Skip to main content
Star us on GitHub Star

Install the Controller in Kubernetes

ziti-controller

Version: 1.0.1 Type: application AppVersion: 1.0.0

Host an OpenZiti controller in Kubernetes

Requirements

RepositoryNameVersion
https://charts.jetstack.iocert-manager~1.11.0
https://charts.jetstack.iotrust-manager~0.4.0
https://kubernetes.github.io/ingress-nginx/ingress-nginx~4.5.2

Note that ingress-nginx is not strictly required, but the chart is parameterized to allow for conveniently declaring pass-through TLS.

You must patch the ingress-nginx deployment to enable the SSL passthrough option.

kubectl patch deployment "ingress-nginx-controller" \
--namespace ingress-nginx \
--type json \
--patch '[{"op": "add",
"path": "/spec/template/spec/containers/0/args/-",
"value":"--enable-ssl-passthrough"
}]'

Overview

This chart runs a Ziti controller in Kubernetes. It uses the custom resources provided by cert-manager and trust-manager, i.e., Issuer, Certificate, and Bundle. Delete the controller pod after an upgrade for the new controller configuration to take effect.

Requirements

Add the OpenZiti Charts Repo to Helm

helm repo add openziti https://docs.openziti.io/helm-charts/

This chart requires Certificate, Issuer, and Bundle resources to be applied before installing the chart. Sub-charts cert-manager, and trust-manager will be installed automatically. You may disable the sub-charts if you wish to provide these resources separately, but if you do so then please use the sub-chart values at the foot of Values.yaml to ensure those charts are correctly configured.

Install Required Custom Resource Definitions

This step satisfies Helm's requirement that the CRDs used in the umbrella chart already exist in Kubernetes before installing the controller chart.

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml
kubectl apply -f https://raw.githubusercontent.com/cert-manager/trust-manager/v0.9.0/deploy/crds/trust.cert-manager.io_bundles.yaml

Minimal Installation

This first example shows a minimal installation for a Kubernetes distribution that provides TLS pass-through for Service type LoadBalancer, e.g., K3S, Minikube.

You must supply one value when you install the chart.

KeyTypeDefaultDescription
clientApi.advertisedHoststringnilthe DNS name that edge clients and routers will resolve to reach this controller's edge client API
clientApi.advertisedPortstringnilthe TCP port associated with the advertisedHost to advertise to edge clients and routers
helm install \
--namespace ziti-controller ziti-controller-minimal1 \
openziti/ziti-controller \
--set clientApi.advertisedHost="ziti-controller-minimal.example.com" \
--set clientApi.advertisedPort="443"

A default admin user and password will be generated and saved to a secret during installation. The credentials can be retrieved using this command:

kubectl get secret \
-n ziti-controller ziti-controller-minimal1-admin-secret \
-o go-template='{{range $k,$v := .data}}{{printf "%s: " $k}}{{if not $v}}{{$v}}{{else}}{{$v | base64decode}}{{end}}{{"\n"}}{{end}}'

You may log in the ziti CLI with one command or omit the -p part to prompt:

ziti edge login ziti-controller-minimal.example.com:1280 \
--yes \
--username admin \
--password $(
kubectl -n ziti-controller \
get secrets ziti-controller-minimal1-admin-secret \
-o go-template='{{index .data "admin-password" | base64decode }}'
)

Managed Kubernetes Installation

Managed Kubernetes providers typically configure server TLS for a Service of type LoadBalancer. Ziti needs pass-through TLS because edge clients and routers authenticate with client certificates. We'll accomplish this by changing the Service type to ClusterIP and creating Ingress resources with pass-through TLS for each cluster service.

This example demonstrates creating TLS pass-through Ingress resources for use with ingress-nginx.

Ensure you have the ingress-nginx chart installed with controller.extraArgs.enable-ssl-passthrough=true. You can verify this feature is enabled by running kubectl describe pods {ingress-nginx-controller pod} and checking the args for --enable-ssl-passthrough=true.

Create a Helm chart values file like this.

