "\n\n" - logInfo "Success! Remember to add your edge client identity '$(pathToNative "$CLIENT_OTT")' in your tunneler, e.g. Ziti Desktop Edge." + logInfo "r'Success! Remember to add your edge client identity '$(pathToNative "$CLIENT_OTT")' in your tunneler, e.g. Ziti Desktop Edge.'" } main "$@" From 38d71328ea26020da60dcbf02b0911ee88531c3f Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 7 Sep 2023 12:36:51 -0400 Subject: [PATCH 62/97] Make helm kube context aware --- .../learn/quickstarts/network/miniziti.bash | 38 ++++++++++--------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index acb2c5cda..3c4281974 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -261,6 +261,10 @@ kubectl_wrapper() { minikube kubectl --profile "$MINIKUBE_PROFILE" -- --context "$MINIKUBE_PROFILE" "$@" } +helm_wrapper() { + helm --kube-context "$MINIKUBE_PROFILE" "$@" +} + main(){ # require commands declare -a BINS=(ziti minikube kubectl helm sed) @@ -521,12 +525,12 @@ main(){ HELM_REPOS[jetstack]="charts.jetstack.io" HELM_REPOS[ingress-nginx]="kubernetes.github.io/ingress-nginx" for REPO in "${!HELM_REPOS[@]}"; do - if helm repo list | cut -f1 | grep -qE "^${REPO}(\s+)?$"; then + if helm_wrapper repo list | cut -f1 | grep -qE "^${REPO}(\s+)?$"; then logDebug "refreshing ${REPO} Helm Charts" - helm repo update "${REPO}" >&3 + helm_wrapper repo update "${REPO}" >&3 else logInfo "subscribing to ${REPO} Helm Charts" - helm repo add "${REPO}" "https://${HELM_REPOS[${REPO}]}" >&3 + helm_wrapper repo add "${REPO}" "https://${HELM_REPOS[${REPO}]}" >&3 fi done @@ -534,9 +538,9 @@ main(){ ## Ensure OpenZiti Controller is Upgraded and Ready # - if helm status ziti-controller --namespace "${ZITI_NAMESPACE}" &>/dev/null; then + if helm_wrapper status ziti-controller --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logInfo "upgrading openziti controller" - helm upgrade "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ + helm_wrapper upgrade "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" \ --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ @@ -546,9 +550,9 @@ main(){ else logInfo "installing openziti controller" (( ZITI_CHARTS_ALT )) && { - helm dependency build "${ZITI_CHARTS_REF}/ziti-controller" >&3 + helm_wrapper dependency build "${ZITI_CHARTS_REF}/ziti-controller" >&3 } - helm install "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ + helm_wrapper install "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ @@ -697,9 +701,9 @@ main(){ --jwt-output-file "$ROUTER_OTT" >&3 fi - if helm status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then + if helm_wrapper status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logDebug "upgrading router chart as 'ziti-router'" - helm upgrade "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ + helm_wrapper upgrade "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ @@ -709,9 +713,9 @@ main(){ else logDebug "installing router chart as 'ziti-router'" (( ZITI_CHARTS_ALT )) && { - helm dependency build "${ZITI_CHARTS_REF}/ziti-router" >&3 + helm_wrapper dependency build "${ZITI_CHARTS_REF}/ziti-router" >&3 } - helm install "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ + helm_wrapper install "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt="$ROUTER_OTT" \ --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ @@ -739,10 +743,10 @@ main(){ ## Ensure OpenZiti Console is Configured and Ready # - if helm --namespace "${ZITI_NAMESPACE}" list --all \ + if helm_wrapper --namespace "${ZITI_NAMESPACE}" list --all \ | grep -q ziti-console; then logDebug "upgrading console chart as 'ziti-console'" - helm upgrade "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ + helm_wrapper upgrade "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ @@ -750,9 +754,9 @@ main(){ else logDebug "installing console chart as 'ziti-console'" (( ZITI_CHARTS_ALT )) && { - helm dependency build "${ZITI_CHARTS_REF}/ziti-console" >&3 + helm_wrapper dependency build "${ZITI_CHARTS_REF}/ziti-console" >&3 } - helm install "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ + helm_wrapper install "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ @@ -882,9 +886,9 @@ main(){ if [[ -s "$HTTPBIN_JSON" ]]; then logDebug "installing httpbin chart as 'miniziti-httpbin'" (( ZITI_CHARTS_ALT )) && { - helm dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 + helm_wrapper dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 } - helm install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ + helm_wrapper install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ --set-file zitiIdentity="$HTTPBIN_JSON" \ --set zitiServiceName=httpbin-service >&3 rm -f "$HTTPBIN_JSON" From 961816eb698cca12cff8e7b2b20f81c9bfebc70d Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 7 Sep 2023 13:26:31 -0400 Subject: [PATCH 63/97] Follow guidance of RFC6762 Appendix G. Fix log --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 3c4281974..cbb23d34f 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -266,6 +266,7 @@ helm_wrapper() { } main(){ + MINIZITI_DEBUG=0 # require commands declare -a BINS=(ziti minikube kubectl helm sed) for BIN in "${BINS[@]}"; do @@ -284,9 +285,7 @@ main(){ DO_ZITI_LOGIN=0 \ MINIKUBE_NODE_EXTERNAL \ MINIKUBE_PROFILE="miniziti" \ - MINIZITI_DEBUG=0 \ MINIZITI_HOSTS=1 \ - MINIZITI_INTERCEPT_ZONE="miniziti" \ MINIZITI_MODIFY_HOSTS=0 \ RUN_ZITI_CLI=0 \ SAFETY_WAIT=1 \ @@ -384,7 +383,8 @@ main(){ : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" MINIZITI_PROFILE_MARKER="# miniziti:profile:$MINIKUBE_PROFILE" - MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.ziti" + MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.internal" + MINIZITI_INTERCEPT_ZONE="$MINIKUBE_PROFILE.private" \ STATE_DIR="$(makeMinizitiStateDir)" PROFILE_DIR="$STATE_DIR/profiles/${MINIKUBE_PROFILE}" IDENTITIES_DIR="$PROFILE_DIR/identities" From 071b46973ffe318fd1b3daf9026b4dc342935b93 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 7 Sep 2023 14:04:37 -0400 Subject: [PATCH 64/97] Fix macOS --- .../docs/learn/quickstarts/network/miniziti.bash | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index cbb23d34f..f31b66b32 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -97,7 +97,7 @@ detectOs(){ makeMinizitiStateDir() { case "$DETECTED_OS" in - MacOS) + macOS) state_dir="${XDG_STATE_DIR:-$HOME/Library/Application Support}/miniziti" ;; Linux|Windows) @@ -224,16 +224,17 @@ logger() { fi caller_level="${caller##log}" + level="$(echo "$caller_level" | tr '[:lower:]' '[:upper:]')" if (( MINIZITI_DEBUG )); then - line="${caller_level^^} ${FUNCNAME[2]}:${BASH_LINENO[1]}: $message" + line="$level ${FUNCNAME[2]}:${BASH_LINENO[1]}: $message" else - line="${caller_level^^} $message" + line="$level $message" fi if [[ -n "${raw_message-}" ]]; then - echo -E "${line}" + echo -E "$line" else - echo -e "${line}" + echo -e "$line" fi } From 0dbd4d5fadb06c1590286859f97b8cb7a45825d4 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 7 Sep 2023 15:20:21 -0400 Subject: [PATCH 65/97] Make cert dir distribution relative --- .../docs/learn/quickstarts/network/miniziti.bash | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index f31b66b32..5695345d6 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -116,6 +116,13 @@ makeMinizitiStateDir() { echo "$state_dir" } +getZitiCliHome() { + case "$DETECTED_OS" in + Linux) echo "$HOME/.config/ziti" ;; + *) echo "$HOME/.ziti" ;; + esac +} + pathToNative() { local path="$1" case "$DETECTED_OS" in @@ -385,7 +392,9 @@ main(){ MINIZITI_PROFILE_MARKER="# miniziti:profile:$MINIKUBE_PROFILE" MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.internal" - MINIZITI_INTERCEPT_ZONE="$MINIKUBE_PROFILE.private" \ + MINIZITI_INTERCEPT_ZONE="$MINIKUBE_PROFILE.private" + ZITI_CLI_HOME="$(getZitiCliHome)" + ZITI_CLI_CERTS_DIR="$ZITI_CLI_HOME/certs" STATE_DIR="$(makeMinizitiStateDir)" PROFILE_DIR="$STATE_DIR/profiles/${MINIKUBE_PROFILE}" IDENTITIES_DIR="$PROFILE_DIR/identities" @@ -420,7 +429,7 @@ main(){ rm -rf "$PROFILE_DIR" fi - CERT_FILE="$(find "$HOME/.config/ziti/certs" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit)" + CERT_FILE="$(find "$ZITI_CLI_CERTS_DIR" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit)" if [[ -n "$CERT_FILE" ]]; then logWarn "Deleting miniziti certificate file: $CERT_FILE" rm -f "$CERT_FILE" From e4ea933fd3a7c526a704d8d35fb969b34428d9d7 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Thu, 7 Sep 2023 16:29:01 -0400 Subject: [PATCH 66/97] Revert logger. Add comment for limitation. --- .../docs/learn/quickstarts/network/miniziti.bash | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 5695345d6..5d8839e5a 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -231,11 +231,10 @@ logger() { fi caller_level="${caller##log}" - level="$(echo "$caller_level" | tr '[:lower:]' '[:upper:]')" if (( MINIZITI_DEBUG )); then - line="$level ${FUNCNAME[2]}:${BASH_LINENO[1]}: $message" + line="${caller_level^^} ${FUNCNAME[2]}:${BASH_LINENO[1]}: $message" else - line="$level $message" + line="${caller_level^^} $message" fi if [[ -n "${raw_message-}" ]]; then @@ -429,7 +428,10 @@ main(){ rm -rf "$PROFILE_DIR" fi - CERT_FILE="$(find "$ZITI_CLI_CERTS_DIR" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit)" + # This is best effort, when '--no-hosts' is specified, + # the right file is unknown due to the way the cli names the file, + # and we don't store enough state to recover it at this time. + CERT_FILE="$(find "$ZITI_CLI_CERTS_DIR" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit 2> /dev/null)" if [[ -n "$CERT_FILE" ]]; then logWarn "Deleting miniziti certificate file: $CERT_FILE" rm -f "$CERT_FILE" From 99807ae5cd482df3c401336a72ad573adbb73ef8 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 11:09:52 -0400 Subject: [PATCH 67/97] add miniziti kubectl command --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 5d8839e5a..7fd79f4ef 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -32,6 +32,7 @@ _usage(){ " creds\t\tprints admin user updb credentials\n"\ " login\t\trun ziti edge login with miniziti context\n"\ " ziti\t\tziti cli wrapper with miniziti context\n"\ + " kubectl\t\tkubectl cli wrapper with miniziti context\n"\ " help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ " --quiet\t\tsuppress INFO messages\n"\ @@ -328,6 +329,10 @@ main(){ ziti_cli_args=("$@") shift "${#ziti_cli_args[@]}" ;; + kubectl) shift + kubectl_wrapper "${@:-}" + exit + ;; -p|--profile) validateDnsName "$2" MINIKUBE_PROFILE="$2" # sanity check the profile name input From 777ad8c3f029c383bc92f03b80ec3d0513cce2fb Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 12:15:30 -0400 Subject: [PATCH 68/97] stop running kubectl on host to delete coredns pod --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 7fd79f4ef..13ec5d752 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -672,12 +672,10 @@ main(){ " >&3 logDebug "deleting coredns pod so a new one will have modified Corefile" - kubectl_wrapper get pods \ + kubectl_wrapper delete pods \ + --context "$MINIKUBE_PROFILE" \ --namespace kube-system \ - | awk '/^coredns-/ {print $1}' \ - | xargs kubectl delete pods \ - --context "$MINIKUBE_PROFILE" \ - --namespace kube-system >&3 + --selector k8s-app=kube-dns >&3 logDebug "waiting for cluster dns to be ready" kubectl_wrapper wait deployments "coredns" \ From 2c63be1149cd5268a306cfb79eab23a994519c4a Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 11:24:29 -0400 Subject: [PATCH 69/97] run ziti cli inside controller container --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 13ec5d752..5b5e9e001 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -262,7 +262,8 @@ logDebug() { } ziti_wrapper() { - ziti "$@" --cli-identity "$MINIKUBE_PROFILE" + CONTROLLER_POD=$(kubectl_wrapper get pods --selector app.kubernetes.io/component=ziti-controller --output jsonpath='{.items[0].metadata.name}') + kubectl_wrapper exec "$CONTROLLER_POD" --container ziti-controller -- bash -c "zitiLogin &>/dev/null; ziti $*" } kubectl_wrapper() { @@ -441,10 +442,6 @@ main(){ logWarn "Deleting miniziti certificate file: $CERT_FILE" rm -f "$CERT_FILE" fi - - logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" - ziti_wrapper edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 - exit 0 } From 2cb5f7c837bc54000202fb1cc06de4555c60f839 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 11:28:24 -0400 Subject: [PATCH 70/97] adopt local var caps convention --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 5b5e9e001..430bd6c03 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -224,7 +224,7 @@ logger() { return 1 fi - local message="$*" + --container ziti-controller local message="$*" if [[ "$message" =~ ^r\'(.+)\'$ ]]; then raw_message="${BASH_REMATCH[1]}" @@ -262,8 +262,9 @@ logDebug() { } ziti_wrapper() { - CONTROLLER_POD=$(kubectl_wrapper get pods --selector app.kubernetes.io/component=ziti-controller --output jsonpath='{.items[0].metadata.name}') - kubectl_wrapper exec "$CONTROLLER_POD" --container ziti-controller -- bash -c "zitiLogin &>/dev/null; ziti $*" + local controller_pod + controller_pod=$(kubectl_wrapper get pods --selector app.kubernetes.io/component=ziti-controller --output jsonpath='{.items[0].metadata.name}') + kubectl_wrapper exec "$controller_pod" --container ziti-controller -- bash -c "zitiLogin &>/dev/null; ziti $*" } kubectl_wrapper() { From fbefdb0e2eb930732709e27b197d7a9cb684d234 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 11:29:52 -0400 Subject: [PATCH 71/97] typo --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 430bd6c03..2c09911c4 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -224,7 +224,7 @@ logger() { return 1 fi - --container ziti-controller local message="$*" + local message="$*" if [[ "$message" =~ ^r\'(.+)\'$ ]]; then raw_message="${BASH_REMATCH[1]}" From 5d8b700a54cfdfa42e9566114a3d65d3a6367ba7 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 11:37:44 -0400 Subject: [PATCH 72/97] let login command depend on ziti command --- .../docs/learn/quickstarts/network/miniziti.bash | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 2c09911c4..4b048df48 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -210,6 +210,7 @@ showAdminCreds() { } miniziti_login() { + check_command ziti getAdminSecret | xargs ziti edge login \ --cli-identity "$MINIKUBE_PROFILE" \ --username "admin" \ @@ -275,15 +276,19 @@ helm_wrapper() { helm --kube-context "$MINIKUBE_PROFILE" "$@" } +check_command() { + if ! command -v "$1" &>/dev/null; then + logError "this script requires command '$1'. Please install on the search PATH and try again." + $1 + fi +} + main(){ MINIZITI_DEBUG=0 # require commands - declare -a BINS=(ziti minikube kubectl helm sed) + declare -a BINS=(minikube helm sed) for BIN in "${BINS[@]}"; do - if ! command -v "$BIN" &>/dev/null; then - logError "this script requires commands '${BINS[*]}'. Please install on the search PATH and try again." - $BIN || exit 1 - fi + check_command "$BIN" done # open a descriptor for debug messages From e2505a4650b1f5e54515f0b45d554adfc377edfb Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 11:48:14 -0400 Subject: [PATCH 73/97] stop logging in to ziti and always run in container --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 7 ------- 1 file changed, 7 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 4b048df48..900386d61 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -694,13 +694,6 @@ main(){ ## Ensure OpenZiti Router is Enrolled and Ready # - logDebug "fetching admin password from k8s secret to log in to ziti mgmt" - getAdminSecret | xargs ziti edge login "miniziti-controller.${MINIZITI_INGRESS_ZONE}:443" \ - --yes \ - --cli-identity "$MINIKUBE_PROFILE" \ - --username "admin" \ - --password >&3 - logInfo "Setting default ziti identity to: $MINIKUBE_PROFILE" ziti_wrapper edge use "$MINIKUBE_PROFILE" >&3 From 5210666ad6cb81c8fe478761c65f41278fe66762 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 12:35:14 -0400 Subject: [PATCH 74/97] logout ziti profile if ziti command exists --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 900386d61..1e0fd2592 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -448,6 +448,12 @@ main(){ logWarn "Deleting miniziti certificate file: $CERT_FILE" rm -f "$CERT_FILE" fi + + if check_command ziti &>/dev/null; then + logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" + ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 + fi + exit 0 } From c0a732ac998d9cca18545825ee7e1fb39d01c077 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 11:41:18 -0400 Subject: [PATCH 75/97] add minikube wrapper command --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 1e0fd2592..f8e703565 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -33,6 +33,7 @@ _usage(){ " login\t\trun ziti edge login with miniziti context\n"\ " ziti\t\tziti cli wrapper with miniziti context\n"\ " kubectl\t\tkubectl cli wrapper with miniziti context\n"\ + " minikube\t\tminikube cli wrapper with miniziti context\n"\ " help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ " --quiet\t\tsuppress INFO messages\n"\ @@ -272,6 +273,10 @@ kubectl_wrapper() { minikube kubectl --profile "$MINIKUBE_PROFILE" -- --context "$MINIKUBE_PROFILE" "$@" } +minikube_wrapper() { + minikube --profile "$MINIKUBE_PROFILE" "$@" +} + helm_wrapper() { helm --kube-context "$MINIKUBE_PROFILE" "$@" } @@ -340,6 +345,10 @@ main(){ kubectl_wrapper "${@:-}" exit ;; + minikube) shift + minikube_wrapper "${@:-}" + exit + ;; -p|--profile) validateDnsName "$2" MINIKUBE_PROFILE="$2" # sanity check the profile name input From 281d141159f5f39752497c0cc444c0f4af3457ea Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 12:05:15 -0400 Subject: [PATCH 76/97] add shell wrapper --- .../learn/quickstarts/network/miniziti.bash | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index f8e703565..86f20f599 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -34,6 +34,7 @@ _usage(){ " ziti\t\tziti cli wrapper with miniziti context\n"\ " kubectl\t\tkubectl cli wrapper with miniziti context\n"\ " minikube\t\tminikube cli wrapper with miniziti context\n"\ + " exec\t\trun bash interactively inside the ziti-controller container\n"\ " help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ " --quiet\t\tsuppress INFO messages\n"\ @@ -263,10 +264,16 @@ logDebug() { logger "$*" >&3 } +controller_pod() { + kubectl_wrapper get pods --selector app.kubernetes.io/component=ziti-controller --output jsonpath='{.items[0].metadata.name}' +} + ziti_wrapper() { - local controller_pod - controller_pod=$(kubectl_wrapper get pods --selector app.kubernetes.io/component=ziti-controller --output jsonpath='{.items[0].metadata.name}') - kubectl_wrapper exec "$controller_pod" --container ziti-controller -- bash -c "zitiLogin &>/dev/null; ziti $*" + kubectl_wrapper exec "$(controller_pod)" --container ziti-controller -- bash -c "zitiLogin &>/dev/null; ziti $*" +} + +shell_wrapper() { + kubectl_wrapper exec "$(controller_pod)" --container ziti-controller --tty --stdin -- bash } kubectl_wrapper() { @@ -349,6 +356,10 @@ main(){ minikube_wrapper "${@:-}" exit ;; + shell) shift + shell_wrapper "${@:-}" + exit + ;; -p|--profile) validateDnsName "$2" MINIKUBE_PROFILE="$2" # sanity check the profile name input