知识图谱>> CPX-on-MAC>> 返回
项目作者： mohitsaxena019

项目描述 ：
Citrix ADC on MAC - Advanced use cases and easy to test environment
高级语言： Python
项目地址: git://github.com/mohitsaxena019/CPX-on-MAC.git
创建时间： 2019-03-15T12:30:08Z
项目社区：https://github.com/mohitsaxena019/CPX-on-MAC
开源协议：BSD 2-Clause "Simplified" License
下载


CPX-on-MAC

Citrix ADC on MAC - Advanced use cases and easy to test environment

Prerequisite

Getting started first time with Docker containers on MAC you need to install Mac for Docker on your MAC machine. Get the stable download version of MAC for docker by clicking below link

  • https://download.docker.com/mac/stable/Docker.dmg

    For latest information and documentation on MAC for docker please visit

  • https://docs.docker.com/v17.12/docker-for-mac/install/#download-docker-for-mac

    System Requirements

    Docker for Mac launches only if all of these requirements are met.
    • Mac hardware must be a 2010 or newer model,
    • You can check to see if your machine has virtualization support : sysctl kern.hv_support
    • macOS El Capitan 10.11 and newer macOS releases are supported.
    • At least 4GB of RAM

      Install and run Docker for Mac

    • Double-click Docker.dmg to open the installer, then drag Moby the whale to the Applications folder.
    • Double-click Docker.app in the Applications folder to start Docker. (In the example below, the Applications folder is in “grid” view mode.)
    • Login with your docker id, if you dont have docker id please create one on below link
  • https://hub.docker.com/signup

    Install Git

    • To browse the code of this sample demo you need to install git on your mac machine.
    • Open Terminal of your choice
    • Type git —version on shell
    • This will automatically prompt you to git installer

      Verify your Docker installation

    • Open the terminal of your choice.
    • Type docker login.
    • Enter your username and password created on docker hub.
    • Run the below command to run your first container
  • docker run hello-world

    Domain Names for Demo

    Write the following config in /etc/hosts file to run all the demo examples from local browser.
    • 127.0.0.1 www.hotdrink.com
    • 127.0.0.1 www.colddrink.com

      Demo Port Requirement

      This demo uses following ports
    • 80 (To access the test domain on http)
    • 443 (To access the test domain on SSL)
    • 4443 (To access the test domain on SSL with clientauth enabled)
    • 9080 (To Configure CPX via nitro api’s on http)
    • 9443 (To configure CPX via nitro api’s on https)

      If any of these ports are not available then test environment will fail to start, in such cases please update docker-compose file with some other free ports.

Deploying test environment

Chekout the code from github using below link

  • git clone https://github.com/mohitsaxena019/CPX-on-MAC.git

    Once the code is downloaded, Navigate to CPX-on-MAC/cpx-demo folder. And use below command to start and stop the test environment. Before starting the test environment please make sure to update the /etc/hosts file with above mentioned domain names.

    Deploy the demo

    1. docker-compose up -d

    The above command will install the following applications on the system

    • CPX application
    • colddrinks application
    • hotdrinks applcation
    • Creates a network bridge for communucation across the applications

The current CPX image specified within docker-compose.yml can be modified to any required version

The CPX image can be pulled from quay

  1. image: quay.io/citrix/citrix-k8s-cpx-ingress:12.1-51.16

Destroy the demo

  1. docker-compose down

To Access the CPX once deployment is up 

  1.  docker exec -it cpxdemo_cpx_1 bash

OR

  1. docker exec -it cpxdemo_cpx_1 bash

OR use the container ID of CPX

  1. docker ps -a
  2. docker exec -it <CPX container id> bash

To access CPX CLI once you login to cpx 

  1. cli_script.sh "show ver"

For NITRO API access to CPX

  1.  http://localhost:9080/nitro/v1/config/lbvserver

For NITRO API access over HTTPS 

  1. https://localhost:9443/nitro/v1/config/lbvserver

For more information on configuring Citrix ADC

  1. https://docs.citrix.com/en-us/citrix-adc-cpx/12-1/configure-cpx.html

Understanding Demo use cases

All the configuration related to Demo use cases are applied on the CPX when ‘docker-compose up -d’ is executed

Usecase 1: Basic content switching: switch based on domain. Use servicegroups and HTTP monitors.

