From f46a1533a60c0a8628c39ad34658369feef81dbe Mon Sep 17 00:00:00 2001 From: Michael Quigley Date: Wed, 14 Dec 2022 14:04:29 -0500 Subject: [PATCH] service policy (#112) --- controller/bootstrap.go | 4 +- controller/create_identity.go | 3 +- controller/disable.go | 4 +- controller/edge.go | 178 ------------------------------- controller/gc.go | 6 +- controller/share_private.go | 2 +- controller/share_public.go | 4 +- controller/unaccess.go | 3 +- controller/unshare.go | 4 +- controller/zrok_edge_sdk/sp.go | 188 +++++++++++++++++++++++++++++++++ 10 files changed, 204 insertions(+), 192 deletions(-) create mode 100644 controller/zrok_edge_sdk/sp.go diff --git a/controller/bootstrap.go b/controller/bootstrap.go index a5c88cbb..736c9f6f 100644 --- a/controller/bootstrap.go +++ b/controller/bootstrap.go @@ -314,7 +314,7 @@ func assertCtrlMetricsBind(ctrlZId, metricsSvcZId string, edge *rest_management_ } if len(listResp.Payload.Data) != 1 { logrus.Info("creating 'ctrl-metrics-bind' service policy") - if err := createNamedBindServicePolicy("ctrl-metrics-bind", metricsSvcZId, ctrlZId, edge, zrok_edge_sdk.ZrokTags()); err != nil { + if err := zrok_edge_sdk.CreateNamedBindServicePolicy("ctrl-metrics-bind", metricsSvcZId, ctrlZId, edge, zrok_edge_sdk.ZrokTags()); err != nil { return errors.Wrap(err, "error creating 'ctrl-metrics-bind' service policy") } } @@ -338,7 +338,7 @@ func assertFrontendMetricsDial(frontendZId, metricsSvcZId string, edge *rest_man } if len(listResp.Payload.Data) != 1 { logrus.Info("creating 'frontend-metrics-dial' service policy") - if err := createNamedDialServicePolicy("frontend-metrics-dial", metricsSvcZId, frontendZId, edge, zrok_edge_sdk.ZrokTags()); err != nil { + if err := zrok_edge_sdk.CreateNamedDialServicePolicy("frontend-metrics-dial", metricsSvcZId, frontendZId, edge, zrok_edge_sdk.ZrokTags()); err != nil { return errors.Wrap(err, "error creating 'frontend-metrics-dial' service policy") } } diff --git a/controller/create_identity.go b/controller/create_identity.go index 69e3c44c..4e8a69d6 100644 --- a/controller/create_identity.go +++ b/controller/create_identity.go @@ -5,6 +5,7 @@ import ( "encoding/json" "fmt" "github.com/go-openapi/runtime/middleware" + "github.com/openziti-test-kitchen/zrok/controller/zrok_edge_sdk" "github.com/openziti-test-kitchen/zrok/rest_model_zrok" "github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/admin" "github.com/openziti/edge/rest_management_api_client/service" @@ -72,7 +73,7 @@ func (h *createIdentityHandler) Handle(params admin.CreateIdentityParams, princi svcZId := *listSvcResp.Payload.Data[0].ID spName := fmt.Sprintf("%v-%v-dial", name, cfg.Metrics.ServiceName) - if err := createNamedDialServicePolicy(spName, svcZId, zId, edge); err != nil { + if err := zrok_edge_sdk.CreateNamedDialServicePolicy(spName, svcZId, zId, edge); err != nil { logrus.Errorf("error creating named dial service policy '%v': %v", spName, err) return admin.NewCreateIdentityInternalServerError() } diff --git a/controller/disable.go b/controller/disable.go index bea4dc85..02903dd9 100644 --- a/controller/disable.go +++ b/controller/disable.go @@ -90,10 +90,10 @@ func (h *disableHandler) removeServicesForEnvironment(envId int, tx *sqlx.Tx, ed if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy(env.ZId, svcToken, edge); err != nil { logrus.Error(err) } - if err := deleteServicePolicyDial(env.ZId, svcToken, edge); err != nil { + if err := zrok_edge_sdk.DeleteServicePolicyDial(env.ZId, svcToken, edge); err != nil { logrus.Error(err) } - if err := deleteServicePolicyBind(env.ZId, svcToken, edge); err != nil { + if err := zrok_edge_sdk.DeleteServicePolicyBind(env.ZId, svcToken, edge); err != nil { logrus.Error(err) } if err := deleteConfig(env.ZId, svcToken, edge); err != nil { diff --git a/controller/edge.go b/controller/edge.go index 85088c6e..3093ae76 100644 --- a/controller/edge.go +++ b/controller/edge.go @@ -9,7 +9,6 @@ import ( "github.com/openziti/edge/rest_management_api_client/config" "github.com/openziti/edge/rest_management_api_client/edge_router_policy" identity_edge "github.com/openziti/edge/rest_management_api_client/identity" - "github.com/openziti/edge/rest_management_api_client/service_policy" "github.com/openziti/edge/rest_model" rest_model_edge "github.com/openziti/edge/rest_model" sdk_config "github.com/openziti/sdk-golang/ziti/config" @@ -19,183 +18,6 @@ import ( "time" ) -func createServicePolicyBind(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error { - semantic := rest_model.SemanticAllOf - identityRoles := []string{fmt.Sprintf("@%v", envZId)} - name := fmt.Sprintf("%v-backend", svcToken) - var postureCheckRoles []string - serviceRoles := []string{fmt.Sprintf("@%v", svcZId)} - dialBind := rest_model.DialBindBind - svcp := &rest_model.ServicePolicyCreate{ - IdentityRoles: identityRoles, - Name: &name, - PostureCheckRoles: postureCheckRoles, - Semantic: &semantic, - ServiceRoles: serviceRoles, - Type: &dialBind, - Tags: zrok_edge_sdk.ZrokServiceTags(svcToken), - } - req := &service_policy.CreateServicePolicyParams{ - Policy: svcp, - Context: context.Background(), - } - req.SetTimeout(30 * time.Second) - resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil) - if err != nil { - return err - } - logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId) - return nil -} - -func createNamedBindServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error { - allTags := &rest_model_edge.Tags{SubTags: make(rest_model_edge.SubTags)} - for _, t := range tags { - for k, v := range t.SubTags { - allTags.SubTags[k] = v - } - } - identityRoles := []string{"@" + idZId} - var postureCheckRoles []string - semantic := rest_model.SemanticAllOf - serviceRoles := []string{"@" + svcZId} - dialBind := rest_model.DialBindBind - sp := &rest_model.ServicePolicyCreate{ - IdentityRoles: identityRoles, - Name: &name, - PostureCheckRoles: postureCheckRoles, - Semantic: &semantic, - ServiceRoles: serviceRoles, - Type: &dialBind, - Tags: allTags, - } - req := &service_policy.CreateServicePolicyParams{ - Policy: sp, - Context: context.Background(), - } - req.SetTimeout(30 * time.Second) - _, err := edge.ServicePolicy.CreateServicePolicy(req, nil) - if err != nil { - return err - } - return nil -} - -func deleteServicePolicyBind(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error { - // type=2 == "Bind" - return deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=2", svcToken), edge) -} - -func createServicePolicyDial(envZId, svcToken, svcZId string, dialZIds []string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error { - allTags := zrok_edge_sdk.ZrokServiceTags(svcToken) - for _, t := range tags { - for k, v := range t.SubTags { - allTags.SubTags[k] = v - } - } - - var identityRoles []string - for _, proxyIdentity := range dialZIds { - identityRoles = append(identityRoles, "@"+proxyIdentity) - logrus.Infof("added proxy identity role '%v'", proxyIdentity) - } - name := fmt.Sprintf("%v-dial", svcToken) - var postureCheckRoles []string - semantic := rest_model.SemanticAllOf - serviceRoles := []string{fmt.Sprintf("@%v", svcZId)} - dialBind := rest_model.DialBindDial - svcp := &rest_model.ServicePolicyCreate{ - IdentityRoles: identityRoles, - Name: &name, - PostureCheckRoles: postureCheckRoles, - Semantic: &semantic, - ServiceRoles: serviceRoles, - Type: &dialBind, - Tags: allTags, - } - req := &service_policy.CreateServicePolicyParams{ - Policy: svcp, - Context: context.Background(), - } - req.SetTimeout(30 * time.Second) - resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil) - if err != nil { - return err - } - logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId) - return nil -} - -func createNamedDialServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error { - allTags := &rest_model_edge.Tags{SubTags: make(rest_model_edge.SubTags)} - for _, t := range tags { - for k, v := range t.SubTags { - allTags.SubTags[k] = v - } - } - identityRoles := []string{"@" + idZId} - var postureCheckRoles []string - semantic := rest_model.SemanticAllOf - serviceRoles := []string{"@" + svcZId} - dialBind := rest_model.DialBindDial - sp := &rest_model.ServicePolicyCreate{ - IdentityRoles: identityRoles, - Name: &name, - PostureCheckRoles: postureCheckRoles, - Semantic: &semantic, - ServiceRoles: serviceRoles, - Type: &dialBind, - Tags: allTags, - } - req := &service_policy.CreateServicePolicyParams{ - Policy: sp, - Context: context.Background(), - } - req.SetTimeout(30 * time.Second) - _, err := edge.ServicePolicy.CreateServicePolicy(req, nil) - if err != nil { - return err - } - return nil -} - -func deleteServicePolicyDial(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error { - // type=1 == "Dial" - return deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=1", svcToken), edge) -} - -func deleteServicePolicy(envZId, filter string, edge *rest_management_api_client.ZitiEdgeManagement) error { - limit := int64(1) - offset := int64(0) - listReq := &service_policy.ListServicePoliciesParams{ - Filter: &filter, - Limit: &limit, - Offset: &offset, - Context: context.Background(), - } - listReq.SetTimeout(30 * time.Second) - listResp, err := edge.ServicePolicy.ListServicePolicies(listReq, nil) - if err != nil { - return err - } - if len(listResp.Payload.Data) == 1 { - spId := *(listResp.Payload.Data[0].ID) - req := &service_policy.DeleteServicePolicyParams{ - ID: spId, - Context: context.Background(), - } - req.SetTimeout(30 * time.Second) - _, err := edge.ServicePolicy.DeleteServicePolicy(req, nil) - if err != nil { - return err - } - logrus.Infof("deleted service policy '%v' for environment '%v'", spId, envZId) - } else { - logrus.Infof("did not find a service policy") - } - return nil -} - func createConfig(envZId, svcToken string, authSchemeStr string, authUsers []*model.AuthUser, edge *rest_management_api_client.ZitiEdgeManagement) (cfgID string, err error) { authScheme, err := model.ParseAuthScheme(authSchemeStr) if err != nil { diff --git a/controller/gc.go b/controller/gc.go index 5314d930..d48279a2 100644 --- a/controller/gc.go +++ b/controller/gc.go @@ -75,10 +75,10 @@ func gcServices(edge *rest_management_api_client.ZitiEdgeManagement, liveMap map if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy("gc", *svc.Name, edge); err != nil { logrus.Errorf("error garbage collecting service edge router policy: %v", err) } - if err := deleteServicePolicyDial("gc", *svc.Name, edge); err != nil { + if err := zrok_edge_sdk.DeleteServicePolicyDial("gc", *svc.Name, edge); err != nil { logrus.Errorf("error garbage collecting service dial policy: %v", err) } - if err := deleteServicePolicyBind("gc", *svc.Name, edge); err != nil { + if err := zrok_edge_sdk.DeleteServicePolicyBind("gc", *svc.Name, edge); err != nil { logrus.Errorf("error garbage collecting service bind policy: %v", err) } if err := deleteConfig("gc", *svc.Name, edge); err != nil { @@ -136,7 +136,7 @@ func gcServicePolicies(edge *rest_management_api_client.ZitiEdgeManagement, live if _, found := liveMap[spName]; !found { logrus.Infof("garbage collecting, svcId='%v'", spName) deleteFilter := fmt.Sprintf("id=\"%v\"", *sp.ID) - if err := deleteServicePolicy("gc", deleteFilter, edge); err != nil { + if err := zrok_edge_sdk.DeleteServicePolicy("gc", deleteFilter, edge); err != nil { logrus.Errorf("error garbage collecting service policy: %v", err) } } else { diff --git a/controller/share_private.go b/controller/share_private.go index 10e6e416..80fbb15c 100644 --- a/controller/share_private.go +++ b/controller/share_private.go @@ -28,7 +28,7 @@ func (a *privateResourceAllocator) allocate(envZId, svcToken string, params serv return "", nil, err } - if err := createServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil { + if err := zrok_edge_sdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil { return "", nil, err } diff --git a/controller/share_public.go b/controller/share_public.go index 2626a159..d1cef2e3 100644 --- a/controller/share_public.go +++ b/controller/share_public.go @@ -28,11 +28,11 @@ func (a *publicResourceAllocator) allocate(envZId, svcToken