vRealize Orchestrator 7 User Guide: Authentication

Last updated
Save as PDF

The Pure Storage Plugin for vRealize Orchestrator provides a few things:

Default workflows for running common tasks
Discrete actions for assembling common functions together to create workflows
JavaScript libraries to create very customized workflows
REST API libraries to make specific REST calls that are not included in the JavaScript libraries
Integrated authentication
Integrated and synchronized inventory of Pure Storage environments

To perform most tasks in the plugin, authentication needs to be configured first. The Pure Storage Plugin supports authentication via the following targets:

Pure1
FlashArray (or Cloud Block Store--authentication is the same)
FlashBlade

If you have many FlashArrays, FlashBlades, or Cloud Block Store instances, they can be be registered in an automated fashion via a Pure1 connection. For details on that process refer to the section on Fleet Registration towards the bottom of this page.

Network Requirements

To authenticate a Pure1 connection the following is required:

TCP Port 443 access to pure1.purestorage.com from vRealize Orchestrator

To authenticate a FlashArray or Cloud Block Store connection the following is required:

TCP Port 443 access to the virtual IP address (this can be virtual IP address 0 or 1) of the target FlashArray from vRealize Orchestrator

To authenticate a FlashBlade connection the following is required:

TCP Port 443 access to the virtual IP address (this can be virtual IP address 0 or 1) of the target FlashBladey from vRealize Orchestrator
If you plan to generate a FlashBlade API token directly from vRO you will need TCP port 22 opened as well.

Authenticating with Pure1

Adding a Pure1 Connection

The 3.5.0 release of the Pure Storage Plugin for vRealize Orchestrator adds support for connectivity to the Pure1 REST API. The Pure1 REST API provides additional information about your fleet of storage as well as metrics and metadata not available directly from the arrays themselves. Pure1 authentication is not required, but recommended to fully take advantage of the plugin.

Generating a Key Pair

The Pure1 REST API uses RSA256 private/public key-based authentication. In order to authenticate an application with Pure1, a public key must be configured within Pure1 that corresponds to the private key configured within that application. There are a variety of mechanisms to do this, but the Pure Storage Plugin for vRealize Orchestrator (from now on will be shortened to "vRO Plugin") provides the ability to do this. You do not have to use this procedure, but this is the simplest in context to vRO.

Login to the vRealize Orchestrator interface and navigate to the workflow named Generate RSA Key under Library > Pure Storage > Pure1 Meta > Pure Organization Management:

Right-click on the workflow and click Start Workflow

The only option in the workflow is to choose if the workflow outputs the private key as a secure string or as a regular string. If you plan on copying the key and storing it externally, choose No (most common). If you have included this workflow in a larger one, it is recommended to keep this as Yes (default) so that vRO passes the private key in a secure fashion.

Choose your option and click Submit.

Under the Variables tab of the workflow run, click on the value of the publicKeyOutput.

Triple-click on the value so that the full public key is highlighted in dark blue and type Ctrl-C (or the relative command for your OS) on your keyboard to copy the contents.

Do the same thing with the private key (privateKeyOutput) and store the key for later.

Adding a Public Key to Pure1

Login to Pure1 as an administrator. If you are not an administrator, provide the key to your admin and have them follow this section.

https://pure1.purestorage.com

On the left-hand side, click on API Registration under the Administration section. If you do not see this, you are not a Pure1 administrator.

Click on Register Application

Give the application a name (something descriptive) and paste in the public key. Currently when you copy the key it removes the new lines between -----BEGIN PUBLIC KEY----- and the key itself and the key and -----END PUBLIC KEY-----. You need to replace the space with a new line.

When you paste it in:

So select the space after -----BEGIN PUBLIC KEY-----:

And hit enter while it is still selected.

Then do the same for before the -----END PUBLIC KEY-----:

While selected, hit enter. This will move it to a new line.

Note the requirement to edit the key formatting is something we plan to fix in a future release.

Now choose either Admin or Read Only. It is recommended to make the application admin (this will allow you to create tags from vRO) but not required.

Click Upload.

