extern/zrok
1
1
Fork 0
mirror of https://github.com/openziti/zrok.git synced 2025-06-20 09:48:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

massive zrokEdgeSdk cleanups around service policies (#112)

Browse Source
This commit is contained in:
Michael Quigley 2022-12-14 17:17:19 -05:00
parent d9148490a3
commit 1c5b030472
No known key found for this signature in database
GPG Key ID: 9B60314A9DD20A62
7 changed files with 60 additions and 170 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
controller/access.go
View File

@ -6,7 +6,6 @@ import (
"github.com/openziti-test-kitchen/zrok/controller/zrokEdgeSdk"
"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/service"
rest_model_edge "github.com/openziti/edge/rest_model"
"github.com/sirupsen/logrus"
)
@ -72,11 +71,12 @@ func (h *accessHandler) Handle(params service.AccessParams, principal *rest_mode
logrus.Error(err)
return service.NewAccessInternalServerError()
}
extraTags := &rest_model_edge.Tags{SubTags: map[string]interface{}{
addlTags := map[string]interface{}{
"zrokEnvironmentZId": envZId,
"zrokFrontendToken": feToken,
}}
if err := zrokEdgeSdk.CreateServicePolicyDialForEnvironment(envZId, ssvc.Token, ssvc.ZId, edge, extraTags); err != nil {
"zrokServiceToken": svcToken,
}
if err := zrokEdgeSdk.CreateServicePolicyDial(envZId+"-dial", ssvc.ZId, []string{envZId}, addlTags, edge); err != nil {
logrus.Errorf("unable to create dial policy: %v", err)
return service.NewAccessInternalServerError()
}

4
controller/bootstrap.go
View File

@ -314,7 +314,7 @@ func assertCtrlMetricsBind(ctrlZId, metricsSvcZId string, edge *rest_management_
}
if len(listResp.Payload.Data) != 1 {
logrus.Info("creating 'ctrl-metrics-bind' service policy")
if err := zrokEdgeSdk.CreateNamedBindServicePolicy("ctrl-metrics-bind", metricsSvcZId, ctrlZId, edge, zrokEdgeSdk.ZrokTags()); err != nil {
if _, err = zrokEdgeSdk.CreateServicePolicy("ctrl-metrics-bind", rest_model.SemanticAllOf, []string{"@"+ctrlZId}, []string{"@"+metricsSvcZId}, nil, zrokEdgeSdk.ServicePolicyBind, edge); err != nil {
return errors.Wrap(err, "error creating 'ctrl-metrics-bind' service policy")
}
}
@ -338,7 +338,7 @@ func assertFrontendMetricsDial(frontendZId, metricsSvcZId string, edge *rest_man
}
if len(listResp.Payload.Data) != 1 {
logrus.Info("creating 'frontend-metrics-dial' service policy")
if err := zrokEdgeSdk.CreateNamedDialServicePolicy("frontend-metrics-dial", metricsSvcZId, frontendZId, edge, zrokEdgeSdk.ZrokTags()); err != nil {
if _, err = zrokEdgeSdk.CreateServicePolicy("frontend-metrics-dial", rest_model.SemanticAllOf, []string{"@"+frontendZId}, []string{"@"+metricsSvcZId}, nil, zrokEdgeSdk.ServicePolicyDial, edge); err != nil {
return errors.Wrap(err, "error creating 'frontend-metrics-dial' service policy")
}
}

2
controller/createIdentity.go
View File

@ -73,7 +73,7 @@ func (h *createIdentityHandler) Handle(params admin.CreateIdentityParams, princi
svcZId := *listSvcResp.Payload.Data[0].ID
spName := fmt.Sprintf("%v-%v-dial", name, cfg.Metrics.ServiceName)
if err := zrokEdgeSdk.CreateNamedDialServicePolicy(spName, svcZId, zId, edge); err != nil {
if _, err := zrokEdgeSdk.CreateServicePolicy(spName, rest_model_edge.SemanticAllOf, []string{zId}, []string{svcZId}, nil, zrokEdgeSdk.ServicePolicyDial, edge); err != nil {
logrus.Errorf("error creating named dial service policy '%v': %v", spName, err)
return admin.NewCreateIdentityInternalServerError()
}

