...

• The JS7 offers to perform operations on orders, workflows, jobs and related objects Controllers and Agents by the JS7 - REST Web Service API.
  
  • For detailed information see the Technical Documentation of the REST Web Service API.
  • For available CLI operations see JS7 - Unix Shell Command Line Interface.
• The REST Web Service API can be accessed from Shell utilities such as curl.
• In addition, a PowerShell module is available for simplified access to the REST Web Service API. This is described in the JS7 - PowerShell Module article.

The Controller Status Operation Script offered for Unix Shell can be applied to perform frequently used status operations on Controllers and Agents.

Use of a Controller Cluster or Agent Cluster is subject to the JS7 - License.

Controller Status Operation Script

The script is offered for download and can be applied for frequently used status operations:

...

jq ships with the MIT license, see https://opensource.org/licenses/MIT.

Download

Download: JS7 - Download (Section: Unix Shell ClI)

Usage

Invoking the script without arguments displays the usage clause:

...

Usage: deployoperate-workflowcontroller.sh [Command] [Options] [Switches]

  Commands:
    exportterminate            --filecontroller-id [--format] --path --type [--use-short-pathcontroller-url] [--startswitch-folder] [--for-signing] over]
    ..  restart              --file [--format] --foldercontroller-id [--recursive] [--typecontroller-url] [--useswitch-short-path] [--for-signing]]over]
    cancel              --controller-id [--controller-url]
     cancel-restart      [--nocontroller-draft]id [--nocontroller-deployedurl] [--no-released] [--no-invalid]

    switch-over    import     --controller-id
    appoint-nodes   --file [--format] [--folder] [--overwrite] [--prefix] [--suffix]controller-id
    importconfirm-deployloss      --file [--format] [--folder] [--algorithm]controller-id
    deploycheck            --path --type [--date-from] [--nocontroller-draft]id [--nocontroller-deployed]url
    ..  enable-agent        --controller-id --agent-id
    disable-agent    --folder [--recursive] [--date-from] [--nocontroller-draft]id [--noagent-deployed]id
    revokereset-agent            --controller-pathid --typeagent-id [--force]
    ..switch-over-agent   --controller-id --agent-id
    confirm-loss-agent        --folder [--recursive]
    release   --controller-id --agent-id
    enable-subagent        --path controller--typeid [--datesubagent-from]id
    ..disable-subagent    --controller-id --subagent-id
    reset-subagent       --controller-folderid [--subagent-recursive]id [--date-fromforce]
    encrypt recall            --pathin [--type
    ..                --folderinfile --outfile] --cert [--java-home] [--recursivejava-lib]
    storedecrypt             --pathin [--typeinfile --file
    remove            --path --typeoutfile] --key [--key-password] [--java-home] [--datejava-fromlib]

  Options:
  ..  --url=<url>                --folder [--date-from]
    restore   | required: JOC Cockpit URL
    --path --type --new-path [--prefix] [--suffix]
user=<account>           ..        | required: JOC Cockpit user account
   --folder --new-path [--prefix] [--suffix]
password=<password>      delete        | optional: JOC  --path --typeCockpit password
    ..--ca-cert=<path>                --folder
   | revalidateoptional: path to CA Certificate used for JOC --folder [--recursive]

  Options:
    --url=<url>Cockpit login
    --client-cert=<path>               | optional: path to Client Certificate used for login
 | required: JOC Cockpit URL
 --client-key=<path>      --controller-id=<id[,id]>          | required: Controller IDoptional: path to Client Key used for login
    --user=<account>   timeout=<seconds>                | requiredoptional: timeout JOCfor Cockpitrequest, userdefault: account60
    --controller-passwordid=<password><id>               | optionalrequired: JOCController Cockpit passwordID
    --cacontroller-certurl=<path><url>             | optional: Controller URL for  | optional: path to CA Certificate used for JOC Cockpit loginconnection test
    --clientagent-cert=<path>id=<id[,id]>               | optional: path to Client Certificate used for loginAgent IDs
    --clientsubagent-key=<path>id=<id[,id]>                | optional: pathSubagent ID
  to Client Key--key=<path> used for login
    --timeout=<seconds>                | optional: timeoutpath for request, default: 60to private key file in PEM format
    --filekey-password=<path><password>          | optional: password for private key file
      | optional: path to export file or import file
--cert=<path>        --format=<ZIP|TAR_GZ>              | optional: formatpath ofto exportcertificate file orin importPEM fileformat
    --folder=<folder[,folder]>in=<string>          | optional: list of inventory folders holding objects
    --start-folder=<folder> | optional: input string for encryption/decryption
    --infile=<path>                    | optional: startinput folderfile for export with relative pathsencryption/decryption
    --path=<path[,path]>outfile=<path>                   | optional: listoutput offile inventory paths to objectsfor encryption/decryption
    --type=<type[,type]>java-home=<directory>               | optional: listJava ofHome objectdirectory types such as WORKFLOW,SCHEDDULEfor encryption/decryption, default: $JAVA_HOME
    --newjava-pathlib=<path><directory>                  | optional: Java library newdirectory object path on restorefor encryption/decryption, default: ./lib
    --audit-prefixmessage=<string>                  | optional: prefixaudit for duplicate objects on importlog message
    --audit-time-suffixspent=<string><number>        | optional: audit log time spent in minutes
   | optional: suffix for duplicate objects on import
 --audit-link=<url>          --algorithm=<identifier>           | optional: signatureaudit algorithm for import, default: SHA512withECDSAlog link
    --datelog-from=<date>   dir=<directory>              | optional: path to updatedirectory dailyholding planthe startscript's datelog for deploy/release operationfiles

