Czernobog Tracker

Re: NSX ALB Avi 30.1.1 - macro API "Input object does not have model_name field" even thou

Czernobog — Thu, 02 Nov 2023 07:13:33 GMT

This can be tested with the example provided in the documentation, it end with the response:

Response: {

"error": "Input object does not have model_name field"

}

ERROR!: 400 Client Error: BAD REQUEST for url: https://{base_url}/api/macro

I get the same response with my custom VS:

payload = { "model_name": "VirtualService", "data": { "name": "n_vs", "services": [ { "port": 80 } ], "vip":[ { "ip_address": { "type": "V4", "addr": "2.2.2.2" } } ], "application_profile_ref": "/api/applicationprofile?name=n_app_http", "pool_ref_data": { "name": "n_pool", "servers": [ { "ip": { "type": "V4", "addr": "1.1.1.1" } } ], "health_monitor_refs_data": [ { "type": "HEALTH_MONITOR_HTTP", "name": "n_http", "http_monitor": { "http_response_code": [ { "code": "HTTP_2XX" } ] } } ] } } }

NSX ALB Avi 30.1.1 - macro API "Input object does not have model_name field" even though present

Czernobog — Fri, 27 Oct 2023 14:32:06 GMT

I've started evaluating the Avi/NSX ALB product a short while ago and try to automate the creation of some of the objects.

When using the macro API to create a virtual service I cannot get past the "Input object does not have model_name field" error.

How this works is pretty confusing.

First I have created a new virtual service using the UI and captured the query using the browsers' developer mode. Afterwards I used curl to make a request, for which I copied the payload 1:1 from what was captured earlier. The error "Input object does not have model_name field" accompanzing a http error 400 was returned.

I've checked the payload, the model_name field was actually missing. Instead the "uri_path":"/api/virtualservice" was present. Manually adding the "model_name": "VirtualService" field to the payload did not resolve the error.

Using the example provided in MACRO API (avinetworks.com) also results in the error mentioned above.

Am I doing something wrong here? How does the query work, when executed using the UI without the model_name field?

Overall, the REST API makes a pretty janky first impression. I've noticed a similar problem when creating a new server pool. Copied the payload from browser dev mode, query returns an errro 400 with reason of being not able to interpret the healt monitor field...

NSX 4.x - API query to return deleted entities (vms), return groups with no effective members

Czernobog — Tue, 26 Sep 2023 07:29:11 GMT

I think I saw something like this is the past, in the UI or API documentation, but could not find it now.

Is there a way to search for deleted objects using a REST query on the nsx manager? Or even better, list security groups, that have no effective members? What I want to return by API is basically this:

In the past I would use the "Get effective VMs for the Group" query to get the effective members of a group, but this query is deprecated.

The reason I need this is, that I suspect a lot of groups have no members anymore, and those empty groups are assigned to firewall rule, which in turn have no reason to exist anymore.

The group object returned by a API query does not list the virtual machine member as deleted. The only way to see if a group still has members is to run /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/members/{member-type}, but this would have to be run fo every possible member type separately.

It would be great to have a method that looks from top to bottom (policy - rule - group) if the firewall policy is still valid, that is, if it is not applied to empty security groups.

Aria Automation 8.x - MFA with one-time password?

Czernobog — Thu, 17 Aug 2023 07:49:19 GMT

Hello,

is there any way to use one-time passwords as part of a multi-factor authentication method in Automation 8.x?

Workspace ONE allows the integration of Authenticator Apps, VIDM 3.x is limited in that regard and allows following options:

Configuring User Authentication in VMware Identity Manager

A built in identity provider does not seem to be an option here, would it be possible to use a 3rd party idP to send emails with one-time passwords to users during the authentication process?

Re: Orchestartor 8 - Increase Session Timeout

Czernobog — Fri, 04 Aug 2023 12:34:11 GMT

Bumping again, on the 1-year-anniversary of the post. There still does not seem to be a resolution for this issue, the 8.13 release notes do not contain anything on the topic.

Maybe someone found a workaround for this frustrating problem? Except the one I got suggested from support, that is installing a auto-reloader in the browser.

