...

Controller Deployment Script

The script is offered for download and can be applied for frequently used deployment operations:

• The script is available for Linux and MacOS® using bash shell.
• The script terminates with exit code 0 to signal successful execution, with exit code 1 for command line argument errors and with exit code 4 for non-recoverable errors. Exit code 3 signals that no matching objects have been found.
• The script is intended as a baseline example for customization by JS7 users and by SOS within the scope of professional services. Examples make use of JS7 Release 2.7.2, bash 4.2, curl 7.29.0 and jq 1.6.0.
  

...

Usage: deploy-controller.sh [Command] [Options] [Switches]

  Commands:
    register          --primary-url    [--primary-cluster-url]   [--primary-title]
                     [--secondary-url] [--secondary-cluster-url] [--secondary-title]
    unregister        --controller-id
    check             --controller-id --controller-url
    store-agent       --controller-id --agent-id --agent-name --agent-url [--title] [--alias] [--process-limit] [--hide]
    ..                --controller-id --agent-id --agent-name [--title] [--alias] [--process-limit]
                      --primary-subagent-id   --primary-url   [--primary-title]
                      --secondary-subagent-id --secondary-url [--secondary-title]
    delete-agent      --controller-id --agent-id
    deploy-agent      --controller-id --agent-id [--cluster]
    revoke-agent      --controller-id --agent-id [--cluster]
    store-subagent    --controller-id --agent-id --subagent-id --subagent-url [--title] [--role]
    delete-subagent   --controller-id --subagent-id
    store-cluster     --controller-id --cluster-id --agent-id --subagent-id [--priority] [--title]
    delete-cluster    --controller-id --cluster-id
    deploy-cluster    --controller-id --cluster-id
    revoke-cluster    --controller-id --cluster-id
    export-agent      --controller-id --file [--format] --agent-id
    import-agent      --controller-id --file [--format] [--overwrite]
    encrypt           --in [--infile --outfile] --cert [--java-home] [--java-lib]
    decrypt           --in [--infile --outfile] --key [--key-password] [--java-home] [--java-lib]

  Options:
    --url=<url>                        | required: JOC Cockpit URL
    --user=<account>                   | required: JOC Cockpit user account
    --password=<password>              | optional: JOC Cockpit password
    --ca-cert=<path>                   | optional: path to CA Certificate used for JOC Cockpit login
    --client-cert=<path>               | optional: path to Client Certificate used for login
    --client-key=<path>                | optional: path to Client Key used for login
    --timeout=<seconds>                | optional: timeout for request, default: 60
    --controller-id=<id[,id]>          | required: Controller ID
    --controller-url=<url>             | optional: Controller URL for connection test
    --primary-url=<url>                | optional: Primary Controller/Director Agent URL
    --primary-cluster-url=<url>        | optional: Primary Controller Cluster URL
    --primary-title=<string>           | optional: Primary Controller/Director Agent title
    --primary-subagent-id=<id>         | optional: Primary Director Agent Subagent ID
    --secondary-url=<url>              | optional: Secondary Controller/Director Agent URL
    --secondary-cluster-url=<url>      | optional: Secondary Controller Cluster URL
    --secondary-title=<string>         | optional: Secondary Controller/Director Agent title
    --secondary-subagent-id=<id>       | optional: Secondary Director Agent Subagent ID
    --file=<path>                      | optional: path to export file or import file
    --format=<ZIP|TAR_GZ>              | optional: format of export file or import file
    --agent-id=<id[,id]>               | optional: Agent IDs
    --agent-name=<name>                | optional: Agent name
    --agent-url=<url>                  | optional: Agent URL
    --title=<string>                   | optional: Agent title or Subagent Cluster title
    --alias=<name[,name]>              | optional: Agent alias name
    --process-limit=<number>           | optional: Agent max. number of parallel processes
    --subagent-id=<id[,id]>            | optional: Subagent ID
    --subagent-url=<url>               | optional: Subagent URL
    --role=<primary|secondary|no>      | optional: Subagent role acting as Primary/Secondary Director Agent
    --cluster-id=<id>                  | optional: Subagent Cluster ID
    --priority=<first|next>            | optional: Subagent Cluster priority: active-passive, active-active
    --key=<path>                       | optional: path to private key file in PEM format
    --key-password=<password>          | optional: password for private key file
    --cert=<path>                      | optional: path to certificate file in PEM format
    --in=<string>                      | optional: input string for encryption/decryption
    --infile=<path>                    | optional: input file for encryption/decryption
    --outfile=<path>                   | optional: output file for encryption/decryption
    --java-home=<directory>            | optional: Java Home directory for encryption/decryption, default: $JAVA_HOME
    --java-lib=<directory>             | optional: Java library directory for encryption/decryption, default: ./lib
    --audit-message=<string>           | optional: audit log message
    --audit-time-spent=<number>        | optional: audit log time spent in minutes
    --audit-link=<url>                 | optional: audit log link
    --log-dir=<directory>              | optional: path to directory holding the script's log files