string, frontendZIds return "", nil, err } - if err := createServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil { + if err := zrok_edge_sdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil { return "", nil, err } - if err := createServicePolicyDial(envZId, svcToken, svcZId, frontendZIds, edge); err != nil { + if err := zrok_edge_sdk.CreateServicePolicyDial(envZId, svcToken, svcZId, frontendZIds, edge); err != nil { return "", nil, err } diff --git a/controller/unaccess.go b/controller/unaccess.go index f9fc2f8e..c7059358 100644 --- a/controller/unaccess.go +++ b/controller/unaccess.go @@ -4,6 +4,7 @@ import ( "fmt" "github.com/go-openapi/runtime/middleware" "github.com/openziti-test-kitchen/zrok/controller/store" + "github.com/openziti-test-kitchen/zrok/controller/zrok_edge_sdk" "github.com/openziti-test-kitchen/zrok/rest_model_zrok" "github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/service" "github.com/pkg/errors" @@ -69,7 +70,7 @@ func (h *unaccessHandler) Handle(params service.UnaccessParams, principal *rest_ return service.NewUnaccessNotFound() } - if err := deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and tags.zrokFrontendToken=\"%v\" and type=1", svcToken, feToken), edge); err != nil { + if err := zrok_edge_sdk.DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and tags.zrokFrontendToken=\"%v\" and type=1", svcToken, feToken), edge); err != nil { logrus.Errorf("error removing access to '%v' for '%v': %v", svcToken, envZId, err) return service.NewUnaccessInternalServerError() } diff --git a/controller/unshare.go b/controller/unshare.go index 41a9a228..031f66b5 100644 --- a/controller/unshare.go +++ b/controller/unshare.go @@ -126,10 +126,10 @@ func (h *unshareHandler) deallocateResources(senv *store.Environment, svcToken, if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy(senv.ZId, svcToken, edge); err != nil { return err } - if err := deleteServicePolicyDial(senv.ZId, svcToken, edge); err != nil { + if err := zrok_edge_sdk.DeleteServicePolicyDial(senv.ZId, svcToken, edge); err != nil { return err } - if err := deleteServicePolicyBind(senv.ZId, svcToken, edge); err != nil { + if err := zrok_edge_sdk.DeleteServicePolicyBind(senv.ZId, svcToken, edge); err != nil { return err } if err := deleteConfig(senv.ZId, svcToken, edge); err != nil { diff --git a/controller/zrok_edge_sdk/sp.go b/controller/zrok_edge_sdk/sp.go new file mode 100644 index 00000000..b76d8cbe --- /dev/null +++ b/controller/zrok_edge_sdk/sp.go @@ -0,0 +1,188 @@ +package zrok_edge_sdk + +import ( + "context" + "fmt" + "github.com/openziti/edge/rest_management_api_client" + "github.com/openziti/edge/rest_management_api_client/service_policy" + "github.com/openziti/edge/rest_model" + "github.com/sirupsen/logrus" + "time" +) + +func CreateServicePolicyBind(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error { + semantic := rest_model.SemanticAllOf + identityRoles := []string{fmt.Sprintf("@%v", envZId)} + name := fmt.Sprintf("%v-backend", svcToken) + var postureCheckRoles []string + serviceRoles := []string{fmt.Sprintf("@%v", svcZId)} + dialBind := rest_model.DialBindBind + svcp := &rest_model.ServicePolicyCreate{ + IdentityRoles: identityRoles, + Name: &name, + PostureCheckRoles: postureCheckRoles, + Semantic: &semantic, + ServiceRoles: serviceRoles, + Type: &dialBind, + Tags: ZrokServiceTags(svcToken), + } + req := &service_policy.CreateServicePolicyParams{ + Policy: svcp, + Context: context.Background(), + } + req.SetTimeout(30 * time.Second) + resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil) + if err != nil { + return err + } + logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId) + return nil +} + +func CreateNamedBindServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error { + allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)} + for _, t := range tags { + for k, v := range t.SubTags { + allTags.SubTags[k] = v + } + } + identityRoles := []string{"@" + idZId} + var postureCheckRoles []string + semantic := rest_model.SemanticAllOf + serviceRoles := []string{"@" + svcZId} + dialBind := rest_model.DialBindBind + sp := &rest_model.ServicePolicyCreate{ + IdentityRoles: identityRoles, + Name: &name, + PostureCheckRoles: postureCheckRoles, + Semantic: &semantic, + ServiceRoles: serviceRoles, + Type: &dialBind, + Tags: allTags, + } + req := &service_policy.CreateServicePolicyParams{ + Policy: sp, + Context: context.Background(), + } + req.SetTimeout(30 * time.Second) + _, err := edge.ServicePolicy.CreateServicePolicy(req, nil) + if err != nil { + return err + } + return nil +} + +func DeleteServicePolicyBind(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error { + // type=2 == "Bind" + return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=2", svcToken), edge) +} + +func CreateServicePolicyDial(envZId, svcToken, svcZId string, dialZIds []string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error { + allTags := ZrokServiceTags(svcToken) + for _, t := range tags { + for k, v := range t.SubTags { + allTags.SubTags[k] = v + } + } + + var identityRoles []string + for _, proxyIdentity := range dialZIds { + identityRoles = append(identityRoles, "@"+proxyIdentity) + logrus.Infof("added proxy identity role '%v'", proxyIdentity) + } + name := fmt.Sprintf("%v-dial", svcToken) + var postureCheckRoles []string + semantic := rest_model.SemanticAllOf + serviceRoles := []string{fmt.Sprintf("@%v", svcZId)} + dialBind := rest_model.DialBindDial + svcp := &rest_model.ServicePolicyCreate{ + IdentityRoles: identityRoles, + Name: &name, + PostureCheckRoles: postureCheckRoles, + Semantic: &semantic, + ServiceRoles: serviceRoles, + Type: &dialBind, + Tags: allTags, + } + req := &service_policy.CreateServicePolicyParams{ + Policy: svcp, + Context: context.Background(), + } + req.SetTimeout(30 * time.Second) + resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil) + if err != nil { + return err + } + logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId) + return nil +} + +func CreateNamedDialServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error { + allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)} + for _, t := range tags { + for k, v := range t.SubTags { + allTags.SubTags[k] = v + } + } + identityRoles := []string{"@" + idZId} + var postureCheckRoles []string + semantic := rest_model.SemanticAllOf + serviceRoles := []string{"@" + svcZId} + dialBind := rest_model.DialBindDial + sp := &rest_model.ServicePolicyCreate{ + IdentityRoles: identityRoles, + Name: &name, + PostureCheckRoles: postureCheckRoles, + Semantic: &semantic, + ServiceRoles: serviceRoles, + Type: &dialBind, + Tags: allTags, + } + req := &service_policy.CreateServicePolicyParams{ + Policy: sp, + Context: context.Background(), + } + req.SetTimeout(30 * time.Second) + _, err := edge.ServicePolicy.CreateServicePolicy(req, nil) + if err != nil { + return err + } + return nil +} + +func DeleteServicePolicyDial(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error { + // type=1 == "Dial" + return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=1", svcToken), edge) +} + +func DeleteServicePolicy(envZId, filter string, edge *rest_management_api_client.ZitiEdgeManagement) error { + limit := int64(1) + offset := int64(0) + listReq := &service_policy.ListServicePoliciesParams{ + Filter: &filter, + Limit: &limit, + Offset: &offset, + Context: context.Background(), + } + listReq.SetTimeout(30 * time.Second) + listResp, err := edge.ServicePolicy.ListServicePolicies(listReq, nil) + if err != nil { + return err + } + if len(listResp.Payload.Data) == 1 { + spId := *(listResp.Payload.Data[0].ID) + req := &service_policy.DeleteServicePolicyParams{ + ID: spId, + Context: context.Background(), + } + req.SetTimeout(30 * time.Second) + _, err := edge.ServicePolicy.DeleteServicePolicy(req, nil) + if err != nil { + return err + } + logrus.Infof("deleted service policy '%v' for environment '%v'", spId, envZId) + } else { + logrus.Infof("did not find a service policy") + } + return nil +}