add option to read curve and ca name from env var

[xshadowlegendx]

hello, I would like to be able to configure the names for root and intermediate ca and private key algo via env var when using container image, currently I am able to change the country and organization name via ZITI_PKI_COUNTRY and ZITI_PKI_ORGANIZATION but not the ca name and private key algo.

I can open PR for this if this is ok to add and if so I only have to update the ziti pki create ca/intermediate in cmd right?

[qrkourier]

Hello, I understood you were using the openziti/ziti-controller container image to self-host a Ziti Controller. Are you leveraging the built-in configurator described in the Docker controller guide, or bypassing that with custom orchestration?

If using that image's built-in configuration wrapper, you may override these defaults in the container env:

: "${ZITI_PKI_ROOT:=pki}"  # relative to working directory
: "${ZITI_CA_FILE:=root}"  # relative to ZITI_PKI_ROOT
: "${ZITI_INTERMEDIATE_FILE:=intermediate}"  # relative to ZITI_PKI_ROOT
: "${ZITI_SERVER_FILE:=server}"  # relative to intermediate CA "keys" and "certs" dirs
: "${ZITI_CLIENT_FILE:=client}"  # relative to intermediate CA "keys" and "certs" dirs
: "${ZITI_NETWORK_NAME:=ctrl}"  # basename of identity files

This is how they're used to create the root and intermediate CA during the container's first run (bootstrap.bash):

    ziti pki create ca \
      --pki-root "${ZITI_PKI_ROOT}" \
      --ca-file "${ZITI_CA_FILE}"

    ziti pki create intermediate \
      --pki-root "${ZITI_PKI_ROOT}" \
      --ca-name "${ZITI_CA_FILE}" \
      --intermediate-file "${ZITI_INTERMEDIATE_FILE}"

    ziti pki create key \
      --pki-root "${ZITI_PKI_ROOT}" \
      --ca-name "${ZITI_INTERMEDIATE_FILE}" \
      --key-file "${ZITI_SERVER_FILE}"

    ziti pki create server \
      --pki-root "${ZITI_PKI_ROOT}" \
      --ca-name "${ZITI_INTERMEDIATE_FILE}" \
      --key-file "${ZITI_SERVER_FILE}" \
      --server-file "${ZITI_SERVER_FILE}" \
      --dns "localhost,${ZITI_CTRL_ADVERTISED_ADDRESS}" \
      --ip "127.0.0.1,::1" \
      --allow-overwrite >&3

---

The script runs at every startup, so you can customize it and mount it on top of the one in the image, masking it so yours will run instead. Remember to set the executable bit in filemode, i.e., chmod +x bootstrap.bash before mounting. Alternatively, you can build a container image with your custom bootstrap.bash.

Your customization needs to set the additional params in the ziti pki create key, ziti pki create server, or both command(s).

❯ ziti pki create key --help
Creates new private key (to be used when creating server/client certs)

Usage:
  ziti pki create key [flags]

Aliases:
  key, k

Flags:
      --ca-name string         Name of Intermediate CA (within PKI_ROOT) to use to sign the new Client certificate (default "intermediate")
      --curve string           If set an EC private key is generated and -private-key-size is ignored, options: P224, P256, P384, P521
  -h, --help                   help for key
      --key-file string        Name of file (under chosen CA) in which to store new private key (default "key")
      --pki-root string        Directory in which PKI resides
      --private-key-size int   Size of the RSA private key, ignored if -curve is set (default 4096)

❯ ziti pki create server --help
Creates new Server certificate (signed by previously created Intermediate-chain)

Usage:
  ziti pki create server [flags]

Aliases:
  server, s

Flags:
      --allow-overwrite                  Allow overwrite existing certs
      --ca-name string                   Name of Intermediate CA (within PKI_ROOT) to use to sign the new Server certificate (default "intermediate")
      --curve string                     If set an EC private key is generated and -private-key-size is ignored, options: P224, P256, P384, P521
      --dns strings                      DNS name(s) to add to Subject Alternate Name (SAN) for new Server certificate
      --expire-limit int                 Expiration limit in days (default 365)
  -h, --help                             help for server
      --ip strings                       IP addr(s) to add to Subject Alternate Name (SAN) for new Server certificate
      --key-file string                  Name of file (under chosen CA) containing private key to use when generating Server certificate
      --max-path-len int                 Intermediate maximum path length (default -1)
      --pki-country string               Country (default "US")
      --pki-locality string              Locality/Location (default "Charlotte")
      --pki-organization string          Organization (default "NetFoundry")
      --pki-organizational-unit string   Organization unit (default "ADV-DEV")
      --pki-province string              Province/State (default "NC")
      --pki-root string                  Directory in which PKI resides
      --private-key-size int             Size of the RSA private key, ignored if -curve is set (default 4096)
      --server-file string               Name of file (under chosen CA) in which to store new Server certificate and private key (default "server")
      --server-name string               Common Name (CN) to use for new Server certificate (default "NetFoundry Inc. Server")
      --spiffe-id string                 The SPIFFE id to use. If not a complete SPIFFE id, this is treated as the SPIFFE id path and the trust domain will be taken from the signing certificate.

[xshadowlegendx]

hello @qrkourier, yes I already take a look at the bootstrap.bash script and also know that I can override and mount the modified instead but I think it is easier to use env var to reduce the steps it take to achieve that instead of having to copy the file, modify it and save it somewhere to reference for mounting later, also currently in production I am using podman quadlet instead of compose so when I am using ansible I only have to set the env var instead of have to think about modifying the bash script and copy it over