gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-09-11 13:29:03 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
sdk-rerouting
ziti/etc/ctrl.with.edge.yml
T
dovholuknf 767568a2e0 add option to ctrl.with.edge.yml and the template
2026-06-09 13:27:42 -04:00

450 lines
19 KiB
YAML
Raw Permalink Blame History

v: 3
network:
# Sets router minimum cost. Defaults to 10
minRouterCost: 10
# Sets how often a new control channel connection can take over for a router with an existing control channel connection
# Defaults to 1 minute
routerConnectChurnLimit: 1m
# `trustDomain` is used to name and uniquely identify a network. Its main use is as a trust domain in SPIFFE ids.
# Defining it here is only for single controller environments that are not configured for high
# availability. Deployments with high availability MUST be configured via x509 certificate URI SANs.
#
# For more information on SPIFFE IDs see: https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
#
# A trust domain is required, but where it is defined depends on how the network was deployed. The preference is for it
# to come from SPIFFE ids embedded within x509 certificates. The trust domain is derived from the closest SPIFFE id
# looking at server cert > intermediate CA > root CA.
#
# For non-HA environments, a trust domain will deterministically be generated for you from the root CA if it is not
# specified. The controller log will have warnings with this value on startup.
#
# Trust Domain Resolution:
# - Single Controllers Non-HA:
# - Preference for future continuity is that SPIFFE ids are defined on all CAs and leafs, sharing the same trust domain.
# - For pre-existing networks without SPIFFE ids, use of the `trustDomain` file configuration value.
# - In situations where `trustDomain` is defined within the configuration and in a SPIFFE id, the SPIFFE id take precedent.
# - If no SPIFFE ids are detected, a trust domain will be deterministically generated from the root CA and warnings
# will appear in the controller log on startup
#
# - High Availability Controllers:
# - Must have SPIFFE ids defined on all CAs and leafs for controllers.
# - The `trustDomain` configuration value is always ignored.
# - If a trust domain cannot be determined the controller will not start.
trustDomain: ""
# `additionalTrustDomains` is an array of string trust domains that should additionally be trusted. If certificates
# have been issued through router/identity enrollment with the default generated trust domain or other trust domains
# previously used, and they should continue to function, they should be added here.
additionalTrustDomains: []
#trace:
# path: ctrl.trace
profile:
# cpu:
# path: ${TMPDIR}/ziti.ctrl.cpu.pprof
# memory:
# path: ctrl.memprof
db: ${ZITI_DATA}/db/ctrl.db
identity:
cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem
server_cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem
key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem
ca: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem
# the endpoint that routers will connect to the controller over.
ctrl:
listener: tls:127.0.0.1:6262
options:
advertiseAddress: tls:127.0.0.1:6262
# (optional) settings
# set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000)
#maxQueuedConnects: 50
# the maximum number of connects that have begun hello synchronization (1 to 1000, default 16)
#maxOutstandingConnects: 100
# the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
#connectTimeoutMs: 3000
# Sets the control channel write timeout. A write timeout will close the control channel, so the router will reconnect
#writeTimeout: 15s
# A listener address which will be sent to connecting routers in order to change their configured controller
# address. If defined, routers will update address configuration to immediately use the new address for future
# connections. The value of newListener must be resolvable both via DNS and validate via certificates
#newListener: tls:localhost:6262
events:
jsonLogger:
subscriptions:
# - type: apiSession
# - type: authentication
# - type: circuit
# - type: connect
# - type: sdk
# - type: entityChange
# include:
# - services
# - identities
# - type: entityCount
- type: link
# - type: metrics
# sourceFilter: .*
# metricFilter: .*
# - type: router
# - type: session
# - type: services
# - type: terminator
# - type: usage
# version: 3
# - type: usage
# version: 2
# include:
# - ingress.rx
# - egress.rx
# interval: 5s
handler:
type: file
format: json
path: ${TMPDIR}/ziti-events.log
# usageLogger:
# subscriptions:
# - type: fabric.usage
# interval: 5s
# handler:
# type: amqp
# format: json
# url: "amqp://localhost:5672"
# queue: ziti
# durable: true //default:true
# autoDelete: false //default:false
# exclusive: false //default:false
# noWait: false //default:false
# bufferSize: 50 //default:50
# serviceBusLogger:
# subscriptions:
# - type: apiSession
# - type: authentication
# - type: circuit
# - type: connect
# - type: sdk
# - type: entityChange
# include:
# - services
# - identities
# - type: entityCount
# - type: link
# - type: metrics
# sourceFilter: .*
# metricFilter: .*
# - type: router
# - type: session
# - type: services
# - type: terminator
# - type: usage
# version: 3
# - type: usage
# version: 2
# include:
# - ingress.rx
# - egress.rx
# interval: 5s
# handler:
# type: servicebus
# format: json
# connectionString: "Endpoint=sb://your-namespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=your-key"
# topic: "ziti-events"
# bufferSize: 100
# Alternative configuration with queue instead of topic
# events:
# serviceBusQueueLogger:
# subscriptions:
# - type: fabric.circuits
# - type: edge.sessions
# handler:
# type: servicebus
# format: json
# connectionString: "Endpoint=sb://your-namespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=your-key"
# queue: "ziti-events-queue"
# bufferSize: 50
# xctrl_example
#
#example:
# enabled: false
# delay: 5
# tls configures TLS handshake settings for incoming connections
#tls:
# handshakeTimeout: 10s
# rateLimiter:
# # if disabled, no tls handshake rate limiting will be enforced
# enabled: true
# # the smallest window size for concurrent tls handshakes
# minSize: 5
# # the largest allowed window size for concurrent tls handshakes
# maxSize: 250
# # how long before incomplete handshake work is assumed to have failed
# timeout: 30s
# # success rate threshold above which window will grow, below which it will shrink
# successThreshold: 0.9
# # multiplier applied to window size when growing
# increaseFactor: 1.02
# # multiplier applied to window size when shrinking
# decreaseFactor: 0.9
# # number of successes between window increase checks
# increaseCheckInterval: 10
# # number of backoffs between window decrease checks
# decreaseCheckInterval: 10
healthChecks:
boltCheck:
