OCM hub functionality without OpenZiti tunneler (45ee148d) · Commits · OSL / MDG HypO / code / addons / ocm-hub

ocm-hub-chart/Chart.lock

deleted100644 → 0

+0 −6

Changes for ocm-hub-chart/Chart.lock: 0 added lines, 6 removed lines.
Original line number	Diff line number	Diff line
		dependencies:
		- name: ziti-edge-tunnel
		repository: https://openziti.io/helm-charts/
		version: 1.5.0
		digest: sha256:d0b6068a31a88405c194aabaef966b8bd2068e147fedb613b84202effedfca89
		generated: "2026-09-01T14:25:32.639540571Z"

ocm-hub-chart/Chart.yaml

+0 −6

Changes for ocm-hub-chart/Chart.yaml: 0 added lines, 6 removed lines.
Original line number	Diff line number	Diff line
		@@ -6,9 +6,3 @@ type: application
		version: 0.2.0
		appVersion: "latest"


		dependencies:
		- name: ziti-edge-tunnel
		version: "1.5.0"
		repository: "https://openziti.io/helm-charts/"
		condition: openziti.enabled

ocm-hub-chart/charts/ziti-edge-tunnel-1.5.0.tgz

deleted100644 → 0

−7.78 KiB

File deleted.

View file

ocm-hub-chart/templates/cleanup-job.yaml

+0 −125

Changes for ocm-hub-chart/templates/cleanup-job.yaml: 0 added lines, 125 removed lines.
Original line number	Diff line number	Diff line
		@@ -248,129 +248,4 @@ spec:
		manifestworkvalidators.admission.work.open-cluster-management.io \
		--ignore-not-found=true \|\| true

		{{- if .Values.openziti.enabled }}
		echo "========================================"
		echo "Cleaning OpenZiti controller resources"
		echo "========================================"

		ZITI_API="{{ .Values.openziti.controller.url }}/edge/management/v1"
		ZITI_USERNAME={{ .Values.openziti.controller.username \| quote }}
		ZITI_PASSWORD={{ .Values.openziti.controller.password \| quote }}

		ZITI_IDENTITY_NAME={{ .Values.openziti.identity.name \| quote }}
		ZITI_SERVICE_NAME={{ .Values.openziti.hubApi.serviceName \| quote }}

		ZITI_BIND_POLICY="${ZITI_SERVICE_NAME}-bind"
		ZITI_INTERCEPT_CONFIG="${ZITI_SERVICE_NAME}-intercept"
		ZITI_HOST_CONFIG="${ZITI_SERVICE_NAME}-host"

		echo "Authenticating to OpenZiti controller..."

		AUTH_RESPONSE="$(curl -ksS -X POST \
		"${ZITI_API}/authenticate?method=password" \
		-H "Content-Type: application/json" \
		-d "{\"username\":\"${ZITI_USERNAME}\",\"password\":\"${ZITI_PASSWORD}\"}")"

		ZITI_TOKEN="$(echo "${AUTH_RESPONSE}" \| jq -r '.data.token // empty')"

		if [ -n "${ZITI_TOKEN}" ]; then

		echo "Authenticated successfully."

		delete_ziti_resource() {
		RESOURCE="$1"
		NAME="$2"

		echo "Looking for ${RESOURCE}: ${NAME}"

		FILTER="name=\"${NAME}\""

		RESPONSE="$(curl -ksS --get \
		"${ZITI_API}/${RESOURCE}" \
		--data-urlencode "filter=${FILTER}" \
		-H "zt-session: ${ZITI_TOKEN}")"

		RESOURCE_ID="$(echo "${RESPONSE}" \
		\| jq -r --arg NAME "${NAME}" \
		'.data[]? \| select(.name == $NAME) \| .id' \
		\| head -n1)"

		if [ -n "${RESOURCE_ID}" ]; then

		echo "Deleting ${RESOURCE}: ${NAME}"

		curl -ksS -X DELETE \
		"${ZITI_API}/${RESOURCE}/${RESOURCE_ID}" \
		-H "zt-session: ${ZITI_TOKEN}" \
		>/dev/null \|\| true

		else

		echo "${RESOURCE} ${NAME} not found."