  Switches:
    -h | -audit-message=<string>help           | optional: audit  log message
    --audit-time-spent=<number>    | displays usage
  | optional: audit-v log| time--verbose spent in minutes
    --audit-link=<url>              | displays verbose |output, optional:repeat auditto logincrease linkverbosity
    -p | -log-dir=<directory>password              | optional: path to directory holding the| script'sasks logfor files
password
  Switches:
    -hk | --helpkey-password                | asks for      | displays usagekey password
    -vo | --verboseswitch-over                 | switches over the |active displaysrole verboseto output,the repeat to increase verbositystandby instance
    -pf | --passwordforce                       | forces asksreset foron passwordAgent
    -r | -show-recursivelogs                   | specifies folders to be looked| upshows recursively
log output  if -o | -log-overwritedir                   | overwrites objects on importis used
    -s | -make-for-signing dirs                | exports objects for digital signing
    -u | --use-short-path              | exports relative paths
    --no-draft                         | excludes draft objects
    --no-deployed                      | excludes deployed objects
    --no-released                      | excludes released objects
    --no-invalid                       | excludes invalid objects
    --show-logs                        | shows log output if --log-dir is used
    --make-dirs                        | creates directories if they do not exist

...

• export
  • Allows to export objects such as workflows to an archive file in .zip or .tar.gz format. The command comes in two flavors:
    • export individual objects specified by the --path and --type options.
      • Should relative paths be used in the archive file then the --start-folder option and --use-short-path switch can be applied.
    • export objects from folders using the --folder option and --recursive switch.
      • Optionally one or more object types can be specified and otherwise all objects will be exported, see --type option.
      • Should relative paths be used in the archive file then the  --use-short-path switch can be applied.
      • Export of objects can further be limited by use of the --no-* switches, see section Switches.
  • The archive file is specified from the --file and --format options.
  • If JOC Cockpit is operated for the High Security Level then the --for-signing switch can be used to export Controller Objects that should be digitally signed. Objects and signatures can be imported using the import-deploy command.
• import
  • Imports an archive file to the inventory. The operation applies to use of JOC Cockpit with the Low and Medium Security Level.
  • Users can specify if existing objects will be overwritten or if duplicate objects from the import file will be assigned a prefix or suffix or will be ignored.
• import-deploy
  
