service policy (#112)

controller/bootstrap.go

@@ -314,7 +314,7 @@ func assertCtrlMetricsBind(ctrlZId, metricsSvcZId string, edge *rest_management_
 	}
 	if len(listResp.Payload.Data) != 1 {
 		logrus.Info("creating 'ctrl-metrics-bind' service policy")
-		if err := createNamedBindServicePolicy("ctrl-metrics-bind", metricsSvcZId, ctrlZId, edge, zrok_edge_sdk.ZrokTags()); err != nil {
+		if err := zrok_edge_sdk.CreateNamedBindServicePolicy("ctrl-metrics-bind", metricsSvcZId, ctrlZId, edge, zrok_edge_sdk.ZrokTags()); err != nil {
 			return errors.Wrap(err, "error creating 'ctrl-metrics-bind' service policy")
 		}
 	}
@@ -338,7 +338,7 @@ func assertFrontendMetricsDial(frontendZId, metricsSvcZId string, edge *rest_man
 	}
 	if len(listResp.Payload.Data) != 1 {
 		logrus.Info("creating 'frontend-metrics-dial' service policy")
-		if err := createNamedDialServicePolicy("frontend-metrics-dial", metricsSvcZId, frontendZId, edge, zrok_edge_sdk.ZrokTags()); err != nil {
+		if err := zrok_edge_sdk.CreateNamedDialServicePolicy("frontend-metrics-dial", metricsSvcZId, frontendZId, edge, zrok_edge_sdk.ZrokTags()); err != nil {
 			return errors.Wrap(err, "error creating 'frontend-metrics-dial' service policy")
 		}
 	}

controller/create_identity.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti-test-kitchen/zrok/controller/zrok_edge_sdk"
 	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/admin"
 	"github.com/openziti/edge/rest_management_api_client/service"
@@ -72,7 +73,7 @@ func (h *createIdentityHandler) Handle(params admin.CreateIdentityParams, princi
 	svcZId := *listSvcResp.Payload.Data[0].ID
 
 	spName := fmt.Sprintf("%v-%v-dial", name, cfg.Metrics.ServiceName)
-	if err := createNamedDialServicePolicy(spName, svcZId, zId, edge); err != nil {
+	if err := zrok_edge_sdk.CreateNamedDialServicePolicy(spName, svcZId, zId, edge); err != nil {
 		logrus.Errorf("error creating named dial service policy '%v': %v", spName, err)
 		return admin.NewCreateIdentityInternalServerError()
 	}

controller/disable.go

@@ -90,10 +90,10 @@ func (h *disableHandler) removeServicesForEnvironment(envId int, tx *sqlx.Tx, ed
 		if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy(env.ZId, svcToken, edge); err != nil {
 			logrus.Error(err)
 		}
-		if err := deleteServicePolicyDial(env.ZId, svcToken, edge); err != nil {
+		if err := zrok_edge_sdk.DeleteServicePolicyDial(env.ZId, svcToken, edge); err != nil {
 			logrus.Error(err)
 		}
-		if err := deleteServicePolicyBind(env.ZId, svcToken, edge); err != nil {
+		if err := zrok_edge_sdk.DeleteServicePolicyBind(env.ZId, svcToken, edge); err != nil {
 			logrus.Error(err)
 		}
 		if err := deleteConfig(env.ZId, svcToken, edge); err != nil {

controller/edge.go

@@ -9,7 +9,6 @@ import (
 	"github.com/openziti/edge/rest_management_api_client/config"
 	"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
 	identity_edge "github.com/openziti/edge/rest_management_api_client/identity"
-	"github.com/openziti/edge/rest_management_api_client/service_policy"
 	"github.com/openziti/edge/rest_model"
 	rest_model_edge "github.com/openziti/edge/rest_model"
 	sdk_config "github.com/openziti/sdk-golang/ziti/config"
@@ -19,183 +18,6 @@ import (
 	"time"
 )
 