		fi
		}

		echo "========================================"
		echo "Deleting OpenZiti Bind policy"
		echo "========================================"

		delete_ziti_resource \
		"service-policies" \
		"${ZITI_BIND_POLICY}"

		echo "========================================"
		echo "Deleting OpenZiti service"
		echo "========================================"

		delete_ziti_resource \
		"services" \
		"${ZITI_SERVICE_NAME}"

		echo "========================================"
		echo "Deleting OpenZiti configs"
		echo "========================================"

		delete_ziti_resource \
		"configs" \
		"${ZITI_INTERCEPT_CONFIG}"

		delete_ziti_resource \
		"configs" \
		"${ZITI_HOST_CONFIG}"

		echo "========================================"
		echo "Deleting OpenZiti controller identity"
		echo "========================================"

		delete_ziti_resource \
		"identities" \
		"${ZITI_IDENTITY_NAME}"

		else

		echo "WARNING: Could not authenticate to OpenZiti controller."
		echo "Continuing uninstall without controller cleanup."

		fi

		echo "========================================"
		echo "Cleaning OpenZiti bootstrap resources"
		echo "========================================"

		kubectl delete secret {{ .Values.openziti.identity.secretName }} \
		-n {{ .Release.Namespace }} \
		--ignore-not-found=true \|\| true

		kubectl delete rolebinding {{ include "ocm-hub.fullname" . }}-ziti-bootstrap \
		-n {{ .Release.Namespace }} \
		--ignore-not-found=true \|\| true

		kubectl delete role {{ include "ocm-hub.fullname" . }}-ziti-bootstrap \
		-n {{ .Release.Namespace }} \
		--ignore-not-found=true \|\| true

		kubectl delete serviceaccount {{ include "ocm-hub.fullname" . }}-ziti-bootstrap \
		-n {{ .Release.Namespace }} \
		--ignore-not-found=true \|\| true
		{{- end }}

ocm-hub-chart/templates/openziti-bootstrap-job.yaml

deleted100644 → 0

+0 −395

Changes for ocm-hub-chart/templates/openziti-bootstrap-job.yaml: 0 added lines, 395 removed lines.
Original line number	Diff line number	Diff line
		{{- if .Values.openziti.enabled }}
		apiVersion: batch/v1
		kind: Job
		metadata:
		name: {{ include "ocm-hub.fullname" . }}-ziti-bootstrap
		namespace: {{ .Release.Namespace }}
		annotations:
		"helm.sh/hook": pre-install
		"helm.sh/hook-weight": "-10"
		"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded

		spec:
		backoffLimit: 1

		template:
		spec:
		restartPolicy: Never

		serviceAccountName: {{ include "ocm-hub.fullname" . }}-ziti-bootstrap

		volumes:
		- name: ziti-bootstrap-data
		emptyDir: {}

		# ============================================================
		# STEP 1
		#
		# Authenticate to OpenZiti
		# Delete existing identity if present
		# Create identity
		# Retrieve enrollment JWT
		# ============================================================

		initContainers:
		- name: create-ziti-identity
		image: alpine:3.22
		imagePullPolicy: IfNotPresent

		env:
		- name: ZITI_CONTROLLER
		value: {{ .Values.openziti.controller.url \| quote }}

		- name: ZITI_USERNAME
		value: {{ .Values.openziti.controller.username \| quote }}

		- name: ZITI_PASSWORD
		value: {{ .Values.openziti.controller.password \| quote }}

		- name: ZITI_IDENTITY_NAME
		value: {{ .Values.openziti.identity.name \| quote }}

		volumeMounts:
		- name: ziti-bootstrap-data
		mountPath: /work

		command:
		- /bin/sh
		- -ec
		- \|
		echo "========================================"
		echo "OpenZiti identity creation"
		echo "Controller: ${ZITI_CONTROLLER}"
		echo "Identity: ${ZITI_IDENTITY_NAME}"
		echo "========================================"

		apk add --no-cache curl jq ca-certificates

		API="${ZITI_CONTROLLER}/edge/management/v1"

		# ----------------------------------------------------
		# 1. Authenticate
		# ----------------------------------------------------

		echo
		echo "[1/4] Authenticating..."

