extern/zrok
1
1
Fork 0
mirror of https://github.com/openziti/zrok.git synced 2024-11-07 08:44:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

service policy (#112)

Browse Source
This commit is contained in:
Michael Quigley 2022-12-14 14:04:29 -05:00
parent 7b520597d6
commit f46a1533a6
No known key found for this signature in database
GPG Key ID: 9B60314A9DD20A62
10 changed files with 204 additions and 192 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
controller/bootstrap.go
View File

@ -314,7 +314,7 @@ func assertCtrlMetricsBind(ctrlZId, metricsSvcZId string, edge *rest_management_
}
if len(listResp.Payload.Data) != 1 {
logrus.Info("creating 'ctrl-metrics-bind' service policy")
if err := createNamedBindServicePolicy("ctrl-metrics-bind", metricsSvcZId, ctrlZId, edge, zrok_edge_sdk.ZrokTags()); err != nil {
if err := zrok_edge_sdk.CreateNamedBindServicePolicy("ctrl-metrics-bind", metricsSvcZId, ctrlZId, edge, zrok_edge_sdk.ZrokTags()); err != nil {
return errors.Wrap(err, "error creating 'ctrl-metrics-bind' service policy")
}
}
@ -338,7 +338,7 @@ func assertFrontendMetricsDial(frontendZId, metricsSvcZId string, edge *rest_man
}
if len(listResp.Payload.Data) != 1 {
logrus.Info("creating 'frontend-metrics-dial' service policy")
if err := createNamedDialServicePolicy("frontend-metrics-dial", metricsSvcZId, frontendZId, edge, zrok_edge_sdk.ZrokTags()); err != nil {
if err := zrok_edge_sdk.CreateNamedDialServicePolicy("frontend-metrics-dial", metricsSvcZId, frontendZId, edge, zrok_edge_sdk.ZrokTags()); err != nil {
return errors.Wrap(err, "error creating 'frontend-metrics-dial' service policy")
}
}

3
controller/create_identity.go
View File

@ -5,6 +5,7 @@ import (
"encoding/json"
"fmt"
"github.com/go-openapi/runtime/middleware"
"github.com/openziti-test-kitchen/zrok/controller/zrok_edge_sdk"
"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/admin"
"github.com/openziti/edge/rest_management_api_client/service"
@ -72,7 +73,7 @@ func (h *createIdentityHandler) Handle(params admin.CreateIdentityParams, princi
svcZId := *listSvcResp.Payload.Data[0].ID
spName := fmt.Sprintf("%v-%v-dial", name, cfg.Metrics.ServiceName)
if err := createNamedDialServicePolicy(spName, svcZId, zId, edge); err != nil {
if err := zrok_edge_sdk.CreateNamedDialServicePolicy(spName, svcZId, zId, edge); err != nil {
logrus.Errorf("error creating named dial service policy '%v': %v", spName, err)
return admin.NewCreateIdentityInternalServerError()
}

4
controller/disable.go
View File

@ -90,10 +90,10 @@ func (h *disableHandler) removeServicesForEnvironment(envId int, tx *sqlx.Tx, ed
if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy(env.ZId, svcToken, edge); err != nil {
logrus.Error(err)
}
if err := deleteServicePolicyDial(env.ZId, svcToken, edge); err != nil {
if err := zrok_edge_sdk.DeleteServicePolicyDial(env.ZId, svcToken, edge); err != nil {
logrus.Error(err)
}
if err := deleteServicePolicyBind(env.ZId, svcToken, edge); err != nil {
if err := zrok_edge_sdk.DeleteServicePolicyBind(env.ZId, svcToken, edge); err != nil {
logrus.Error(err)
}
if err := deleteConfig(env.ZId, svcToken, edge); err != nil {