  Switches:
    -h | --help                        | displays usage
    -v | --verbose                     | displays verbose output, repeat to increase verbosity
    -p | --password                    | asks for password
    -k | --key-password                | asks for key password
    -o | --overwrite                   | overwrites objects on import
    -i | --hide                        | hides Agent
    -c | --cluster                     | signalsspecifies a Cluster Agent
    --show-logs                        | shows log output if --log-dir is used
    --make-dirs                        | creates directories if they do not exist

see https://kb.sos-berlin.com/x/9YZvCQ

Anchor
commands commands

Commands

...

• --url
  • Specifies the URL by which JOC Cockpit is accessible using <http|https>://<host>:<port>.
  • Example: http://centostest-primary.sos:4446
  • Example: https://centostest-primary.sos:4443
• --user
  • Specifies the user account for login to JOC Cockpit. If JS7 - Identity Services are available for Client authentication certificates that are specified with the --client-cert and --client-key options then their common name (CN) attribute has to match the user account.
  • If a user account is specified then a password can be specified using the --password option or interactive keyboard input can be prompted using the -p switch.
• --password
  • Specifies the password used for the account specified with the --user option for login to JOC Cockpit.
  • Password input from the command line is considered insecure.
    • Consider use of the -p switch offering a secure option for interactive keyboard input.
    • Consider use of the encrypt command to encrypt a password: ./deploy-workflowcontroller.sh encrypt --in=root --cert=encrypt.crt.
      • The encryption result will include the prefix enc: followed by the encrypted symmetric key, initialization vector and encrypted secret separated by space.
      • If an encrypted password is specified, then it will be decrypted using the Private Key file: ./deploy-workflowcontroller.sh <command> --password="enc:BF8J8KP7TPlxy..." --key=encrypt.key.
• --ca-cert
  • Specifies the path to a file in PEM format that holds the Root CA Certificate and optionally Intermediate CA Certificates to verify HTTPS connections to JOC Cockpit.
• --client-cert
  • Specifies the path to a file in PEM format that holds the Client Certificate if HTTPS mutual authentication is used..
• --client-key
  • Specifies the path to a file in PEM format that holds the Client Private Key if HTTPS mutual authentication is used..
• --timeout
  • Specifies the maximum duration for requests to the JS7 REST Web Service. Default: 60 seconds.
• --controller-id
  • Specifies the identification of the Controller.
• --controller-url
  • When used with the check command, specifies the protocol, host and optionally port of the Controller instance to which the connection is tested.
• --primary-url
  • When used with the register command, specifies the protocol, host and optionally port of a Standalone Controller or Primary Controller instance in a cluster. The JOC Cockpit will connect to the Controller instance using the URL specified.
  • When used with the store-agent command for an Agent Cluster, specifies the protocol, host and optionally port of the Primary Director Agent. The Controller will connect to the Director Agent instance using the URL specified.
• --primary-cluster-url
  • Specifies the URL used by the Pirmary Controller instance to connect to the Secondary Controller instance in a cluster. The URL can be specified if it is different from the value specified with the --primary-url option used for access from JOC Cockpit to the Primary Controller instance.
  • .The option can be used for example if a proxy service is active between Controller instances.
• --primary-title
  • When used with the register command specifies the title of a Standalone Controller or Primary Controller instance.
  • When used with the store-agent command specifies the title of the Primary Director Agent in an Agent Cluster.
• --primary-subagent-id
  • When used with the store-agent command specifies the identifier of the Primary Director Agent in an Agent Cluster.