Screenshot 2019-03-15 at 10 31 43 PM

Relevant configs relating to below procedures are present within cpx.conf file

  • Create servicegroups listening on services from hotdrink and coldrink app on port 80
  • Create content switching CS vserver listening on HTTP
  • Create two non-addressable lb vservers
  • Create appropriate CS vserver policy and attach the non-addressable lb vservers
  • Add http monitors to servicegroup
  • Send a browser request to http://www.hotdrink.com and http://www.colddrink.com
  1. Relevant configuration:
  2. ##NetScaler feature to be enabled for these use cases
  3. enable feature lb cs
  5. #HTTP Backend Service for HotDrink app running two instance
  6. add serviceGroup sg_hotdrink_http HTTP
  7. bind serviceGroup sg_hotdrink_http 172.100.100.3 80
  8. bind serviceGroup sg_hotdrink_http 172.100.100.4 80
  9. add lb vserver lbvs_hotdrink_http HTTP 0.0.0.0 0
  10. bind lb vserver lbvs_hotdrink_http sg_hotdrink_http
  12. #HTTP Backend Service for ColdDrink app running two instance
  13. add serviceGroup sg_colddrink_http HTTP
  14. bind serviceGroup sg_colddrink_http 172.100.100.5 80
  15. bind serviceGroup sg_colddrink_http 172.100.100.6 80
  16. add lb vserver lbvs_colddrink_http HTTP 0.0.0.0 0
  17. bind lb vserver lbvs_colddrink_http sg_colddrink_http
  18. #Add HTTP monitor
  19. add lb monitor monitorhttp HTTP -respCode 200 -httpRequest "GET /"
  20. bind servicegroup sg_hotdrink_http -monitorName monitorhttp
  21. bind servicegroup sg_colddrink_http -monitorName monitorhttp
  23. #Add CS policy and action
  24. add cs action csa_hotdrink -targetLBVserver lbvs_hotdrink_http
  25. add cs action csa_colddrink -targetLBVserver lbvs_colddrink_http
  26. add cs policy csp_hotdrink -rule "HTTP.REQ.HOSTNAME.SERVER.EQ(\"www.hotdrink.com\")" -action csa_hotdrink
  27. add cs policy csp_colddrink -rule "HTTP.REQ.HOSTNAME.SERVER.EQ(\"www.colddrink.com\")" -action csa_colddrink 
  29. #Add HTTP cs vserver for hotdrink and cold drink domain to content switch
  30. add cs vserver csv_drinks_http HTTP 127.0.0.1 80
  31. bind cs vserver csv_drinks_http -policyName csp_hotdrink -priority 20001
  32. bind cs vserver csv_drinks_http -policyName csp_colddrink -priority 20002

Usecase 2: SSL OFFLOAD:

Screenshot 2019-03-15 at 11 45 52 PM

Relevant configs relating to below procedures are present within cpx.conf file.
Relevant certs are present within certs folder

