massive zrokEdgeSdk cleanups around service policies (#112)

controller/access.go

@@ -6,7 +6,6 @@ import (
 	"github.com/openziti-test-kitchen/zrok/controller/zrokEdgeSdk"
 	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/service"
-	rest_model_edge "github.com/openziti/edge/rest_model"
 	"github.com/sirupsen/logrus"
 )
 
@@ -72,11 +71,12 @@ func (h *accessHandler) Handle(params service.AccessParams, principal *rest_mode
 		logrus.Error(err)
 		return service.NewAccessInternalServerError()
 	}
-	extraTags := &rest_model_edge.Tags{SubTags: map[string]interface{}{
+	addlTags := map[string]interface{}{
 		"zrokEnvironmentZId": envZId,
 		"zrokFrontendToken":  feToken,
-	}}
+		"zrokServiceToken":   svcToken,
-	if err := zrokEdgeSdk.CreateServicePolicyDialForEnvironment(envZId, ssvc.Token, ssvc.ZId, edge, extraTags); err != nil {
+	}
+	if err := zrokEdgeSdk.CreateServicePolicyDial(envZId+"-dial", ssvc.ZId, []string{envZId}, addlTags, edge); err != nil {
 		logrus.Errorf("unable to create dial policy: %v", err)
 		return service.NewAccessInternalServerError()
 	}

controller/bootstrap.go

@@ -314,7 +314,7 @@ func assertCtrlMetricsBind(ctrlZId, metricsSvcZId string, edge *rest_management_
 	}
 	if len(listResp.Payload.Data) != 1 {
 		logrus.Info("creating 'ctrl-metrics-bind' service policy")
-		if err := zrokEdgeSdk.CreateNamedBindServicePolicy("ctrl-metrics-bind", metricsSvcZId, ctrlZId, edge, zrokEdgeSdk.ZrokTags()); err != nil {
+		if _, err = zrokEdgeSdk.CreateServicePolicy("ctrl-metrics-bind", rest_model.SemanticAllOf, []string{"@"+ctrlZId}, []string{"@"+metricsSvcZId}, nil, zrokEdgeSdk.ServicePolicyBind, edge); err != nil {
 			return errors.Wrap(err, "error creating 'ctrl-metrics-bind' service policy")
 		}
 	}
@@ -338,7 +338,7 @@ func assertFrontendMetricsDial(frontendZId, metricsSvcZId string, edge *rest_man
 	}
 	if len(listResp.Payload.Data) != 1 {
 		logrus.Info("creating 'frontend-metrics-dial' service policy")
-		if err := zrokEdgeSdk.CreateNamedDialServicePolicy("frontend-metrics-dial", metricsSvcZId, frontendZId, edge, zrokEdgeSdk.ZrokTags()); err != nil {
+		if _, err = zrokEdgeSdk.CreateServicePolicy("frontend-metrics-dial", rest_model.SemanticAllOf, []string{"@"+frontendZId}, []string{"@"+metricsSvcZId}, nil, zrokEdgeSdk.ServicePolicyDial, edge); err != nil {
 			return errors.Wrap(err, "error creating 'frontend-metrics-dial' service policy")
 		}
 	}

controller/createIdentity.go

@@ -73,7 +73,7 @@ func (h *createIdentityHandler) Handle(params admin.CreateIdentityParams, princi
 	svcZId := *listSvcResp.Payload.Data[0].ID
 
 	spName := fmt.Sprintf("%v-%v-dial", name, cfg.Metrics.ServiceName)
-	if err := zrokEdgeSdk.CreateNamedDialServicePolicy(spName, svcZId, zId, edge); err != nil {
+	if _, err := zrokEdgeSdk.CreateServicePolicy(spName, rest_model_edge.SemanticAllOf, []string{zId}, []string{svcZId}, nil, zrokEdgeSdk.ServicePolicyDial, edge); err != nil {
 		logrus.Errorf("error creating named dial service policy '%v': %v", spName, err)
 		return admin.NewCreateIdentityInternalServerError()
 	}

controller/sharePrivate.go

@@ -28,11 +28,11 @@ func (a *privateResourceAllocator) allocate(envZId, svcToken string, params serv
 		return "", nil, err
 	}
 