-func createServicePolicyBind(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	semantic := rest_model.SemanticAllOf
-	identityRoles := []string{fmt.Sprintf("@%v", envZId)}
-	name := fmt.Sprintf("%v-backend", svcToken)
-	var postureCheckRoles []string
-	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
-	dialBind := rest_model.DialBindBind
-	svcp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              zrok_edge_sdk.ZrokServiceTags(svcToken),
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  svcp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
-	return nil
-}
-
-func createNamedBindServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
-	allTags := &rest_model_edge.Tags{SubTags: make(rest_model_edge.SubTags)}
-	for _, t := range tags {
-		for k, v := range t.SubTags {
-			allTags.SubTags[k] = v
-		}
-	}
-	identityRoles := []string{"@" + idZId}
-	var postureCheckRoles []string
-	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{"@" + svcZId}
-	dialBind := rest_model.DialBindBind
-	sp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              allTags,
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  sp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func deleteServicePolicyBind(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	// type=2 == "Bind"
-	return deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=2", svcToken), edge)
-}
-
-func createServicePolicyDial(envZId, svcToken, svcZId string, dialZIds []string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
-	allTags := zrok_edge_sdk.ZrokServiceTags(svcToken)
-	for _, t := range tags {
-		for k, v := range t.SubTags {
-			allTags.SubTags[k] = v
-		}
-	}
-
-	var identityRoles []string
-	for _, proxyIdentity := range dialZIds {
-		identityRoles = append(identityRoles, "@"+proxyIdentity)
-		logrus.Infof("added proxy identity role '%v'", proxyIdentity)
-	}
-	name := fmt.Sprintf("%v-dial", svcToken)
-	var postureCheckRoles []string
-	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
-	dialBind := rest_model.DialBindDial
-	svcp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              allTags,
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  svcp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
-	return nil
-}
-
-func createNamedDialServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
-	allTags := &rest_model_edge.Tags{SubTags: make(rest_model_edge.SubTags)}
-	for _, t := range tags {
-		for k, v := range t.SubTags {
-			allTags.SubTags[k] = v
-		}
-	}
-	identityRoles := []string{"@" + idZId}
-	var postureCheckRoles []string
-	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{"@" + svcZId}
-	dialBind := rest_model.DialBindDial
-	sp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              allTags,
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  sp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func deleteServicePolicyDial(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	// type=1 == "Dial"
-	return deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=1", svcToken), edge)
-}
-
-func deleteServicePolicy(envZId, filter string, edge *rest_management_api_client.ZitiEdgeManagement) error {
-	limit := int64(1)
-	offset := int64(0)
-	listReq := &service_policy.ListServicePoliciesParams{
-		Filter:  &filter,
-		Limit:   &limit,
-		Offset:  &offset,
-		Context: context.Background(),
-	}
-	listReq.SetTimeout(30 * time.Second)
-	listResp, err := edge.ServicePolicy.ListServicePolicies(listReq, nil)
-	if err != nil {
-		return err
-	}
-	if len(listResp.Payload.Data) == 1 {
-		spId := *(listResp.Payload.Data[0].ID)
-		req := &service_policy.DeleteServicePolicyParams{
-			ID:      spId,
-			Context: context.Background(),
-		}
-		req.SetTimeout(30 * time.Second)
-		_, err := edge.ServicePolicy.DeleteServicePolicy(req, nil)
-		if err != nil {
-			return err
-		}
-		logrus.Infof("deleted service policy '%v' for environment '%v'", spId, envZId)
-	} else {
-		logrus.Infof("did not find a service policy")
-	}
-	return nil
-}
-
 func createConfig(envZId, svcToken string, authSchemeStr string, authUsers []*model.AuthUser, edge *rest_management_api_client.ZitiEdgeManagement) (cfgID string, err error) {
 	authScheme, err := model.ParseAuthScheme(authSchemeStr)
 	if err != nil {

controller/gc.go

@@ -75,10 +75,10 @@ func gcServices(edge *rest_management_api_client.ZitiEdgeManagement, liveMap map
 				if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy("gc", *svc.Name, edge); err != nil {
 					logrus.Errorf("error garbage collecting service edge router policy: %v", err)
 				}
-				if err := deleteServicePolicyDial("gc", *svc.Name, edge); err != nil {
+				if err := zrok_edge_sdk.DeleteServicePolicyDial("gc", *svc.Name, edge); err != nil {
 					logrus.Errorf("error garbage collecting service dial policy: %v", err)
 				}
-				if err := deleteServicePolicyBind("gc", *svc.Name, edge); err != nil {
+				if err := zrok_edge_sdk.DeleteServicePolicyBind("gc", *svc.Name, edge); err != nil {
 					logrus.Errorf("error garbage collecting service bind policy: %v", err)
 				}
 				if err := deleteConfig("gc", *svc.Name, edge); err != nil {
@@ -136,7 +136,7 @@ func gcServicePolicies(edge *rest_management_api_client.ZitiEdgeManagement, live
 			if _, found := liveMap[spName]; !found {
 				logrus.Infof("garbage collecting, svcId='%v'", spName)
 				deleteFilter := fmt.Sprintf("id=\"%v\"", *sp.ID)
-				if err := deleteServicePolicy("gc", deleteFilter, edge); err != nil {
+				if err := zrok_edge_sdk.DeleteServicePolicy("gc", deleteFilter, edge); err != nil {
 					logrus.Errorf("error garbage collecting service policy: %v", err)
 				}
 			} else {

controller/share_private.go

@@ -28,7 +28,7 @@ func (a *privateResourceAllocator) allocate(envZId, svcToken string, params serv
 		return "", nil, err
 	}
 