  • Imports an archive file to the inventory and deploys the included objects. The operation is applicable if JOC Cockpit is operated for the High Security Level.
    • As a prerequisite the archive file must be exported using the --for-signing switch.
    • Workflows and Job Resources from the archive file are digitally signed by the user. Signature files are added to the archive file.
  • On import the objects in the archive file are deployed to related Controllers as specified during export.
• deploy
  • Allows to deploy Controller Objects such as workflows. The command can be used in two flavors:
    • deploy individual objects specified by the --path and --type options.
    • deploy objects from folders using the --folder option and --recursive switch.
  • Deploying objects forwards them to Controllers and Agents.
    • More than one Controller ID can be specified like this: --controller-id=controller-uat-1,controller-uat-2
• revoke
  • Allows to undeploy Controller Objects such as workflows. The command can be used in two flavors:
    • revoke individual objects specified by the --path and --type options.
    • revoke objects from folders using the --folder option and --recursive switch.
  • Revoking Controller objects deletes them from the Controller and Agents, objects remain in draft status in the inventory.
    • More than one Controller ID can be specified like this: --controller-id=controller-uat-1,controller-uat-2
• release
  • Allows to release Automation Objects such as schedules. The command can be used in two flavors:
    • release individual objects specified by the --path and --type options.
    • release objects from folders using the --folder option and --recursive switch.
  • Releasing objects activates them for example for use by the Daily Plan.
• recall
  • Allows to unrelease Automation Objects such as schedules. The command can be used in two flavors:
    • recall individual objects specified by the --path and --type options.
    • recall objects from folders using the --folder option and --recursive switch.
  • Recalling objects deactivates them from further use, objects remain in draft status in the inventory.
• store
  • Allows to store an object such as a workflow or schedule from a file to the inventory.
    • The --file option specifies the file that holds the JSON representation of an object.
    • The --type option specifies the object type. 
    • The --path option specifies the folders and object name of the objects inventory location.
  • Objects are stored to the inventory in draft status and can be deployed or released using the related commands.
• remove
  • Allows to remove objects such as workflows or schedules from the inventory. The command can be used in two flavors:
    • remove individual objects specified by the --path and --type options.
    • remove objects from folders recursively using the --folder option.
  • Controller objects such as workflows are removed from the Controller and from the inventory. Automation objects such as schedules are removed from the inventory.
  • Removing objects moves them to the trash from which they can be restored or deleted
• restore
  • Allows to restore objects such as workflows or schedules from the trash. The command can be used in two flavors:
    • restore individual objects specified by the --path and --type options.
    • restore objects from folders recursively using the --folder option.
  • Restoring objects moves them from the trash to the inventory from which they can be deployed or released.
• delete
  • Allows to delete objects such as workflows or schedules from the trash. The command can be used in two flavors:
    • delete individual objects specified by the --path and --type options.
    • delete objects from folders recursively using the --folder option.
  • Deleting objects will permanently wipe them from the trash.
• revalidate
  • Allows to revalildate objects such as workflows or schedules from the inventory, for example after import. The command can be used for inventory folders.

...

• --url
  • Specifies the URL by which JOC Cockpit is accessible using <http|https>://<host>:<port>.
  • Example: http://centostest-primary.sos:4446
  • Example: https://centostest-primary.sos:4443
• --user
  • Specifies the user account for login to JOC Cockpit. If JS7 - Identity Services are available for Client authentication certificates that are specified with the --client-cert and --client-key options then their common name (CN) attribute has to match the user account.
  • If a user account is specified then a password can be specified using the --password option or interactive keyboard input can be prompted using the -p switch.
• --password
  • Specifies the password used for the account specified with the --user option for login to JOC Cockpit.
  • Consider use of the -p switch offering a secure option for interactive keyboard input.
• --controller-id
  • Specifies the identification of the Controller that holds related orders.
  • More than one Controller ID can be specified, separated by comma, for the export operation when using the --for-signing switch.
• --ca-cert
  • Specifies the path to a file in PEM format that holds the Root CA Certificate and optionally Intermediate CA Certificates to verify HTTPS connections to JOC Cockpit.
• --client-cert
  • Specifies the path to a file in PEM format that holds the Client Certificate if HTTPS mutual authentication is used..
• --client-key
  • Specifies the path to a file in PEM format that holds the Client Private Key if HTTPS mutual authentication is used..
• --timeout
  • Specifies the maximum duration for requests to the JS7 REST Web Service. Default: 60 seconds.
• --file
  • Specifies the location of an archive file that is used with export, import and import-deploy commands.
  • On export an existing archive file will be overwritten.
• --format
  • Specifies the format of the archive file indicated with the --file option.
  • The format can be one of ZIP or TAR_GZ. Default: ZIP. The JS7 can process archive files in .zip format on Unix.
• --folder
  • Specifies the inventory folder used for the related operation.
    • Folder specification starts from a / followed by one or more sub-folders.
    • More than one folder can be specified using comma as in --folder=/ProductDemo/AgentCluster,/ProductDemo/ScheduledExecution.
  • When used with the import and import-deploy commands, a single folder can be specified that is prepended the folders included with the archive file.
• --start-folder
  • Specifies the inventory folder used for relative paths in archive files when using the export command with the --path option, see --use-short-path switch.
• --path
  • Specifies the path of an object such as a workflow, job resource, schedule. A path starts from a /, optionally followed by a hierarchy of sub-folders, and the object name.
  • Objects are identified from thier path and object type.
• --type
  • Specifies the object type such as a workflow or schedule that is indicated together with the --path option to identify an object.
    • Controller Object types include: WORKFLOW,FILEORDERSOURCE,JOBRESOURCE,NOTICEBOARD,LOCK
    • Automation Object types include: SCHEDULE,WORKINGDAYSCALENDAR,NONWORKINGDAYSCALENDAR,JOBTEMPLATE,INCLUDESCRIPT,REPORT
  • When used with the export command for folders then more than one object type can be specified separated by comma, for example --type=WORKFLOW,JOBRESOURCE
• --new-path
  • When used with the restore command, the new path is specified to which the object will be restored in the inventory.
• --prefix
  • When used with the import command, a prefix can be specified that is prepended all objects that are imported.
  • If an object with the same name and prefix exists, then the object will not be imported.
• --suffix
  • When used with the import command, a suffix can be specified that is appended all objects that are imported.
  • If an object with the same name and suffix exists, then the object will not be imported.
• --algorithm
  • When used with the import-deploy command, the signature algorithm is specified that was used to digitally sign objects. Default: SHA512withECDSA.
  • The algorithm name is made up of the hash algorithm name such as SHA256, SHA512 and the encryption type of the Private Key such as ECDSA or RSA.
  • This offers to specify the following algorithm names: SHA256withECDSA, SHA256withRSA, SHA512withECDSA, SHA512withRSA.
• --date-from
  • Specifies the date starting from which the Daily Plan will be updated:
    • The --date-from=now option value specifies that the Daily Plan will be updated for orders starting from now.
    • The Daily Plan date in ISO date format can be specified, for example --date-from=2023-10-23.
    • If omitted then the Daily Plan will not be updated.
  • Orders in the Daily Plan can be updated for example if the underlying workflow or schedule is changed.
• --audit-message
  • Specifies a message that is made available to the Audit Log.
  • Specification of Audit Log messages can be enforced on a per user basis and for a JS7 environment.
• --audit-time-spent
  • Specifies the time spent to perform an operation which is added to the Audit Log.
  • The option can be specified if the --audit-message option is used.
• --audit-link
  • Specifies a link (URL) which is added to the Audit Log.
  • The option can be specified if the --audit-message option is used.
• --log-dir
  • If a log directory is specified then the script will log information about processing steps to a log file in this directory.
  • File names are created according to the pattern: deploy-workflow.<yyyy>-<MM>-<dd>T<hh>-<mm>-<ss>.log
  • For example: deploy-workflow.2022-03-19T20-50-45.log