# /tmp/controller-values.yml
clientApi:
advertisedHost: ziti-controller-managed.example.com
advertisedPort: 443
service:
type: ClusterIP
ingress:
enabled: true
ingressClassName: nginx
annotations:
kubernetes.io/ingress.allow-http: "false"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"

Now install or upgrade this controller chart with your values file.

helm install \
--namespace ziti-controller ziti-controller-managed1 \
openziti/ziti-controller \
--values /tmp/controller-values.yml

Expose the Router Control Plane

This is applicable if you have any routers outside the Ziti controller's cluster. You must configure pass-through TLS LoadBalancer or Ingress for the control plane service. Routers running in the same cluster as the controller can use the cluster service named {controller release}-ctrl (the "ctrl" endpoint). This example demonstrates a pass-through Ingress resource for nginx-ingress.

Merge this with your Helm chart values file before installing or upgrading.

ctrlPlane:
advertisedHost: ziti-controller-managed-ctrl.example.com
advertisedPort: 443
service:
enabled: true
ingress:
enabled: true
ingressClassName: nginx
annotations:
kubernetes.io/ingress.allow-http: "false"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"

Extra Security for the Management API

You can split the client and management APIs into separate cluster services by setting managementApi.service.enabled=true. With this configuration, you'll have an additional cluster service named {controller release}-mgmt that is the management API, and the client API will not have management features.

This Helm chart's values allow for both operational scenarios: combined and split. The default choice is to expose the combined client and management APIs as the cluster service named {controller release}-client, which is convenient because you can use the ziti CLI immediately. For additional security, you may shelter the management API by splitting these two sets of features, exposing them as separate API servers. After the split, you can access the management API in several ways:

  • running the web console inside the cluster,
  • hosting a Ziti service, or
  • kubectl port-forward.

Advanced PKI

The default configuration generates a singular PKI root of trust for all the controller's servers and the edge signer CA. Optionally, you may provide the name of a cert-manager Issuer or ClusterIssuer to become the root of trust for the Ziti controller's identity.

Merge this with your Helm chart values file before installing or upgrading.

ctrlPlane:
issuer:
kind: ClusterIssuer
name: my-alternative-cluster-issuer

You may also configure the Ziti controller to use separate PKI roots of trust for its three main identities: control plane, edge signer, and web bindings.

For example, to use a separate CA for the edge signer function, merge this with your Helm chart values file before installing or upgrading.

