I was trying to use this: Containers | OpenZiti
but probably not understanding how I'm supposed to wire this up.
I exec'ed into the controller and ran these commands:
(base) nyck33@nyck33-tt:/media/nyck33/1TB-backup/ziti/quickstart/Docker$ docker exec -it 01ee8eb6260d /bin/bash
NOT OVERRIDING: env var ZITI_BIN_DIR already set. using existing value
NOT OVERRIDING: env var ZITI_BIN_ROOT already set. using existing value
NOT OVERRIDING: env var ZITI_CTRL_ADVERTISED_ADDRESS already set. using existing value
NOT OVERRIDING: env var ZITI_ENV_FILE already set. using existing value
NOT OVERRIDING: env var ZITI_HOME already set. using existing value
NOT OVERRIDING: env var ZITI_NETWORK already set. using existing value
NOT OVERRIDING: env var ZITI_SCRIPTS already set. using existing value
NOT OVERRIDING: env var ZITI_SHARED already set. using existing value
adding /var/openziti/ziti-bin to the path
ziti@01ee8eb6260d:/persistent$ zitiLogin
Untrusted certificate authority retrieved from server
Verified that server supplied certificates are trusted by server
Server supplied 4 certificates
Server certificate chain written to /home/ziti/.config/ziti/certs/ziti-edge-controller
Token: 18848fea-85d6-4a28-8393-29a516ae1460
Saving identity 'default' to /home/ziti/.config/ziti/ziti-cli.json
ziti@01ee8eb6260d:/persistent$ ziti edge list edge-routers
╭────────────┬────────────────────┬────────┬───────────────┬──────┬────────────╮
│ ID │ NAME │ ONLINE │ ALLOW TRANSIT │ COST │ ATTRIBUTES │
├────────────┼────────────────────┼────────┼───────────────┼──────┼────────────┤
│ 8h03TuL-7W │ ziti-edge-router-2 │ true │ true │ 0 │ public │
│ kMoLfHS37W │ ziti-edge-router-1 │ true │ true │ 0 │ public │
╰────────────┴────────────────────┴────────┴───────────────┴──────┴────────────╯
results: 1-2 of 2
ziti@01ee8eb6260d:/persistent$ ziti edge create identity user http-client -a 'http-clients' -o http.client.jwt
Command "user" is deprecated, this command is deprecated, specifying identity type is no longer required
error: error creating identities instance in Ziti Edge Controller at https://ziti-edge-controller:1280/edge/management/v1. Status code: 400 Bad Request, Server returned: {
"error": {
"cause": {
"field": "name",
"reason": "duplicate value 'http-client' in unique index on identities store",
"value": "http-client"
},
"code": "COULD_NOT_VALIDATE",
"message": "The supplied request contains an invalid document or no valid accept content were available, see cause",
"requestId": "UQfgZM9EY"
},
"meta": {
"apiEnrollmentVersion": "0.0.1",
"apiVersion": "0.0.1"
}
}
ziti@01ee8eb6260d:/persistent$ ziti edge list identities
╭────────────┬────────────────────┬─────────┬──────────────┬─────────────╮
│ ID │ NAME │ TYPE │ ATTRIBUTES │ AUTH-POLICY │
├────────────┼────────────────────┼─────────┼──────────────┼─────────────┤
│ 1GKMVuS-7W │ http-server │ Default │ │ Default │
│ 8h03TuL-7W │ ziti-edge-router-2 │ Router │ │ Default │
│ HpbWmuL3aW │ http-client │ Default │ http-clients │ Default │
│ kMoLfHS37W │ ziti-edge-router-1 │ Router │ │ Default │
│ n5DTYKpVR │ Default Admin │ Default │ │ Default │
╰────────────┴────────────────────┴─────────┴──────────────┴─────────────╯
results: 1-5 of 5
ziti@01ee8eb6260d:/persistent$ ls
db ziti-edge-router-1.server.chain.cert
http.client.jwt ziti-edge-router-1.yaml
http.server.jwt ziti-edge-router-2.cas
pki ziti-edge-router-2.cert
scripts ziti-edge-router-2.jwt
ziti-controller.yaml ziti-edge-router-2.key
ziti-edge-router-1.cas ziti-edge-router-2.log
ziti-edge-router-1.cert ziti-edge-router-2.server.chain.cert
ziti-edge-router-1.jwt ziti-edge-router-2.yaml
ziti-edge-router-1.key ziti.env
ziti-edge-router-1.log
ziti@01ee8eb6260d:/persistent$ ziti edge create config http.intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses":["http.ziti"], "portRanges":[{"low":80, "high":80}]}'
error: error creating configs instance in Ziti Edge Controller at https://ziti-edge-controller:1280/edge/management/v1. Status code: 400 Bad Request, Server returned: {
"error": {
"cause": {
"field": "name",
"reason": "name is must be unique",
"value": "http.intercept.v1"
},
"code": "COULD_NOT_VALIDATE",