		AUTH_RESPONSE="$(curl -ksS \
		-X POST \
		"${API}/authenticate?method=password" \
		-H "Content-Type: application/json" \
		-d "{
		\"username\": \"${ZITI_USERNAME}\",
		\"password\": \"${ZITI_PASSWORD}\"
		}")"

		TOKEN="$(echo "${AUTH_RESPONSE}" \
		\| jq -r '.data.token // empty')"

		if [ -z "${TOKEN}" ]; then
		echo "ERROR: OpenZiti authentication failed."
		echo "${AUTH_RESPONSE}" \| jq .
		exit 1
		fi

		echo "Authentication successful."

		# ----------------------------------------------------
		# 2. Delete existing identity
		# ----------------------------------------------------

		echo
		echo "[2/4] Checking existing identity..."

		FILTER="name=\"${ZITI_IDENTITY_NAME}\""

		IDENTITIES="$(curl -ksS \
		--get \
		"${API}/identities" \
		--data-urlencode "filter=${FILTER}" \
		-H "zt-session: ${TOKEN}")"

		OLD_ID="$(echo "${IDENTITIES}" \
		\| jq -r --arg NAME "${ZITI_IDENTITY_NAME}" \
		'.data[]? \| select(.name == $NAME) \| .id' \
		\| head -n1)"

		if [ -n "${OLD_ID}" ]; then

		echo "Existing identity found:"
		echo " ${OLD_ID}"

		echo "Deleting existing identity..."

		DELETE_CODE="$(curl -ksS \
		-o /tmp/delete-response \
		-w "%{http_code}" \
		-X DELETE \
		"${API}/identities/${OLD_ID}" \
		-H "zt-session: ${TOKEN}")"

		if [ "${DELETE_CODE}" != "200" ] &&
		[ "${DELETE_CODE}" != "202" ] &&
		[ "${DELETE_CODE}" != "204" ]; then

		echo "ERROR: Failed to delete existing identity."
		echo "HTTP: ${DELETE_CODE}"
		cat /tmp/delete-response
		echo
		exit 1
		fi

		echo "Existing identity deleted."

		else

		echo "No existing identity found."

		fi

		# ----------------------------------------------------
		# 3. Create identity
		# ----------------------------------------------------

		echo
		echo "[3/4] Creating identity..."

		CREATE_RESPONSE="$(curl -ksS \
		-X POST \
		"${API}/identities" \
		-H "zt-session: ${TOKEN}" \
		-H "Content-Type: application/json" \
		-d "{
		\"name\": \"${ZITI_IDENTITY_NAME}\",
		\"type\": \"Default\",
		\"isAdmin\": false,
		\"enrollment\": {
		\"ott\": true
		}
		}")"

		IDENTITY_ID="$(echo "${CREATE_RESPONSE}" \
		\| jq -r '.data.id // empty')"

		if [ -z "${IDENTITY_ID}" ]; then
		echo "ERROR: Failed to create OpenZiti identity."
		echo "${CREATE_RESPONSE}" \| jq .
		exit 1
		fi

		echo "Identity created:"
		echo " ${IDENTITY_ID}"

		# ----------------------------------------------------
		# 4. Retrieve enrollment JWT
		# ----------------------------------------------------

		echo
		echo "[4/4] Retrieving enrollment JWT..."

		COUNT=0
		JWT=""

		while [ -z "${JWT}" ]; do

		COUNT=$((COUNT + 1))

		IDENTITY_RESPONSE="$(curl -ksS \
		"${API}/identities/${IDENTITY_ID}" \
		-H "zt-session: ${TOKEN}")"

		JWT="$(echo "${IDENTITY_RESPONSE}" \
		\| jq -r '.data.enrollment.ott.jwt // empty')"

		if [ -n "${JWT}" ]; then
		break
		fi

		if [ "${COUNT}" -ge 10 ]; then
		echo "ERROR: Enrollment JWT did not become available."
		echo "${IDENTITY_RESPONSE}" \| jq .
		exit 1
		fi

		echo "JWT not available yet. Retrying..."
		sleep 2

		done

		printf '%s' "${JWT}" > /work/enrollment.jwt

		chmod 600 /work/enrollment.jwt

		echo
		echo "Enrollment JWT retrieved."
		echo "OpenZiti identity creation completed."