edgeSignerPki:
enabled: true

Values Reference

KeyTypeDefaultDescription
additionalVolumeslist[]additional volumes to mount to ziti-controller container
affinityobject{}deployment template spec affinity
ca.clusterDomainstring"cluster.local"Set a custom cluster domain if other than cluster.local
ca.durationstring"87840h"Go time.Duration string format
ca.renewBeforestring"720h"Go time.Duration string format
cert-manager.enableCertificateOwnerRefbooltrueclean up secret when certificate is deleted
cert-manager.enabledboolfalseinstall the cert-manager subchart to provide CRDs Certificate, Issuer
cert-manager.installCRDsboolfalseCRDs must be applied in advance of installing the parent chart
cert.durationstring"87840h"server certificate duration as Go time.Duration string format
cert.renewBeforestring"720h"rewnew server certificates before expiry as Go time.Duration string format
clientApi.advertisedHoststringnilglobal DNS name by which routers can resolve a reachable IP for this service
clientApi.advertisedPortint443cluster service, node port, load balancer, and ingress port
clientApi.containerPortint1280cluster service target port on the container
clientApi.dnsNameslist[]additional DNS SANs
clientApi.ingress.annotationsstringnilingress annotations, e.g., to configure ingress-nginx
clientApi.ingress.enabledboolfalsecreate an ingress for the cluster service
clientApi.service.enabledbooltruecreate a cluster service for the deployment
clientApi.service.typestring"LoadBalancer"expose the service as a ClusterIP, NodePort, or LoadBalancer
ctrlPlane.advertisedHoststringnilglobal DNS name by which routers can resolve a reachable IP for this service: default is cluster service DNS name which assumes all routers are inside the same cluster
ctrlPlane.advertisedPortint443cluster service, node port, load balancer, and ingress port
ctrlPlane.alternativeIssuerstringnilkind and name of alternative issuer for the controller's identity
ctrlPlane.containerPortint6262cluster service target port on the container
ctrlPlane.dnsNameslist[]additional DNS SANs
ctrlPlane.ingress.annotationsstringnilingress annotations, e.g., to configure ingress-nginx
ctrlPlane.ingress.enabledboolfalsecreate an ingress for the cluster service
ctrlPlane.service.enabledbooltruecreate a cluster service for the deployment
ctrlPlane.service.typestring"ClusterIP"expose the service as a ClusterIP, NodePort, or LoadBalancer
ctrlPlaneCasBundle.namespaceSelectorobject{}namespaces where trust-manager will create the Bundle resource containing Ziti's trusted CA certs (default: empty means all namespaces)
dbFilestring"ctrl.db"name of the BoltDB file
edgeSignerPki.admin_client_cert.durationstring"8760h"admin client certificate duration as Go time.Duration
edgeSignerPki.admin_client_cert.renewBeforestring"720h"renew admin client certificate before expiry as Go time.Duration
edgeSignerPki.enabledbooltruegenerate a separate PKI root of trust for the edge signer CA
fabric.events.enabledboolfalseenable fabric event logger and file handler
fabric.events.fileNamestring"fabric-events.json"
fabric.events.mountDirstring"/var/run/ziti"
fabric.events.network.intervalAgeThresholdstring"5s"matching interval age and reporting interval ensures coherent metrics from fabric events
fabric.events.network.metricsReportIntervalstring"5s"matching interval age and reporting interval ensures coherent metrics from fabric events
fabric.events.subscriptions[0].typestring"fabric.circuits"
fabric.events.subscriptions[1].typestring"fabric.links"
fabric.events.subscriptions[2].typestring"fabric.routers"
fabric.events.subscriptions[3].typestring"fabric.terminators"
fabric.events.subscriptions[4].metricFilterstring".*"
fabric.events.subscriptions[4].sourceFilterstring".*"
fabric.events.subscriptions[4].typestring"metrics"
fabric.events.subscriptions[5].typestring"edge.sessions"
fabric.events.subscriptions[6].typestring"edge.apiSessions"
fabric.events.subscriptions[7].typestring"fabric.usage"
fabric.events.subscriptions[7].versionint3
fabric.events.subscriptions[8].typestring"services"
fabric.events.subscriptions[9].intervalstring"5s"
fabric.events.subscriptions[9].typestring"edge.entityCounts"
highAvailability.modestring"standalone"Ziti controller HA mode
highAvailability.replicasint1Ziti controller HA swarm replicas
image.argslist["{{ include \"configMountDir\" . }}/ziti-controller.yaml"]args for the entrypoint command
image.commandlist["ziti","controller","run"]container entrypoint command
image.homeDirstring"/home/ziggy"homeDir for admin login shell must align with container image's ~/.bashrc for ziti CLI auto-complete to work
image.pullPolicystring"IfNotPresent"deployment image pull policy
image.repositorystring"docker.io/openziti/ziti-controller"container image repository for app deployment
image.tagstring""override the container image tag specified in the chart
ingress-nginx.controller.extraArgs.enable-ssl-passthroughstring"true"configure subchart ingress-nginx to enable the pass-through TLS feature
ingress-nginx.enabledboolfalserecommended: install the ingress-nginx subchart (may be necessary for managed k8s)
managementApi.advertisedHoststringnilglobal DNS name by which routers can resolve a reachable IP for this service
managementApi.advertisedPortint443cluster service, node port, load balancer, and ingress port
managementApi.containerPortint1281cluster service target port on the container
managementApi.dnsNameslist[]additional DNS SANs