• --secondary-url
  • When used with the register command, specifies the protocol, host and optionally port of a Secondary Controller instance in a cluster. The JOC Cockpit will connect to the Controller instance using the URL specified.
  • When used with the store-agent command for an Agent Cluster specifies the protocol, host and optionally port of the Secondary Director Agent. The Controller will connect to the Director Agent instance using the URL specified.
• --secondary-cluster-url
  • Specifies the URL used by the Secondary Controller instance to connect to the Primary Controller instance in a cluster. The URL can be specified if it is different from the value specified with the --secondary-url option used for access from JOC Cockpit to the Secondary Controller instance.
  • .The option can be used for example if a proxy service is active between Controller instances.
• --secondary-title
  • When used with the register command, specifies the title of the Secondary Controller instance.
  • When used with the store-agent command, specifies the title of the Secondary Director Agent in an Agent Cluster.
• --secondary-subagent-id
  • When used with the store-agent command, specifies the identifier of the Secondary Director Agent in an Agent Cluster.
• --file
  • Specifies the location of an archive file that is used with export-agent and import-agent commands.
  • On export an existing archive file will be overwritten.
• --format
  • Specifies the format of the archive file indicated with the --file option.
  • The format can be one of ZIP or TAR_GZ. Default: ZIP. The JS7 can process archive files in .zip format on Unix.
• --agent-id
  • The Agent ID specifies a unique identifier for a Standalone Agent or Agent Cluster that cannot be changed later on.
  • Agents are identified from their Agent ID.
• --agent-name
  • The Agent name specifies a unique identifier for a Standalone Agent or Agent Cluster that can be changed later on..
• --agent-url
  • When used with the store-agent command, the option specifies the protocol, host and optionally port of a Standalone Agent.
• --title
  • Specifies the title of a Controller, Agent or Subagent Cluster with related register, store-agent and store-cluster commands.
• --alias
  • When used with the store-agent command, the option specifies alternative names for a Standalone Agent or Agent Cluster. Any number of alias names can be specified separated by comma.
  • Alias names can be used for assignment of Agents to jobs.
• --process-limit
  • Specifies the maximum number of processes running in parallel in a Standalone Agent or Agent Cluster.
  • In an Agent Cluster the maximum number of processes is counted for all Subagents.
• --subagent-id
  • When used with the store-subagent and delete-subagent commands, the option specifies the related Subagent.
  • When used with the store-cluster command, any number of Subagent IDs can be specified separated by comma. This allows to specify Subagents that are members of a Subagent Cluster.
• --subagent-url
  • The option is used with the store-subagent command to specify the proocol, host and port by which the Subagent can be reached.
• --role
  • When used with the store-subagent command, the option specifies the Subagent's role can be specified. In an Agent Cluster we find the following roles:
    • Primary Director Agent
    • Secondary Director Agent
    • No Director Agent
  • The option accepts the values primary, secondary, no. Default: no.
• --cluster-id
  • Specifies the unique identifier of a Subagent Cluster. The Subagent Cluster ID cannot be changed after the Subagent Cluster is created.
  • The option is used with the store-cluster , delete-cluster, deploy-cluster and revoke-cluster commands.
• --priority
  • Specifies an active-passive or , active-active or metrics Subagent Cluster. The option accepts one fo of the values first  (active-passive) or , next (active-active) or a metrics expression. Default: first.
  • The option is used with the store-cluster command.
• --key
  • When used with the decrypt command, specifies the path to a file that holds the Private Key used for decrypting in PEM format used for decryption.
• --cert
  
