create edge router policy for identity at enable time, not tunnel time

controller/enable.go

@@ -10,6 +10,7 @@ import (
 	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/identity"
 	"github.com/openziti/edge/rest_management_api_client"
+	"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
 	identity_edge "github.com/openziti/edge/rest_management_api_client/identity"
 	rest_model_edge "github.com/openziti/edge/rest_model"
 	sdk_config "github.com/openziti/sdk-golang/ziti/config"
@@ -50,6 +51,10 @@ func (self *enableHandler) Handle(params identity.EnableParams, principal *rest_
 		logrus.Error(err)
 		return identity.NewEnableInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
 	}
+	if err := self.createEdgeRouterPolicy(ident.Payload.Data.ID, client); err != nil {
+		logrus.Error(err)
+		return identity.NewEnableInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
+	}
 
 	addrTokens := strings.Split(params.HTTPRequest.RemoteAddr, ":")
 	addr := addrTokens[0]
@@ -136,3 +141,27 @@ func (_ *enableHandler) enrollIdentity(id string, client *rest_management_api_cl
 	}
 	return conf, nil
 }
+
+func (_ *enableHandler) createEdgeRouterPolicy(id string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	edgeRouterRoles := []string{"#all"}
+	identityRoles := []string{fmt.Sprintf("@%v", id)}
+	name := fmt.Sprintf("zrok-%v", id)
+	semantic := rest_model_edge.SemanticAllOf
+	erp := &rest_model_edge.EdgeRouterPolicyCreate{
+		EdgeRouterRoles: edgeRouterRoles,
+		IdentityRoles:   identityRoles,
+		Name:            &name,
+		Semantic:        &semantic,
+	}
+	req := &edge_router_policy.CreateEdgeRouterPolicyParams{
+		Policy:  erp,
+		Context: context.Background(),
+	}
+	req.SetTimeout(30 * time.Second)
+	resp, err := edge.EdgeRouterPolicy.CreateEdgeRouterPolicy(req, nil)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("created edge router policy '%v'", resp.Payload.Data.ID)
+	return nil
+}

controller/tunnel.go

@@ -10,7 +10,6 @@ import (
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/tunnel"
 	"github.com/openziti/edge/rest_management_api_client"
 	"github.com/openziti/edge/rest_management_api_client/config"
-	"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
 	"github.com/openziti/edge/rest_management_api_client/service"
 	"github.com/openziti/edge/rest_management_api_client/service_edge_router_policy"
 	"github.com/openziti/edge/rest_management_api_client/service_policy"
@@ -89,10 +88,6 @@ func (self *tunnelHandler) Handle(params tunnel.TunnelParams, principal *rest_mo
 		logrus.Error(err)
 		return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
 	}
-	if err := self.createEdgeRouterPolicy(svcName, envId, edge); err != nil {
-		logrus.Error(err)
-		return tunnel.NewTunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
-	}
 
 	logrus.Infof("allocated service '%v'", svcName)
 
@@ -253,29 +248,6 @@ func (self *tunnelHandler) createServiceEdgeRouterPolicy(svcName, svcId string,
 	return nil
 }
 
-func (self *tunnelHandler) createEdgeRouterPolicy(svcName, envId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	edgeRouterRoles := []string{"#all"}
-	identityRoles := []string{fmt.Sprintf("@%v", envId)}
-	semantic := rest_model.SemanticAllOf
-	erp := &rest_model.EdgeRouterPolicyCreate{
-		EdgeRouterRoles: edgeRouterRoles,
-		IdentityRoles:   identityRoles,
-		Name:            &svcName,
-		Semantic:        &semantic,
-	}
-	req := &edge_router_policy.CreateEdgeRouterPolicyParams{
-		Policy:  erp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.EdgeRouterPolicy.CreateEdgeRouterPolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	logrus.Infof("created edge router policy '%v'", resp.Payload.Data.ID)
-	return nil
-}
-
 func (self *tunnelHandler) proxyUrl(svcName string) string {
 	return strings.Replace(self.cfg.Proxy.UrlTemplate, "{svcName}", svcName, -1)
 }

controller/untunnel.go

@@ -9,7 +9,6 @@ import (
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/tunnel"
 	"github.com/openziti/edge/rest_management_api_client"
 	"github.com/openziti/edge/rest_management_api_client/config"
-	"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
 	"github.com/openziti/edge/rest_management_api_client/service"
 	"github.com/openziti/edge/rest_management_api_client/service_edge_router_policy"
 	"github.com/openziti/edge/rest_management_api_client/service_policy"
@@ -83,10 +82,6 @@ func (self *untunnelHandler) Handle(params tunnel.UntunnelParams, principal *res
 		return tunnel.NewUntunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
 	}
 
-	if err := self.deleteEdgeRouterPolicy(svcName, edge); err != nil {
-		logrus.Error(err)
-		return tunnel.NewUntunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
-	}
 	if err := self.deleteServiceEdgeRouterPolicy(svcName, edge); err != nil {
 		logrus.Error(err)
 		return tunnel.NewUntunnelInternalServerError().WithPayload(rest_model_zrok.ErrorMessage(err.Error()))
@@ -144,39 +139,6 @@ func (_ *untunnelHandler) findServiceId(svcName string, edge *rest_management_ap
 	return "", errors.Errorf("service '%v' not found", svcName)
 }
 
-func (_ *untunnelHandler) deleteEdgeRouterPolicy(svcName string, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	filter := fmt.Sprintf("name=\"%v\"", svcName)
-	limit := int64(1)
-	offset := int64(0)
-	listReq := &edge_router_policy.ListEdgeRouterPoliciesParams{
-		Filter:  &filter,
-		Limit:   &limit,
-		Offset:  &offset,
-		Context: context.Background(),
-	}
-	listReq.SetTimeout(30 * time.Second)
-	listResp, err := edge.EdgeRouterPolicy.ListEdgeRouterPolicies(listReq, nil)
-	if err != nil {
-		return err
-	}
-	if len(listResp.Payload.Data) == 1 {
-		erpId := *(listResp.Payload.Data[0].ID)
-		req := &edge_router_policy.DeleteEdgeRouterPolicyParams{
-			ID:      erpId,
-			Context: context.Background(),
-		}
-		req.SetTimeout(30 * time.Second)
-		_, err := edge.EdgeRouterPolicy.DeleteEdgeRouterPolicy(req, nil)
-		if err != nil {
-			return err
-		}
-		logrus.Infof("deleted edge router policy '%v'", erpId)
-	} else {
-		logrus.Infof("did not find an edge router policy")
-	}
-	return nil
-}
-
 func (_ *untunnelHandler) deleteServiceEdgeRouterPolicy(svcName string, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	filter := fmt.Sprintf("name=\"%v\"", svcName)
 	limit := int64(1)