From 1c88ed15df7af317464c8dbb518f2f44afe7f0ee Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 12:06:15 -0400 Subject: [PATCH 77/97] fix shell usage hint --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 86f20f599..ff19d31be 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -34,7 +34,7 @@ _usage(){ " ziti\t\tziti cli wrapper with miniziti context\n"\ " kubectl\t\tkubectl cli wrapper with miniziti context\n"\ " minikube\t\tminikube cli wrapper with miniziti context\n"\ - " exec\t\trun bash interactively inside the ziti-controller container\n"\ + " shell\t\trun interactive shell inside the ziti-controller container\n"\ " help\t\tshow these usage hints\n"\ "\n OPTIONS\n"\ " --quiet\t\tsuppress INFO messages\n"\ From 89d9f966253cf728b39eb13bc94e0d7377cd19d7 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Fri, 8 Sep 2023 12:08:07 -0400 Subject: [PATCH 78/97] check more commands --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index ff19d31be..803bb710c 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -298,7 +298,7 @@ check_command() { main(){ MINIZITI_DEBUG=0 # require commands - declare -a BINS=(minikube helm sed) + declare -a BINS=(minikube helm sed nslookup xargs awk grep pgrep) for BIN in "${BINS[@]}"; do check_command "$BIN" done From 27421b70663425e1780ed53dfcd34639e8d0316b Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Fri, 8 Sep 2023 14:26:51 -0400 Subject: [PATCH 79/97] Fix 1: quoting issue --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 803bb710c..e940fdb21 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -725,7 +725,7 @@ main(){ ROUTER_NAME='miniziti-router' ROUTER_OTT="$IDENTITIES_DIR/$ROUTER_NAME.jwt" - if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ + if ziti_wrapper edge list edge-routers "'name=\"$ROUTER_NAME\"'" \ | grep -q miniziti-router; then logDebug "updating $ROUTER_NAME" ziti_wrapper edge update edge-router "$ROUTER_NAME" \ @@ -767,7 +767,7 @@ main(){ --for condition=Available=True >&3 logDebug "probing miniziti-router for online status" - if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ + if ziti_wrapper edge list edge-routers "'name=\"$ROUTER_NAME\"'" \ | awk '/miniziti-router/ {print $6}' \ | grep -q true; then logInfo "miniziti-router is online" @@ -817,7 +817,7 @@ main(){ CLIENT_NAME="${MINIKUBE_PROFILE}-client" CLIENT_OTT="$IDENTITIES_DIR/$CLIENT_NAME.jwt" - if ! ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" --csv \ + if ! ziti_wrapper edge list identities "'name=\"$CLIENT_NAME\"'" --csv \ | grep -q "$CLIENT_NAME"; then logDebug "creating identity $CLIENT_NAME" ziti_wrapper edge create identity device "$CLIENT_NAME" \ @@ -830,7 +830,7 @@ main(){ HTTPBIN_OTT="$IDENTITIES_DIR/$HTTPBIN_NAME.jwt" HTTPBIN_JSON="$IDENTITIES_DIR/$HTTPBIN_NAME.json" - if ! ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" --csv \ + if ! ziti_wrapper edge list identities "'name=\"$HTTPBIN_NAME\"'" --csv \ | grep -q "$HTTPBIN_NAME"; then logDebug "creating identity $HTTPBIN_NAME" ziti_wrapper edge create identity device "$HTTPBIN_NAME" \ From 896c50f80ce4120f567245c3a6356546cf837f4e Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Fri, 8 Sep 2023 18:34:44 -0400 Subject: [PATCH 80/97] Fix 2: argument forwarding, jq dep and jwt parsing --- .../learn/quickstarts/network/miniziti.bash | 34 +++++++++++++------ 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index e940fdb21..c3b3f1a9f 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -215,6 +215,7 @@ miniziti_login() { check_command ziti getAdminSecret | xargs ziti edge login \ --cli-identity "$MINIKUBE_PROFILE" \ + --yes \ --username "admin" \ --password } @@ -269,7 +270,8 @@ controller_pod() { } ziti_wrapper() { - kubectl_wrapper exec "$(controller_pod)" --container ziti-controller -- bash -c "zitiLogin &>/dev/null; ziti $*" + kubectl_wrapper exec "$(controller_pod)" --container ziti-controller -- zitiLogin > /dev/null + kubectl_wrapper exec "$(controller_pod)" --container ziti-controller -- ziti "$@" } shell_wrapper() { @@ -298,7 +300,7 @@ check_command() { main(){ MINIZITI_DEBUG=0 # require commands - declare -a BINS=(minikube helm sed nslookup xargs awk grep pgrep) + declare -a BINS=(awk grep helm jq minikube nslookup pgrep sed xargs) for BIN in "${BINS[@]}"; do check_command "$BIN" done @@ -471,7 +473,7 @@ main(){ if check_command ziti &>/dev/null; then logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" - ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 + #ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 fi exit 0 @@ -725,7 +727,7 @@ main(){ ROUTER_NAME='miniziti-router' ROUTER_OTT="$IDENTITIES_DIR/$ROUTER_NAME.jwt" - if ziti_wrapper edge list edge-routers "'name=\"$ROUTER_NAME\"'" \ + if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ | grep -q miniziti-router; then logDebug "updating $ROUTER_NAME" ziti_wrapper edge update edge-router "$ROUTER_NAME" \ @@ -734,8 +736,11 @@ main(){ logDebug "creating $ROUTER_NAME" ziti_wrapper edge create edge-router "$ROUTER_NAME" \ --role-attributes "public-routers" \ - --tunneler-enabled \ - --jwt-output-file "$ROUTER_OTT" >&3 + --tunneler-enabled >&3 + ziti_wrapper edge list edge-routers \ + "name=\"$ROUTER_NAME\"" \ + --output-json \ + | jq -r '.data[0].enrollmentJwt' > "$ROUTER_OTT" fi if helm_wrapper status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then @@ -767,7 +772,7 @@ main(){ --for condition=Available=True >&3 logDebug "probing miniziti-router for online status" - if ziti_wrapper edge list edge-routers "'name=\"$ROUTER_NAME\"'" \ + if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ | awk '/miniziti-router/ {print $6}' \ | grep -q true; then logInfo "miniziti-router is online" @@ -817,11 +822,14 @@ main(){ CLIENT_NAME="${MINIKUBE_PROFILE}-client" CLIENT_OTT="$IDENTITIES_DIR/$CLIENT_NAME.jwt" - if ! ziti_wrapper edge list identities "'name=\"$CLIENT_NAME\"'" --csv \ + if ! ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" --csv \ | grep -q "$CLIENT_NAME"; then logDebug "creating identity $CLIENT_NAME" ziti_wrapper edge create identity device "$CLIENT_NAME" \ - --jwt-output-file "$CLIENT_OTT" --role-attributes httpbin-clients >&3 + --role-attributes httpbin-clients >&3 + ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" \ + --output-json \ + | jq -r '.data[0].enrollment.ott.jwt' > "$CLIENT_OTT" else logDebug "ignoring identity $CLIENT_NAME" fi @@ -830,11 +838,15 @@ main(){ HTTPBIN_OTT="$IDENTITIES_DIR/$HTTPBIN_NAME.jwt" HTTPBIN_JSON="$IDENTITIES_DIR/$HTTPBIN_NAME.json" - if ! ziti_wrapper edge list identities "'name=\"$HTTPBIN_NAME\"'" --csv \ + if ! ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" --csv \ | grep -q "$HTTPBIN_NAME"; then logDebug "creating identity $HTTPBIN_NAME" ziti_wrapper edge create identity device "$HTTPBIN_NAME" \ - --jwt-output-file "$HTTPBIN_OTT" --role-attributes httpbin-hosts >&3 + --role-attributes httpbin-hosts >&3 + ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" \ + --output-json \ + | jq -r '.data[0].enrollment.ott.jwt' > "$HTTPBIN_OTT" + else logDebug "ignoring identity $HTTPBIN_NAME" fi From f54bfb820727c1b7826d49ca32fe64e8bfe428da Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Mon, 11 Sep 2023 10:27:55 -0400 Subject: [PATCH 81/97] Comment out unused check --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index c3b3f1a9f..717f5a078 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -471,10 +471,11 @@ main(){ rm -f "$CERT_FILE" fi - if check_command ziti &>/dev/null; then - logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" - #ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 - fi + # Cannot nicely call logout until https://github.com/openziti/ziti/issues/1305 is addressed. + # if check_command ziti &>/dev/null; then + # logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" + # ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 + # fi exit 0 } From 5f386fd4427f6a6e126b22e1e14b7a2ac79f5204 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Mon, 11 Sep 2023 11:17:52 -0400 Subject: [PATCH 82/97] Add --exit-status to jq invocations --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 717f5a078..0d8a0878f 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -741,7 +741,7 @@ main(){ ziti_wrapper edge list edge-routers \ "name=\"$ROUTER_NAME\"" \ --output-json \ - | jq -r '.data[0].enrollmentJwt' > "$ROUTER_OTT" + | jq --exit-status --raw-output '.data[0].enrollmentJwt' > "$ROUTER_OTT" fi if helm_wrapper status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then @@ -830,7 +830,7 @@ main(){ --role-attributes httpbin-clients >&3 ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" \ --output-json \ - | jq -r '.data[0].enrollment.ott.jwt' > "$CLIENT_OTT" + | jq --exit-status --raw-output '.data[0].enrollment.ott.jwt' > "$CLIENT_OTT" else logDebug "ignoring identity $CLIENT_NAME" fi @@ -846,7 +846,7 @@ main(){ --role-attributes httpbin-hosts >&3 ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" \ --output-json \ - | jq -r '.data[0].enrollment.ott.jwt' > "$HTTPBIN_OTT" + | jq --exit-status --raw-output '.data[0].enrollment.ott.jwt' > "$HTTPBIN_OTT" else logDebug "ignoring identity $HTTPBIN_NAME" From e19286316e0141b5a608dc2bea5a5e14b61b2fb7 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Mon, 11 Sep 2023 15:37:49 -0400 Subject: [PATCH 83/97] No default command. Adopts kube command style. --- .../learn/quickstarts/network/miniziti.bash | 33 ++++++++++++------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 0d8a0878f..cfb726682 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -26,24 +26,26 @@ _usage(){ else banner fi - echo -e "\n COMMANDS\n"\ - " start\t\tstart miniziti (default)\n"\ + echo -e "\n Basic Commands:\n"\ + " start\t\tstart miniziti\n"\ " delete\t\tdelete miniziti\n"\ - " creds\t\tprints admin user updb credentials\n"\ - " login\t\trun ziti edge login with miniziti context\n"\ " ziti\t\tziti cli wrapper with miniziti context\n"\ + " creds\t\tprints admin user updb credentials\n"\ + " help\t\tshow these usage hints\n"\ + "\n Advanced Commands:\n"\ + " shell\t\trun interactive shell inside the ziti-controller container\n"\ + " login\t\trun local ziti binary edge login with miniziti context\n"\ + "\n Other Commands:\n"\ " kubectl\t\tkubectl cli wrapper with miniziti context\n"\ " minikube\t\tminikube cli wrapper with miniziti context\n"\ - " shell\t\trun interactive shell inside the ziti-controller container\n"\ - " help\t\tshow these usage hints\n"\ - "\n OPTIONS\n"\ + "\n Options:\n"\ " --quiet\t\tsuppress INFO messages\n"\ " --verbose\t\tshow DEBUG messages\n"\ " --profile\t\tMINIKUBE_PROFILE (miniziti)\n"\ " --namespace\t\tZITI_NAMESPACE (MINIKUBE_PROFILE)\n"\ " --no-hosts\t\tdon't use local hosts DB or ingress-dns nameserver\n"\ " --modify-hosts\tadd entries to local hosts database. Requires sudo if not running as root. Linux only.