-	if err := zrokEdgeSdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
+	if err := zrokEdgeSdk.CreateServicePolicyBind(envZId+"-bind", svcZId, envZId, zrokEdgeSdk.ZrokServiceTags(svcToken).SubTags, edge); err != nil {
 		return "", nil, err
 	}
 
-	if err := zrokEdgeSdk.CreateShareServiceEdgeRouterPolicy(envZId, svcToken, svcZId, edge); err != nil {
+	if err := zrokEdgeSdk.CreateServiceEdgeRouterPolicyForShare(envZId, svcToken, svcZId, edge); err != nil {
 		return "", nil, err
 	}
 

controller/sharePublic.go

@@ -28,15 +28,15 @@ func (a *publicResourceAllocator) allocate(envZId, svcToken string, frontendZIds
 		return "", nil, err
 	}
 
-	if err := zrokEdgeSdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
+	if err := zrokEdgeSdk.CreateServicePolicyBind(envZId+"-bind", svcZId, envZId, zrokEdgeSdk.ZrokServiceTags(svcToken).SubTags, edge); err != nil {
 		return "", nil, err
 	}
 
-	if err := zrokEdgeSdk.CreateServicePolicyDial(envZId, svcToken, svcZId, frontendZIds, edge); err != nil {
+	if err := zrokEdgeSdk.CreateServicePolicyDial(envZId+"-dial", svcZId, frontendZIds, zrokEdgeSdk.ZrokServiceTags(svcToken).SubTags, edge); err != nil {
 		return "", nil, err
 	}
 
-	if err := zrokEdgeSdk.CreateShareServiceEdgeRouterPolicy(envZId, svcToken, svcZId, edge); err != nil {
+	if err := zrokEdgeSdk.CreateServiceEdgeRouterPolicyForShare(envZId, svcToken, svcZId, edge); err != nil {
 		return "", nil, err
 	}
 

controller/zrokEdgeSdk/serp.go

@@ -11,7 +11,7 @@ import (
 	"time"
 )
 
-func CreateShareServiceEdgeRouterPolicy(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+func CreateServiceEdgeRouterPolicyForShare(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	serpZId, err := CreateServiceEdgeRouterPolicy(svcToken, svcZId, ZrokServiceTags(svcToken).SubTags, edge)
 	if err != nil {
 		return err

controller/zrokEdgeSdk/sp.go

@@ -6,158 +6,84 @@ import (
 	"github.com/openziti/edge/rest_management_api_client"
 	"github.com/openziti/edge/rest_management_api_client/service_policy"
 	"github.com/openziti/edge/rest_model"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"time"
 )
 
 const (
-	ServicePolicyBind = 1
+	ServicePolicyDial = 1
-	ServicePolicyDial = 2
+	ServicePolicyBind = 2
 )
 
-func CreateServicePolicyBind(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+func CreateServicePolicyBind(name, svcZId, bindZId string, addlTags map[string]interface{}, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	semantic := rest_model.SemanticAllOf
-	identityRoles := []string{fmt.Sprintf("@%v", envZId)}
+	identityRoles := []string{"@" + bindZId}
-	name := fmt.Sprintf("%v-backend", svcToken)
+	serviceRoles := []string{"@" + svcZId}
-	var postureCheckRoles []string
+	spZId, err := CreateServicePolicy(name, semantic, identityRoles, serviceRoles, addlTags, ServicePolicyBind, edge)
-	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
-	dialBind := rest_model.DialBindBind
-	svcp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              ZrokServiceTags(svcToken),
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  svcp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
 	if err != nil {
-		return err
+		return errors.Wrapf(err, "error creating bind service policy for service '%v' for identity '%v'", svcZId, bindZId)
 	}
-	logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
+	logrus.Infof("created bind service policy '%v' for service '%v' for identity '%v'", spZId, svcZId, bindZId)
 	return nil
 }
 