Re: Aria Automation 8.12.1 - Orchestrator Python 3.10 env - importing netifaces, infoblox module fai

Czernobog — Thu, 03 Aug 2023 07:40:49 GMT

I was doing it this way (with request module in vRO python env) up until now and wanted to switch to the infoblox python module, since it's just easier to work with.

I've made good experience with it in ABX, what irks me is that stuff that works there is not compatible with the vRO python env. I would like to use ABX more, however when you build a flow and construct a custom form, the validation and external source for the input fields has to be a vRO action, so I cannot use the infoblox module there. It's frustrating.

Aria Automation 8.12.1 - Orchestrator Python 3.10 env - importing netifaces, infoblox module fails

Czernobog — Wed, 02 Aug 2023 11:08:19 GMT

Hi,

I need to do some object manipulation in our Infoblox IPAM. This is to be done using an Orchestrator workflow.

Infoblox provides a python module: infoblox-client · PyPI

I have created a new python 3.10 environment in vRO, where I tried to import the infoblox-client module.

This fails because a depencency (netifaces module) cannot be built, here's a part of the download log:

2023-08-02 12:59:48.549 +02:00INFOCollecting netifaces>=0.10.4 2023-08-02 12:59:48.551 +02:00INFO Using cached netifaces-0.11.0.tar.gz (30 kB)

...

2023-08-02 12:59:50.629 +02:00ERROR building 'netifaces' extension 2023-08-02 12:59:50.630 +02:00ERROR x86_64-unknown-linux-gnu-gcc -pthread -Wno-unused-result -Wsign-compare -DNDEBUG -O2 -g -O2 -g -fPIC -DNETIFACES_VERSION=0.11.0 -I/usr/include/python3.10 -c netifaces.c -o build/temp.linux-x86_64-cpython-310/netifaces.o 2023-08-02 12:59:50.631 +02:00ERROR error: command 'x86_64-unknown-linux-gnu-gcc' failed: No such file or directory 2023-08-02 12:59:50.632 +02:00ERROR ---------------------------------------- 2023-08-02 12:59:50.633 +02:00ERRORERROR: Command errored out with exit status 1: /usr/bin/python3.10 -u -c 'import io, os, sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-zylpe8x5/netifaces_e73f72b17063488abfe6fcc25b903a2c/setup.py'"'"'; __file__='"'"'/tmp/pip-install-zylpe8x5/netifaces_e73f72b17063488abfe6fcc25b903a2c/setup.py'"'"';f = getattr(tokenize, '"'"'open'"'"', open)(__file__) if os.path.exists(__file__) else io.StringIO('"'"'from setuptools import setup; setup()'"'"');code = f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record /tmp/pip-record-uexld4j8/install-record.txt --single-version-externally-managed --home /tmp/pip-target-jww4b747 --compile --install-headers /tmp/pip-target-jww4b747/include/python/netifaces Check the logs for full command output.

Importing the infoblox-client module works fine in ABX, just not in vRO.

Is a workaround possible?

And why is there such a discrepancy in the python envs in ABx and vRO?

Re: External IPAM | VRA Internal References - Use Case

Czernobog — Mon, 03 Jul 2023 12:56:03 GMT

The IPAM plugin in this case should not save/cache any data regarding the VM's IP configuration. It's just there to grab and assign an IP adress from your IPAM to a Automation provisioned machine. On a provisioning operation it looks up IPAM for a free adress in a range that you can select, for example by using constraints in Automation. It selects the IP, saves this information in the IPAM (ex. IP 1.2.3.4 is assigned to MAC aa:bb:cc, hostname is xyz) and either feeds this IP to the VM directly (static assignement) or just makes an IP reservation and is done. Similar during deprovisioning, it grabs the MAC address of the VM, looks up IPAM for this MAC, if it finds an IP - a delete operation for the IP and associated objects (hostname, dns entry...) executed.

This way no information needs to be saved by the plugin itself. In case of Aria Automation having a plugin save something would not be possible anyway, without using an external database or maybe an Orchestrator Resource element or dynamic type or a similar workaround.