178
controller/edge.go
View File

@ -9,7 +9,6 @@ import (
"github.com/openziti/edge/rest_management_api_client/config"
"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
identity_edge "github.com/openziti/edge/rest_management_api_client/identity"
"github.com/openziti/edge/rest_management_api_client/service_policy"
"github.com/openziti/edge/rest_model"
rest_model_edge "github.com/openziti/edge/rest_model"
sdk_config "github.com/openziti/sdk-golang/ziti/config"
@ -19,183 +18,6 @@ import (
"time"
)
func createServicePolicyBind(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
semantic := rest_model.SemanticAllOf
identityRoles := []string{fmt.Sprintf("@%v", envZId)}
name := fmt.Sprintf("%v-backend", svcToken)
var postureCheckRoles []string
serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
dialBind := rest_model.DialBindBind
svcp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: zrok_edge_sdk.ZrokServiceTags(svcToken),
}
req := &service_policy.CreateServicePolicyParams{
Policy: svcp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
return nil
}
func createNamedBindServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := &rest_model_edge.Tags{SubTags: make(rest_model_edge.SubTags)}
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
identityRoles := []string{"@" + idZId}
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{"@" + svcZId}
dialBind := rest_model.DialBindBind
sp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: sp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
return nil
}
func deleteServicePolicyBind(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
// type=2 == "Bind"
return deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=2", svcToken), edge)
}
func createServicePolicyDial(envZId, svcToken, svcZId string, dialZIds []string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := zrok_edge_sdk.ZrokServiceTags(svcToken)
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
var identityRoles []string
for _, proxyIdentity := range dialZIds {
identityRoles = append(identityRoles, "@"+proxyIdentity)
logrus.Infof("added proxy identity role '%v'", proxyIdentity)
}
name := fmt.Sprintf("%v-dial", svcToken)
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
dialBind := rest_model.DialBindDial
svcp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: svcp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
return nil
}
func createNamedDialServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := &rest_model_edge.Tags{SubTags: make(rest_model_edge.SubTags)}
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
identityRoles := []string{"@" + idZId}
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{"@" + svcZId}
dialBind := rest_model.DialBindDial
sp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: sp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
return nil
}
func deleteServicePolicyDial(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
// type=1 == "Dial"
return deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=1", svcToken), edge)
}
func deleteServicePolicy(envZId, filter string, edge *rest_management_api_client.ZitiEdgeManagement) error {
limit := int64(1)
offset := int64(0)
listReq := &service_policy.ListServicePoliciesParams{
Filter: &filter,
Limit: &limit,
Offset: &offset,
Context: context.Background(),
}
listReq.SetTimeout(30 * time.Second)
listResp, err := edge.ServicePolicy.ListServicePolicies(listReq, nil)
if err != nil {
return err
}
if len(listResp.Payload.Data) == 1 {
spId := *(listResp.Payload.Data[0].ID)
req := &service_policy.DeleteServicePolicyParams{
ID: spId,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.ServicePolicy.DeleteServicePolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("deleted service policy '%v' for environment '%v'", spId, envZId)
} else {
logrus.Infof("did not find a service policy")
}
return nil
}
func createConfig(envZId, svcToken string, authSchemeStr string, authUsers []*model.AuthUser, edge *rest_management_api_client.ZitiEdgeManagement) (cfgID string, err error) {
authScheme, err := model.ParseAuthScheme(authSchemeStr)
if err != nil {

6
controller/gc.go
View File

@ -75,10 +75,10 @@ func gcServices(edge *rest_management_api_client.ZitiEdgeManagement, liveMap map
if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy("gc", *svc.Name, edge); err != nil {
logrus.Errorf("error garbage collecting service edge router policy: %v", err)
}
if err := deleteServicePolicyDial("gc", *svc.Name, edge); err != nil {
if err := zrok_edge_sdk.DeleteServicePolicyDial("gc", *svc.Name, edge); err != nil {
logrus.Errorf("error garbage collecting service dial policy: %v", err)
}
if err := deleteServicePolicyBind("gc", *svc.Name, edge); err != nil {
if err := zrok_edge_sdk.DeleteServicePolicyBind("gc", *svc.Name, edge); err != nil {
logrus.Errorf("error garbage collecting service bind policy: %v", err)
}
if err := deleteConfig("gc", *svc.Name, edge); err != nil {
@ -136,7 +136,7 @@ func gcServicePolicies(edge *rest_management_api_client.ZitiEdgeManagement, live
if _, found := liveMap[spName]; !found {
logrus.Infof("garbage collecting, svcId='%v'", spName)
deleteFilter := fmt.Sprintf("id=\"%v\"", *sp.ID)
if err := deleteServicePolicy("gc", deleteFilter, edge); err != nil {
if err := zrok_edge_sdk.DeleteServicePolicy("gc", deleteFilter, edge); err != nil {
logrus.Errorf("error garbage collecting service policy: %v", err)
}
} else {

2
controller/share_private.go
View File

@ -28,7 +28,7 @@ func (a *privateResourceAllocator) allocate(envZId, svcToken string, params serv
return "", nil, err
}
if err := createServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
if err := zrok_edge_sdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
return "", nil, err
}

4
controller/share_public.go
View File

@ -28,11 +28,11 @@ func (a *publicResourceAllocator) allocate(envZId, svcToken string, frontendZIds
return "", nil, err
}
if err := createServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
if err := zrok_edge_sdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
return "", nil, err
}
if err := createServicePolicyDial(envZId, svcToken, svcZId, frontendZIds, edge); err != nil {
if err := zrok_edge_sdk.CreateServicePolicyDial(envZId, svcToken, svcZId, frontendZIds, edge); err != nil {
return "", nil, err
}