-func CreateNamedBindServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
+func CreateServicePolicyDial(name, svcZId string, dialZIds []string, addlTags map[string]interface{}, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)}
-	for _, t := range tags {
-		for k, v := range t.SubTags {
-			allTags.SubTags[k] = v
-		}
-	}
-	identityRoles := []string{"@" + idZId}
-	var postureCheckRoles []string
 	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{"@" + svcZId}
+	var identityRoles []string
-	dialBind := rest_model.DialBindBind
+	for _, zId := range dialZIds {
-	sp := &rest_model.ServicePolicyCreate{
+		identityRoles = append(identityRoles, "@"+zId)
+	}
+	serviceRoles := []string{"@"+svcZId}
+	spZId, err := CreateServicePolicy(name, semantic, identityRoles, serviceRoles, addlTags, ServicePolicyDial, edge)
+	if err != nil {
+		return errors.Wrapf(err, "error creating dial service policy for service '%v' for identities '%v'", svcZId, dialZIds)
+	}
+	logrus.Infof("created dial service policy '%v' for service '%v' for identities '%v'", spZId, svcZId, dialZIds)
+	return nil
+}
+
+func CreateServicePolicy(name string, semantic rest_model.Semantic, identityRoles, serviceRoles []string, addlTags map[string]interface{}, dialBind int, edge *rest_management_api_client.ZitiEdgeManagement) (spZId string, err error) {
+	var dialBindType rest_model.DialBind
+	switch dialBind {
+	case ServicePolicyBind:
+		dialBindType = rest_model.DialBindBind
+	case ServicePolicyDial:
+		dialBindType = rest_model.DialBindDial
+	default:
+		return "", errors.Errorf("invalid dial bind type")
+	}
+
+	spc := &rest_model.ServicePolicyCreate{
 		IdentityRoles:     identityRoles,
 		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
+		PostureCheckRoles: make([]string, 0),
 		Semantic:          &semantic,
 		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
+		Tags:              MergeTags(ZrokTags(), addlTags),
-		Tags:              allTags,
+		Type:              &dialBindType,
 	}
+
 	req := &service_policy.CreateServicePolicyParams{
-		Policy:  sp,
+		Policy: spc,
 		Context: context.Background(),
 	}
 	req.SetTimeout(30 * time.Second)
-	_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
+
+	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
 	if err != nil {
-		return err
+		return "", errors.Wrap(err, "error creating service policy")
 	}
-	return nil
+
+	return resp.Payload.Data.ID, nil
 }
 
 func DeleteServicePolicyBind(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	// type=2 == "Bind"
+	return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=%d", svcToken, ServicePolicyBind), edge)
-	return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=2", svcToken), edge)
-}
-
-func CreateServicePolicyDial(envZId, svcToken, svcZId string, dialZIds []string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
-	allTags := ZrokServiceTags(svcToken)
-	for _, t := range tags {
-		for k, v := range t.SubTags {
-			allTags.SubTags[k] = v
-		}
-	}
-
-	var identityRoles []string
-	for _, proxyIdentity := range dialZIds {
-		identityRoles = append(identityRoles, "@"+proxyIdentity)
-		logrus.Infof("added proxy identity role '%v'", proxyIdentity)
-	}
-	name := fmt.Sprintf("%v-dial", svcToken)
-	var postureCheckRoles []string
-	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
-	dialBind := rest_model.DialBindDial
-	svcp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              allTags,
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  svcp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
-	return nil
-}
-
-func CreateNamedDialServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
-	allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)}
-	for _, t := range tags {
-		for k, v := range t.SubTags {
-			allTags.SubTags[k] = v
-		}
-	}
-	identityRoles := []string{"@" + idZId}
-	var postureCheckRoles []string
-	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{"@" + svcZId}
-	dialBind := rest_model.DialBindDial
-	sp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              allTags,
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  sp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	return nil
 }
 
 func DeleteServicePolicyDial(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	// type=1 == "Dial"
+	return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=%d", svcToken, ServicePolicyDial), edge)
-	return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=1", svcToken), edge)
 }
 
 func DeleteServicePolicy(envZId, filter string, edge *rest_management_api_client.ZitiEdgeManagement) error {
@@ -191,39 +117,3 @@ func DeleteServicePolicy(envZId, filter string, edge *rest_management_api_client
 	}
 	return nil
 }
-
-func CreateServicePolicyDialForEnvironment(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
-	allTags := ZrokServiceTags(svcToken)
-	for _, t := range tags {
-		for k, v := range t.SubTags {
-			allTags.SubTags[k] = v
-		}
-	}
-
-	identityRoles := []string{"@" + envZId}
-	name := fmt.Sprintf("%v-%v-dial", envZId, svcToken)
-	var postureCheckRoles []string
-	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
-	dialBind := rest_model.DialBindDial
-	svcp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              allTags,
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  svcp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
-	return nil
-}