I have done a similar migration in the past. We went from a NSX-DHCP provisioned network to another external solution - Infoblox. Infoblox provides a plugin for Automation. Really the only 2 things we had to do was move the IP reservations from NSX DHCP to Infoblox and re-configure the networks in Automation, by selecting them as provisioned by an external resource and adding new tags, so that the constraints work during provisioning. No VM/IP-relevant data was touched.

IPAM should be the only source of truth for IP information, in my opinion, a the role of the plugin is to manage the communication between Automation and IPAM, this is all.

Re: redeploy deployments

Czernobog — Fri, 28 Apr 2023 12:04:08 GMT

This is one of the features that are missing for the whole time after vRA 8.x was relased, so almost 2,5 years now, along with unregistering and changing owners of deployments after onboarding.

You could force a deployment to redeploy after making changes, using a deployment (resource?) parameter, however from my experience this would result in: redeploying on almost every change or not redeploying on any change.

Since there is no universal "redeploy" action, you have to find the right combination of correct resource parameters and an action, that would change the deplyoment in a way to force a redeployment.

So far I have not found a solution for this, either you end up with small changes triggering a redeplyoment, which you do not want, or break the plan update with changes that you want to trigger a redeplyoment with. An example would be changing the base image of a deployed virtual machines: say you use an Ubuntu 20 image and add the option to use Ubuntu 22 in your templates (for vsphere.machine). Users which deplyoed their Ubuntu 20 systems using the template would now be able to select Ubuntu 22 in "Update Deployment". This would trigger a redeployment, however when you configure your template like this, other miniscule changes, like editing the NIC configuration, would also trigger a redeployment.

Re: vRA 8.11.2 - custom repositories for python environment in vRO but not ABX, why?

Czernobog — Wed, 05 Apr 2023 06:43:23 GMT

Thanks for answering. I will take the topic to our TAM.

However, I have to say, I am really disappointed in how features are developed for the ABX part. No local repositories, not being able to use abx actions for user form field validation, 150 actions limit on the local faas provider... I was told back in 2019 that with time this is going to be an alternatvie to vRO, but now, what is the point of using it with all the shortcomings?

vRA 8.11.2 - custom repositories for python environment in vRO but not ABX, why?

Czernobog — Tue, 04 Apr 2023 08:53:36 GMT

At some point, I want to create my own python classes, package them and upload to our own git repository, from where they could be used in python actions. The feature works fine in vRO: I've added the git repo url, selected the runtime and, in the environment, selected the 'requests' package, which was previously uploaded as a .whl file to the repository. The package gets downloaded from the local repository and its dependencies fro mthe public repository.

I am now looking for a solution to emulate this behaviour in abx. Sadly the abx part of vRA seems to be neglected compared to vRO.

I've uploaded the requests package in version 2.28.2 to my local repo as .whl and .gz, sourced from pypi. After that, I've created a new abx python action and tried to install a module from the local git repo using multiple methods, by filling the Dependency text field with the repository url. Following approaches failed:

https://localgiturl/project/folder/requests-2.28.2.tar.gz#egg=requests==2.28.1

result: OSError: Not a gzipped file (b'<!')

https://localgiturl/project/folder/requests-2.28.2-py3-none-any.whl

https://localgiturl/project/folder/requests-2.28.2-py3-none-any.whl#egg=requests==2.28.1

result: ERROR: Wheel 'requests' located at /tmp/pip-unpack-ajz0rsjy/requests-2.28.2-py3-none-any.whl is invalid.

git+https://localgiturl/project.git#egg=requests==2.28.1

result: ERROR: Cannot find command 'git' - do you have 'git' installed and in your PATH?

I assume using git+http as the protocol will fail every time since git is not part of the virtual environment.

I cannot explain the two other error however.

Is there a way to load custom python modules in abx?

Re: vRA 8.10.2 and VMs with multiple networks -Network profiles

Czernobog — Thu, 19 Jan 2023 07:16:52 GMT

You said one of your networks is NSX based. In this case your resource in the template should be Clound.NSX.Network, not Cloud.vSphere.Network. Could also be that the capability tag is applied on the wrong object.