# How often to try entering a bolt read tx. Defaults to 30 seconds
interval: 30s
# When to timeout the check. Defaults to 15 seconds
timeout: 15s
# How long to wait before starting the check. Defaults to 15 seconds
initialDelay: 15s
# By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this
# section, commenting out, or altering the name of the section will cause the edge to not run.
edge:
# This section allows configuring the rate limiter for auth attempts
authRateLimiter:
# if disabled, no auth rate limiting with be enforced
enabled: true
# the smallest window size for auth attempts
minSize: 5
# the largest allowed window size for auth attempts
maxSize: 100
oidc:
# (optional, default 30m) Sets the time OIDC issued access JWTs are valid for. Must be greater than 1m and must be 1m less
# than `refreshTokenDuration`
accessTokenDuration: 30m
# (optional, default 30m) Sets the time OIDC issued id JWTs are valid for. Must be greater than 1m.
idTokenDuration: 30m
# (optional, default 24hr)
refreshTokenDuration: 24h
# --- Refresh-token revocation tuning ---
#
# When a session is refreshed the old refresh token is revoked on a best-effort basis.
# The settings below control when and how those revocations are created.
# (optional, default unset) If set, skip creating a revocation for refresh tokens that
# expire within this duration — they will become invalid on their own. Must be less than
# 50% of refreshTokenDuration. Unset means always revoke.
# revocationMinTokenLifetime: 2m
# (optional, default 1m) The bucket window for batching refresh-token revocations before
# flushing them through raft. A longer interval means fewer raft entries but a larger
# window where the old token has not yet been formally revoked.
# revocationBucketInterval: 1m
# (optional, default 200) Maximum number of revocations per raft log entry / DB transaction
# when flushing. Larger values reduce raft overhead at the cost of bigger individual writes.
# revocationBucketMaxSize: 200
# (optional, default 25000) Maximum number of revocations that can accumulate in memory
# before new ones are dropped. Acts as a safety valve under extreme load.
# revocationMaxQueued: 25000
# (optional, default 1m) How often the controller purges expired revocation records from the
# database. Only runs on the raft leader.
# revocationEnforcerFrequency: 1m
# Set to true to disable posture check functionality
disablePostureChecks: false
# This section represents the configuration of the Edge API that is served over HTTPS
api:
#(optional, default 90s) Alters how frequently heartbeat and last activity values are persisted
# activityUpdateInterval: 90s
#(optional, default 250) The number of API Sessions updated for last activity per transaction
# activityUpdateBatchSize: 250
# sessionTimeout - optional, default 10m
# The number of minutes before an Edge API session will timeout. Timeouts are reset by
# API requests and connections that are maintained to Edge Routers
sessionTimeout: 30m
# address - required
# The default address (host:port) to use for enrollment for the Client API. This value must match one of the addresses
# defined in a bind point's address field for the `edge-client` API in the web section.
address: 127.0.0.1:1280
# disableOidcAutoBinding - optional, default false
# By default the controller automatically adds the edge-oidc API binding to any web listener hosting
# edge-client, even when edge-oidc is not explicitly configured. Set to true to suppress this behaviour
# and require edge-oidc to be explicitly listed in the web section.
# disableOidcAutoBinding: false
# enrollment - required
# A section containing settings pertaining to enrollment.
enrollment:
# signingCert - required
# A Ziti Identity configuration section that specifically makes use of the cert and key fields to define
# a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert
# will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller.
signingCert:
cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/intermediate.cert.pem
key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/intermediate.key.decrypted.pem
# edgeIdentity - optional
# A section for identity enrollment specific settings
edgeIdentity:
# duration - optional, default 5m
# The length of time that a Ziti Edge Identity enrollment should remain valid. After
# this duration, the enrollment will expire and not longer be usable.
duration: 5m
# edgeRouter - Optional
# A section for edge router enrollment specific settings.
edgeRouter:
# duration - optional, default 5m
# The length of time that a Ziti Edge Router enrollment should remain valid. After
# this duration, the enrollment will expire and not longer be usable.
duration: 5m
# web - optional
# Defines webListeners that will be hosted by the controller. Each webListener can host many APIs and be bound to many
# bind points.
web:
# name - required
# Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.