\n"\ - "\n DEBUG\n"\ + "\n Debug:\n"\ " --charts\t\tZITI_CHARTS_REF (openziti) alternative charts repo\n"\ " --now\t\teliminate safety waits, e.g., before deleting miniziti\n"\ " --\t\t\tMINIKUBE_START_ARGS args after -- passed to minikube start\n" @@ -310,6 +312,7 @@ main(){ # local strings with defaults that never produce an error declare DETECTED_OS \ + START_MINIZITI=0 \ DELETE_MINIZITI=0 \ DO_ZITI_LOGIN=0 \ MINIKUBE_NODE_EXTERNAL \ @@ -334,7 +337,8 @@ main(){ while (( $# )); do case "$1" in - start) shift + start) START_MINIZITI=1 + shift ;; delete) DELETE_MINIZITI=1 shift @@ -447,9 +451,8 @@ main(){ fi - banner "$MINIKUBE_PROFILE" - (( DELETE_MINIZITI )) && { + banner "$MINIKUBE_PROFILE" deleteMiniziti 10 if (( MINIZITI_MODIFY_HOSTS )) && grep -q "$MINIZITI_PROFILE_MARKER" "$HOSTS_FILE"; then @@ -480,6 +483,14 @@ main(){ exit 0 } + if (( START_MINIZITI != 1 )); then + _usage + exit 0; + fi + + + banner "$MINIKUBE_PROFILE" + if [[ ! -d "$IDENTITIES_DIR" ]]; then logDebug "Creating miniziti identities directory: ($IDENTITIES_DIR)" mkdir -p "$IDENTITIES_DIR" From 3bcf6023645edfdafbb4992a231cf0e63d926950 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Mon, 11 Sep 2023 16:11:18 -0400 Subject: [PATCH 84/97] Add bash version check and help --- .../docs/learn/quickstarts/network/miniziti.bash | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index cfb726682..cebce7c1a 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -4,6 +4,21 @@ set -o errexit set -o nounset set -o pipefail +checkBashVersion() { + if (( "${BASH_VERSION%%.*}" < 4 )); then + echo "This script requires Bash major version 4 or greater." >&2 + echo "Detected version: $BASH_VERSION" >&2 + if [[ "$DETECTED_OS" == "macOS" ]]; then + echo -e "\nOn macOS, you can install bash with Homebrew:" >&2 + echo "brew install bash" >&2 + echo -e "\nThen run:" >&2 + #shellcheck disable=SC2016 + echo '"$(brew --prefix bash)" ./miniziti.bash ...' >&2 + fi + exit 1; + fi +} + banner(){ local profile="${1-}" @@ -334,6 +349,7 @@ main(){ DETECTED_OS="$(detectOs)" : "${DEBUG_MINIKUBE_TUNNEL:=0}" # set env = 1 to trigger the minikube tunnel probe + checkBashVersion while (( $# )); do case "$1" in From 2aaf2b2dda9203cbc2ae4c579a24b747bf32d828 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Mon, 11 Sep 2023 16:17:13 -0400 Subject: [PATCH 85/97] Redirect in caller --- .../docs/learn/quickstarts/network/miniziti.bash | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index cebce7c1a..6523b3250 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -6,14 +6,14 @@ set -o pipefail checkBashVersion() { if (( "${BASH_VERSION%%.*}" < 4 )); then - echo "This script requires Bash major version 4 or greater." >&2 - echo "Detected version: $BASH_VERSION" >&2 + echo "This script requires Bash major version 4 or greater." + echo "Detected version: $BASH_VERSION" if [[ "$DETECTED_OS" == "macOS" ]]; then - echo -e "\nOn macOS, you can install bash with Homebrew:" >&2 - echo "brew install bash" >&2 - echo -e "\nThen run:" >&2 + echo -e "\nOn macOS, you can install bash with Homebrew:" + echo "brew install bash" + echo -e "\nThen run:" #shellcheck disable=SC2016 - echo '"$(brew --prefix bash)" ./miniziti.bash ...' >&2 + echo '"$(brew --prefix bash)" ./miniziti.bash ...' fi exit 1; fi @@ -349,7 +349,7 @@ main(){ DETECTED_OS="$(detectOs)" : "${DEBUG_MINIKUBE_TUNNEL:=0}" # set env = 1 to trigger the minikube tunnel probe - checkBashVersion + checkBashVersion >&2 while (( $# )); do case "$1" in From feba3e8680b167a1b4b774ed704bed9732b016c7 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Mon, 11 Sep 2023 17:34:31 -0400 Subject: [PATCH 86/97] Fixup bash version check --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 6523b3250..54309ac20 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -8,7 +8,7 @@ checkBashVersion() { if (( "${BASH_VERSION%%.*}" < 4 )); then echo "This script requires Bash major version 4 or greater." echo "Detected version: $BASH_VERSION" - if [[ "$DETECTED_OS" == "macOS" ]]; then + if [[ ${OSTYPE:-} =~ [Dd]arwin ]]; then echo -e "\nOn macOS, you can install bash with Homebrew:" echo "brew install bash" echo -e "\nThen run:" @@ -315,6 +315,7 @@ check_command() { } main(){ + checkBashVersion >&2 MINIZITI_DEBUG=0 # require commands declare -a BINS=(awk grep helm jq minikube nslookup pgrep sed xargs) @@ -349,8 +350,6 @@ main(){ DETECTED_OS="$(detectOs)" : "${DEBUG_MINIKUBE_TUNNEL:=0}" # set env = 1 to trigger the minikube tunnel probe - checkBashVersion >&2 - while (( $# )); do case "$1" in start) START_MINIZITI=1 From 6cfe3a8e802d94618b9df2f543c3013663099781 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Wed, 13 Sep 2023 20:06:34 -0400 Subject: [PATCH 87/97] let Helm lifecycle hook enroll httpbin's JWT; resolves #682 --- .../learn/quickstarts/network/miniziti.bash | 25 +++---------------- 1 file changed, 3 insertions(+), 22 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 54309ac20..7a5728fdc 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -863,7 +863,6 @@ main(){ HTTPBIN_NAME="httpbin-host" HTTPBIN_OTT="$IDENTITIES_DIR/$HTTPBIN_NAME.jwt" - HTTPBIN_JSON="$IDENTITIES_DIR/$HTTPBIN_NAME.json" if ! ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" --csv \ | grep -q "$HTTPBIN_NAME"; then @@ -942,33 +941,15 @@ main(){ fi if [[ -s "$HTTPBIN_OTT" ]]; then - logDebug "enrolling $HTTPBIN_OTT" - # discard expected output that normally flows to stderr - ENROLL_OUT="$( - ziti edge enroll "$HTTPBIN_OTT" 2>&1 \ - | grep -vE '(generating.*key|enrolled\s+successfully)' \ - || true - )" - if [[ -z "${ENROLL_OUT}" ]]; then - rm -f "$HTTPBIN_OTT" - logDebug "deleted $HTTPBIN_OTT after enrolling successfully" - else - echo -e "ERROR: unexpected result during OpenZiti Identity enrollment\n"\ - "${ENROLL_OUT}" - exit 1 - fi - fi - - if [[ -s "$HTTPBIN_JSON" ]]; then logDebug "installing httpbin chart as 'miniziti-httpbin'" (( ZITI_CHARTS_ALT )) && { helm_wrapper dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 } helm_wrapper install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ - --set-file zitiIdentity="$HTTPBIN_JSON" \ + --set-file zitiEnrollment="$HTTPBIN_OTT" \ --set zitiServiceName=httpbin-service >&3 - rm -f "$HTTPBIN_JSON" - logDebug "deleted $HTTPBIN_JSON after installing successfully with miniziti-httpbin chart" + rm -f "$HTTPBIN_OTT" + logDebug "deleted $HTTPBIN_OTT after installing successfully with miniziti-httpbin chart" fi echo -e "\n\n" From 311700a1a6f4047af5e920dfd6f25392cce65ac9 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 11 Sep 2023 11:29:16 -0400 Subject: [PATCH 88/97] miniziti configurable timeout --- .../docs/learn/quickstarts/network/miniziti.bash | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 7a5728fdc..bed9d7594 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -349,6 +349,7 @@ main(){ # local defaults that are inherited or may error DETECTED_OS="$(detectOs)" : "${DEBUG_MINIKUBE_TUNNEL:=0}" # set env = 1 to trigger the minikube tunnel probe + : "${MINIZITI_TIMEOUT_SECS:=240}" while (( $# )); do case "$1" in @@ -581,13 +582,13 @@ main(){ kubectl_wrapper wait jobs "ingress-nginx-admission-patch" \ --namespace ingress-nginx \ --for condition=complete \ - --timeout 120s >&3 + --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 kubectl_wrapper wait pods \ --namespace ingress-nginx \ --for condition=ready \ --selector app.kubernetes.io/component=controller \ - --timeout 120s >&3 + --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 logDebug "applying Custom Resource Definitions: Certificate, Issuer, and Bundle" kubectl_wrapper apply \ @@ -645,7 +646,7 @@ main(){ kubectl_wrapper wait deployments "$DEPLOYMENT" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ - --timeout 240s >&3 + --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 done # @@ -738,7 +739,8 @@ main(){ logDebug "waiting for cluster dns to be ready" kubectl_wrapper wait deployments "coredns" \ --namespace kube-system \ - --for condition=Available=True >&3 + --for condition=Available=True \ + --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 } # perform a DNS query in a pod so we know ingress-dns is working inside the cluster @@ -796,7 +798,8 @@ main(){ logInfo "waiting for ziti-router to be ready" kubectl_wrapper wait deployments "ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ - --for condition=Available=True >&3 + --for condition=Available=True \ + --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 logDebug "probing miniziti-router for online status" if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ @@ -836,7 +839,7 @@ main(){ kubectl_wrapper wait deployments "ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ - --timeout 240s >&3 + --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 logDebug "setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" kubectl_wrapper config set-context "${MINIKUBE_PROFILE}" \ From 87e3393eb569e22ffa71d53bdee17f8b6f07f954 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 13 Sep 2023 13:50:20 -0400 Subject: [PATCH 89/97] Add console command to open miniziti profile console --- .../learn/quickstarts/network/miniziti.bash | 49 ++++++++++++++----- 1 file changed, 37 insertions(+), 12 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index bed9d7594..165e1bd31 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -44,15 +44,16 @@ _usage(){ echo -e "\n Basic Commands:\n"\ " start\t\tstart miniziti\n"\ " delete\t\tdelete miniziti\n"\ - " ziti\t\tziti cli wrapper with miniziti context\n"\ + " console\t\topen ziti-console in browser\n"\ " creds\t\tprints admin user updb credentials\n"\ + " ziti\t\tziti cli wrapper\n"\ " help\t\tshow these usage hints\n"\ "\n Advanced Commands:\n"\ " shell\t\trun interactive shell inside the ziti-controller container\n"\ - " login\t\trun local ziti binary edge login with miniziti context\n"\ + " login\t\trun local ziti binary edge login\n"\ "\n Other Commands:\n"\ - " kubectl\t\tkubectl cli wrapper with miniziti context\n"\ - " minikube\t\tminikube cli wrapper with miniziti context\n"\ + " kubectl\t\tkubectl cli wrapper\n"\ + " minikube\t\tminikube cli wrapper\n"\ "\n Options:\n"\ " --quiet\t\tsuppress INFO messages\n"\ " --verbose\t\tshow DEBUG messages\n"\ @@ -237,6 +238,21 @@ miniziti_login() { --password } +openZitiConsole() { + console_url="https://miniziti-console.$MINIKUBE_PROFILE.internal" + case "$DETECTED_OS" in + "Windows") + check_command wslview + wslview "$console_url" + ;; + *) + check_command xdg-open + xdg-open "$console_url" + ;; + esac + logInfo "Opening ziti-console: $console_url ..." +} + logger() { local caller="${FUNCNAME[1]}" @@ -327,17 +343,18 @@ main(){ exec 3>/dev/null # local strings with defaults that never produce an error - declare DETECTED_OS \ - START_MINIZITI=0 \ - DELETE_MINIZITI=0 \ + declare DELETE_MINIZITI=0 \ + DETECTED_OS \ DO_ZITI_LOGIN=0 \ MINIKUBE_NODE_EXTERNAL \ MINIKUBE_PROFILE="miniziti" \ MINIZITI_HOSTS=1 \ MINIZITI_MODIFY_HOSTS=0 \ + OPEN_ZITI_CONSOLE=0 \ RUN_ZITI_CLI=0 \ SAFETY_WAIT=1 \ SHOW_ADMIN_CREDS=0 \ + START_MINIZITI=0 \ ZITI_CHARTS_ALT=0 \ ZITI_CHARTS_REF="openziti" \ ZITI_CHARTS_URL="https://openziti.io/helm-charts/charts" \ @@ -359,6 +376,9 @@ main(){ delete) DELETE_MINIZITI=1 shift ;; + console) OPEN_ZITI_CONSOLE=1 + shift + ;; creds) SHOW_ADMIN_CREDS=1 shift ;; @@ -456,18 +476,23 @@ main(){ miniziti_login exit 0 fi + if (( SHOW_ADMIN_CREDS )); then showAdminCreds exit 0 fi + if (( OPEN_ZITI_CONSOLE )); then + openZitiConsole + exit 0 + fi + if (( RUN_ZITI_CLI )); then ziti_wrapper "${ziti_cli_args[@]}" exit 0 fi - - (( DELETE_MINIZITI )) && { + if (( DELETE_MINIZITI )); then banner "$MINIKUBE_PROFILE" deleteMiniziti 10 @@ -497,7 +522,7 @@ main(){ # fi exit 0 - } + fi if (( START_MINIZITI != 1 )); then _usage @@ -855,7 +880,7 @@ main(){ if ! ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" --csv \ | grep -q "$CLIENT_NAME"; then logDebug "creating identity $CLIENT_NAME" - ziti_wrapper edge create identity device "$CLIENT_NAME" \ + ziti_wrapper edge create identity "$CLIENT_NAME" \ --role-attributes httpbin-clients >&3 ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" \ --output-json \ @@ -870,7 +895,7 @@ main(){ if ! ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" --csv \ | grep -q "$HTTPBIN_NAME"; then logDebug "creating identity $HTTPBIN_NAME" - ziti_wrapper edge create identity device "$HTTPBIN_NAME" \ + ziti_wrapper edge create identity "$HTTPBIN_NAME" \ --role-attributes httpbin-hosts >&3 ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" \ --output-json \ From 316676422da629104c9c1761fe1ae11f86b6f95a Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 13 Sep 2023 13:54:45 -0400 Subject: [PATCH 90/97] Add macOS --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 165e1bd31..a462291c6 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -245,6 +245,10 @@ openZitiConsole() { check_command wslview wslview "$console_url" ;; + "macOS") + check_command open + open "$console_url" + ;; *) check_command xdg-open xdg-open "$console_url" From 0d4816cb4b26f9f56883cf7850aa948f806f5e41 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 13 Sep 2023 16:23:29 -0400 Subject: [PATCH 91/97] Makes ingress zone a config map. Rely on stored state for relevant operations. --- .../learn/quickstarts/network/miniziti.bash | 244 ++++++++++-------- 1 file changed, 139 insertions(+), 105 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index a462291c6..e60c82c66 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -153,7 +153,7 @@ pathToNative() { } testClusterDns(){ - if kubectl_wrapper run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ + if kubectlWrapper run "dnstest" --rm --tty --stdin --image busybox --restart Never -- \ nslookup "miniziti-controller.${MINIZITI_INGRESS_ZONE}" | grep "$1" >&3; then logInfo "cluster dns test succeeded" else @@ -186,10 +186,11 @@ HOSTS_FILE='/etc/hosts' cleanHosts() { logWarn "Removing stale miniziti entries from $HOSTS_FILE" + marker="$(getIngressZone)" if (( EUID != 0 )); then - sudo sed -i "/$MINIZITI_PROFILE_MARKER/d" "$HOSTS_FILE" + sudo sed -i "/$marker/d" "$HOSTS_FILE" else - sed -i "/$MINIZITI_PROFILE_MARKER/d" "$HOSTS_FILE" + sed -i "/$marker/d" "$HOSTS_FILE" fi } @@ -200,13 +201,13 @@ installHosts() { "miniziti-console.$MINIZITI_INGRESS_ZONE" ) - hosts_line="$MINIKUBE_NODE_EXTERNAL ${hosts[*]} $MINIZITI_PROFILE_MARKER" + hosts_line="$MINIKUBE_NODE_EXTERNAL ${hosts[*]}" if ! grep -q "$hosts_line" "$HOSTS_FILE"; then checkSudoRequired - if grep -q "$MINIZITI_PROFILE_MARKER" "$HOSTS_FILE"; then + if grep -q "$MINIZITI_INGRESS_ZONE" "$HOSTS_FILE"; then cleanHosts fi @@ -220,7 +221,7 @@ installHosts() { } getAdminSecret() { - kubectl_wrapper get secrets "ziti-controller-admin-secret" \ + kubectlWrapper get secrets "ziti-controller-admin-secret" \ --namespace "$ZITI_NAMESPACE" \ --output go-template='{{index .data "admin-password" | base64decode }}' } @@ -229,28 +230,42 @@ showAdminCreds() { logInfo "The password for 'admin' is: '$(getAdminSecret)'" } -miniziti_login() { - check_command ziti - getAdminSecret | xargs ziti edge login \ +getIngressZone() { + if ! ingress_zone="$(kubectlWrapper get configmap "$MINIZITI_INGRESS_ZONE_CONFIGMAP" -o json | jq --exit-status --raw-output '.data.zone')"; then + logError "Failed to retrieve ingress zone. Did you start profile '$MINIKUBE_PROFILE' successfully?" + exit 1 + else + echo "$ingress_zone" + fi +} + +minizitiLogin() { + checkCommand ziti + ingress_zone="$(getIngressZone)" + getAdminSecret | xargs ziti edge login "https://miniziti-controller.$ingress_zone:443/edge/management/v1" \ --cli-identity "$MINIKUBE_PROFILE" \ --yes \ --username "admin" \ --password + + logInfo "Setting default ziti identity to: $MINIKUBE_PROFILE" + zitiWrapper edge use "$MINIKUBE_PROFILE" >&3 } -openZitiConsole() { - console_url="https://miniziti-console.$MINIKUBE_PROFILE.internal" +minizitiConsole() { + ingress_zone="$(getIngressZone)" + console_url="https://miniziti-console.$ingress_zone" case "$DETECTED_OS" in "Windows") - check_command wslview + checkCommand wslview wslview "$console_url" ;; "macOS") - check_command open + checkCommand open open "$console_url" ;; *) - check_command xdg-open + checkCommand xdg-open xdg-open "$console_url" ;; esac @@ -302,32 +317,32 @@ logDebug() { logger "$*" >&3 } -controller_pod() { - kubectl_wrapper get pods --selector app.kubernetes.io/component=ziti-controller --output jsonpath='{.items[0].metadata.name}' +controllerPod() { + kubectlWrapper get pods --selector app.kubernetes.io/component=ziti-controller --output jsonpath='{.items[0].metadata.name}' } -ziti_wrapper() { - kubectl_wrapper exec "$(controller_pod)" --container ziti-controller -- zitiLogin > /dev/null - kubectl_wrapper exec "$(controller_pod)" --container ziti-controller -- ziti "$@" +zitiWrapper() { + kubectlWrapper exec "$(controllerPod)" --container ziti-controller -- zitiLogin > /dev/null + kubectlWrapper exec "$(controllerPod)" --container ziti-controller -- ziti "$@" } -shell_wrapper() { - kubectl_wrapper exec "$(controller_pod)" --container ziti-controller --tty --stdin -- bash +shellWrapper() { + kubectlWrapper exec "$(controllerPod)" --container ziti-controller --tty --stdin -- bash } -kubectl_wrapper() { +kubectlWrapper() { minikube kubectl --profile "$MINIKUBE_PROFILE" -- --context "$MINIKUBE_PROFILE" "$@" } -minikube_wrapper() { +minikubeWrapper() { minikube --profile "$MINIKUBE_PROFILE" "$@" } -helm_wrapper() { +helmWrapper() { helm --kube-context "$MINIKUBE_PROFILE" "$@" } -check_command() { +checkCommand() { if ! command -v "$1" &>/dev/null; then logError "this script requires command '$1'. Please install on the search PATH and try again." $1 @@ -340,7 +355,7 @@ main(){ # require commands declare -a BINS=(awk grep helm jq minikube nslookup pgrep sed xargs) for BIN in "${BINS[@]}"; do - check_command "$BIN" + checkCommand "$BIN" done # open a descriptor for debug messages @@ -395,15 +410,15 @@ main(){ shift "${#ziti_cli_args[@]}" ;; kubectl) shift - kubectl_wrapper "${@:-}" + kubectlWrapper "${@:-}" exit ;; minikube) shift - minikube_wrapper "${@:-}" + minikubeWrapper "${@:-}" exit ;; shell) shift - shell_wrapper "${@:-}" + shellWrapper "${@:-}" exit ;; -p|--profile) validateDnsName "$2" @@ -467,8 +482,8 @@ main(){ : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" - MINIZITI_PROFILE_MARKER="# miniziti:profile:$MINIKUBE_PROFILE" MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.internal" + MINIZITI_INGRESS_ZONE_CONFIGMAP="ziti-ingress-zone" MINIZITI_INTERCEPT_ZONE="$MINIKUBE_PROFILE.private" ZITI_CLI_HOME="$(getZitiCliHome)" ZITI_CLI_CERTS_DIR="$ZITI_CLI_HOME/certs" @@ -477,7 +492,7 @@ main(){ IDENTITIES_DIR="$PROFILE_DIR/identities" if (( DO_ZITI_LOGIN )); then - miniziti_login + minizitiLogin exit 0 fi @@ -487,40 +502,41 @@ main(){ fi if (( OPEN_ZITI_CONSOLE )); then - openZitiConsole + minizitiConsole exit 0 fi if (( RUN_ZITI_CLI )); then - ziti_wrapper "${ziti_cli_args[@]}" + zitiWrapper "${ziti_cli_args[@]}" exit 0 fi if (( DELETE_MINIZITI )); then banner "$MINIKUBE_PROFILE" - deleteMiniziti 10 - if (( MINIZITI_MODIFY_HOSTS )) && grep -q "$MINIZITI_PROFILE_MARKER" "$HOSTS_FILE"; then - checkSudoRequired - cleanHosts + trap EXIT + if ingress_zone="$(getIngressZone)"; then + if (( MINIZITI_MODIFY_HOSTS )) && grep -q "$ingress_zone" "$HOSTS_FILE"; then + checkSudoRequired + cleanHosts + fi + + CERT_FILE="$(find "$ZITI_CLI_CERTS_DIR" -maxdepth 1 -type f -name "miniziti-controller.