Paul Lorenz 45197242c1 Deprecate creating a router outside enrollment ...

A router's id is assigned when it enrolls, except on one path: the fabric router
create API takes the id from the request, and `ziti fabric create router <cert>`
fills it from the certificate's common name. That dates from when a router had a
single identifier rather than a separate id and name, so the certificate named the
router. It is the only way a router gets an id that was chosen rather than
assigned, and so the only way a deleted router's id can come back.

- deprecates the CLI command, which now prints a notice on every use
- documents the API mapper that consumes the supplied id as deprecated. Only the
  fabric router create path does; the transit router path already ignores it and
  lets the id be generated
- logs a warning on the controller whenever a router is created this way. The CLI
  notice is only seen by CLI users, and the point of deprecating rather than
  removing is to find out whether anyone is driving the API directly
- adds it to the deprecations list, with the history, since an id taken from a
  certificate reads as deliberate design without it

Per-router state cleanup is written against the assumption this establishes, that
a deleted router id does not return.

(cherry picked from commit 6c968b1ed0)

2026-09-16 13:33:15 -04:00

..

policy

Hold the policy enforcers' meters rather than resolving one per run. Fixes #4350

2026-09-03 17:18:29 -04:00

routes

Deprecate creating a router outside enrollment

2026-09-16 13:33:15 -04:00