managementApi.ingress.annotationsstringnilingress annotations, e.g., to configure ingress-nginx
managementApi.ingress.enabledboolfalsecreate an ingress for the cluster service
managementApi.service.enabledboolfalsecreate a cluster service for the deployment
managementApi.service.typestring"ClusterIP"expose the service as a ClusterIP, NodePort, or LoadBalancer
network.createCircuitRetriesint2createCircuitRetries controls the number of retries that will be attempted to create a path (and terminate it) for new circuits.
network.cycleSecondsint15Defines the period that the controller re-evaluates the performance of all of the circuits running on the network.
network.initialLinkLatencystring"65s"Sets the latency of link when it's first created. Will be overwritten as soon as latency from the link is actually reported from the routers. Defaults to 65 seconds.
network.minRouterCostint10Sets router minimum cost. Defaults to 10
network.pendingLinkTimeoutSecondsint10pendingLinkTimeoutSeconds controls how long we'll wait before creating a new link between routers where there isn't an established link, but a link request has been sent
network.routeTimeoutSecondsint10routeTimeoutSeconds controls the number of seconds the controller will wait for a route attempt to succeed.
network.routerConnectChurnLimitstring"1m"Sets how often a new control channel connection can take over for a router with an existing control channel connection Defaults to 1 minute
network.smart.rerouteCapint4Defines the hard upper limit of underperforming circuits that are candidates to be re-routed. If smart routing detects 100 circuits that are underperforming, and smart.rerouteCap is set to 1, and smart.rerouteFraction is set to 0.02, then the upper limit of circuits that will be re-routed in this cycleSeconds period will be limited to 1.
network.smart.rerouteFractionfloat0.02Defines the fractional upper limit of underperforming circuits that are candidates to be re-routed. If smart routing detects 100 circuits that are underperforming, and smart.rerouteFraction is set to 0.02, then the upper limit of circuits that will be re-routed in this cycleSeconds period will be limited to 2 (2% of 100).
nodeSelectorobject{}deployment template spec node selector
persistence.VolumeNamestringnilPVC volume name
persistence.accessModestring"ReadWriteOnce"PVC access mode: ReadWriteOnce (concurrent mounts not allowed), ReadWriteMany (concurrent allowed)
persistence.annotationsobject{}annotations for the PVC
persistence.enabledbooltruerequired: place a storage claim for the BoltDB persistent volume
persistence.existingClaimstring""A manually managed Persistent Volume and Claim Requires persistence.enabled=true. If defined, PVC must be created manually before volume will be bound.
persistence.sizestring"2Gi"2GiB is enough for tens of thousands of entities, but feel free to make it larger
persistence.storageClassstringnilStorage class of PV to bind. By default it looks for the default storage class. If the PV uses a different storage class, specify that here.
podAnnotationsobject{}annotations to apply to all pods deployed by this chart
podSecurityContextobject{"fsGroup":2171}deployment template spec security context
podSecurityContext.fsGroupint2171the GID of the group that should own any files created by the container, especially the BoltDB file
prometheus.advertisedHoststring""DNS name to advertise in place of the default internal cluster name built from the Helm release name
prometheus.advertisedPortint443cluster service, node port, load balancer, and ingress port
prometheus.containerPortint9090cluster service target port on the container
prometheus.service.annotationsobject{}
prometheus.service.enabledboolfalsecreate a cluster service for the deployment
prometheus.service.labelsobject{}
prometheus.service.typestring"ClusterIP"expose the service as a ClusterIP, NodePort, or LoadBalancer
resourcesobject{}deployment container resources
securityContextobject{}deployment container security context
spireAgent.enabledboolfalseif you are running a container with the spire-agent binary installed then this will allow you to add the hostpath necessary for connecting to the spire socket
spireAgent.spireSocketMntstring"/run/spire/sockets"file path of the spire socket mount
tolerationslist[]deployment template spec tolerations
trust-manager.app.trust.namespacestring"ziti"trust-manager needs to be configured to trust the namespace in which the controller is deployed so that it will create the Bundle resource for the ctrl plane trust bundle
trust-manager.crds.enabledboolfalseCRDs must be applied in advance of installing the parent chart
trust-manager.enabledboolfalseinstall the trust-manager subchart to provide CRD Bundle
webBindingPki.enabledbooltruegenerate a separate PKI root of trust for web bindings, i.e., client, management, and prometheus APIs

TODO's

  • replicas - Each controller replica needs to be it's own HA member. We have to wait until HA https://github.com/openziti/ziti/blob/release-next/doc/ha/overview.md is officially released.
  • lower CA / Cert lifetime; how to refresh stuff when Certs are updated?
  • Deploy Prometheus scraper configuration when prometheus.enabled = true
  • cert-manager allows issuing only one cert per key, i.e., ClientCertKeyReuseIssue prevents us from issuing a user cert and server cert backed by same private key, hence the controller config.yaml re-uses server certs in place of user certs to allow startup and testing to continue