Now identify the key in the table and find the application ID. Copy it and return to vRealize Orchestrator.

Authenticating a Pure1 Connection

Run the workflow called Add Pure1 Organization under Library > Pure Storage > Pure1 Meta > Pure1 Organization Management.

Add a name for the organization (no spaces).

There are two ways to authenticate Pure1. Either enter in a private key and the Pure1 application ID generated from its public key (from the process above) or you can paste in a JSON Web Token. A JSON Web Token (JWT) is generated from the application ID and the private key (instructions on creating a JWT can be found here).

The benefit of using a private key directly is that the connection is valid as long as the public key is still configured in Pure1. There is no set expiration. This is the simplest option as you also do not need to generate (or have someone generate) a JWT. The JWT option is better for organizations with stricter access control. A JWT can have an expiration and therefore an admin provisioning authentication to vRO can provide a JWT that is good for 3 months (for instance). Once it expires they will need request a new JWT. The benefit to that is stricter control. The downside is that you must monitor your expiration and replace it as needed.

To enter in a private key keep the option as No. To enter a JWT, choose Yes. Click Next.

Paste in your private key and you application ID, or a JWT, depending on the previously selected method.

Click Submit.

This will add the organization.

If you click on the Inventory tab, and expand Pure Storage, you will see the new Pure1 organization. You may add more than one organization, but a given organization can only be added once.

Note that existing FlashArray, FlashBlade, or Cloud Block Store connections will not be moved into a Pure1 organization if it was registered before Pure1 was. Also if an array is moved to a new organization by Pure Storage support, vRO will not automatically respond and move the connection. To move a connection into the correct Pure1 organization once the Pure1 has been authenticated, run the Update FlashArray Connection or Update FlashBlade Connection and it will automatically be placed in the correct organization.

Permission Requirements of a Pure1 Connection

There are two levels of permissions needed for Pure1 authentication. First, there needs to be a user with Pure1 login credentials who is an administrator in your Pure1 organization. If you are unsure who your administrator is, contact Pure Storage Support. Once the administrator logs in, they should see the Administration section on the lower-left of the Pure1 screen. If they do not, they are not an admin.

Having an admin level REST application ID does not provide this ability--this is separate from a Pure1 login administrator and has less privileges. Once logged in, an administrator creates an application ID with a certain level of permissions--as of the writing of this document it is either Admin or Read Only.

Today there is not a significant difference between the two levels. An admin application ID can create, delete or edit tags plus everything else in the REST API. A read only user cannot create, edit, or delete tags, only read them. In short, a read only application ID cannot do anything besides authenticate and run GET-type REST operations as described in the Pure1 REST API Swagger:

https://static.pure1.purestorage.com/api-swagger/index.html

The vRO Plugin has workflows to tag arrays in Pure1, so to use that functionality it is recommended to generate application IDs with administrative permissions--but it is only needed if you plan to orchestrate tagging through vRO.

Updating a Pure1 Connection

To update a Pure1 Connection navigate to the Inventory within vRO, select the desired Pure1 organization, and click Run workflow.

From here, choose Update Pure1 Organization and click Select.

From here, enter in the changes you would like to make (rename, changing private key/application ID, update JWT, or switch from one authentication option to the other).

Click Submit when you have entered in your desired changes.

Removing a Pure1 Connection

To remove a Pure1 Connection navigate to the Inventory within vRO, select the desired Pure1 organization, and click Run workflow.

From here, choose Remove Pure1 Organization and click Select.

Confirm the selected Pure1 organization and click Submit.

If the workflow finds any remaining FlashArray, Cloud Block Store, or FlashBlade connections it will ask for additional input after the workflow has began.

Click Answer.

This will ask if you want all identified connections to also be removed. The default is No. If you choose No the connections will be moved to the Uncategorized organization. If you choose Yes they will be removed entirely.

Automated Fleet Authentication via Pure1

If you have more than one array, the vRO plugin offers an automated way to authenticate all of your arrays. Once you have authenticated a Pure1 organization, there is a workflow called Register FlashArrays from Pure1 under Library > Pure Storage > Pure1 Meta > Array Registration.