  • Create servicegroups listening on services from hotdrink and colddrink app on port 80
  • Create content switching CS Vserver listening on port 443 (SSL)
  • Create two non-addressable lb vservers
  • Attach the relevant certs to the vservers
  • Create appropriate CS vserver policy and attach the non-addressable lb vservers
  • Send a https browser request to https://www.hotdrink.com and https://www.colddrink.com
  1. Relevant Configuration:
  3. ##NetScaler feature to be enabled for these use cases
  4. enable feature lb cs
  6. #HTTP Backend Service for HotDrink app running two instance
  7. add serviceGroup sg_hotdrink_http HTTP
  8. bind serviceGroup sg_hotdrink_http 172.100.100.3 80
  9. bind serviceGroup sg_hotdrink_http 172.100.100.4 80
  10. add lb vserver lbvs_hotdrink_http HTTP 0.0.0.0 0
  11. bind lb vserver lbvs_hotdrink_http sg_hotdrink_http
  13. #HTTP Backend Service for ColdDrink app running two instance
  14. add serviceGroup sg_colddrink_http HTTP
  15. bind serviceGroup sg_colddrink_http 172.100.100.5 80
  16. bind serviceGroup sg_colddrink_http 172.100.100.6 80
  17. add lb vserver lbvs_colddrink_http HTTP 0.0.0.0 0
  18. bind lb vserver lbvs_colddrink_http sg_colddrink_http
  20. #Add CS policy and action
  21. add cs action csa_hotdrink -targetLBVserver lbvs_hotdrink_http
  22. add cs action csa_colddrink -targetLBVserver lbvs_colddrink_http
  23. add cs policy csp_hotdrink -rule "HTTP.REQ.HOSTNAME.SERVER.EQ(\"www.hotdrink.com\")" -action csa_hotdrink
  24. add cs policy csp_colddrink -rule "HTTP.REQ.HOSTNAME.SERVER.EQ(\"www.colddrink.com\")" -action csa_colddrink 
  27. #Shell Commands
  28. cp -r /etc/ssl /tmp/
  30. #NetScaler Commands
  31. #Add SSL certs
  32. add ssl certKey cert_drink -cert "/tmp/ssl/wild-hotdrink.com-cert.pem" -key "/tmp/ssl/wild-hotdrink.com-key.pem"
  33. add ssl certkey colddrink_cert  -cert "/tmp/ssl/wild-colddrink.com-cert.pem" -key "/tmp/ssl/wild-colddrink.com-key.pem"
  34. add ssl certkey cacert -cert "/tmp/ssl/wild-rootcert.pem"
  36. #ADD SSL cs vserver for hotdrink and cold drink domain to content switch with SSL offload
  37. add cs vserver csv_drinks_ssl SSL 127.0.0.1 443
  38. bind cs vserver csv_drinks_ssl -policyName csp_hotdrink -priority 20001
  39. bind cs vserver csv_drinks_ssl -policyName csp_colddrink -priority 20002
  40. bind ssl vserver csv_drinks_ssl -certkeyName cert_drink

Usecase 3: SSL BACKEND: CLIENT AUTHENTICATION INCLUDED:

Screenshot 2019-03-15 at 11 46 09 PM

Relevant configs relating to below procedures are present within cpx.conf file
Relevant certs are present within certs folder