$ingress_zone" -print -quit 2> /dev/null)" + if [[ -n "$CERT_FILE" ]]; then + logWarn "Deleting miniziti certificate file: $CERT_FILE" + rm -f "$CERT_FILE" + fi fi + deleteMiniziti 10 + if [[ -d "$PROFILE_DIR" ]]; then logWarn "Deleting miniziti profile directory: $PROFILE_DIR" rm -rf "$PROFILE_DIR" fi - # This is best effort, when '--no-hosts' is specified, - # the right file is unknown due to the way the cli names the file, - # and we don't store enough state to recover it at this time. - CERT_FILE="$(find "$ZITI_CLI_CERTS_DIR" -maxdepth 1 -type f -name "miniziti-controller.$MINIKUBE_PROFILE.*" -print -quit 2> /dev/null)" - if [[ -n "$CERT_FILE" ]]; then - logWarn "Deleting miniziti certificate file: $CERT_FILE" - rm -f "$CERT_FILE" - fi - # Cannot nicely call logout until https://github.com/openziti/ziti/issues/1305 is addressed. - # if check_command ziti &>/dev/null; then + # if checkCommand ziti &>/dev/null; then # logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" # ziti edge logout --cli-identity "$MINIKUBE_PROFILE" >&3 # fi @@ -565,6 +581,7 @@ main(){ MINIZITI_INGRESS_ZONE="${MINIKUBE_NODE_EXTERNAL}.sslip.io" logDebug "DNS wildcard zone for ingresses is ${MINIZITI_INGRESS_ZONE}" } + if [[ -n "${MINIKUBE_NODE_EXTERNAL:-}" ]]; then logDebug "the minikube external IP is ${MINIKUBE_NODE_EXTERNAL}" else @@ -577,11 +594,11 @@ main(){ fi # verify current context can connect to apiserver - kubectl_wrapper cluster-info >&3 + kubectlWrapper cluster-info >&3 logDebug "kubectl successfully obtained cluster-info from apiserver" # enable ssl-passthrough for OpenZiti ingresses - if kubectl_wrapper get deployment "ingress-nginx-controller" \ + if kubectlWrapper get deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ --output 'go-template={{ (index .spec.template.spec.containers 0).args }}' 2>/dev/null \ | grep -q enable-ssl-passthrough; then @@ -597,7 +614,7 @@ main(){ --profile "${MINIKUBE_PROFILE}" >&3 } logDebug "patching ingress-nginx deployment to enable ssl-passthrough" - kubectl_wrapper patch deployment "ingress-nginx-controller" \ + kubectlWrapper patch deployment "ingress-nginx-controller" \ --namespace ingress-nginx \ --type json \ --patch '[{"op": "add", @@ -608,21 +625,21 @@ main(){ logInfo "waiting for ingress-nginx to be ready" # wait for ingress-nginx - kubectl_wrapper wait jobs "ingress-nginx-admission-patch" \ + kubectlWrapper wait jobs "ingress-nginx-admission-patch" \ --namespace ingress-nginx \ --for condition=complete \ --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 - kubectl_wrapper wait pods \ + kubectlWrapper wait pods \ --namespace ingress-nginx \ --for condition=ready \ --selector app.kubernetes.io/component=controller \ --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 logDebug "applying Custom Resource Definitions: Certificate, Issuer, and Bundle" - kubectl_wrapper apply \ + kubectlWrapper apply \ --filename https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml >&3 - kubectl_wrapper apply \ + kubectlWrapper apply \ --filename https://raw.githubusercontent.com/cert-manager/trust-manager/v0.4.0/deploy/crds/trust.cert-manager.io_bundles.yaml >&3 declare -A HELM_REPOS @@ -630,12 +647,12 @@ main(){ HELM_REPOS[jetstack]="charts.jetstack.io" HELM_REPOS[ingress-nginx]="kubernetes.github.io/ingress-nginx" for REPO in "${!HELM_REPOS[@]}"; do - if helm_wrapper repo list | cut -f1 | grep -qE "^${REPO}(\s+)?$"; then + if helmWrapper repo list | cut -f1 | grep -qE "^${REPO}(\s+)?$"; then logDebug "refreshing ${REPO} Helm Charts" - helm_wrapper repo update "${REPO}" >&3 + helmWrapper repo update "${REPO}" >&3 else logInfo "subscribing to ${REPO} Helm Charts" - helm_wrapper repo add "${REPO}" "https://${HELM_REPOS[${REPO}]}" >&3 + helmWrapper repo add "${REPO}" "https://${HELM_REPOS[${REPO}]}" >&3 fi done @@ -643,9 +660,9 @@ main(){ ## Ensure OpenZiti Controller is Upgraded and Ready # - if helm_wrapper status ziti-controller --namespace "${ZITI_NAMESPACE}" &>/dev/null; then + if helmWrapper status ziti-controller --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logInfo "upgrading openziti controller" - helm_wrapper upgrade "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ + helmWrapper upgrade "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" \ --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ @@ -655,9 +672,9 @@ main(){ else logInfo "installing openziti controller" (( ZITI_CHARTS_ALT )) && { - helm_wrapper dependency build "${ZITI_CHARTS_REF}/ziti-controller" >&3 + helmWrapper dependency build "${ZITI_CHARTS_REF}/ziti-controller" >&3 } - helm_wrapper install "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ + helmWrapper install "ziti-controller" "${ZITI_CHARTS_REF}/ziti-controller" \ --namespace "${ZITI_NAMESPACE}" --create-namespace \ --set clientApi.advertisedHost="miniziti-controller.${MINIZITI_INGRESS_ZONE}" \ --set trust-manager.app.trust.namespace="${ZITI_NAMESPACE}" \ @@ -667,12 +684,12 @@ main(){ fi logDebug "setting default namespace '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" - kubectl_wrapper config set-context "${MINIKUBE_PROFILE}" \ + kubectlWrapper config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >&3 for DEPLOYMENT in ziti-controller-cert-manager trust-manager ziti-controller; do logInfo "waiting for $DEPLOYMENT to be ready" - kubectl_wrapper wait deployments "$DEPLOYMENT" \ + kubectlWrapper wait deployments "$DEPLOYMENT" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 @@ -722,7 +739,7 @@ main(){ (( MINIZITI_HOSTS )) && { logDebug "patching coredns configmap with *.${MINIZITI_INGRESS_ZONE} forwarder to minikube ingress-dns nameserver" - kubectl_wrapper patch configmap "coredns" \ + kubectlWrapper patch configmap "coredns" \ --namespace kube-system \ --patch " data: @@ -760,13 +777,13 @@ main(){ " >&3 logDebug "deleting coredns pod so a new one will have modified Corefile" - kubectl_wrapper delete pods \ + kubectlWrapper delete pods \ --context "$MINIKUBE_PROFILE" \ --namespace kube-system \ --selector k8s-app=kube-dns >&3 logDebug "waiting for cluster dns to be ready" - kubectl_wrapper wait deployments "coredns" \ + kubectlWrapper wait deployments "coredns" \ --namespace kube-system \ --for condition=Available=True \ --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 @@ -776,34 +793,51 @@ main(){ testClusterDns "${MINIKUBE_NODE_EXTERNAL}" fi + if miniziti kubectl get configmaps \ + | grep -q "$MINIZITI_INGRESS_ZONE_CONFIGMAP"; then + logDebug "$MINIZITI_INGRESS_ZONE_CONFIGMAP configmap has been applied" + else + logInfo "Applying $MINIZITI_INGRESS_ZONE_CONFIGMAP configmap" + cat <&3 + zitiWrapper edge use "$MINIKUBE_PROFILE" >&3 ROUTER_NAME='miniziti-router' ROUTER_OTT="$IDENTITIES_DIR/$ROUTER_NAME.jwt" - if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ + if zitiWrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ | grep -q miniziti-router; then logDebug "updating $ROUTER_NAME" - ziti_wrapper edge update edge-router "$ROUTER_NAME" \ + zitiWrapper edge update edge-router "$ROUTER_NAME" \ --role-attributes "public-routers" >&3 else logDebug "creating $ROUTER_NAME" - ziti_wrapper edge create edge-router "$ROUTER_NAME" \ + zitiWrapper edge create edge-router "$ROUTER_NAME" \ --role-attributes "public-routers" \ --tunneler-enabled >&3 - ziti_wrapper edge list edge-routers \ + zitiWrapper edge list edge-routers \ "name=\"$ROUTER_NAME\"" \ --output-json \ | jq --exit-status --raw-output '.data[0].enrollmentJwt' > "$ROUTER_OTT" fi - if helm_wrapper status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then + if helmWrapper status ziti-router --namespace "${ZITI_NAMESPACE}" &>/dev/null; then logDebug "upgrading router chart as 'ziti-router'" - helm_wrapper upgrade "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ + helmWrapper upgrade "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set enrollmentJwt=\ \ --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ @@ -813,9 +847,9 @@ main(){ else logDebug "installing router chart as 'ziti-router'" (( ZITI_CHARTS_ALT )) && { - helm_wrapper dependency build "${ZITI_CHARTS_REF}/ziti-router" >&3 + helmWrapper dependency build "${ZITI_CHARTS_REF}/ziti-router" >&3 } - helm_wrapper install "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ + helmWrapper install "ziti-router" "${ZITI_CHARTS_REF}/ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --set-file enrollmentJwt="$ROUTER_OTT" \ --set edge.advertisedHost="miniziti-router.