3
controller/unaccess.go
View File

@ -4,6 +4,7 @@ import (
"fmt"
"github.com/go-openapi/runtime/middleware"
"github.com/openziti-test-kitchen/zrok/controller/store"
"github.com/openziti-test-kitchen/zrok/controller/zrok_edge_sdk"
"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/service"
"github.com/pkg/errors"
@ -69,7 +70,7 @@ func (h *unaccessHandler) Handle(params service.UnaccessParams, principal *rest_
return service.NewUnaccessNotFound()
}
if err := deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and tags.zrokFrontendToken=\"%v\" and type=1", svcToken, feToken), edge); err != nil {
if err := zrok_edge_sdk.DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and tags.zrokFrontendToken=\"%v\" and type=1", svcToken, feToken), edge); err != nil {
logrus.Errorf("error removing access to '%v' for '%v': %v", svcToken, envZId, err)
return service.NewUnaccessInternalServerError()
}

4
controller/unshare.go
View File

@ -126,10 +126,10 @@ func (h *unshareHandler) deallocateResources(senv *store.Environment, svcToken,
if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy(senv.ZId, svcToken, edge); err != nil {
return err
}
if err := deleteServicePolicyDial(senv.ZId, svcToken, edge); err != nil {
if err := zrok_edge_sdk.DeleteServicePolicyDial(senv.ZId, svcToken, edge); err != nil {
return err
}
if err := deleteServicePolicyBind(senv.ZId, svcToken, edge); err != nil {
if err := zrok_edge_sdk.DeleteServicePolicyBind(senv.ZId, svcToken, edge); err != nil {
return err
}
if err := deleteConfig(senv.ZId, svcToken, edge); err != nil {

188
controller/zrok_edge_sdk/sp.go Normal file
View File

@ -0,0 +1,188 @@
package zrok_edge_sdk
import (
"context"
"fmt"
"github.com/openziti/edge/rest_management_api_client"
"github.com/openziti/edge/rest_management_api_client/service_policy"
"github.com/openziti/edge/rest_model"
"github.com/sirupsen/logrus"
"time"
)
func CreateServicePolicyBind(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
semantic := rest_model.SemanticAllOf
identityRoles := []string{fmt.Sprintf("@%v", envZId)}
name := fmt.Sprintf("%v-backend", svcToken)
var postureCheckRoles []string
serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
dialBind := rest_model.DialBindBind
svcp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: ZrokServiceTags(svcToken),
}
req := &service_policy.CreateServicePolicyParams{
Policy: svcp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
return nil
}
func CreateNamedBindServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)}
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
identityRoles := []string{"@" + idZId}
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{"@" + svcZId}
dialBind := rest_model.DialBindBind
sp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: sp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
return nil
}
func DeleteServicePolicyBind(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
// type=2 == "Bind"
return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=2", svcToken), edge)
}
func CreateServicePolicyDial(envZId, svcToken, svcZId string, dialZIds []string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := ZrokServiceTags(svcToken)
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
var identityRoles []string
for _, proxyIdentity := range dialZIds {
identityRoles = append(identityRoles, "@"+proxyIdentity)
logrus.Infof("added proxy identity role '%v'", proxyIdentity)
}
name := fmt.Sprintf("%v-dial", svcToken)
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
dialBind := rest_model.DialBindDial
svcp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: svcp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
return nil
}
func CreateNamedDialServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)}
for _, t := range tags {
for k, v := range t.SubTags {
allTags.SubTags[k] = v
}
}
identityRoles := []string{"@" + idZId}
var postureCheckRoles []string
semantic := rest_model.SemanticAllOf
serviceRoles := []string{"@" + svcZId}
dialBind := rest_model.DialBindDial
sp := &rest_model.ServicePolicyCreate{
IdentityRoles: identityRoles,
Name: &name,
PostureCheckRoles: postureCheckRoles,
Semantic: &semantic,
ServiceRoles: serviceRoles,
Type: &dialBind,
Tags: allTags,
}
req := &service_policy.CreateServicePolicyParams{
Policy: sp,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
if err != nil {
return err
}
return nil
}
func DeleteServicePolicyDial(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
// type=1 == "Dial"
return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=1", svcToken), edge)
}
func DeleteServicePolicy(envZId, filter string, edge *rest_management_api_client.ZitiEdgeManagement) error {
limit := int64(1)
offset := int64(0)
listReq := &service_policy.ListServicePoliciesParams{
Filter: &filter,
Limit: &limit,
Offset: &offset,
Context: context.Background(),
}
listReq.SetTimeout(30 * time.Second)
listResp, err := edge.ServicePolicy.ListServicePolicies(listReq, nil)
if err != nil {
return err
}
if len(listResp.Payload.Data) == 1 {
spId := *(listResp.Payload.Data[0].ID)
req := &service_policy.DeleteServicePolicyParams{
ID: spId,
Context: context.Background(),
}
req.SetTimeout(30 * time.Second)
_, err := edge.ServicePolicy.DeleteServicePolicy(req, nil)
if err != nil {
return err
}
logrus.Infof("deleted service policy '%v' for environment '%v'", spId, envZId)
} else {
logrus.Infof("did not find a service policy")
}
return nil
}