CICD, Identity and Enrollment

Tunneler Apps Ziti Tunnel
1

Hi, i would like to use a Ziti Network in my CICD Pipeline. So i create a Container with Ziti Tunneler. But what's with the Identitiy. I tried some ways:

  1. I copy the identity File from /opt/openziti/etc/identities but in the config there is not loaded the controller Url and loaded=false
  2. I add the Admin Credentials and i create a Idenitiy during the Pipeline is running, but then i have a lot of Identities
  3. I saved the Container with the Identitiy inside, but then i have a Container accessable with the Identity.

Perhaps, you have an Idea or whats the best Solution for that?
How can i use Ziti Network in the Pipeline without storing Admin Credentials?
Thanks for Idea shareing!
Robin

2

@Robin welcome to the OpenZiti discourse!

we do internally in our CI jobs (github) to run webhooks over Ziti Network. we enroll an identity and create a secret with the content of the identity JSON file.

3

To build on @ekoby's reply, once you have the identity stored as a secret in the CI engine, echo it to a file and then run ziti-edge-tunnel run -i /path/to/the/file.json but it will depend on your CI stack and whether or not you can run sudo and make a tun. Hopefully that is allowed, it's mandatory if you want to intercept traffic.

Here's a GitHub action that you can look at. I have a ziti service that let's me contact my controller as a test example at mgmt.ziti.

name: Dial via ZET

on:
  workflow_dispatch:

jobs:
  dial-ziti-service:
    runs-on: ubuntu-latest
    env:
      ZITI_IDENTITY_JSON: ${{ secrets.ZITI_IDENTITY_JSON }}
    steps:
      - name: Install dependencies
        run: |
          sudo apt-get update && \
          sudo apt-get install -y unzip curl jq

      - name: Download Ziti Edge Tunnel
        run: |
          curl -sL https://github.com/openziti/ziti-tunnel-sdk-c/releases/latest/download/ziti-edge-tunnel-Linux_x86_64.zip \
            -o zet.zip && \
          unzip zet.zip && chmod +x ziti-edge-tunnel

      - name: Write identity file
        run: |
          echo "$ZITI_IDENTITY_JSON" > id.json

      - name: Run ZET and dial
        run: |
          sudo ./ziti-edge-tunnel run -i id.json &
          sleep 5
          timeout 10s curl -sk https://mgmt.ziti:8441 || true
4

Thanks a lot for your answer. I tried to run the edge tunnel in "run"-Mode, but it is not allowed to use /dev/net/tun in our gitlab runners. So i try "run-host", but then i can not resolve the intercepted Names, because the tunneler doesn't provide the proxy with dns namesever. Run-Host isn't the right way i think. Any Idea what can i do?

5

Sounds like you'll probably have to rely on using the ziti-prox-c binary. This is a small example app the ziti-sdk-c project provides with releases. Releases · openziti/ziti-sdk-c · GitHub

This will operate by starting a locally bound socket on whatever port you choose, acting like a local forward proxy. Have a try with that.

6

What are you trying to do over Ziti Network?

Depending on your needs Python SDK app might be something easier to set up.

7

Thanks a lot. Python SDK is the Solution! Locally it works fine. We have to install the Certifactes to solve the TLS Issues. We do the same in the Pipeline. Before we do:
print("Start")
ztx = openziti.load('./ziti_id.json')
print("Identity loaded")
we check if the controller available with a simple curl execution. And it is available.
But "Print Identity loaded" is never reached. No error occured but it is running and running a lot of time. Locally it's fine. Is there a way to get an error or another way to debug openziti.load? Perhaps Proxy is ignored? Python SDK is using the C LIbrary. Can we configure the C Library to use the Proxy?

8

is Ziti controller available only via proxy? that could be the issue.
sounds like proxy setting is not propagated to the underlying transport. (added an issue)

Do you set an environment variable(http_proxy)?

you can also set ZITI_LOG envvar to get ziti library logs -- 1 - ERROR, 2 - WARN, 3 - INFO, and so forth

9

Thanks a lot for creating the Issue. This was really the Issue, i am very sure: CONTROLLER_UNAVAILABLE(connection timed out)

We set http_proxy, https_proxy and also same in uppercase.