  • When used with the encrypt command, specifies the path to a file that holds the CA-signed or self-signed X.509 Certificate. Alternatively, the path to a file holding the Public Key can be specified. The Certificate or Public Key is expected in PEM format.
  • For encryption the Certificate or Public Key must match the Private Key used for later decryption specified with the --key option.
• --key-password
  • When used with the decrypt command, specifies the password for access to the key the Private Key file using the --key option.
  • Password input from the command line is considered insecure.
    • Consider use of the -k switch or more elaborate mechanisms, for example by temporarily populating the system keystore form a security key such as a YubiKey® or similar.
    • Consider use of encrypted passwords as explained with the --password option.
• --in
  • When used with the encrypt and decrypt commands, specifies the input value that should be encrypted or decrypted.,
  • One of the options --in or --infile can be specified.
• --infile
  • When used with the encrypt and decrypt commands, specifies the path to the input file that should be encrypted/decrypted.
  • One of the options --in or --infile can be specified. This option requires use of the --outfile option.
• --outfile
  • When used with the encrypt command, specifies the path to the output file that will be created holding the encrypted content of the input file.
  • When used with the decrypt command, specifies the path to the output file that will be created holding the decrypted content of the input file.
  • The option is required if the --infile option is specified
• --java-home
  • When used with the encrypt and decrypt commands or with encrypted passwords, specifies the Java home directory. By default the JAVA_HOME environment variable is used to determine the location of Java.
  • The Java home directory is the top-level directory of a Java installation. The directory includes the bin sub-directory and java executable.
• --java-lib
  • When used with the encrypt and decrypt commands or with encrypted passwords, a number of Java libraries are required to perform encryption/decryption.
  • The Java libraries are expected in the lib sub-directory of the JS7 Unix Shell CLI. Default: ./lib.
• --audit-message
  • Specifies a message that is made available to the Audit Log.
  • Specification of Audit Log messages can be enforced on a per user basis and for a JS7 environment.
• --audit-time-spent
  • Specifies the time spent to perform an operation which is added to the Audit Log.
  • The option can be specified if the --audit-message option is used.
• --audit-link
  • Specifies a link (URL) which is added to the Audit Log.
  • The option can be specified if the --audit-message option is used.
• --log-dir
  • If a log directory is specified then the script will log information about processing steps to a log file in this directory.
  • File names are created according to the pattern: deploy-workflowcontroller.<yyyy>-<MM>-<dd>T<hh>-<mm>-<ss>.log
  • For example: deploy-workflowcontroller.2022-03-19T20-50-45.log

Anchor
switches switches

Switches

...

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# export Agents from their Agent ID
./deploy-controller.sh export-agent "${request_options[@]}" \
    --file=export_agents.zip --agent-id=StandaloneAgent,AgentCluster

# import Agents
./deploy-controller.sh import-agent "${request_options[@]}" --file=export_agents.zip

...

Using encrypted Passwords

• Secrets can be encrypted and decrypted as explaind with JS7 - Encryption and Decryption.
• Encryption/decryption require related Java libraries that are available from the ./lib sub-directory.
• For creation of a Private Key and Certificate see JS7 - How to create X.509 Encryption Keys.
  
  

# create Private Key
openssl ecparam -name secp384r1 -genkey -noout -out encrypt.key

# create Certificate Signing Request, adjust the subject to your needs
openssl req -new -sha512 -nodes -key encrypt.key -out encrypt.csr -subj "/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=Encrypt"

# create Certificate, adjust the validity period to your needs
openssl x509 -req -sha512 -days 1825 -signkey encrypt.key -in encrypt.csr -out encrypt.crt -extfile <(printf "keyUsage=critical,keyEncipherment,keyAgreement\n")


# encrypt athe secret such as a passwordpassword "root" using the Certificate, the encryption result will be returned and will look like: enc:BEXbHYa...
MY_JS7_PASSWORD=$(./deploy-controller.sh  encrypt --in="root" --cert=encrypt.crt)

# store optionsthe forenvironment connectionvariable to your the JS7 REST API can specifyprofile ($HOME/.bash_profile or similar) to make the encryptionencrypted resultpassword asavailable password andto the Privateshell
# Key for decryption
request_export MY_JS7_PASSWORD=enc:BEXbHYa...


# options for connection to the JS7 REST API can specify the encryption result as password and the Private Key for decryption
request_options=(--url=http://localhost:4446 --user=root --password="enc:BEXbHYa...$MY_JS7_PASSWORD" --key=encrypt.key --controller-id=controller)

 # for example, when exporting Agents the Private Key is used to decrypt the password on-the-fly for access to the REST API on-the-fly
./deploy-controller.sh export-agent "${request_options[@]}" --file=export_agents.zip --agent-id=StandaloneAgent,AgentCluster

# decrypt an encrypted secret using the Private Key
./deploy-controller.sh decrypt --in="enc:BEXbHYa..." --key=encrypt.key

Resources

• API
  • JS7 - REST Web Service API
  • JS7 - PowerShell Module
• Controller Status Operations
  • JS7 - Unix Shell CLI for Controller Status Operations
• Workflow Deployment Operations
  • JS7 - Unix Shell CLI for Workflow Deployment
• Workflow Status Operations
  • JS7 - Unix Shell CLI for Workflow Status Operations
• Identity Service Deployment Operations
  • JS7 - Unix Shell CLI for Identity Service Deployment
• JOC Cockpit Status Operations
  • JS7 - Unix Shell CLI for JOC Cockpit Status Operations