PuppetConf 2015: Puppet API Roundup
•
1 recomendación•801 vistas
Jeremy Adams and Lizzi Lindboe delivered this talk at PuppetConf 2015. You'll learn some REST / HTTP API basics, hear about some useful CLI tools, and get some useful examples that you can try on the Puppet Learning VM or any Puppet Enterprise install.
Recomendados
Más contenido relacionado
Similar a PuppetConf 2015: Puppet API Roundup
Similar a PuppetConf 2015: Puppet API Roundup (20)
Último
Último (20)
PuppetConf 2015: Puppet API Roundup
- 2. Jeremy Adams Solutions Engineering Puppet Labs Puppet API Roundup Lizzi Lindboe Software Engineer Puppet Labs
- 3. What to expect The talk Guided examples After the talk Now you try! Slides, video, and code online github.com/jpadams/puppetconf_api
- 4. Begin! Let’s make an HTTP request https://docs.puppetlabs.com/pe/latest/status_api.html
- 5. Console status RBAC NC Activity PuppetDB API Puppet Server Puppet CA Services Overview
- 6. Components of an HTTP request Verb URL Data Auth
- 7. Components of an HTTP request Verb URL Data Auth
- 8. The verb: how GET request data PUT send data POST send data DELETE delete something
- 9. The verb: how GET request data
- 10. Components of an HTTP request Verb GET, PUT, POST, DELETE URL Data Auth
- 11. Components of an HTTP request Verb GET, PUT, POST, DELETE URL Data Auth
- 12. The URL: what protocol HTTP or HTTPS host node where API is port like a service address endpoint (a.k.a. route) which resource to interact with
- 13. How do I know what the URL is? https://docs.puppetlabs.com/pe/latest/status_api.html
- 14. Components of an HTTP request Verb GET, PUT, POST, DELETE URL protocol, host, port, and route Data Auth
- 15. curl workhorse (install curl.exe with choco!) httpie sturdy, pretty pony python requests library (also `python -m json.tool`) ruby so many libs! github: puppetlabs/puppet-classify gem puppet github: dalen/puppet-puppetdbquery, puppetlabs/prosvcs-node_manager GUI tools browser extensions, standalone apps, web apps Some tools
- 16. Let’s request data! curl -X GET http://localhost:8123/status/v1/services #demo 1
- 17. Components of an HTTP request Verb GET, PUT, POST, DELETE URL protocol, host, port, and route Data Auth
- 18. curl -X POST --data @my-data.json http://google.com The request body { "foo": "bar", "baz": "oof" } ./my-data.json
- 19. curl -X POST -d @my-data.json -H "Content-Type: application/json" http://google.com The request headers
- 20. curl -X GET http://google.com/?key1=val1&key2=val2 curl -X GET http://google.com --data "key1=val1" --data "key2=val2" curl -X GET --data-urlencode 'level=debug' http://localhost:8123/status/v1/services Query params #demo 2
- 21. Components of an HTTP request Verb GET, PUT, POST, DELETE URL protocol, host, port, and route Data headers, body, or query params Auth
- 22. Components of an HTTP request Verb GET, PUT, POST, DELETE URL protocol, host, port, and route Data headers, body, or query params Auth
- 23. For when you don’t want status information traveling unencrypted Let’s request status with SSL
- 24. Why SSL? encryption information security identity verification are you who you say are?
- 25. SSL components Certificate Public information Key Private, don’t share! CA Certificate Which certificate authority verified your identity?
- 26. Where do I get one? Default agent certs SSL dir: /etc/puppetlabs/puppet/ssl/ Certificate: certs/<agent_name>.pem Key: private_keys/<agent_name>.pem CA cert: certs/ca.pem
- 27. Where do I get one? Make your own: #demo 3 `puppet cert generate lizzi`
- 28. Components of an HTTP request Verb GET, PUT, POST, DELETE URL protocol, host, port, and route Data headers, body, or query params Auth HTTPS, certificate, key, CA certificate
- 29. cd /etc/puppetlabs/puppet/ssl curl -X GET --cert ./certs/lizzi.pem --key ./private_keys/lizzi.pem --cacert ./certs/ca.pem https://learning...vm:4433/status/v1/services Let’s request status with SSL now #demo 4
- 30. But wait, there’s more!
- 31. Authentication and authorization SSL need: certificate, key, CA certificate Whitelist
- 32. Certificate whitelist determines if certificate holder has access to an endpoint. Status API doesn’t use a whitelist, but many other routes will, including PuppetDB routes. Authorization
- 33. Authentication and authorization SSL need: certificate, key, CA certificate Whitelist need: SSL, add certificate to whitelist
- 34. Console status RBAC NC Activity PuppetDB API Puppet Server Puppet CA Can be configured for HTTP Must use HTTPS rbac-certificate-whitelist Services Overview certificate-whitelist ca.conf pe-puppet-server.conf #demo 5 :4433:8123:8140:8081 :4433 :8080
- 35. Components of an HTTP request Verb GET, PUT, POST, DELETE URL protocol, host, port, and route Data headers, body, or query params Auth HTTPS, certificate, key, CA certificate, cert whitelisting
- 36. curl -X GET --cert ./certs/lizzi.pem --key ./private_keys/lizzi.pem --cacert ./certs/ca.pem --data-urlencode query='["and", ["=", "name", "osfamily"], ["=", "value", "RedHat"]]' https://learning...vm:8081/pdb/query/v4/facts Let’s query PuppetDB #demo 6
- 37. Components of an HTTP request Verb choose: GET, PUT, POST, DELETE URL need: protocol, host, port, and route Data might need: headers, body, or query params Auth can use: HTTPS and cert whitelisting
- 38. API-only LDAP StartTLS feature https://learning...vm:4433/rbac-api GET /v1/ds > ds.json PUT /v1/ds --data @ds.json Let’s access some new features #demo 7,8 docs 1
- 39. https://learning...vm:4433/classifier-api GET /v1/groups > groups.json POST /v1/import-hierarchy --data @groups.json POST /v1/groups using API-only trusted and structured facts! Let’s do something with groups #demo 9,10,11 docs 2
- 40. `curl --verbose` for more information A brief note on responses 404 200 303
- 41. All the APIs and their documentation API Features Auth Docs Puppet Server Master, certificate authority ca.conf, auth.conf Puppet HTTP API Guide Console Node groups, access control, activity logging Certificate whitelist, cookies (UI) Node Classifier API Endpoints RBAC Service API Endpoints Activity Service API Endpoints PuppetDB Query data, reports Certificate whitelist PuppetDB API Overview
- 42. • No cert whitelist management required • Uses access control - configurable permissions • Doesn’t require root access to nodes like certs • Only available for some APIs, rolling out for more Making it easier: tokens coming soon! 100010 101011 010 111100 111010 111
- 43. Look out for new APIs in the future! API v11
- 44. Now it's your turn!