4
controller/sharePrivate.go
View File

@ -28,11 +28,11 @@ func (a *privateResourceAllocator) allocate(envZId, svcToken string, params serv
return "", nil, err
}
if err := zrokEdgeSdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
if err := zrokEdgeSdk.CreateServicePolicyBind(envZId+"-bind", svcZId, envZId, zrokEdgeSdk.ZrokServiceTags(svcToken).SubTags, edge); err != nil {
return "", nil, err
}
if err := zrokEdgeSdk.CreateShareServiceEdgeRouterPolicy(envZId, svcToken, svcZId, edge); err != nil {
if err := zrokEdgeSdk.CreateServiceEdgeRouterPolicyForShare(envZId, svcToken, svcZId, edge); err != nil {
return "", nil, err
}

6
controller/sharePublic.go
View File

@ -28,15 +28,15 @@ func (a *publicResourceAllocator) allocate(envZId, svcToken string, frontendZIds
return "", nil, err
}
if err := zrokEdgeSdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
if err := zrokEdgeSdk.CreateServicePolicyBind(envZId+"-bind", svcZId, envZId, zrokEdgeSdk.ZrokServiceTags(svcToken).SubTags, edge); err != nil {
return "", nil, err
}
if err := zrokEdgeSdk.CreateServicePolicyDial(envZId, svcToken, svcZId, frontendZIds, edge); err != nil {
if err := zrokEdgeSdk.CreateServicePolicyDial(envZId+"-dial", svcZId, frontendZIds, zrokEdgeSdk.ZrokServiceTags(svcToken).SubTags, edge); err != nil {
return "", nil, err
}
if err := zrokEdgeSdk.CreateShareServiceEdgeRouterPolicy(envZId, svcToken, svcZId, edge); err != nil {
if err := zrokEdgeSdk.CreateServiceEdgeRouterPolicyForShare(envZId, svcToken, svcZId, edge); err != nil {
return "", nil, err
}

2
controller/zrokEdgeSdk/serp.go
View File

@ -11,7 +11,7 @@ import (
"time"
)
func CreateShareServiceEdgeRouterPolicy(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
func CreateServiceEdgeRouterPolicyForShare(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
serpZId, err := CreateServiceEdgeRouterPolicy(svcToken, svcZId, ZrokServiceTags(svcToken).SubTags, edge)
if err != nil {
return err

