extern/zrok
1
1
Fork 0
mirror of https://github.com/openziti/zrok.git synced 2024-11-25 01:23:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

create edge router policy for identity at enable time, not tunnel time

Browse Source
This commit is contained in:
Michael Quigley 2022-08-17 13:43:16 -04:00
parent e4b06c1a19
commit b45f01b34a
No known key found for this signature in database
GPG Key ID: 9B60314A9DD20A62
3 changed files with 29 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
controller/enable.go
View File

@ -10,6 +10,7 @@ import (
"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/identity"
"github.com/openziti/edge/rest_management_api_client"
"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
identity_edge "github.com/openziti/edge/rest_management_api_client/identity"
rest_model_edge "github.com/openziti/edge/rest_model"
sdk_config "github.com/openziti/sdk-golang/ziti/config"
@ -50,6 +51,10 @@ func (self *enableHandler) Handle(params identity.EnableParams, principal *rest_
logrus.Error(err)
return identity.NewEnableInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
if err := self.createEdgeRouterPolicy(ident.Payload.Data.ID, client); err != nil {
logrus.Error(err)
return identity.NewEnableInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
addrTokens := strings.Split(params.HTTPRequest.RemoteAddr, ":")
addr := addrTokens[0]
@ -136,3 +141,27 @@ func (_ *enableHandler) enrollIdentity(id string, client *rest_management_api_cl
}
return conf, nil
}
func (_ *enableHandler) createEdgeRouterPolicy(id string, edge *rest_management_api_client.ZitiEdgeManagement) error {
edgeRouterRoles := []string{"#all"}
identityRoles := []string{fmt.Sprintf("@%v", id)}
name := fmt.Sprintf("zrok-%v", id)
semantic := rest_model_edge.SemanticAllOf
erp := &rest_model_edge.EdgeRouterPolicyCreate{
EdgeRouterRoles: edgeRouterRoles,
IdentityRoles: identityRoles,
Name: &name,
Semantic: &semantic,
}
req := &edge_router_policy.CreateEdgeRouterPolicyParams{
Policy: erp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.EdgeRouterPolicy.CreateEdgeRouterPolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("created edge router policy '%v'", resp.Payload.Data.ID)
return nil
}

28
controller/tunnel.go
View File

@ -10,7 +10,6 @@ import (
"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/tunnel"
"github.com/openziti/edge/rest_management_api_client"
"github.com/openziti/edge/rest_management_api_client/config"
"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
"github.com/openziti/edge/rest_management_api_client/service"
"github.com/openziti/edge/rest_management_api_client/service_edge_router_policy"
"github.com/openziti/edge/rest_management_api_client/service_policy"
@ -89,10 +88,6 @@ func (self *tunnelHandler) Handle(params tunnel.TunnelParams, principal *rest_mo
logrus.Error(err)
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
if err := self.createEdgeRouterPolicy(svcName, envId, edge); err != nil {
logrus.Error(err)
return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
logrus.Infof("allocated service '%v'", svcName)
@ -253,29 +248,6 @@ func (self *tunnelHandler) createServiceEdgeRouterPolicy(svcName, svcId string,
return nil
}
func (self *tunnelHandler) createEdgeRouterPolicy(svcName, envId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
edgeRouterRoles := []string{"#all"}
identityRoles := []string{fmt.Sprintf("@%v", envId)}
semantic := rest_model.SemanticAllOf
erp := &rest_model.EdgeRouterPolicyCreate{
EdgeRouterRoles: edgeRouterRoles,
IdentityRoles: identityRoles,
Name: &svcName,
Semantic: &semantic,
}
req := &edge_router_policy.CreateEdgeRouterPolicyParams{
Policy: erp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.EdgeRouterPolicy.CreateEdgeRouterPolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("created edge router policy '%v'", resp.Payload.Data.ID)
return nil
}
func (self *tunnelHandler) proxyUrl(svcName string) string {
return strings.Replace(self.cfg.Proxy.UrlTemplate, "{svcName}", svcName, -1)
}

38
controller/untunnel.go
View File

@ -9,7 +9,6 @@ import (
"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/tunnel"
"github.com/openziti/edge/rest_management_api_client"
"github.com/openziti/edge/rest_management_api_client/config"
"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
"github.com/openziti/edge/rest_management_api_client/service"
"github.com/openziti/edge/rest_management_api_client/service_edge_router_policy"
"github.com/openziti/edge/rest_management_api_client/service_policy"
@ -83,10 +82,6 @@ func (self *untunnelHandler) Handle(params tunnel.UntunnelParams, principal *res
return tunnel.NewUntunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
if err := self.deleteEdgeRouterPolicy(svcName, edge); err != nil {
logrus.Error(err)
return tunnel.NewUntunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
}
if err := self.deleteServiceEdgeRouterPolicy(svcName, edge); err != nil {
logrus.Error(err)
return tunnel.NewUntunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
@ -144,39 +139,6 @@ func (_ *untunnelHandler) findServiceId(svcName string, edge *rest_management_ap
return "", errors.Errorf("service '%v' not found", svcName)
}
func (_ *untunnelHandler) deleteEdgeRouterPolicy(svcName string, edge *rest_management_api_client.ZitiEdgeManagement) error {
filter := fmt.Sprintf("name=\"%v\"", svcName)
limit := int64(1)
offset := int64(0)
listReq := &edge_router_policy.ListEdgeRouterPoliciesParams{
Filter: &filter,
Limit: &limit,
Offset: &offset,
Context: context.Background(),
}
listReq.SetTimeout(30 * time.Second)
listResp, err := edge.EdgeRouterPolicy.ListEdgeRouterPolicies(listReq, nil)
if err != nil {
return err
}
if len(listResp.Payload.Data) == 1 {
erpId := *(listResp.Payload.Data[0].ID)
req := &edge_router_policy.DeleteEdgeRouterPolicyParams{
ID: erpId,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.EdgeRouterPolicy.DeleteEdgeRouterPolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("deleted edge router policy '%v'", erpId)
} else {
logrus.Infof("did not find an edge router policy")
}
return nil
}
func (_ *untunnelHandler) deleteServiceEdgeRouterPolicy(svcName string, edge *rest_management_api_client.ZitiEdgeManagement) error {
filter := fmt.Sprintf("name=\"%v\"", svcName)
limit := int64(1)