  • Create servicegroups listening on services from hotdrink and colddrink app on port 443
  • Create content switching CS Vserver listening on port 443 (SSL)
  • Create two non-addressable lb vservers
  • Attach the relevant certs to the vserver
  • Create appropriate CS VServer policy and attach the non-addressable lb vservers
  • Send a https browser request to www.hotdrink.com and www.colddrink.com
  • Add new CS and LB vserver for enabling clientauth and serverauth
  • Attach the relevant LB vservers with CS vserver for enabling clientauth and serverauth
  • Send a https request to https://www.hotdrink.com:4443 and https://www.colddrink.com:4443
  1. Relevant Configuration:
  3. ##NetScaler feature to be enabled for these use cases
  4. enable feature lb cs
  6. #Shell Commands
  7. cp -r /etc/ssl /tmp/
  9. #NetScaler Commands
  10. #Add SSL certs
  11. add ssl certKey cert_drink -cert "/tmp/ssl/wild-hotdrink.com-cert.pem" -key "/tmp/ssl/wild-hotdrink.com-key.pem"
  12. add ssl certkey colddrink_cert  -cert "/tmp/ssl/wild-colddrink.com-cert.pem" -key "/tmp/ssl/wild-colddrink.com-key.pem"
  13. add ssl certkey cacert -cert "/tmp/ssl/wild-rootcert.pem"
  15. #SSL Backend Service for HotDrink app running two instance with clientauth enabled
  16. add serviceGroup sg_hotdrink_ssl_clientauth SSL
  17. bind serviceGroup sg_hotdrink_ssl_clientauth 172.100.100.3 443
  18. bind serviceGroup sg_hotdrink_ssl_clientauth 172.100.100.4 443
  19. add lb vserver lbvs_hotdrink_ssl_clientauth HTTP 0.0.0.0 0
  20. bind lb vserver lbvs_hotdrink_ssl_clientauth sg_hotdrink_ssl_clientauth
  21. bind ssl servicegroup sg_hotdrink_ssl_clientauth -certkey cacert -CA
  22. bind ssl servicegroup sg_hotdrink_ssl_clientauth -certkey cert_drink  
  23. set ssl servicegroup sg_hotdrink_ssl_clientauth -serverauth enabled
  25. #SSL Backend Service for coldDrink app running two instance with clientauth enabled
  26. add serviceGroup sg_colddrink_ssl_clientauth SSL
  27. bind serviceGroup sg_colddrink_ssl_clientauth 172.100.100.5 443
  28. bind serviceGroup sg_colddrink_ssl_clientauth 172.100.100.6 443
  29. add lb vserver lbvs_colddrink_ssl_clientauth HTTP 0.0.0.0 0
  30. bind lb vserver lbvs_colddrink_ssl_clientauth sg_colddrink_ssl_clientauth
  31. bind ssl servicegroup sg_colddrink_ssl_clientauth -certkey cacert -CA
  32. bind ssl servicegroup sg_colddrink_ssl_clientauth -certkey colddrink_cert  
  33. set ssl servicegroup sg_colddrink_ssl_clientauth -serverauth enabled
  35. #SSL cs vserver with clientauth enabled
  36. add cs vserver csvs_hotdrink_ssl_clientauth SSL 127.0.0.1 4443
  37. add cs action csa_hotdrink_clientauth -targetLBVserver lbvs_hotdrink_ssl_clientauth
  38. add cs action csa_colddrink_clientauth -targetLBVserver lbvs_colddrink_ssl_clientauth
  39. add cs policy csp_hotdrink_clientauth -rule "HTTP.REQ.HOSTNAME.SERVER.EQ(\"www.hotdrink.com\")" -action csa_hotdrink_clientauth
  40. add cs policy csp_colddrink_clientauth -rule "HTTP.REQ.HOSTNAME.SERVER.EQ(\"www.colddrink.com\")" -action csa_colddrink_clientauth
  41. set ssl vserver csvs_hotdrink_ssl_clientauth -clientauth enabled
  42. bind ssl vserver csvs_hotdrink_ssl_clientauth -certkey cacert -CA
  43. bind ssl vserver csvs_hotdrink_ssl_clientautH -certkeyName cert_drink

UseCase 4: Example of applying a responder policy through command line on CPX

Denying access to www.hotdrink.com using responder policy

CPX login

  1. docker exec -it <cpx container name or container ID> bash

Enable responder rewrite feature

  1. root@590b90a51752:/# cli_script.sh 'enable feature responder rewrite'
  2. exec: enable feature responder rewrite
  3. Done

Add a responder action to respond with a certain http header when a http request arrives to CPX

  1. root@590b90a51752:/# cli_script.sh 'add responder action respond_custom_content respondwith "\"HTTP/1.1 200 OK\r\nAccept-Encoding: text\r\nServer: Test-Server\r\n\r\n\""'
  2. exec: add responder action respond_custom_content respondwith "\"HTTP/1.1 200 OK\r\nAccept-Encoding: text\r\nServer: Test-Server\r\n\r\n\""

Add a responder policy with the above action if url contains /

  1. root@590b90a51752:/# cli_script.sh 'add responder policy respond_custom_content_policy "http.req.url.contains(\"/\")" respond_custom_content'
  2. exec: add responder policy respond_custom_content_policy "http.req.url.contains(\"/\")" respond_custom_content
  3. Done

Check the applied responder config

  1. root@590b90a51752:/# cli_script.sh 'show run' | grep responder
  2. add responder action respond_custom_content respondwith "\"HTTP/1.1 200 OK\r\nAccept-Encoding: text\r\nServer: Test-Server\r\n\r\n\""
  3. add responder policy respond_custom_content_policy "http.req.url.contains(\"/\")" respond_custom_content