		# ============================================================
		# STEP 2
		#
		# Enroll the JWT
		# Produce identity.json
		# ============================================================

		- name: enroll-ziti-identity
		image: openziti/ziti-edge-tunnel:1.15.1
		imagePullPolicy: IfNotPresent

		securityContext:
		runAsUser: 0

		volumeMounts:
		- name: ziti-bootstrap-data
		mountPath: /work

		command:
		- /usr/local/bin/ziti-edge-tunnel

		args:
		- enroll
		- --jwt
		- /work/enrollment.jwt
		- --identity
		- /work/identity.json


		# ============================================================
		# STEP 3
		#
		# Create Kubernetes Secret containing identity.json
		# ============================================================

		containers:
		- name: create-kubernetes-secret
		image: alpine:3.22
		imagePullPolicy: IfNotPresent

		env:
		- name: ZITI_SECRET_NAME
		value: {{ .Values.openziti.identity.secretName \| quote }}

		- name: NAMESPACE
		valueFrom:
		fieldRef:
		fieldPath: metadata.namespace

		volumeMounts:
		- name: ziti-bootstrap-data
		mountPath: /work

		command:
		- /bin/sh
		- -ec
		- \|
		echo
		echo "========================================"
		echo "Creating OpenZiti Kubernetes Secret"
		echo "Namespace: ${NAMESPACE}"
		echo "Secret: ${ZITI_SECRET_NAME}"
		echo "========================================"

		apk add --no-cache curl ca-certificates

		IDENTITY_FILE="/work/identity.json"

		if [ ! -s "${IDENTITY_FILE}" ]; then
		echo "ERROR: identity.json does not exist."
		exit 1
		fi

		K8S_TOKEN="$(cat \
		/var/run/secrets/kubernetes.io/serviceaccount/token)"

		K8S_CA="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"

		K8S_API="https://kubernetes.default.svc"

		# ----------------------------------------------------
		# Remove old Secret if it exists
		# ----------------------------------------------------

		echo
		echo "Checking existing Secret..."

		DELETE_CODE="$(curl \
		--silent \
		--show-error \
		--cacert "${K8S_CA}" \
		-o /tmp/secret-delete-response \
		-w "%{http_code}" \
		-X DELETE \
		"${K8S_API}/api/v1/namespaces/${NAMESPACE}/secrets/${ZITI_SECRET_NAME}" \
		-H "Authorization: Bearer ${K8S_TOKEN}")"

		if [ "${DELETE_CODE}" = "200" ] \|\|
		[ "${DELETE_CODE}" = "202" ]; then

		echo "Old Secret deleted."

		elif [ "${DELETE_CODE}" = "404" ]; then

		echo "No existing Secret."

		else

		echo "ERROR: Could not delete/check existing Secret."
		echo "HTTP: ${DELETE_CODE}"
		cat /tmp/secret-delete-response
		echo
		exit 1

		fi

		# ----------------------------------------------------
		# Encode identity.json
		# ----------------------------------------------------

		SECRET_DATA="$(base64 "${IDENTITY_FILE}" \| tr -d '\n')"

		# ----------------------------------------------------
		# Create Secret
		# ----------------------------------------------------

		echo
		echo "Creating Secret..."

		CREATE_CODE="$(curl \
		--silent \
		--show-error \
		--cacert "${K8S_CA}" \
		-o /tmp/secret-create-response \
		-w "%{http_code}" \
		-X POST \
		"${K8S_API}/api/v1/namespaces/${NAMESPACE}/secrets" \
		-H "Authorization: Bearer ${K8S_TOKEN}" \
		-H "Content-Type: application/json" \
		-d "{
		\"apiVersion\": \"v1\",
		\"kind\": \"Secret\",
		\"metadata\": {
		\"name\": \"${ZITI_SECRET_NAME}\"
		},
		\"type\": \"Opaque\",
		\"data\": {
		\"persisted-identity\": \"${SECRET_DATA}\"
		}
		}")"

		if [ "${CREATE_CODE}" != "201" ]; then
		echo "ERROR: Failed to create Kubernetes Secret."
		echo "HTTP: ${CREATE_CODE}"
		cat /tmp/secret-create-response
		echo
		exit 1
		fi

		echo
		echo "Secret created successfully:"
		echo " ${NAMESPACE}/${ZITI_SECRET_NAME}"

		echo
		echo "========================================"
		echo "OpenZiti bootstrap SUCCESS"
		echo "========================================"
		{{- end }}