I have created some identities and related service policies as follows.
mango@bluesky tmp % ziti edge list service-policies
╭────────────────────────┬───────────┬──────────┬───────────────┬────────────────┬─────────────────────╮
│ ID │ NAME │ SEMANTIC │ SERVICE ROLES │ IDENTITY ROLES │ POSTURE CHECK ROLES │
├────────────────────────┼───────────┼──────────┼───────────────┼────────────────┼─────────────────────┤
│ 1NrKqCOGxefnKNGMKitAVD │ chat.dial │ AllOf │ #chat-service │ #engineering │ │
│ 6oDKSb5exVDV5uf4cylxQN │ chat.bind │ AllOf │ #chat-service │ #engineering │ │
╰────────────────────────┴───────────┴──────────┴───────────────┴────────────────┴─────────────────────╯
results: 1-2 of 2
mango@bluesky tmp % ziti edge list identities
╭────────────┬──────────────────┬────────┬─────────────────╮
│ ID │ NAME │ TYPE │ ATTRIBUTES │
├────────────┼──────────────────┼────────┼─────────────────┤
│ .7SUfW7jK │ erv0v0 │ Router │ │
│ 5VbEucHUd │ doer │ Router │ │
│ DD5dMygUTS │ mellisa │ User │ engineering,qa │
│ H37LMRXUdS │ dan │ User │ dev,engineering │
│ fE2O2elFI │ ziti-edge-router │ Router │ │
│ menjDyn43 │ Default Admin │ User │ │
│ uA7bMRXbTS │ chat.server │ Device │ chat.servers │
╰────────────┴──────────────────┴────────┴─────────────────╯
results: 1-7 of 7
I also have a service edge router policy and I think this is created default by ziti?
mango@bluesky tmp % ziti edge list service-edge-router-policies
╭────────────────────────┬──────────────────┬───────────────┬───────────────────╮
│ ID │ NAME │ SERVICE ROLES │ EDGE ROUTER ROLES │
├────────────────────────┼──────────────────┼───────────────┼───────────────────┤
│ 4zoFIedKB4f5g59kuZctc3 │ allSvcAllRouters │ #all │ #all │
╰────────────────────────┴──────────────────┴───────────────┴───────────────────╯
But I’m still getting service is not accessible message:
mango@bluesky tmp % ziti edge policy-advisor services
Policy General Guidelines
In order for an identity to dial or bind a service, the following must be true:
- The identity must have access to the service via a service policy of the correct type (dial or bind)
- The identity must have acces to at least one on-line edge router via an edge router policy
- The service must have access to at least one on-line edge router via a service edge router policy
- There must be at least one on-line edge router that both the identity and service have access to.
Policy Advisor Output Guide:
STATUS = The status of the identity -> service reachability. Will be OKAY or ERROR.
ID = identity name
ID ROUTERS = number of routers accessible to the identity via edge router policies.
- See edge router polices for an identity: ziti edge controller list identity edge-router-policies <identity>
SVC = service name
SVC ROUTERS = number of routers accessible to the service via service edge router policies.
- See service edge router policies for a service with: ziti edge controller list service service-edge-router-policies <service>
ONLINE COMMON ROUTERS = number of routers the identity and service have in common which are online.
COMMON ROUTERS = number of routers (online or offline) the identity and service have in common.
DIAL_OK = indicates if the identity has permission to dial the service.
- See service polices for a service : ziti edge controller list service service-policies <service>
- See service polices for an identity: ziti edge controller list identity service-policies <identity>
BIND_OK = indicates if the identity has permission to bind the service.
ERROR_LIST = if the status is ERROR, error details will be listed on the following lines
Output format: STATUS: ID (ID ROUTERS) -> SVC (SVC ROUTERS) Common Routers: (ONLINE COMMON ROUTERS/COMMON ROUTERS) Dial: DIAL_OK Bind: BIND_OK. ERROR_LIST
-------------------------------------------------------------------------------
ERROR: chat
- Service is not accessible by any identities. Adjust service policies.
What am I missing?
.