Skip to content

Commit e983aff

Browse files
nenkorunenkoru
committed
feat: add openziti network extension
Adds OpenZiti's system extension to be run on the talos node, allowing to serve Talos nodes network resources over the overlay network. Signed-off-by: Chernenko Ruslan <[email protected]>
1 parent bb94c9d commit e983aff

File tree

7 files changed

+180
-0
lines changed

7 files changed

+180
-0
lines changed

‎Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ TARGETS += realtek-firmware
8888
TARGETS += spin
8989
TARGETS += stargz-snapshotter
9090
TARGETS += tailscale
91+
TARGETS += openziti
9192
TARGETS += thunderbolt
9293
TARGETS += usb-modem-drivers
9394
TARGETS += util-linux-tools

‎network/openziti/README.md

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# OpenZiti
2+
3+
Runs OpenZiti's edge tunneler in run-host mode allowing to access talos nodes resources on the overlay network
4+
5+
https://openziti.io
6+
7+
https://openziti.io/docs/reference/tunnelers/docker/#use-case-hosting-openziti-services
8+
9+
## Installation
10+
11+
See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
12+
13+
## Usage
14+
15+
Create an identity for the machine.
16+
Manually enroll it using(for example using ziti edge enroll ...) and output the enrolled identity into a file or stdout
17+
Copy the contents of the enrolled identity
18+
Create `ExtensionServiceConfig` as the example below with replacing `JSON_IDENTITY` with the JSON of the identity you created and in mountPath replace `IDENTITY_FILE_NAME` with the filename of the identity(preserve the json in the filename)
19+
20+
```yaml
21+
---
22+
apiVersion: v1alpha1
23+
kind: ExtensionServiceConfig
24+
name: openziti
25+
configFiles:
26+
- content: 'JSON_IDENTITY'
27+
mountPath: /var/lib/ziti/etc/identities/IDENTITY_FILE_NAME.json
28+
```
29+
30+
Then apply the patch to your node's MachineConfigs
31+
```bash
32+
talosctl patch mc -p @openziti.talos.yaml
33+
```
34+
35+
You will then be able to verify that it is in place with the following command
36+
```bash
37+
talosctl get extensionserviceconfigs
38+
39+
NODE NAMESPACE TYPE ID VERSION
40+
192.168.10.10 runtime ExtensionServiceConfig openziti 1
41+
```
42+
43+
Example of creation of ziti service to serve talos api on the overlay network(note that 192.168.10.10 is the address of the node):
44+
```
45+
ziti edge create config talosctl-controlplane.intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses": ["talosctl-controlplane.ziti.internal"], "portRanges":[{"low": 50000, "high":50000}]}'
46+
ziti edge create config talosctl-controlplane.host.v1 host.v1 '{"protocol": "tcp","address":"'"192.168.10.10"'", "port": 50000}'
47+
ziti edge create service talosctrl-controlplane.svc --configs talosctl-controlplane.intercept.v1,talosctl-controlplane.host.v1
48+
ziti edge create service-policy talosctl-controlplane.policy.dial Dial --service-roles "@talosctrl-controlplane.svc" --identity-roles "@macos"
49+
ziti edge create service-policy talosctl-controlplane.policy.bind Bind --service-roles "@talosctrl-controlplane.svc" --identity-roles "@talos-cluster-test-identity"
50+
```

‎network/openziti/manifest.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
version: v1alpha1
2+
metadata:
3+
name: openziti
4+
version: "$VERSION"
5+
author: Ruslan Chernenko
6+
description: |
7+
OpenZiti is the world’s most used and widely integrated open source secure networking platform.
8+
This extension deploys a ziti-edge-tunneler in run-host mode which allows to access node's net resources
9+
through the overlay network.
10+
compatibility:
11+
talos:
12+
version: ">= v1.7.0"

‎network/openziti/openziti.yaml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: openziti
2+
depends:
3+
- service: cri
4+
- network:
5+
- addresses
6+
- connectivity
7+
- etcfiles
8+
- configuration: true
9+
container:
10+
entrypoint: /usr/local/bin/ziti-edge-tunnel
11+
args:
12+
- run-host
13+
- --verbose=4
14+
- --identity-dir=/var/lib/ziti/etc/identities
15+
security:
16+
writeableRootfs: false
17+
writeableSysfs: true
18+
mounts:
19+
# libssl lib
20+
- source: /usr/lib
21+
destination: /usr/lib
22+
type: bind
23+
options:
24+
- bind
25+
- ro
26+
- source: /sbin
27+
destination: /sbin
28+
type: bind
29+
options:
30+
- bind
31+
- ro
32+
- source: /dev/net/tun
33+
destination: /dev/net/tun
34+
type: bind
35+
options:
36+
- bind
37+
- rw
38+
- source: /var/lib/ziti/etc/identities/
39+
destination: /var/lib/ziti/etc/identities/
40+
type: bind
41+
options:
42+
- bind
43+
- rw
44+
- source: /var/lib/ziti/
45+
destination: /var/lib/ziti/
46+
type: bind
47+
options:
48+
- bind
49+
- rw
50+
restart: always