Apply the policy to hotdrink lb vserver

  1. root@590b90a51752:/# cli_script.sh 'bind lb vserver lbvs_hotdrink_http -policyname respond_custom_content_policy -priority 1000' 
  2. exec: bind lb vserver lbvs_hotdrink_http -policyname respond_custom_content_policy -priority 1000
  3. Done

Check the browser by accessing www.hotdrink.com

A browser query would show a blank page

  1. root@slave40:~/MohitCPX/CPX-on-MAC/cpx-demo# curl -vvv  http://www.hotdrink.com
  2. * Rebuilt URL to: http://www.hotdrink.com
  3. *   Trying 127.0.0.1...
  4. * Connected to www.hotdrink.com (127.0.0.1) port 1080 (#0)
  5. > GET / HTTP/1.1
  6. > Host: www.hotdrink.com:1080
  7. > User-Agent: curl/7.47.0
  8. > Accept: */*
  9. > 
  10. < HTTP/1.1 200 OK =========> Response from responder policy
  11. < Accept-Encoding: text =========> Response from responder policy
  12. < Server: Test-Server=========> Response from responder policy
  13. * no chunk, no close, no size. Assume close to signal end
  14. < 
  15. * Closing connection 0

Unbind the responder policy to allow access to www.hotdrink.com

  1. root@590b90a51752:/# cli_script.sh 'unbind lb vserver lbvs_hotdrink_http -policyname respond_custom_content_policy'
  2. exec: unbind lb vserver lbvs_hotdrink_http -policyname respond_custom_content_policy
  3. Done

Access www.hotdrink.com to view the webpage

CPX Rewrite Policy

CPX Rewrite Action

CPX Responder Policy

CX Responder Action

Debugging CPX using command line

CPX login

  1. docker exec -it <cpx container name or container ID> bash

Checking logs within CPX

  1. root@75a3c02f18a8:/# cat /var/log/ns.log 
  2. Mar 18 05:30:34 75a3c02f18a8 rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="129" x-info="http://www.rsyslog.com"] start
  3. Mar 18 05:30:35 75a3c02f18a8 nsppe: PPE-0 : Lower PE :Debug Info 1: 0x6d5a56da 0x255b0ec2 0x4167253d 0x43a38fb0 0xd0ca2bcb 0xae7b30b4 0x77cb2da3 0x8030f20c 0x4167253d 0x43a38fb0#012 
  4. Mar 18 05:30:35 75a3c02f18a8 nsppe: IPv6 address fe80:0:0:0:40ca:29ff:feb8:4352/64 modification on interface ns2 failed
  5. Mar 18 05:30:34 75a3c02f18a8 rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
  6. Mar 18 05:30:34 75a3c02f18a8 rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
  7. Mar 18 05:30:34 75a3c02f18a8 rsyslogd-2145: activation of module imklog failed [v8.16.0 try http://www.rsyslog.com/e/2145 ]
  8. Mar 18 05:30:38 75a3c02f18a8 nsaggregatord: nsaggregator: system command 'echo nslog: cannot access /var/nslog/nslog.nextfile due to error=2, use 0 >> /var/nslog/ns.log' failed ret -1
  9. Mar 18 05:30:38 75a3c02f18a8 nsaggregatord: nsaggregator: system command 'echo nslog: `date`: renaming /var/nslog/newnslog to /var/nslog/newnslog.0 >> /var/nslog/ns.log' failed ret -1
  11. TRIMMED
  12. .........

Verify CS vserver

  1. root@590b90a51752:/# cli_script.sh 'show cs vserver'
  2. exec: show cs vserver
  3. 1)    csv_drinks_http (127.0.0.1:80) - HTTP    Type: CONTENT 
  4.     State: UP
  5.     Last state change was at Fri Mar 15 16:53:04 2019
  6.     Time since last state change: 0 days, 00:45:38.470  ARP:DISABLED
  7.     Client Idle Timeout: 180 sec
  8.     Down state flush: ENABLED
  9.     Disable Primary Vserver On Down : DISABLED
  10.     Appflow logging: ENABLED
  11.     Port Rewrite : DISABLED
  12.     State Update: DISABLED
  13.     Default:     Content Precedence: RULE
  14.     Vserver IP and Port insertion: OFF 
  15.     L2Conn: OFF    Case Sensitivity: ON
  16.     Authentication: OFF
  17.     401 Based Authentication: OFF
  18.     Push: DISABLED    Push VServer: 
  19.     Push Label Rule: none
  20.     Listen Policy: NONE
  21.     IcmpResponse: PASSIVE
  22.     RHIstate:  PASSIVE
  23.     Traffic Domain: 0

