Taste of Ziti – Pet Store – Open Source Zero Trust Networking

A Taste of OpenZiti

In this demo you will use an OpenZiti SDK to access a private instance of the swagger petstore API. This demo will cover:

Initializing Context

2. Calling a Service

3. Reading a Response

Getting Started

Just choose your favorite programing language below, and paste the code into the terminal of your choice

Java

GoLang

Python

Java

Run the Example

Requirements
* JDK 21 or later

				
					git clone https://github.com/netfoundry/taste-of-ziti.git
cd taste-of-ziti/java/petstoreJava
./gradlew clean build run

Look at the Code

1. Loading an identity:

The Ziti SDK needs to be initialized with a strong identity. This is done via the Ziti.init method:

				
					Ziti.init(identityFile, "".toCharArray(), false);

2. Calling a service:

Calling a service means asking the OpenZiti overlay network for a connection. The Java SDK can look at the domain name of network requests and automatically dial the service for you.

OpenZiti defines a service at the dns name “petstore.demo”.

				
					final Request httpRequest = new Builder()
          .url(String.format("http://%s:%d%s", "petstore.ziti", 80, petstoreQuery))
          .header("Accept", "/")
          .get()
          .build();

3. Reading the result:

This looks exactly the same as reading the result from any HTTP request in Java.

				
					final Response response = client.newCall(httpRequest).execute());
String result = response.body().string();

GoLang

Run the Example

Requirements
* go 1.21 or later
* gcc compiler

				
					git clone https://github.com/netfoundry/taste-of-ziti.git
cd taste-of-ziti/golang/petstoreGo

mkdir build
go mod tidy
go build -o build ./...

build/petstoreGo

Python

Run the Example

Requirements
* Python language TBD

				
					git clone https://github.com/netfoundry/taste-of-ziti.git
cd taste-of-ziti/python/petstorePy
pip install -r ../requirements.txt
python3 petstore.py

What You Get by Adopting an OpenZiti SDK

Strong Identity

You need to be confident all entities on your network are who they claim to be, and tightly control access to your network

Completely Dark

No open ports! Your application should be “dark”, meaning no inbound ports to your applications and services are available for direct attack

Segmented Access

Access to services on your network needs to follow a “least privileged access” model, allowing access only to exactly what is needed to help mitigate against lateral attacks