${MINIZITI_INGRESS_ZONE}" \ @@ -825,13 +859,13 @@ main(){ fi logInfo "waiting for ziti-router to be ready" - kubectl_wrapper wait deployments "ziti-router" \ + kubectlWrapper wait deployments "ziti-router" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 logDebug "probing miniziti-router for online status" - if ziti_wrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ + if zitiWrapper edge list edge-routers "name=\"$ROUTER_NAME\"" \ | awk '/miniziti-router/ {print $6}' \ | grep -q true; then logInfo "miniziti-router is online" @@ -844,10 +878,10 @@ main(){ ## Ensure OpenZiti Console is Configured and Ready # - if helm_wrapper --namespace "${ZITI_NAMESPACE}" list --all \ + if helmWrapper --namespace "${ZITI_NAMESPACE}" list --all \ | grep -q ziti-console; then logDebug "upgrading console chart as 'ziti-console'" - helm_wrapper upgrade "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ + helmWrapper upgrade "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ @@ -855,9 +889,9 @@ main(){ else logDebug "installing console chart as 'ziti-console'" (( ZITI_CHARTS_ALT )) && { - helm_wrapper dependency build "${ZITI_CHARTS_REF}/ziti-console" >&3 + helmWrapper dependency build "${ZITI_CHARTS_REF}/ziti-console" >&3 } - helm_wrapper install "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ + helmWrapper install "ziti-console" "${ZITI_CHARTS_REF}/ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --set ingress.advertisedHost="miniziti-console.${MINIZITI_INGRESS_ZONE}" \ --set "settings.edgeControllers[0].url=https://ziti-controller-client.${ZITI_NAMESPACE}.svc:443" \ @@ -865,13 +899,13 @@ main(){ fi logInfo "waiting for ziti-console to be ready" - kubectl_wrapper wait deployments "ziti-console" \ + kubectlWrapper wait deployments "ziti-console" \ --namespace "${ZITI_NAMESPACE}" \ --for condition=Available=True \ --timeout "${MINIZITI_TIMEOUT_SECS}s" >&3 logDebug "setting default namespace to '${ZITI_NAMESPACE}' in kubeconfig context '${MINIKUBE_PROFILE}'" - kubectl_wrapper config set-context "${MINIKUBE_PROFILE}" \ + kubectlWrapper config set-context "${MINIKUBE_PROFILE}" \ --namespace "${ZITI_NAMESPACE}" >&3 # @@ -881,12 +915,12 @@ main(){ CLIENT_NAME="${MINIKUBE_PROFILE}-client" CLIENT_OTT="$IDENTITIES_DIR/$CLIENT_NAME.jwt" - if ! ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" --csv \ + if ! zitiWrapper edge list identities "name=\"$CLIENT_NAME\"" --csv \ | grep -q "$CLIENT_NAME"; then logDebug "creating identity $CLIENT_NAME" - ziti_wrapper edge create identity "$CLIENT_NAME" \ + zitiWrapper edge create identity "$CLIENT_NAME" \ --role-attributes httpbin-clients >&3 - ziti_wrapper edge list identities "name=\"$CLIENT_NAME\"" \ + zitiWrapper edge list identities "name=\"$CLIENT_NAME\"" \ --output-json \ | jq --exit-status --raw-output '.data[0].enrollment.ott.jwt' > "$CLIENT_OTT" else @@ -896,12 +930,12 @@ main(){ HTTPBIN_NAME="httpbin-host" HTTPBIN_OTT="$IDENTITIES_DIR/$HTTPBIN_NAME.jwt" - if ! ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" --csv \ + if ! zitiWrapper edge list identities "name=\"$HTTPBIN_NAME\"" --csv \ | grep -q "$HTTPBIN_NAME"; then logDebug "creating identity $HTTPBIN_NAME" - ziti_wrapper edge create identity "$HTTPBIN_NAME" \ + zitiWrapper edge create identity "$HTTPBIN_NAME" \ --role-attributes httpbin-hosts >&3 - ziti_wrapper edge list identities "name=\"$HTTPBIN_NAME\"" \ + zitiWrapper edge list identities "name=\"$HTTPBIN_NAME\"" \ --output-json \ | jq --exit-status --raw-output '.data[0].enrollment.ott.jwt' > "$HTTPBIN_OTT" @@ -909,64 +943,64 @@ main(){ logDebug "ignoring identity $HTTPBIN_NAME" fi - if ! ziti_wrapper edge list configs 'name="httpbin-intercept-config"' --csv \ + if ! zitiWrapper edge list configs 'name="httpbin-intercept-config"' --csv \ | grep -q "httpbin-intercept-config"; then logDebug "creating config httpbin-intercept-config" - ziti_wrapper edge create config "httpbin-intercept-config" intercept.v1 \ + zitiWrapper edge create config "httpbin-intercept-config" intercept.v1 \ '{"protocols":["tcp"],"addresses":["httpbin.'"${MINIZITI_INTERCEPT_ZONE}"'"], "portRanges":[{"low":80, "high":80}]}' >&3 else logDebug "ignoring config httpbin-intercept-config" fi - if ! ziti_wrapper edge list configs 'name="httpbin-host-config"' --csv \ + if ! zitiWrapper edge list configs 'name="httpbin-host-config"' --csv \ | grep -q "httpbin-host-config"; then logDebug "creating config httpbin-host-config" - ziti_wrapper edge create config "httpbin-host-config" host.v1 \ + zitiWrapper edge create config "httpbin-host-config" host.v1 \ '{"protocol":"tcp", "address":"httpbin","port":8080}' >&3 else logDebug "ignoring config httpbin-host-config" fi - if ! ziti_wrapper edge list services 'name="httpbin-service"' --csv \ + if ! zitiWrapper edge list services 'name="httpbin-service"' --csv \ | grep -q "httpbin-service"; then logDebug "creating service httpbin-service" - ziti_wrapper edge create service "httpbin-service" \ + zitiWrapper edge create service "httpbin-service" \ --configs httpbin-intercept-config,httpbin-host-config >&3 else logDebug "ignoring service httpbin-service" fi - if ! ziti_wrapper edge list service-policies 'name="httpbin-bind-policy"' --csv \ + if ! zitiWrapper edge list service-policies 'name="httpbin-bind-policy"' --csv \ | grep -q "httpbin-bind-policy"; then logDebug "creating service-policy httpbin-bind-policy" - ziti_wrapper edge create service-policy "httpbin-bind-policy" Bind \ + zitiWrapper edge create service-policy "httpbin-bind-policy" Bind \ --service-roles '@httpbin-service' --identity-roles '#httpbin-hosts' >&3 else logDebug "ignoring service-policy httpbin-bind-policy" fi - if ! ziti_wrapper edge list service-policies 'name="httpbin-dial-policy"' --csv \ + if ! zitiWrapper edge list service-policies 'name="httpbin-dial-policy"' --csv \ | grep -q "httpbin-dial-policy"; then logDebug "creating service-policy httpbin-dial-policy" - ziti_wrapper edge create service-policy "httpbin-dial-policy" Dial \ + zitiWrapper edge create service-policy "httpbin-dial-policy" Dial \ --service-roles '@httpbin-service' --identity-roles '#httpbin-clients' >&3 else logDebug "ignoring service-policy httpbin-dial-policy" fi - if ! ziti_wrapper edge list edge-router-policies 'name="public-routers"' --csv \ + if ! zitiWrapper edge list edge-router-policies 'name="public-routers"' --csv \ | grep -q "public-routers"; then logDebug "creating edge-router-policy public-routers" - ziti_wrapper edge create edge-router-policy "public-routers" \ + zitiWrapper edge create edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --identity-roles '#all' >&3 else logDebug "ignoring edge-router-policy public-routers" fi - if ! ziti_wrapper edge list service-edge-router-policies 'name="public-routers"' --csv \ + if ! zitiWrapper edge list service-edge-router-policies 'name="public-routers"' --csv \ | grep -q "public-routers"; then logDebug "creating service-edge-router-policy public-routers" - ziti_wrapper edge create service-edge-router-policy "public-routers" \ + zitiWrapper edge create service-edge-router-policy "public-routers" \ --edge-router-roles '#public-routers' --service-roles '#all' >&3 else logDebug "ignoring service-edge-router-policy public-routers" @@ -975,9 +1009,9 @@ main(){ if [[ -s "$HTTPBIN_OTT" ]]; then logDebug "installing httpbin chart as 'miniziti-httpbin'" (( ZITI_CHARTS_ALT )) && { - helm_wrapper dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 + helmWrapper dependency build "${ZITI_CHARTS_REF}/httpbin" >&3 } - helm_wrapper install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ + helmWrapper install "miniziti-httpbin" "${ZITI_CHARTS_REF}/httpbin" \ --set-file zitiEnrollment="$HTTPBIN_OTT" \ --set zitiServiceName=httpbin-service >&3 rm -f "$HTTPBIN_OTT" From c3817fe4f53a7ee947c2ef6e6aa6247b665e1068 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 13 Sep 2023 16:32:32 -0400 Subject: [PATCH 92/97] Remove trap --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 1 + 1 file changed, 1 insertion(+) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index e60c82c66..c29e4b98c 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -527,6 +527,7 @@ main(){ rm -f "$CERT_FILE" fi fi + trap - EXIT deleteMiniziti 10 From d1d890e6af34f6a84db1a5c9ebeee3437b5978fc Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 13 Sep 2023 17:45:27 -0400 Subject: [PATCH 93/97] Add missing redirection --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index c29e4b98c..599ea7a5b 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -799,7 +799,7 @@ main(){ logDebug "$MINIZITI_INGRESS_ZONE_CONFIGMAP configmap has been applied" else logInfo "Applying $MINIZITI_INGRESS_ZONE_CONFIGMAP configmap" - cat <&3 apiVersion: v1 kind: ConfigMap metadata: From fb27f60fd2b3cac470b45aeec4599d62eaf48c50 Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 13 Sep 2023 23:20:44 -0400 Subject: [PATCH 94/97] Fixes. Adds profile and status commands --- .../learn/quickstarts/network/miniziti.bash | 162 ++++++++++++++++-- 1 file changed, 144 insertions(+), 18 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 599ea7a5b..605589c06 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -46,8 +46,13 @@ _usage(){ " delete\t\tdelete miniziti\n"\ " console\t\topen ziti-console in browser\n"\ " creds\t\tprints admin user updb credentials\n"\ + " status\t\tprint ziti component status\n"\ " ziti\t\tziti cli wrapper\n"\ " help\t\tshow