Thank you so much for the video and test commands that you're running. That really does help tremendously.
First Tip
I see in your commands you're running docker-compose down. That won't delete your volume, nor your docker networks. If you want to 'start fresh and clean' - you must be running a docker-compose down -v. If you just want to 'stop things', you'd use 'docker-compse down' but to clean house - you gotta add -v on there. I would really recommend when you try to reproduce a problem you start real clean and use docker-compose down -v.
As @gooseleggs writes, you're using ziti-tunnel in proxy mode. Proxy mode does _not_ "intercept". You can use it to test that ziti is configured properly but you need to understand that it will not setup intercepts. I highly, highly recommend you stick to using your ZDE for Mac if you're making sure your 'intercepts' work.
What your'e doing with ziti-tunnel has a couple of problems from my perspective.
1.) using ziti-tunnel at all
The first problem is that you've found and used 'ziti-tunnel'. This was our first linux tunneling app for the command line and we've been trying to replace ziti-tunnel with ziti-edge-tunnel. I know we still have places in our doc or in our old videos that refer to ziti-tunnel which is - unfortunate, but that's the reality of the situation at this time. I'd really prefer to see you not use ziti-tunnel if possible. It's just one fewer piece in the puzzle to worry about.
2.) ziti-tunnel in proxy mode
As @gooseleggs points out - proxy mode means that the tunnel will not intercept and instead it works as a forward proxy. It will listen on the underlay at the port you tell it to (2000 in your case) which is why curl localhost:2000 works, but the intercept doesn't.
You are then throwing another variable into the equation by using curlz which works differently than the other proxy, differently than tproxy, and differently than the python sample does. I'd ask you to stop using that for this issue and make another post about curlz if you want to understand that. I'm going to take curlz out of my response based on that.
Addressing your methodology
Your text file has comments in it. That's really helpful for me to understand what you're doing. I took your comments and convert them into my way of thinking abuot this problem. Here is how I edited your notes... Each heading below will correspond to your notes
setup docker containers (note the addition of -v and -f to specify the file)
-
I chose to use simplified-docker-compose.yml as my base and I modified it. You can get it by downloading it from my gist or using wget like:
wget https://gist.githubusercontent.com/dovholuknf/d28be2ec890ff247bd3118a56daa3c80/raw/fdaacbd3c3ab2e507848053a3163f9414c649da7/simplified-docker-compose-with-httpbin.yaml
You can see that it basically just adds these lines to the file:
httpbin:
image: "kennethreitz/httpbin"
networks:
zitiblue:
zitired:
volumes:
- ziti-fs:/openziti
-
Once downloaded, fire up that docker-compose file using this command and you'll have a full, simple env with httpbin in it
docker-compose -f simplified-docker-compose-with-httpbin.yaml down -v
docker-compose -f simplified-docker-compose-with-httpbin.yaml up
from local machine curl to make sure controller is running (not in container)
-
curl -k https://ziti-edge-controller:1280
configure ziti with host and intercept
-
What you have is great but it needs one small tweak to work with the simplified example. You need to change service-policy httpbin-bind-policy Bind from using ziti-private-blue to ziti-edge-router.
ziti edge create service-policy httpbin-bind-policy Bind --identity-roles '@ziti-edge-router' --service-roles '#private-httpbin-services'
test that the host works AND test that the service works
-
First make an identity.
ziti edge create identity user dockertest -a httpbin-clients -o dockertest.jwt
-
Copy it from the controller to your local machine. (exit from the docker container first. (perhaps obvious) Put the file wherever you want. I use /mnt/v/temp here.
docker cp docker_ziti-controller_1:/openziti/dockertest.jwt /mnt/v/temp/
-
Then enroll it in your ZDE (for mac)
Test the tunneler from OUTSIDE the container
- This should work fine now since you enrolled your identity in your ZDEM/ZDEW
curl http://httpbin.ziti:2000
test the Python script
That's it. That's all you should be doing here to make sure things are working. Everytime you use docker-compose and down -v, just make sure you remove the identity from your local ZDEM/ZDEW. OR, just never use -d and you don't have to worry about that. using -d deltes the PKI for your environment, that will force you to make a new identity.
Recap
Add httpbin to your docker-compose file, it just makes things easier. Don't use too many components. Test using the ZDE for Mac/Windows. If it works in ZDE, the python example should work fine. Don't bring curlz into this - it'll just add confusion.