- name: all-apis-localhost
# bindPoints - required
# One or more bind points are required. A bind point specifies an interface (interface:port string) that defines
# where on the host machine the webListener will listen and the address (host:port) that should be used to
# publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for
# incoming address resolution as well as used in responses in the API.
bindPoints:
#interface - required
# A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces
- interface: 127.0.0.1:1280
# address - required
# The public address that external incoming requests will be able to resolve. Used in request processing and
# response content that requires full host:port/path addresses.
address: 127.0.0.1:1280
# newAddress - optional
# A host:port string which will be sent out as an HTTP header "ziti-new-address" if specified. If the header
# is present, clients should update location configuration to immediately use the new address for future
# connections. The value of newAddress must be resolvable both via DNS and validate via certificates
newAddress: localhost:1280
# identity - optional
# Allows the webListener to have a specific identity instead of defaulting to the root `identity` section.
# identity:
# cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem
# server_cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem
# key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem
# ca: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem
# options - optional
# Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are
# used for all http servers started by the current webListener.
options:
# idleTimeout - optional, default 5000ms
# The maximum amount of idle time in milliseconds allowed for pipelined HTTP requests. Setting this too high
# can cause resources on the host to be consumed as clients remain connected and idle. Lowering this value
# will cause clients to reconnect on subsequent HTTPs requests.
idleTimeout: 5000ms #http timeouts, new
# readTimeout - optional, default 5000ms
# The maximum amount of time in milliseconds http servers will wait to read the first incoming requests. A higher
# value risks consuming resources on the host with clients that are acting bad faith or suffering from high latency
# or packet loss. A lower value can risk losing connections to high latency/packet loss clients.
readTimeout: 5000ms
# writeTimeout - optional, default 10000ms
# The total maximum time in milliseconds that the http server will wait for a single requests to be received and
# responded too. A higher value can allow long running requests to consume resources on the host. A lower value
# can risk ending requests before the server has a chance to respond.
writeTimeout: 100000ms
# minTLSVersion - optional, default TSL1.2
# The minimum version of TSL to support
minTLSVersion: TLS1.2
# maxTLSVersion - optional, default TSL1.3
# The maximum version of TSL to support
maxTLSVersion: TLS1.3
# apis - required
# Allows one or more APIs to be bound to this webListener
apis:
# binding - required
# Specifies an API to bind to this webListener. Built-in APIs are
# - health-checks
# - edge-management
# - edge-client
# - fabric-management
- binding: health-checks
- binding: fabric
- binding: edge-management
- binding: edge-client
- binding: edge-oidc
options:
# allowedHostnames (optional): a wildcard server-cert SAN serves OIDC only for the exact hostnames listed here.
# allowedHostnames:
# - ctrl.example.com
redirectURIs:
- "http://localhost:*/auth/callback"
- "http://127.0.0.1:*/auth/callback"
# cluster configures HA cluster settings (HA deployments only)
#cluster:
# advertiseAddress: tls:localhost:1380
# bindAddress: tls:0.0.0.0:1380
# dataDir: /tmp/ziti-cluster-data
# # preferredLeader - optional, default false
# # If set to true, this controller will be preferred as the raft cluster leader. If the current leader is not a
# # preferred leader, it will transfer leadership to a preferred leader if one is available.
# #preferredLeader: true
# dialer:
# # minRetryInterval - optional, default 1s
# # The minimum time between peer dial retry attempts.
# minRetryInterval: 1s
# # maxRetryInterval - optional, default 1m
# # The maximum time between peer dial retry attempts.
# maxRetryInterval: 1m
# # retryBackoffFactor - optional, default 2.0
# # The multiplier applied to the retry interval after each failed dial attempt.
# retryBackoffFactor: 2.0
# # fastFailureWindow - optional, default 30s
# # After a successful connection, the dialer will re-check the peer after this duration. If the
# # connection was lost within this window, it applies backoff instead of resetting the retry delay.
# fastFailureWindow: 30s
# # dialTimeout - optional, default 10s
# # The maximum time a single peer dial attempt is allowed to run before being abandoned.
# dialTimeout: 10s
# # scanInterval - optional, default 30s
# # Period of the dialer's full scan that reconciles dial state against current membership.
# scanInterval: 30s
# # queueCheckInterval - optional, default 5s
# # How often the dialer pops expired entries from its retry heap. Effectively the
# # resolution at which MinRetryInterval is honored.
# queueCheckInterval: 5s
# # nonMemberGrace - optional, default 1m
# # How long the leader will allow a TLS-valid but non-member controller to stay connected
# # to the mesh before dropping it.
# nonMemberGrace: 1m
# rateLimiter:
# enabled: true
# minSize: 5
# maxSize: 250
# timeout: 30s
# successThreshold: 0.9
# increaseFactor: 1.02
# decreaseFactor: 0.9
# increaseCheckInterval: 10
# decreaseCheckInterval: 10
commandRateLimiter:
enabled: true
maxQueued: 100
Reference in New Issue View Git Blame Copy Permalink