...

• -h | --help
  • Displays usage.
• -v | --verbose
  • Displays verbose log output that includes requests and responses with the JS7 REST Web Service.
  • When used twice as with -v -v then curl verbose output will be displayed.
• -p | --password
  • Asks the user for interactive keyboard input of the password used for the account specified with the --user option..
  • The switch is used for secure interactive input as an alternative to use of the option --password=<password>.
• -r | --recursive
  • Specifies that folders will be looked up recursively if the --folder option is used.
• -o | --overwrite
  • Specifies that objects with the same name and type will be overwritten when used with the import command.
• -s | --for-signing
  • Specifies that objects are exported for digital signing when used with the export command. For JS7 environments operated for the High Security Level digitally signed objects can be imported using the import-deploy command.
• -u | --use-short-path
  • Specifies that relative object paths will be applied to archive files when used with the export command.
  • An object path /a/b/c/workflow will be added as /c/workflow to the archive file. A folder /a/b/c will be added as /c to the archive file.
• --no-draft
  • Specifies that draft objects will be excluded when used with the export and deploy command.
• --no-deployed
  • Specifies that deployed objects will be excluded when used with the export and deploy command.
• --no-released
  • Specifies that released objects will be excluded when used with the export command.
• --no-invalid
  • Specifies that invalid objects will be excluded when used with the export command.
• --show-logs
  • Displays the log output created by the script if the --log-dir option is used.
• --make-dirs
  • If directories are missing that are indicated with the --log-dir option then they will be created.

...

• 0: operation successful
• 1: argument errors
• 3: no objects found
• 4: JS7 REST Web Service is not reachable or reports errors

Examples

The following examples illustrate typical use cases.