Right-click on the workflow and click Start Workflow.

There are a few required inputs:

Pure1 Connection. Specify the Pure1 organization from which you would like to register the arrays.	Use same credentials? If one set of credentials is valid for all targets, you can specify them here. If not, choose No and it will not require credentials. They can be added one at a time during the workflow	Resolve IPs? Pure1 (currently) does not offer the FQDN of arrays, only the IP. The vRO workflow will attempt to do a DNS lookup of the IPs and use the identified FQDN. If the lookup fails, it will use the IP. If you would like it to skip arrays that it cannot resolve, choose No.

When ready click Submit.

If you have chosen to specify credentials one at a time, or the credentials are wrong, it will prompt for credentials for arrays that the credentials are not valid for. You will see the workflow is waiting for input by the person icon next to the workflow run:

You can right-click on it and choose Answer to enter credentials.

Enter the credentials and click Submit.

You can choose to skip arrays if you prefer that cannot be authenticated with the specified credentials.

Once done, all of the arrays in that organization will be authenticated and added to the Pure1 organization in the vRO inventory.

There are a few points to make about this workflow:

This is only supported for FlashArray and Cloud Block Store. FlashBlades will be skipped. Inclusion of FlashBlades will come in a future release.
Arrays that cannot be reached on the network will be skipped.
Arrays that are already registered will be skipped.
The workflow will automatically import certificates.
There is no option to choose a REST version--it will automatically choose the latest available on that target.

Authenticating with a FlashArray or Cloud Block Store

Adding a FlashArray Connection

If you do not have access to Pure1, or you want to customize the FlashArray connections as added, you can manually authenticate each FlashArray or Cloud Block Store storage platform. To do so, navigate to the Import FlashArray certificate from URL workflow under Library > Pure Storage > FlashArray Connection Management. Right-click and choose Start workflow:

Enter in the FQDN of the FlashArray management address and choose whether or not to accept an untrusted certificate. Click Submit.

Now right-click on the workflow Add FlashArray Connection and choose Start workflow.

Enter in the following pieces of information:

Name. This is a friendly name and can be anything.
IP/FQDN. Enter in whatever you entered when adding the certificate.
REST API version. If you have added the certificate, the workflow will pull all available REST API versions and will choose the latest available on on that array. If this list does not show up (make sure autopopulate is set to yes), it means either the certificate was not loaded, or the IP/FQDN was entered incorrectly.
Credentials. Enter in a user name and password.

The vRO Plugin does not yet support REST API version 2.x on the FlashArray so those versions are filtered out. Support for that will be in a future release.

Click Submit to add the FlashArray.

Once added it will appear in the vRO inventory. Navigate to the inventory tab, then click on Pure Storage. A FlashArray will be added to the Pure1 organization owning it if the Pure1 organization is authenticated in vRO. If it is not, it will be added to the default group called Uncategorized. Both FlashArrays and Cloud Block Storage connections will appear under the FlashArray Connection folder.

Permission Requirements of a FlashArray Connection

A FlashArray or Cloud Block Store supports a variety of permission levels:

While vRO does not require a certain level, the higher level credentials you provide, the more you can do with the plugin. If you plan on orchestrating array configuration or pod creation/management, you will need array admin permissions. If you plan to only configure and provision storage, storage admin will suffice.

It is recommended, however, to create a local service account (or through LDAP/active directory) to authenticate the plugin.

Updating a FlashArray Connection

To update a FlashArray connection find the FlashArray connection in the vRO inventory and right-click and choose Run Workflow or select it and click the green start button on the top panel:

Find Update FlashArray Connection and click Select.

Update the credentials, name, FQDN, REST version as needed. No matter what, you must re-enter valid credentials to complete any change.

Running an update connection on a connection will also ensure the array is in the right Pure1 organization. So if it is currently in the Uncategorized organization because its owning organization was not yet registered in vRO, but is subsequently, when the update connection workflow is run, the connection will be moved to the right organization.

