Skip to content

Commit

Permalink
tidy markdown
Browse files Browse the repository at this point in the history
  • Loading branch information
qrkourier committed Jan 22, 2025
1 parent a51614f commit afd095c
Show file tree
Hide file tree
Showing 2 changed files with 97 additions and 41 deletions.
55 changes: 46 additions & 9 deletions example/curlz/README.md
Original file line number Diff line number Diff line change
@@ -1,40 +1,55 @@
# Overview
This example is a zitified cURL (cURLz) example. In part 1 of this example, a call will be made to an endpoint which

This example is a zitified cURL (cURLz) example. In part 1 of this example, a call will be made to an endpoint which
is not on the overlay network. In part 2, a call is made to an endpoint that *is* on the overlay network.

This example demonstrates:

* Dialing a service

## Requirements

* an OpenZiti network. If you do not have one, you can use one of the [quickstarts](https://openziti.github.io/ziti/quickstarts/quickstart-overview.html) to set one up.
* OpenZiti CLI to create services and identities on the OpenZiti Network

## Build the examples

Refer to the [example README](../README.md) to build the SDK examples

## Part 1: Set up a cURLz to a non-zitified endpoint
These steps will configure the service using the OpenZiti CLI. In this example, the traffic starts on the overlay zero
trust network and then is offloaded onto the underlay network.

These steps will configure the service using the OpenZiti CLI. In this example, the traffic starts on the overlay zero
trust network and then is offloaded onto the underlay network.

### Part 1 Architecture Overview

![image](unzitified.png)

At the end of these steps you will have created:

* a service called `web.endpoint`
* an identity to connect to (dial) the service
* the service config to connect the service to the overlay
* the service policies required to authorize the identities for bind and dial

Steps:

1. Log into OpenZiti. The host:port and username/password will vary depending on your network.

```bash
ziti edge login localhost:1280 -u admin -p admin
```

1. Determine your edge router's name and populate this environment variable with it.

```bash
ziti edge list edge-routers
export ZITI_EDGE_ROUTER=<name-of-edge-router>
```

1. Run this script to create everything you need.

```bash
echo Changing to build directory
cd $ZITI_SDK_BUILD_DIR

Expand All @@ -54,55 +69,76 @@ Steps:
echo Run policy advisor to check
ziti edge policy-advisor services
```

1. Run the cURLz example for `web.endpoint`

```bash
./curlz https://web.endpoint curlz.json
```

### Example Output

The following is the output you'll see from the cURLz request to `web.endpoint`.
```

```bash
$ ./curlz https://web.endpoint curlz.json
<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en">
... <a lot of html code>
</body></html>
```

## Part 2: Set up a cURLz to a zitified endpoint
These steps will utilize the service and identities created in simple-server to provide an example of using cURLz with
a zitified endpoint. In this example, the traffic never leaves the zero trust overlay.

These steps will utilize the service and identities created in simple-server to provide an example of using cURLz with
a zitified endpoint. In this example, the traffic never leaves the zero trust overlay.

### Part 2 Architecture Overview

![image](zitified.png)

At the end of these steps you will have created:

* an identity to connect to (dial) the service

Steps:
1. Follow all steps in the simple-service example up to, and including, running the server but **do not** enroll the

1. Follow all steps in the simple-service example up to, and including, running the server but **do not** enroll the
`simple-client` identity with the Ziti Desktop Edge client. We will do that with the CLI for this example
1. Open a new terminal and cd into the example build directory

```bash
echo Changing to build directory
cd $ZITI_SDK_BUILD_DIR
```

1. Run this script to create everything you need.

```bash
echo Enroll the simple-client identity
ziti edge enroll --jwt simple-client.jwt
```

1. Run the cURLz example for `simpleService`

```bash
./curlz http://simpleService simple-client.json
```

### Example Output

The following is the output you'll see from the cURLz request to `simpleService`.
```

```bash
$ ./curlz http://simpleService.ziti simple-client.json
Who are you?
```

## Teardown

Done with the example? This script will remove everything created during setup.
```