-	if err := createServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
+	if err := zrok_edge_sdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
 		return "", nil, err
 	}
 

controller/share_public.go

@@ -28,11 +28,11 @@ func (a *publicResourceAllocator) allocate(envZId, svcToken string, frontendZIds
 		return "", nil, err
 	}
 
-	if err := createServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
+	if err := zrok_edge_sdk.CreateServicePolicyBind(envZId, svcToken, svcZId, edge); err != nil {
 		return "", nil, err
 	}
 
-	if err := createServicePolicyDial(envZId, svcToken, svcZId, frontendZIds, edge); err != nil {
+	if err := zrok_edge_sdk.CreateServicePolicyDial(envZId, svcToken, svcZId, frontendZIds, edge); err != nil {
 		return "", nil, err
 	}
 

controller/unaccess.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"github.com/go-openapi/runtime/middleware"
 	"github.com/openziti-test-kitchen/zrok/controller/store"
+	"github.com/openziti-test-kitchen/zrok/controller/zrok_edge_sdk"
 	"github.com/openziti-test-kitchen/zrok/rest_model_zrok"
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/service"
 	"github.com/pkg/errors"
@@ -69,7 +70,7 @@ func (h *unaccessHandler) Handle(params service.UnaccessParams, principal *rest_
 		return service.NewUnaccessNotFound()
 	}
 
-	if err := deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and tags.zrokFrontendToken=\"%v\" and type=1", svcToken, feToken), edge); err != nil {
+	if err := zrok_edge_sdk.DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and tags.zrokFrontendToken=\"%v\" and type=1", svcToken, feToken), edge); err != nil {
 		logrus.Errorf("error removing access to '%v' for '%v': %v", svcToken, envZId, err)
 		return service.NewUnaccessInternalServerError()
 	}

controller/unshare.go

@@ -126,10 +126,10 @@ func (h *unshareHandler) deallocateResources(senv *store.Environment, svcToken,
 	if err := zrok_edge_sdk.DeleteServiceEdgeRouterPolicy(senv.ZId, svcToken, edge); err != nil {
 		return err
 	}
-	if err := deleteServicePolicyDial(senv.ZId, svcToken, edge); err != nil {
+	if err := zrok_edge_sdk.DeleteServicePolicyDial(senv.ZId, svcToken, edge); err != nil {
 		return err
 	}
-	if err := deleteServicePolicyBind(senv.ZId, svcToken, edge); err != nil {
+	if err := zrok_edge_sdk.DeleteServicePolicyBind(senv.ZId, svcToken, edge); err != nil {
 		return err
 	}
 	if err := deleteConfig(senv.ZId, svcToken, edge); err != nil {