Removing a FlashArray Connection

To remove a FlashArray or Cloud Block Store connection one at a time, find the FlashArray connection in the vRO inventory and select it and click on the green button on the top of the panel or right-click and choose Run Workflow:

To remove all FlashArray or Cloud Block Store connections within a specific Pure1 connection, you can remove the Pure1 connection and opt to also remove all children connections.

Choose Remove FlashArray Connection and click Select.

Verify that this is the correct FlashArray or Cloud Block Store connection and click Submit.

This completes the process to remove the connection.

Authenticating with a FlashBlade

Adding a FlashBlade Connection

Authentication with a FlashBlade uses an API token which can be generated or pulled via a user name and password. The API token cannot be retrieved through the API--only through SSH to the FlashBlade. The vRO Plugin has the ability to do this, but it means that port 22 TCP to the FlashBlade must be open from the vRO appliance in addition to port 443 TCP for the REST connection.

Retrieve a FlashBlade API Token

If you do not have a FlashBlade API token, but you do have a username and password to the FlashBlade, you can either login to the FlashBlade via SSH directly and retrieve it, or you can use the vRO Plugin to do so. To generate (or retrieve) an API token, run the workflow called Create FlashBlade Token under Library > Pure Storage > FlashBlade Connection Management.

Right-click on it and choose Start workflow

Enter in the FlashBlade IP or FQDN and valid credentials.

Click Submit. This will either retrieve the token for that user or create a new one and return it. You can go into the logs and copy the token from the log line showing the token:

Copy it.

Import the FlashBlade Certificate

Before adding a FlashBlade, you must import its certificate. To do so, navigate to the Import FlashBlade certificate from URL workflow under Library > Pure Storage > FlashBladeConnection Management. Right-click and choose Start workflow:

Enter in the FQDN of the FlashBlade management address and choose whether or not to accept an untrusted certificate. Click Submit.

Authenticate the FlashBlade

To authenticate a FlashBlade, run the workflow called Add FlashBlade Connection under Library > Pure Storage > FlashBlade Connection Management.

Right-click on it and choose Start workflow

Enter in the following pieces of information:

Name. This is a friendly name and can be anything.
IP/FQDN. Enter in whatever you entered when adding the certificate.
REST API version. If you have added the certificate, the workflow will pull all available REST API versions and will choose the latest available on on that array. If this list does not show up (make sure autopopulate is set to yes), it means either the certificate was not loaded, or the IP/FQDN was entered incorrectly.
API token. Enter in an API token.

If the certificate is self-signed, it will ask you to reconfirm that the certificate is valid.

If a Pure1 organization that owns that FlashBlade is registered, it will be added to it automatically. If not, it will be added the the Uncategorized organization:

To move the FlashBlade into a correct organization once that Pure1 organization has been added, run the Update FlashBlade Connection workflow and it will be automatically placed in the right organization.

Permission Requirements of a FlashBlade Connection

A FlashBlade supports a variety of permission levels:

While vRO does not require a certain level, the higher level credentials you provide, the more you can do with the plugin. If you plan on orchestrating array configuration, you will need array admin permissions. If you plan to only configure and provision storage, storage admin will suffice.

Updating a FlashBlade Connection

To update a FlashBlade connection, run the workflow called Update FlashBlade Connection under Library > Pure Storage > FlashBlade Connection Management.

Right-click on it and choose Start workflow

In the FlashBlade Connection input, click in the search (on Not set) to find the correct FlashBlade

Find the FlashBlade connection and click Select

Update the API token or name. You do not need to re-enter the API token to change the name.

Click Submit to make the change.

Removing a FlashBlade Connection

To remove a FlashBlade connection one at a time, find the FlashBlade connection in the vRO inventory and select it and click on the green button on the top of the panel or right-click and choose Run Workflow:

To remove all FlashBlade connections within a specific Pure1 connection, you can remove the Pure1 connection and opt to also remove all children connections.

Choose Remove FlashBlade Connection and click Select.

Verify that this is the correct FlashBlade connection and click Submit.

This completes the process to remove the connection.