Andrew Martinez
8415a7dbf6
* The controller and the router wrote the complete service session token, an OIDC service session JWT or a legacy session token, into structured log fields during edge control operations. Several of the sites logged at Error or Info, so the values reached logs at default verbosity during ordinary operation. * Adds LoggingFields to the session and api session types in common, controller/model and router/state, so a logging site asks for the session fields or the api session fields instead of picking values by hand. Ids, type, identity, service and the token's validity window go in; the token does not. Empty values are dropped, so the sets merge over each other. * AddLoggingFields in router/state now delegates to LoggingFields. Its output moves from a nested field to flat prefixed keys. * The edge control handlers log the session field set on the shared returnError and logResult paths, on circuit setup and on terminator update. The terminator removal paths log the terminator id, since they never load a session. * Adds unit tests over returnError and logResult that fail if a session token reaches a log entry, covering the loaded-session, failed-to-load and JWT-claims cases.
Ziti Router Components
This document describes the key components of the Ziti router architecture.
Core Components
NetworkControllers
Manages connections to Ziti controllers. Handles controller discovery, connection establishment, failover, and maintains heartbeats. Routes control plane messages between the router and controllers.
Link Registry
Maintains the registry of active links to other routers in the mesh. Tracks link states, manages link lifecycle, and provides link lookup capabilities for routing decisions.
Forwarder
The packet forwarding engine that routes data between xgress instances. Delivers payloads to links, xgress instances or edge forwarders.
Faulter
Monitors link health and detects failures. Automatically reports link faults to controllers and triggers link recovery processes when connectivity issues are detected.
Scanner
Continuously scans the forwarder's state to detect and clean up stale forwarding entries. Removes inactive circuits and performs periodic maintenance of the forwarding tables.
Data Plane Components
Xgress Components
Handle ingress and egress traffic for the router:
- Xgress Listeners: Accept incoming connections from clients and services
- Xgress Dialers: Establish outbound connections to services
- Xgress Factories: Create protocol-specific xgress instances (edge, transport, proxy, tunnel)
- Xgress Registry: Global registry managing all xgress factory types
Xgress Types
edge: Handles Ziti SDK connectionstransport: Router-to-router communicationproxy: TCP/UDP proxy connectionstunnel: Intercepted traffic from tunneling clients
Metrics
Comprehensive metrics collection covering:
- Link latency and throughput
- Xgress connection statistics
- Pool utilization (link dialer, egress dialer, rate limiter)
All metrics are reported to controllers and available via health check APIs.