- publishes FirstPartyX509CertValidation/ThirdPartyX509CertValidation usages and
intermediates on router data model public keys, deprecating ClientX509CertValidation
- builds the router first-party cert pool from RDM first-party keys unioned with
ctrl-channel roots; TLS and VerifyClientCert paths share buildClientCertRoots with
fallback to the deprecated usage for old controllers
- trusts the edge enrollment signing CA when verifying the certificate a router
presents on the control channel, so a signing CA outside the controller's own
trust bundle no longer refuses every router; the anchors go into a clone of the
identity's pool, never the pool its live tls.Configs share
- propagates full controller signing cert chains over the mesh via
SigningCertChainHeader and persists them in Controller store CertPem
- sends stored public keys during router sync instead of rebuilding them; publishes
controller certs leaf-only
- stops router controller reconnect loops after shutdown
- gives each in-process controller its own command decoder registry
- adds the ha-3 three-controller harness and first-party cert integration tests
- drains the cli test stdout pipe while commands run; anchors the totp token
issued-at assertion to the test clock
- backports the SPIFFE-capable test PKI from openziti/ziti#3947: --not-before on
ziti pki create, tests/testdata/create-pki.sh/.ps1, and the generated PKI under
tests/testdata/pki including the separate edge signing root and per-controller
signing intermediates; existing config sets stay on the testdata/ca PKI
- skips *.pem, *.cert and *.key files in codespell
* fixes#3806 expose OpenZiti endpoints in OIDC discovery document
- adds vendor-specific "openziti_endpoints" field to the
/.well-known/openid-configuration response
- overrides Discovery() on the OIDC server to wrap the standard config
with OpenZiti login and MFA endpoint URLs
- advertises password, cert, ext-jwt, totp, totp enrollment, and
auth query endpoints as absolute URLs derived from the issuer
- adds integration test verifying all openziti_endpoints fields
- adds dual-server integration test confirming endpoint URLs reflect
the correct issuer when edge-oidc is hosted on multiple bind points
* changelog
* fixes#3597, enable OIDC by default
- adds ability to have different sets of environment configs for tests
- adds ConfigSet struct as a configuration device for integration tests
- allows entire environments to be defined as needed
- original ats config set at "default-ats"
- tests that do not specify a config set, use "default-ats" as before
- standardizes configuration location, naming, etc.
- adds README.md for the above
- updates testContext to now be config set aware
- add config value to disable, update tests, changelog
- add defense against cached version data for tests
- adds support for trust domain lookup on x509 chain
- adds support for non-ha trustDomain configuration
- adds default generated trust domain for non-ha controllers
- non-HA controllers will generate a trust domain from the root CA if
possible
- additionalTrustDomains has been added for transitioning between trust
domains
update changelog.md
* progress on controller communication
* added yaml encoding/decoding
* move dispatch callbacks to be more consistent
* update unit tests
* small cleaups
* Add new datadir to unit tests
* fix linter
* Was able to use FSM hooks to get configuration updates to show raft state
* Send index to prevent older versions from being applied and added leader override
* pr comments and added/removed ctrl connections
* added error logging
* pr comments
* spelling and bad log newlines
* added delete from the toconnect map and added end case to the background connect
* reordered removal from map
* added mtx around access. Forgot that was changed to be unsopported.
- allows fabric routers to be created in an unenrolled state
- allows fabric routers to be CRUD
- converts both edge and transit routers to use the same enrollment
facilities as identities (1st step to merge)
- migrations for enrollment changes
- adds ability to extend a base store
- add external cleanup logic to tx router to handle isbase=true
- use router handler for is connected status
dovholuknf