"message": "The supplied request contains an invalid document or no valid accept content were available, see cause",
"requestId": "Tydfu5IEY"
},
"meta": {
"apiEnrollmentVersion": "0.0.1",
"apiVersion": "0.0.1"
}
}
ziti@01ee8eb6260d:/persistent$ ziti edge create config http.host.v1 host.v1 '{"protocol":"tcp", "address":"'"${http_server}"'", "port":80}'
error: error creating configs instance in Ziti Edge Controller at https://ziti-edge-controller:1280/edge/management/v1. Status code: 400 Bad Request, Server returned: {
"error": {
"cause": {
"field": "address",
"reason": "address is invalid: address: Must not validate the schema (not)",
"value": ""
},
"code": "COULD_NOT_VALIDATE",
"message": "The supplied request contains an invalid document or no valid accept content were available, see cause",
"requestId": "wl5-k59Eg"
},
"meta": {
"apiEnrollmentVersion": "0.0.1",
"apiVersion": "0.0.1"
}
}
ziti@01ee8eb6260d:/persistent$ ziti edge create service http.svc --configs http.intercept.v1,http.host.v1
Found 0 configs with id or name matching http.host.v1
error: no configs with id or name matching http.host.v1
ziti@01ee8eb6260d:/persistent$
- I remove all containers, volumes and networks created but some stuff persists as shown by the errors above. How do I start with a clean slate each time?
(If this is out of scope and a Docker problem please say so and I'll research)
I have 2 edge routers, a controller and 2 tunnelers running as well as the http server:
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
842ed5d09049 openziti/ziti-edge-tunnel "/docker-entrypoint.…" 18 minutes ago Up 18 minutes ziti-tun-server
094c7f1bb137 openziti/ziti-edge-tunnel "/docker-entrypoint.…" 20 minutes ago Up 20 minutes ziti-tun
bca0a6e0a15f openziti/hello-world "/bin/sh -c 'echo \"h…" 24 minutes ago Up 24 minutes (healthy) 0.0.0.0:80->8000/tcp, :::80->8000/tcp web-test
3416e1777c7d openziti/quickstart "/var/openziti/scrip…" 37 minutes ago Up 37 minutes 0.0.0.0:4022->4022/tcp, :::4022->4022/tcp ziti-edge-router-2
d783e2229a96 openziti/quickstart "/var/openziti/scrip…" 37 minutes ago Up 37 minutes 0.0.0.0:3022->3022/tcp, :::3022->3022/tcp ziti-edge-router-1
01ee8eb6260d openziti/quickstart "/var/openziti/scrip…" 42 minutes ago Up 42 minutes 0.0.0.0:1280->1280/tcp, :::1280->1280/tcp ziti-controller
but the way I started the tunneler is most likely wrong as the arguments seem to be generic in the documentation and the only change I made was for the name of the jwt after copying those out of the controller container.
The server tunneler I start like
C(base) nyck33@nyck33-tt:/media/nyck33/1TB-backup/ziti/quickstart/Docker/server$ docker run --name ziti-tun-server --network host --privileged --volume ${PWD}:/ziti-edge-tunnel/ --volume "/var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket" --device "/dev/net/tun:/dev/net/tun" --env ZITI_IDENTITY_BASENAME=http.server openziti/ziti-edge-tunnel
My web server
bca0a6e0a15f openziti/hello-world "/bin/sh -c 'echo \"h…" 37 minutes ago Up 37 minutes (healthy) 0.0.0.0:80->8000/tcp, :::80->8000/tcp web-test
but I don't see that container ID or any identifying entity being used in any of the Docker commands on this page: Containers | OpenZiti
Thus, I am unsure how to get the tunnelers to terminate/intercept except I see these commands in step 7
ziti edge create config http.intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses":["http.ziti"], "portRanges":[{"low":80, "high":80}]}'
#4. Create a host.v1 config. This config is used instruct the server-side tunneler how to offload the traffic from
the overlay, back to the underlay.
ziti edge create config http.host.v1 host.v1 '{"protocol":"tcp", "address":"'"${http_server}"'", "port":80}'
so the first command is intercepting traffic from http.ziti to feed the client and also to take traffic from my client running on port 80 to http.ziti?
The second command is for the tunnel near the server taking traffic on port 80? Wait, but the traffic from the client is coming through the tunnel on the overlay isn't it? I'm a bit lost here.
I also looked on Youtube for a video for "Local Docker" (not docker-compose) but couldn't find one.
Can I get some help?