‎network/openziti/pkg.yaml

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: openziti
2+
variant: alpine
3+
shell: /toolchain/bin/bash
4+
install:
5+
- unzip
6+
- zip
7+
- ninja-build
8+
- ninja
9+
- zlib-static
10+
dependencies:
11+
- image: "ghcr.io/siderolabs/tools:v1.7.0-4-gc844dc3"
12+
steps:
13+
- sources:
14+
- url: https://github.com/openziti/ziti-tunnel-sdk-c/archive/refs/tags/{{ .OPENZITI_TUNNELER_VERSION }}.tar.gz
15+
destination: edge-tunnel-source.tar.gz
16+
sha256: d455672bf3b6ff28fd0ff864f868f7d6e3de99e6c666a120227fa9dab2d91f78
17+
sha512: 5aeb05347381124e9d75693f12e0d234499a8c6482d322019576a24c622d986d43f159454a43c844623f171a456062a5e1afffcee7f7cbb03740216dbd3bb74c
18+
env:
19+
VCPKG_ROOT: /vcpkg
20+
VCPKG_FORCE_SYSTEM_BINARIES: 1
21+
CC: /toolchain/bin/gcc
22+
CXX: /toolchain/bin/g++
23+
prepare:
24+
- |
25+
# vcpkg depends on git as a delivery tool
26+
# if to download .tar.gz from releases it would fail saying it cannot retrieve versions/baseline.json version using git show
27+
# tried my best to find any CMAKE variable within vcpkg which disables this behaviour
28+
# we fetch here commit to which tag 2024.07.12 is assigned
29+
git clone https://github.com/microsoft/vcpkg.git /vcpkg
30+
git --git-dir=/vcpkg/.git --work-tree=/vcpkg checkout 1de2026f28ead93ff1773e6e680387643e914ea1
31+
32+
- |
33+
sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml
34+
35+
- |
36+
mkdir -p /vcpkg-git /vcpkg /ziti-tunnel-sdk-c/build
37+
tar -xzvf edge-tunnel-source.tar.gz --strip-components=1 -C /ziti-tunnel-sdk-c
38+
39+
build:
40+
- |
41+
export PATH=${PATH}:/toolchain/bin
42+
/vcpkg/bootstrap-vcpkg.sh
43+
44+
- |
45+
export PATH=${PATH}:/toolchain/bin
46+
PRESET="ci-linux-x64"
47+
if [[ "$(uname -m)" == "arm64" || "$(uname -m)" == "aarch64" ]]; then
48+
PRESET="ci-linux-arm64"
49+
ln -s /toolchain/bin/g++ /toolchain/bin/aarch64-linux-gnu-g++
50+
ln -s /toolchain/bin/gcc /toolchain/bin/aarch64-linux-gnu-gcc
51+
fi
52+
cmake -DBUILD_SHARED_LIBS=OFF -DCMAKE_EXE_LINKER_FLAGS="-static" -DDISABLE_SEMVER_VERIFICATION=ON -DDISABLE_LIBSYSTEMD_FEATURE=ON -DCMAKE_MAKE_PROGRAM=/usr/bin/ninja --preset $PRESET -S /ziti-tunnel-sdk-c -B /ziti-tunnel-sdk-c/build
53+
- |
54+
cmake --build /ziti-tunnel-sdk-c/build --config Release
55+
install:
56+
- |
57+
mkdir -p /rootfs/usr/local/lib/containers/openziti/usr/local/bin/
58+
mv /ziti-tunnel-sdk-c/build/programs/ziti-edge-tunnel/Release/ziti-edge-tunnel /rootfs/usr/local/lib/containers/openziti/usr/local/bin/
59+
finalize:
60+
- from: /rootfs
61+
to: /rootfs
62+
- from: /pkg/manifest.yaml
63+
to: /
64+
- from: /pkg/openziti.yaml
65+
to: /rootfs/usr/local/etc/containers/

‎network/openziti/vars.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
VERSION: "{{ .OPENZITI_TUNNELER_VERSION }}"

‎network/vars.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
# renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=tailscale/tailscale
22
TAILSCALE_VERSION: 1.70.0
3+
OPENZITI_TUNNELER_VERSION: v1.1.2

0 commit comments

Comments
 (0)