```bash
ziti edge login localhost:1280 -u admin -p admin

echo Removing service policies
Expand All @@ -118,4 +154,5 @@ ziti edge delete identity curlz
echo Removing service
ziti edge delete service web.endpoint
```

**NOTE:** If you followed **Part 2** of this example, refer to teardown in the `simple-server` [example README](../simple-server/README.md)
83 changes: 51 additions & 32 deletions example/http-client/README.md
Original file line number Diff line number Diff line change
@@ -1,69 +1,90 @@
# Overview

This example demonstrates a zitified HTTP client.

This example demonstrates:

* Dialing a service by intercept address.

## Requirements

* an OpenZiti network. If you do not have one, you can use one of the [quickstarts](https://openziti.github.io/ziti/quickstarts/quickstart-overview.html) to set one up.
* OpenZiti CLI to create services and identities on the OpenZiti Network

## Build the example

Refer to the [example README](../README.md) to build the SDK examples

## Part 1: Set up a cURLz to a non-zitified endpoint
These steps will configure the service using the OpenZiti CLI. In this example, the traffic starts on the overlay zero
trust network and then is offloaded onto the underlay network.

These steps will configure the service using the OpenZiti CLI. In this example, the traffic starts on the overlay zero
trust network and then is offloaded onto the underlay network.

### Part 1 Architecture Overview

![image](unzitified.png)

At the end of these steps you will have created:

* a service called `web.endpoint`
* an identity to connect to (dial) the service
* the service config to connect the service to the overlay
* the service policies required to authorize the identities for bind and dial

Steps:

1. log into Ziti. The host:port and username/password will vary depending on your network.

ziti edge login localhost:1280 -u admin -p admin
```bash
ziti edge login localhost:1280 -u admin -p admin
```

1. Determine your edge router's name and populate this environment variable with it.
ziti edge list edge-routers
export ZITI_EDGE_ROUTER=<name-of-edge-router>
```bash
ziti edge list edge-routers
export ZITI_EDGE_ROUTER=<name-of-edge-router>
```
1. Run this script to create everything you need.
cd <repo-root-dir>/example/build

echo Create the service config
ziti edge create config httpbin.hostv1 host.v1 '{"protocol":"tcp", "address":"httpbin.org","port":80}'
ziti edge create config httpbin.clientv1 intercept.v1 '{"protocols":["tcp"], "addresses":["httpbin.ziti"],"portRanges":[{"low":80,"high":80}]}'

echo Create the service
ziti edge create service ziti.httpbin --configs "httpbin.hostv1,httpbin.clientv1"
echo Create an identity to make the dial request and enroll it
ziti edge create identity user http-client -a clients -o http-client.jwt
ziti edge enroll --jwt http-client.jwt
echo Create service policies
ziti edge create service-policy ziti.httpbin.dial Dial --service-roles "@ziti.httpbin" --identity-roles "#clients"
ziti edge create service-policy ziti.httpbin.bind Bind --service-roles "@ziti.httpbin" --identity-roles "@${ZITI_EDGE_ROUTER}"
echo Create edge router policies
ziti edge create edge-router-policy ziti.httpbin-edge-router-policy --edge-router-roles '#all' --identity-roles '#clients,#servers'
ziti edge create service-edge-router-policy ziti.httpbin-service-edge-router-policy --edge-router-roles '#all' --service-roles '@ziti.httpbin'
echo Run policy advisor to check
ziti edge policy-advisor services
```bash
cd <repo-root-dir>/example/build
echo Create the service config
ziti edge create config httpbin.hostv1 host.v1 '{"protocol":"tcp", "address":"httpbin.org","port":80}'
ziti edge create config httpbin.clientv1 intercept.v1 '{"protocols":["tcp"], "addresses":["httpbin.ziti"],"portRanges":[{"low":80,"high":80}]}'
echo Create the service
ziti edge create service ziti.httpbin --configs "httpbin.hostv1,httpbin.clientv1"
echo Create an identity to make the dial request and enroll it
ziti edge create identity user http-client -a clients -o http-client.jwt
ziti edge enroll --jwt http-client.jwt
echo Create service policies
ziti edge create service-policy ziti.httpbin.dial Dial --service-roles "@ziti.httpbin" --identity-roles "#clients"
ziti edge create service-policy ziti.httpbin.bind Bind --service-roles "@ziti.httpbin" --identity-roles "@${ZITI_EDGE_ROUTER}"
echo Create edge router policies
ziti edge create edge-router-policy ziti.httpbin-edge-router-policy --edge-router-roles '#all' --identity-roles '#clients,#servers'
ziti edge create service-edge-router-policy ziti.httpbin-service-edge-router-policy --edge-router-roles '#all' --service-roles '@ziti.httpbin'

echo Run policy advisor to check
ziti edge policy-advisor services
```

1. Run the `http-client` example for service `ziti.httpbin` using intercept address `tcp:httpbin.ziti:80`

ZITI_IDENTITIES=http-client.json ./http-client http://httpbin.ziti
```bash
ZITI_IDENTITIES=http-client.json ./http-client http://httpbin.ziti
```

### Example Output

The following is the output you'll see.
```
```bash
export ZITI_IDENTITIES=http-client.json
$ ./http-client http://httpbin.ziti/json
{
Expand All @@ -88,5 +109,3 @@ $ ./http-client http://httpbin.ziti/json
}
}
```


0 comments on commit afd095c

Please sign in to comment.