these usage hints\n"\ + "\n Profile Commands:\n"\ + " profile list\tlist available profiles\n"\ + " profile show\tshow default profile\n"\ + " profile use\t\tset default profile\n"\ "\n Advanced Commands:\n"\ " shell\t\trun interactive shell inside the ziti-controller container\n"\ " login\t\trun local ziti binary edge login\n"\ @@ -67,6 +72,26 @@ _usage(){ " --\t\t\tMINIKUBE_START_ARGS args after -- passed to minikube start\n" } +_usageProfileUse(){ + echo -e "\nSet miniziti default profile\n"\ + "\n Usage:\n"\ + " ziti profile use [profile]\n" +} + +_usageProfile(){ + if (( $# )); then + echo -e "\nERROR: unexpected arg '$1'" >&2 + fi + + echo -e "\nProfile management commands\n"\ + "\n Usage:\n"\ + " ziti profile [command]\n"\ + "\n Available Commands:\n"\ + " list\tlist available profiles\n"\ + " show\tshow default profile\n"\ + " use\t\tset miniziti profile\n" +} + checkDns(){ # only param is an IPv4 [[ $# -eq 1 && $1 =~ ([0-9]{1,3}\.){3}[0-9]{1,3} ]] || { @@ -185,8 +210,8 @@ checkSudoRequired() { HOSTS_FILE='/etc/hosts' cleanHosts() { + local marker="$1" logWarn "Removing stale miniziti entries from $HOSTS_FILE" - marker="$(getIngressZone)" if (( EUID != 0 )); then sudo sed -i "/$marker/d" "$HOSTS_FILE" else @@ -208,7 +233,7 @@ installHosts() { checkSudoRequired if grep -q "$MINIZITI_INGRESS_ZONE" "$HOSTS_FILE"; then - cleanHosts + cleanHosts "$MINIZITI_INGRESS_ZONE" fi logInfo "Adding miniziti entries to $HOSTS_FILE" @@ -230,8 +255,17 @@ showAdminCreds() { logInfo "The password for 'admin' is: '$(getAdminSecret)'" } +getConfigMapKey() { + local configmap="$1" + local key="$2" + kubectlWrapper get configmap "$configmap" \ + --ignore-not-found=true \ + --output jsonpath="{.data.$key}" 2> /dev/null +} + getIngressZone() { - if ! ingress_zone="$(kubectlWrapper get configmap "$MINIZITI_INGRESS_ZONE_CONFIGMAP" -o json | jq --exit-status --raw-output '.data.zone')"; then + ingress_zone="$(getConfigMapKey "$MINIZITI_CONFIGMAP" 'ingress-zone')" + if [[ -z "$ingress_zone" ]]; then logError "Failed to retrieve ingress zone. Did you start profile '$MINIKUBE_PROFILE' successfully?" exit 1 else @@ -272,6 +306,10 @@ minizitiConsole() { logInfo "Opening ziti-console: $console_url ..." } +listProfiles() { + dir --format=single-column --ignore=default --sort=time --reverse "$PROFILES_DIR" +} + logger() { local caller="${FUNCNAME[1]}" @@ -318,7 +356,50 @@ logDebug() { } controllerPod() { - kubectlWrapper get pods --selector app.kubernetes.io/component=ziti-controller --output jsonpath='{.items[0].metadata.name}' + kubectlWrapper get pods \ + --selector app.kubernetes.io/component=ziti-controller \ + --output jsonpath='{.items[0].metadata.name}' +} + +getPodStatus() { + local pod_name="$1" + kubectl get pod \ + --selector app.kubernetes.io/component="$pod_name" \ + --ignore-not-found=true \ + --output jsonpath='{.items[0].status.phase}' 2> /dev/null +} + +showStatus() { + COMPONENTS=("ziti-controller" "ziti-router" "ziti-console") + for component in "${COMPONENTS[@]}"; do + status="$(getPodStatus "$component")" + if [[ -z "$status" ]]; then + logError "Could not retrieve status for component $component" + exit 1 + fi + echo "$component: $status" + done +} + +getDefaultProfile() { + default_profile="$DEFAULT_PROFILE" + if [[ -L "$default_profile" ]]; then + basename "$(readlink -f "$default_profile")" + else + echo "miniziti" + fi +} + +setProfile() { + profile="$1" + profiles="$(listProfiles)" + if ! echo "$profiles" | grep -q "$profile"; then + logError "Invalid profile: $profile\nValid profiles are:\n$profiles" + exit 1 + else + ln --no-dereference --symbolic --force "$PROFILES_DIR/$profile" "$DEFAULT_PROFILE" + logInfo "Set default profile to: '$profile'" + fi } zitiWrapper() { @@ -366,7 +447,7 @@ main(){ DETECTED_OS \ DO_ZITI_LOGIN=0 \ MINIKUBE_NODE_EXTERNAL \ - MINIKUBE_PROFILE="miniziti" \ + MINIKUBE_PROFILE \ MINIZITI_HOSTS=1 \ MINIZITI_MODIFY_HOSTS=0 \ OPEN_ZITI_CONSOLE=0 \ @@ -386,6 +467,15 @@ main(){ DETECTED_OS="$(detectOs)" : "${DEBUG_MINIKUBE_TUNNEL:=0}" # set env = 1 to trigger the minikube tunnel probe : "${MINIZITI_TIMEOUT_SECS:=240}" + MINIZITI_CONFIGMAP="miniziti-config" + ZITI_CLI_HOME="$(getZitiCliHome)" + ZITI_CLI_CERTS_DIR="$ZITI_CLI_HOME/certs" + STATE_DIR="$(makeMinizitiStateDir)" + PROFILES_DIR="$STATE_DIR/profiles" + [[ ! -d "$PROFILES_DIR" ]] && mkdir "$PROFILES_DIR" + DEFAULT_PROFILE="$PROFILES_DIR/default" + + MINIKUBE_PROFILE="$(getDefaultProfile)" while (( $# )); do case "$1" in @@ -401,9 +491,44 @@ main(){ creds) SHOW_ADMIN_CREDS=1 shift ;; + profile) + shift + if (( $# == 0 )); then + _usageProfile + exit 1 + fi + case "$1" in + list) + shift + listProfiles + exit + ;; + use) + shift + if (( $# != 1 )); then + _usageProfileUse + exit 1 + fi + setProfile "$1" + exit + ;; + show) + getDefaultProfile + exit + ;; + *) + _usageProfile "$1" + exit 1 + ;; + esac + ;; login) DO_ZITI_LOGIN=1 shift ;; + status) + showStatus + exit + ;; ziti) RUN_ZITI_CLI=1 shift ziti_cli_args=("$@") @@ -483,12 +608,8 @@ main(){ : "${ZITI_NAMESPACE:=${MINIKUBE_PROFILE}}" MINIZITI_INGRESS_ZONE="$MINIKUBE_PROFILE.internal" - MINIZITI_INGRESS_ZONE_CONFIGMAP="ziti-ingress-zone" MINIZITI_INTERCEPT_ZONE="$MINIKUBE_PROFILE.private" - ZITI_CLI_HOME="$(getZitiCliHome)" - ZITI_CLI_CERTS_DIR="$ZITI_CLI_HOME/certs" - STATE_DIR="$(makeMinizitiStateDir)" - PROFILE_DIR="$STATE_DIR/profiles/${MINIKUBE_PROFILE}" + PROFILE_DIR="$PROFILES_DIR/${MINIKUBE_PROFILE}" IDENTITIES_DIR="$PROFILE_DIR/identities" if (( DO_ZITI_LOGIN )); then @@ -518,7 +639,7 @@ main(){ if ingress_zone="$(getIngressZone)"; then if (( MINIZITI_MODIFY_HOSTS )) && grep -q "$ingress_zone" "$HOSTS_FILE"; then checkSudoRequired - cleanHosts + cleanHosts "$ingress_zone" fi CERT_FILE="$(find "$ZITI_CLI_CERTS_DIR" -maxdepth 1 -type f -name "miniziti-controller.$ingress_zone" -print -quit 2> /dev/null)" @@ -536,6 +657,12 @@ main(){ rm -rf "$PROFILE_DIR" fi + if [[ -L "$DEFAULT_PROFILE" ]]; then + if [[ "$(basename "$(readlink -f "$DEFAULT_PROFILE")")" == "$MINIKUBE_PROFILE" ]]; then + unlink "$DEFAULT_PROFILE" + fi + fi + # Cannot nicely call logout until https://github.com/openziti/ziti/issues/1305 is addressed. # if checkCommand ziti &>/dev/null; then # logWarn "Removing $MINIKUBE_PROFILE profile identity from ziti-cli.json" @@ -794,19 +921,18 @@ main(){ testClusterDns "${MINIKUBE_NODE_EXTERNAL}" fi - if miniziti kubectl get configmaps \ - | grep -q "$MINIZITI_INGRESS_ZONE_CONFIGMAP"; then - logDebug "$MINIZITI_INGRESS_ZONE_CONFIGMAP configmap has been applied" + if kubectlWrapper get configmap "$MINIZITI_CONFIGMAP" 2> /dev/null; then + logDebug "$MINIZITI_CONFIGMAP configmap has been applied" else - logInfo "Applying $MINIZITI_INGRESS_ZONE_CONFIGMAP configmap" + logInfo "Applying $MINIZITI_CONFIGMAP configmap" cat <&3 apiVersion: v1 kind: ConfigMap metadata: - name: "$MINIZITI_INGRESS_ZONE_CONFIGMAP" - namespace: "$ZITI_NAMESPACE" + name: "$MINIZITI_CONFIGMAP" + namespace: "$ZITI_NAMESPACE" data: - zone: "$MINIZITI_INGRESS_ZONE" + ingress-zone: "$MINIZITI_INGRESS_ZONE" EOF fi From 0ccdbabe3c51960836f5299ad6fc643497f14f0a Mon Sep 17 00:00:00 2001 From: "Steven A. Broderick Elias" Date: Wed, 13 Sep 2023 23:38:18 -0400 Subject: [PATCH 95/97] Use wrapper, not binary --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index 605589c06..b4f98045d 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -363,7 +363,7 @@ controllerPod() { getPodStatus() { local pod_name="$1" - kubectl get pod \ + kubectlWrapper get pod \ --selector app.kubernetes.io/component="$pod_name" \ --ignore-not-found=true \ --output jsonpath='{.items[0].status.phase}' 2> /dev/null From 0e5c5d1ee0042aacd5473bcdf14f4a88883cca84 Mon Sep 17 00:00:00 2001 From: Steven A Broderick Elias Date: Thu, 14 Sep 2023 11:45:31 -0400 Subject: [PATCH 96/97] Apply suggestions from code review Co-authored-by: Ken Bingham --- docusaurus/docs/learn/quickstarts/network/miniziti.bash | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/docusaurus/docs/learn/quickstarts/network/miniziti.bash index b4f98045d..0ad7af5f3 100644 --- a/docusaurus/docs/learn/quickstarts/network/miniziti.bash +++ b/docusaurus/docs/learn/quickstarts/network/miniziti.bash @@ -384,7 +384,7 @@ showStatus() { getDefaultProfile() { default_profile="$DEFAULT_PROFILE" if [[ -L "$default_profile" ]]; then - basename "$(readlink -f "$default_profile")" + basename "$(realpath "$default_profile")" else echo "miniziti" fi @@ -397,7 +397,7 @@ setProfile() { logError "Invalid profile: $profile\nValid profiles are:\n$profiles" exit 1 else - ln --no-dereference --symbolic --force "$PROFILES_DIR/$profile" "$DEFAULT_PROFILE" + ln -nsf "$PROFILES_DIR/$profile" "$DEFAULT_PROFILE" logInfo "Set default profile to: '$profile'" fi } @@ -658,7 +658,7 @@ main(){ fi if [[ -L "$DEFAULT_PROFILE" ]]; then - if [[ "$(basename "$(readlink -f "$DEFAULT_PROFILE")")" == "$MINIKUBE_PROFILE" ]]; then + if [[ "$(basename "$(realpath "$DEFAULT_PROFILE")")" == "$MINIKUBE_PROFILE" ]]; then unlink "$DEFAULT_PROFILE" fi fi From a776931247a9a108250db727ad9c53b976e43feb Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Wed, 20 Sep 2023 19:52:58 -0400 Subject: [PATCH 97/97] move miniziti.bash --- .../quickstarts/network => quickstart/kubernetes}/miniziti.bash | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename {docusaurus/docs/learn/quickstarts/network => quickstart/kubernetes}/miniziti.bash (100%) diff --git a/docusaurus/docs/learn/quickstarts/network/miniziti.bash b/quickstart/kubernetes/miniziti.bash similarity index 100% rename from docusaurus/docs/learn/quickstarts/network/miniziti.bash rename to quickstart/kubernetes/miniziti.bash