feat: add openziti network extension by nenkoru · Pull Request #454 · siderolabs/extensions

nenkoru · 2024-08-17T10:59:20Z

Adds system extension to run OpenZiti edge tunneler which allows serving Talos nodes network resources over the overlay network.

OpenZiti is a free and open source project focused on bringing zero trust networking principles directly into any application. The project provides all the pieces required to implement a zero trust overlay network and provides all the tools necessary to integrate zero trust into your existing solutions. The OpenZiti project believes the principles of zero trust shouldn't stop at your network, those ideas belong in your application.
https://openziti.io
https://github.com/openziti

nenkoru · 2024-08-17T11:13:01Z

Idk how to solve gpg-identity EOF issue
I use mine ssh key to sign commits
Regarding number-of-commits - idk as well, branched from the main upstream.

Adds OpenZiti's system extension to be run on the talos node, allowing to serve Talos nodes network resources over the overlay network. Signed-off-by: Chernenko Ruslan <ractyfree@gmail.com>

frezbo · 2024-08-17T11:40:03Z

Idk how to solve gpg-identity EOF issue

you can ignore the gpg check, it checks if the commit is also signed by a member of org

Regarding number-of-commits - idk as well, branched from the main upstream.

the checks is passing, so all good

smira · 2024-08-17T12:24:13Z

network/openziti/pkg.yaml

+  - ninja
+  - zlib-static
+dependencies:
+  - image: "ghcr.io/siderolabs/tools:v1.7.0-4-gc844dc3"


this looks a bit strange... we usually build from base layer which contains toolchain (tools) and don't use alpine for the build. is there anything missing?

There is no zlib-static, zip, unzip when using scratch and its impossible to use install directive as apk manager doesnt exist in `scratch' variant.
Vcpkg relies on having zip, unzip as it downloads dependencies in that format.
Zlib-static is required to link an executable against it as ~~there is no zlib on the host /usr/lib folder~~
the build process doesn't build zlib from sources and it has to be manually retrieved from the alpine packages repo in this case.

zlib should be available though, zip and unzip, there will be no apk of course.

vcpkg downloads dependencies? does it pin them in a secure way?

I guess I could just change to using 'base' stage instead of explicitly binding to a tools image here.
Build seems to work fine with that. But idk what to do with those zip, unzip, zlib-static, ninja deps

zlib should be available though, zip and unzip, there will be no apk of course.

vcpkg downloads dependencies? does it pin them in a secure way?

Yes it does by verifying their sha512sum as I skimmed the code.

hmm, then this extension needs to add it's build time dependencies as like qemu-guest-agent for example

hmm, then this extension needs to add it's build time dependencies as like qemu-guest-agent for example

I guess would be hard to do as it heavily depends on vcpkg as the dependency manager.
Maybe I could try working on creating static builds and then pulling them within the build process. Would this be okay?

I mean pulling them from the releases page, as you suggested above.

yes, let's try static builds from the releases page. how big are those?

yes, let's try static builds from the releases page. how big are those?

Well, around 5MB, I am currently working on buildin those using gh workflows, just having a linker issue with CMAKE trying to link libpthread.so instead of libpthread.a.
openziti/ziti-tunnel-sdk-c#938

frezbo · 2024-08-17T12:55:36Z

network/openziti/pkg.yaml

+        sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml
+
+      - |
+        mkdir -p /vcpkg-git /vcpkg /ziti-tunnel-sdk-c/build


why are we building an sdk? doesn't make sense, shouldn't it be using this https://github.com/openziti/ziti/?

why are we building an sdk? doesn't make sense, shouldn't it be using this https://github.com/openziti/ziti/?

No we shouldn't. OpenZiti tunneler is exactly for hosting or tunneling. Main ziti repo is for the other part of the OpenZiti project which provides a controller, router and etc.

Tunneler is just a daemon that runs on the host machines and allows to put the network communication on or from the overlay network it creates. For Talos its impossible to change routing from the extension, so the tunneler runs in a 'run-host' mode which allows offloading of a overlay traffic on the underlay network.

github-actions · 2025-06-28T02:15:26Z

This PR is stale because it has been open 45 days with no activity.

mnbro · 2025-10-19T18:31:43Z

@nenkoru Do you have any news on this? Now openziti has static binaries.

nenkoru · 2025-10-19T19:52:23Z

@nenkoru Do you have any news on this? Now openziti has static binaries.

Unfortunately, they are not

➜  Downloads file ziti-edge-tunnelt1712x64
ziti-edge-tunnelt1712x64: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=8510e9ced615a6b8b9e790db3a23462c52424931, with debug_info, not stripped

Well, as far as I remember the team has decided to do not build static because of the issues they had with some devices and/or environments.
So for me I just proceed with rebuilding an extension every once in a while using the branch in the merge request and pushing it to private registry as well as my gh registry[1]. I have had some small tweaks over the past year, but the gist remains the same.
[1] https://github.com/nenkoru/talos-extensions/pkgs/container/openziti

github-actions · 2025-12-04T02:16:15Z

This PR is stale because it has been open 45 days with no activity.

nenkoru force-pushed the network-openziti-extension branch from 7c6d295 to 3cebc5a Compare August 17, 2024 11:09

nenkoru force-pushed the network-openziti-extension branch from 3cebc5a to 9e26b1e Compare August 17, 2024 11:14

feat: add openziti network extension

e983aff

Adds OpenZiti's system extension to be run on the talos node, allowing to serve Talos nodes network resources over the overlay network. Signed-off-by: Chernenko Ruslan <ractyfree@gmail.com>

nenkoru force-pushed the network-openziti-extension branch from 9e26b1e to e983aff Compare August 17, 2024 11:16

smira reviewed Aug 17, 2024

View reviewed changes

frezbo reviewed Aug 17, 2024

View reviewed changes

nenkoru mentioned this pull request Aug 17, 2024

[Proposal] Linux static executable releases openziti/ziti-tunnel-sdk-c#938

Closed

github-actions bot added the Stale label Jun 28, 2025

github-actions bot removed the Stale label Oct 20, 2025

github-actions bot added the Stale label Dec 4, 2025

smira removed this from Planning Dec 10, 2025

Conversation

nenkoru commented Aug 17, 2024

Uh oh!

nenkoru commented Aug 17, 2024

Uh oh!

frezbo commented Aug 17, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nenkoru Aug 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jun 28, 2025

Uh oh!

mnbro commented Oct 19, 2025

Uh oh!

nenkoru commented Oct 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nenkoru Aug 17, 2024 •

edited

Loading

nenkoru commented Oct 19, 2025 •

edited

Loading