Verify lb vserver

  1. root@590b90a51752:/# cli_script.sh 'show lb vserver' | grep Type
  2. 1)    lbvs_hotdrink_http (0.0.0.0:0) - HTTP    Type: ADDRESS 
  3. 2)    lbvs_colddrink_http (0.0.0.0:0) - HTTP    Type: ADDRESS 
  4. 3)    lbvs_hotdrink_ssl (0.0.0.0:0) - HTTP    Type: ADDRESS 
  5. 4)    lbvs_colddrink_ssl (0.0.0.0:0) - HTTP    Type: ADDRESS 
  6. 5)    lbvs_hotdrink_ssl_clientauth (0.0.0.0:0) - HTTP    Type: ADDRESS 
  7. 6)    lbvs_colddrink_ssl_clientauth (0.0.0.0:0) - HTTP    Type: ADDRESS

Verify running configuration

  1. root@590b90a51752:/# cli_script.sh 'show run'                   
  2. exec: show run
  3. #NS12.1 Build 51.16
  4. # Last modified Fri Mar 15 16:53:02 2019
  5. set ns config -IPAddress 172.100.100.254 -netmask 255.255.255.0
  6. set ns config -tagged NO
  7. enable ns feature LB CS SSL AAA
  8. enable ns mode L3 USNIP PMTUD
  10. OUTPUT TRIMMED
  11. .......

If the configuration needs to be applied fresh, a clear configuration on CPX can be used

  1. root@590b90a51752:/# cli_script.sh "clear config -force full"
  2. exec: clear config -force full
  3. Done

Scripting CPX through nitro SDK Python API

Install python on the system

Untar the nssrc.tar file under script-python folder

  1. tar -xvf nssrc.tar

Execute the python script to configure CPX

  1. python config_script.py

The logs of the script can be viewed under the same folder on file citrix_nitro.log

  1. tail -f citrix_nitro.log

A success message on logs indicates successful configuration of CPX through Nitro API

  1. DEBUG:root:SUCCESS: Configuration completed
  2. INFO:root:Configuration completed

The applied configuration on CPX can be verified using the following command

  1. CPX login:
  2. docker exec -it <cpx container name or container ID> bash
  5. root@590b90a51752:/# cli_script.sh 'show run' | grep example
  6. add serviceGroup sg_hotdrink_http_example HTTP -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP NO
  7. add lb vserver lbvs_hotdrink_http_example HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
  8. bind lb vserver lbvs_hotdrink_http_example sg_hotdrink_http_example
  9. bind serviceGroup sg_hotdrink_http_example 172.100.100.3 80
  10. root@590b90a51752:/#

New Nitro calls can be added or modified within the following function

  1. def call_nitro_commands(ns_session):
  2.     try:
  3.         ns_session.clear_config(force=True, level='full')
  4.         logging.debug('Clear config executed')
  5.         needed_features = [
  6.             nsfeature.Feature.CS,
  7.             nsfeature.Feature.LB,
  8.             nsfeature.Feature.SSL,
  9.             nsfeature.Feature.RESPONDER,
  10.             nsfeature.Feature.REWRITE]
  11.         ns_session.enable_features(needed_features)
  13.         logging.debug('Adding CS vserver')
  14.         csvserver_instance= csvserver()
  15.         csvserver_instance.name = 'drinks_sample'
  16.         csvserver_instance.ipv46= '127.0.0.1'
  17.         csvserver_instance.servicetype = 'http'
  18.         csvserver_instance.port = '443'
  19.         csvserver_instance.add(ns_session, csvserver_instance)
  21.     TRIMMED
  22.     .........