controller/zrok_edge_sdk/sp.go

@@ -0,0 +1,188 @@
+package zrok_edge_sdk
+
+import (
+	"context"
+	"fmt"
+	"github.com/openziti/edge/rest_management_api_client"
+	"github.com/openziti/edge/rest_management_api_client/service_policy"
+	"github.com/openziti/edge/rest_model"
+	"github.com/sirupsen/logrus"
+	"time"
+)
+
+func CreateServicePolicyBind(envZId, svcToken, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	semantic := rest_model.SemanticAllOf
+	identityRoles := []string{fmt.Sprintf("@%v", envZId)}
+	name := fmt.Sprintf("%v-backend", svcToken)
+	var postureCheckRoles []string
+	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
+	dialBind := rest_model.DialBindBind
+	svcp := &rest_model.ServicePolicyCreate{
+		IdentityRoles:     identityRoles,
+		Name:              &name,
+		PostureCheckRoles: postureCheckRoles,
+		Semantic:          &semantic,
+		ServiceRoles:      serviceRoles,
+		Type:              &dialBind,
+		Tags:              ZrokServiceTags(svcToken),
+	}
+	req := &service_policy.CreateServicePolicyParams{
+		Policy:  svcp,
+		Context: context.Background(),
+	}
+	req.SetTimeout(30 * time.Second)
+	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
+	return nil
+}
+
+func CreateNamedBindServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
+	allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)}
+	for _, t := range tags {
+		for k, v := range t.SubTags {
+			allTags.SubTags[k] = v
+		}
+	}
+	identityRoles := []string{"@" + idZId}
+	var postureCheckRoles []string
+	semantic := rest_model.SemanticAllOf
+	serviceRoles := []string{"@" + svcZId}
+	dialBind := rest_model.DialBindBind
+	sp := &rest_model.ServicePolicyCreate{
+		IdentityRoles:     identityRoles,
+		Name:              &name,
+		PostureCheckRoles: postureCheckRoles,
+		Semantic:          &semantic,
+		ServiceRoles:      serviceRoles,
+		Type:              &dialBind,
+		Tags:              allTags,
+	}
+	req := &service_policy.CreateServicePolicyParams{
+		Policy:  sp,
+		Context: context.Background(),
+	}
+	req.SetTimeout(30 * time.Second)
+	_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func DeleteServicePolicyBind(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	// type=2 == "Bind"
+	return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=2", svcToken), edge)
+}
+
+func CreateServicePolicyDial(envZId, svcToken, svcZId string, dialZIds []string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
+	allTags := ZrokServiceTags(svcToken)
+	for _, t := range tags {
+		for k, v := range t.SubTags {
+			allTags.SubTags[k] = v
+		}
+	}
+
+	var identityRoles []string
+	for _, proxyIdentity := range dialZIds {
+		identityRoles = append(identityRoles, "@"+proxyIdentity)
+		logrus.Infof("added proxy identity role '%v'", proxyIdentity)
+	}
+	name := fmt.Sprintf("%v-dial", svcToken)
+	var postureCheckRoles []string
+	semantic := rest_model.SemanticAllOf
+	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
+	dialBind := rest_model.DialBindDial
+	svcp := &rest_model.ServicePolicyCreate{
+		IdentityRoles:     identityRoles,
+		Name:              &name,
+		PostureCheckRoles: postureCheckRoles,
+		Semantic:          &semantic,
+		ServiceRoles:      serviceRoles,
+		Type:              &dialBind,
+		Tags:              allTags,
+	}
+	req := &service_policy.CreateServicePolicyParams{
+		Policy:  svcp,
+		Context: context.Background(),
+	}
+	req.SetTimeout(30 * time.Second)
+	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
+	return nil
+}
+
+func CreateNamedDialServicePolicy(name, svcZId, idZId string, edge *rest_management_api_client.ZitiEdgeManagement, tags ...*rest_model.Tags) error {
+	allTags := &rest_model.Tags{SubTags: make(rest_model.SubTags)}
+	for _, t := range tags {
+		for k, v := range t.SubTags {
+			allTags.SubTags[k] = v
+		}
+	}
+	identityRoles := []string{"@" + idZId}
+	var postureCheckRoles []string
+	semantic := rest_model.SemanticAllOf
+	serviceRoles := []string{"@" + svcZId}
+	dialBind := rest_model.DialBindDial
+	sp := &rest_model.ServicePolicyCreate{
+		IdentityRoles:     identityRoles,
+		Name:              &name,
+		PostureCheckRoles: postureCheckRoles,
+		Semantic:          &semantic,
+		ServiceRoles:      serviceRoles,
+		Type:              &dialBind,
+		Tags:              allTags,
+	}
+	req := &service_policy.CreateServicePolicyParams{
+		Policy:  sp,
+		Context: context.Background(),
+	}
+	req.SetTimeout(30 * time.Second)
+	_, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func DeleteServicePolicyDial(envZId, svcToken string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	// type=1 == "Dial"
+	return DeleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceToken=\"%v\" and type=1", svcToken), edge)
+}
+
+func DeleteServicePolicy(envZId, filter string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	limit := int64(1)
+	offset := int64(0)
+	listReq := &service_policy.ListServicePoliciesParams{
+		Filter:  &filter,
+		Limit:   &limit,
+		Offset:  &offset,
+		Context: context.Background(),
+	}
+	listReq.SetTimeout(30 * time.Second)
+	listResp, err := edge.ServicePolicy.ListServicePolicies(listReq, nil)
+	if err != nil {
+		return err
+	}
+	if len(listResp.Payload.Data) == 1 {
+		spId := *(listResp.Payload.Data[0].ID)
+		req := &service_policy.DeleteServicePolicyParams{
+			ID:      spId,
+			Context: context.Background(),
+		}
+		req.SetTimeout(30 * time.Second)
+		_, err := edge.ServicePolicy.DeleteServicePolicy(req, nil)
+		if err != nil {
+			return err
+		}
+		logrus.Infof("deleted service policy '%v' for environment '%v'", spId, envZId)
+	} else {
+		logrus.Infof("did not find a service policy")
+	}
+	return nil
+}