204
controller/zrokEdgeSdk/sp.go
View File

@ -6,158 +6,84 @@ import (
"github.com/openziti/edge/rest_management_api_client"
"github.com/openziti/edge/rest_management_api_client/service_policy"
"github.com/openziti/edge/rest_model"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"time"
)
const (
ServicePolicyBind = 1
ServicePolicyDial = 2
ServicePolicyDial = 1
ServicePolicyBind = 2
)
func CreateServicePolicyBind(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
func CreateServicePolicyBind(name, svcZId, bindZId string, addlTags map[string]interface{}, edge *rest_management_api_client.ZitiEdgeManagement) error {
semantic := rest_model.SemanticAllOf
identityRoles := []string{fmt.Sprintf("@%v", envZId)}
name := fmt.Sprintf("%v-backend", svcToken)
var postureCheckRoles []string
serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
dialBind := rest_model.DialBindBind
svcp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: ZrokServiceTags(svcToken),
}
req := &service_policy.CreateServicePolicyParams{
Policy: svcp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
identityRoles := []string{"@" + bindZId}
serviceRoles := []string{"@" + svcZId}
spZId, err := CreateServicePolicy(name, semantic, identityRoles, serviceRoles, addlTags, ServicePolicyBind, edge)
if err != nil {
return err
return errors.Wrapf(err, "error creating bind service policy for service '%v' for identity '%v'", svcZId, bindZId)
}
logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
logrus.Infof("created bind service policy '%v' for service '%v' for identity '%v'", spZId, svcZId, bindZId)
return nil
}
func CreateNamedBindServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)}
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
identityRoles := []string{"@" + idZId}
var postureCheckRoles []string
func CreateServicePolicyDial(name, svcZId string, dialZIds []string, addlTags map[string]interface{}, edge *rest_management_api_client.ZitiEdgeManagement) error {
semantic := rest_model.SemanticAllOf
serviceRoles := []string{"@" + svcZId}
dialBind := rest_model.DialBindBind
sp := &rest_model.ServicePolicyCreate{
var identityRoles []string
for _, zId := range dialZIds {
identityRoles = append(identityRoles, "@"+zId)
}
serviceRoles := []string{"@"+svcZId}
spZId, err := CreateServicePolicy(name, semantic, identityRoles, serviceRoles, addlTags, ServicePolicyDial, edge)
if err != nil {
return errors.Wrapf(err, "error creating dial service policy for service '%v' for identities '%v'", svcZId, dialZIds)
}
logrus.Infof("created dial service policy '%v' for service '%v' for identities '%v'", spZId, svcZId, dialZIds)
return nil
}
func CreateServicePolicy(name string, semantic rest_model.Semantic, identityRoles, serviceRoles []string, addlTags map[string]interface{}, dialBind int, edge *rest_management_api_client.ZitiEdgeManagement) (spZId string, err error) {
var dialBindType rest_model.DialBind
switch dialBind {
case ServicePolicyBind:
dialBindType = rest_model.DialBindBind
case ServicePolicyDial:
dialBindType = rest_model.DialBindDial
default:
return "", errors.Errorf("invalid dial bind type")
}
spc := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
PostureCheckRoles: make([]string, 0),
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
Tags: MergeTags(ZrokTags(), addlTags),
Type: &dialBindType,
}
req := &service_policy.CreateServicePolicyParams{
Policy: sp,
Policy: spc,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
return "", errors.Wrap(err, "error creating service policy")
}
return nil
return resp.Payload.Data.ID, nil
}
func DeleteServicePolicyBind(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
// type=2 == "Bind"
return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=2", svcToken), edge)
}
func CreateServicePolicyDial(envZId, svcToken, svcZId string, dialZIds []string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := ZrokServiceTags(svcToken)
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
var identityRoles []string
for _, proxyIdentity := range dialZIds {
identityRoles = append(identityRoles, "@"+proxyIdentity)
logrus.Infof("added proxy identity role '%v'", proxyIdentity)
}
name := fmt.Sprintf("%v-dial", svcToken)
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
dialBind := rest_model.DialBindDial
svcp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: svcp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
return nil
}
func CreateNamedDialServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)}
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
identityRoles := []string{"@" + idZId}
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{"@" + svcZId}
dialBind := rest_model.DialBindDial
sp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: sp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
return nil
return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=%d", svcToken, ServicePolicyBind), edge)
}
func DeleteServicePolicyDial(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
// type=1 == "Dial"
return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=1", svcToken), edge)
return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=%d", svcToken, ServicePolicyDial), edge)
}
func DeleteServicePolicy(envZId, filter string, edge *rest_management_api_client.ZitiEdgeManagement) error {
@ -191,39 +117,3 @@ func DeleteServicePolicy(envZId, filter string, edge *rest_management_api_client
}
return nil
}
func CreateServicePolicyDialForEnvironment(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := ZrokServiceTags(svcToken)
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
identityRoles := []string{"@" + envZId}
name := fmt.Sprintf("%v-%v-dial", envZId, svcToken)
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
dialBind := rest_model.DialBindDial
svcp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: svcp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
return nil
}