Also, the provisioning diagram should help solving the problem, it shows exactly where vRA wants to provision the VM, based on you tagging strategy.

Re: vRA 8.x - Display Owner by Name (not only username)

Czernobog — Thu, 19 Jan 2023 07:10:02 GMT

I don't think you can change that. Its either username or user principal name. I use the upn, since it is the easiest way to identify a user and is unique across domains. However, clients who use the vRA ui are sometimes confused, since in their domain the AD username is just a random string and not related to their actual name and surname.

You can always fill in a feature request, honestly, when I think about it now, the should be the option to include a "Name, Surname" column in the Deployments view since release.

vRA 8.10 - subscription event does not wait for workflow to finish

Czernobog — Tue, 25 Oct 2022 09:06:59 GMT

I need to run a script on a 3rd party system, when a vRA8-provisioned vm is deleted. The script needs the mac address of the vm - it grabs the subscription payload (inputProperties), loads associated resources associated with the deployments and grabs the mac addresses from the proeprties.networks.mac_address attributes.

I have created a subscription for the "compute.removal.pre" event topic which is supposed to be "Fired before a compute resource is being destroyed".

When triggered however, in about 1/3 cases, the vm is no longer there for the mac addresses to be read, and the subscripted workflow fails.

Setting the "Timeout" value in the subscription to >0 minutes does not change anything.

I have specifically set the event option to "pre", so that the required data can be queried, before the resource is removed.

Is there a way to force vRA to wait until the vRO workflow is finished?

Edit: When the subscribed workflow fails, the Deyploemnt Deletion fails too. When querying the resource at this state using

/deployment/api/resources/{id}, the network configuration does not contain mac_adresses, however in the topology gui those are still listed.

Re: VRA 8.x Unregister VM

Czernobog — Wed, 19 Oct 2022 09:11:18 GMT

The feature still isn't there in 8.10. It seems to be one of those 7.6 features that somehow are too hard to implement in the new release.

vRA 8.9 - change Content name and description not possible?

Czernobog — Mon, 10 Oct 2022 14:16:49 GMT

I have presented a few vRO workflows in the vRA content catalog. The workflows are imported in the Service Broker, from one of the content sources.

The new catalog items have the same name and description, as the vRO workflows (as expected), however there does not seem to be a way to change them in the Configure Item view:

You can only change the max instances and icon.

This is a problem since I do not want catalog items to have the same name and description as my vRO workflows. Is there a way to change both fields? I could not find a relevant api call either, is it possible that such a basic feature would not be ported from vRA7?

In contrast, you can change the display name as well as the description, when you import a workflow as a Resource Action in Cloud Assembly.

Re: vRA 8.9 - custom form - break line in text area?

Czernobog — Mon, 05 Sep 2022 10:59:57 GMT

Found a solution, by adding the white-space property to the textarea field, in the imported CSS file:

cf-textarea {
white-space: pre;
}

vRA 8.9 - custom form - break line in text area?

Czernobog — Mon, 05 Sep 2022 09:40:55 GMT

I have a custom form configured, within it is a read-only text area field displaying some information for the service user. The information displayed should be divided into sections by break line (break row).

In vRA 7 I used \n for this, in vRA8 this seems to be discovered ("\n" is not displayed as part of a string), but there is no break line happening.

Is there a way to correctly display a break line in a vRA 8.9 custom form?

Re: vRO 8 / vRA 8 - passing on metadata to a custom form input field - vRO workflow in vRA catalog

Czernobog — Fri, 19 Aug 2022 13:11:09 GMT

I had to rip out configured Directories in vIDM and re-add them usinf UserPrincipalName instead of samaccountname and now all users are correctly identified by their upn (Requested By = upn), which makes life much easier.

Re: vRO 8.8 / vRA 8.8 - Python action - referencing other vRO actions?

Czernobog — Fri, 19 Aug 2022 07:37:06 GMT

Thanks!

I hope a similar solution will be developed for configuring a python environment in vRO, so you'll be able to load custom modules from a folder or maybe gitlab directly into the environment, so that a workaround with the additional actions and functions is not needed.