Exporting Objects

...

creates directories if they do not exist

see https://kb.sos-berlin.com/x/9YZvCQ

Anchor
commands commands

Commands

• terminate
  • Allows to terminate a Controller instance. If a Controller Cluster is used then no fail-over will occur as normal termination is not considered a failure situation.
  • When used with the active Controller instance in a Controller Cluster, users can apply the --switch-over switch to shift the active role on termination of the active cluster member. After restart the Controller instance will take the standby role in a Controller Cluster.
  • In a Controller Cluster the command will terminate the Controller instance identified by its URL using the --controller-url option.
• restart
  • Allows to restart a Controller instance. If a Controller Cluster is used then no fail-over will occur as normal termination is not considered a failure situation. The --switch-over switch can be used similarly to the terminate command.
  • In a Controller Cluster the command will restart the Controller instance identified by its URL using the --controller-url option.
• cancel
  
  • Allows to cancel a Controller instance. The Controller will immediately disconnect from Agents, will not create a journal snapshot and will terminate.
  • The command will cause fail-over in a Controller Cluster if used with the active Controller instance. After restart the Controller instance will take the standby role in a Controller Cluster.
  • In a Controller Cluster the command will cancel the Controller instance identified by its URL using the --controller-url option.
• cancel-restart
  • The command combines the operations to cancel and to restart a Controller instance.
• switch-over
  • The command allows to shift the active role in a Controller Cluster. For switch-over the Primary and Secondary Controller instance must be coupled.
• appoint-nodes

  • The command can be used in case that a Controller Cluster will not be coupled on initial operation.

  • The command is automatically sent by JOC Cockpit to Controller instances after restart.
• confirm-loss
  • The command can be used in a situation when the active JOC Cockpit Cluster Watch was not witness to failure of the active Controller Cluster member.
  • Users can confirm that the failed Controller Cluster member effectively is not running which allows the remaining Controller Cluster member to take the active role.
• check
  • Tests the connection between JOC Cockpit and a Controller instance.
  • The --controller-url option must be specified that will be used from JOC Cockpit to connect to the Controller. 
• enable-agent

  • Agents can be enabled after having been disabled. Enabled Agents are considered for job execution.

• disable-agent
  • When Agents are disabled, they are not considered for job execution. Running jobs can continue until completion.
• reset-agent

  • When an Agent is reset then the Agent will terminate and will restart. Job processes running in the Agent will be forcibly terminated and orders will be set to the failed state. When a forced reset is performed, then the operation forces an Agent to be reinitialized, to drop its journal and to be dedicated to the current Controller. Users are recommended to double-check if an Agent is not dedicated to a different Controller before using the --force switch.

• switch-over-agent

  • Allows to switch-over the active role between Director Agents in an Agent Cluster. For switch-over the Primary and Secondary Director instance must be coupled.

• confirm-loss-agent

  • The command can be used in a situation when the active Controller Cluster Watch was not witness to failure of the active Director Agent in an Agent Cluster. Users can confirm that the failed Director Agent effectively is not running which allows the remaining Director Agent member to take the active role.

• enable-subagent
  • Subagents can be enabled after having been disabled. Enabled Subgents are considered for job execution.
• disable-subagent
  • When Subgents are disabled, they are not considered for job execution. Running jobs can continue until completion. 
• reset-subagent
  • When a Subagent is reset then the Subagent will terminate and will restart. Job processes running in the Subagent will be forcibly terminated and orders will be set to the failed state. When a forced reset is performed, then the operation forces a Subagent to be reinitialized and to be dedicated to the current Agent Cluster. Users are recommended to double-check if a Subagent is not dedicated to a different Agent Cluster before using the --force switch.
• encrypt
  • Allows to encrypt a value using the --in option. If used to encrypt a file then --infile and --outfile options must be specified.
  • The --cert option specifies the path to a file holding the Certificate used for encryption.
  • Encryption is performed by Java libraries that are looked up in the ./lib sub-directory of the JS7 Unix Shell CLI. For details see JS7 - Encryption and Decryption.
• decrypt
  • Allows to decrypt a value using the --in option. If used to decrypt a file then --infile and --outfile options must be specified.
  • The --key option specifies the path to the Private Key used for decryption. If the Private Key is protected by a password, then the --key-password option or switch must be specified.
  • Decryption is performed by Java libraries that are looked up in the ./lib sub-directory of the JS7 Unix Shell CLI.

Anchor
options options

Options

• --url
  • Specifies the URL by which JOC Cockpit is accessible using <http|https>://<host>:<port>.
  • Example: http://centostest-primary.sos:4446
  • Example: https://centostest-primary.sos:4443
• --user
  • Specifies the user account for login to JOC Cockpit. If JS7 - Identity Services are available for Client authentication certificates that are specified with the --client-cert and --client-key options then their common name (CN) attribute has to match the user account.
  • If a user account is specified then a password can be specified using the --password option or interactive keyboard input can be prompted using the -p switch.
• --password
  • Specifies the password used for the account specified with the --user option for login to JOC Cockpit.
  • Password input from the command line is considered insecure.
    • Consider use of the -p switch offering a secure option for interactive keyboard input.
    • Consider use of the encrypt command to encrypt a password: ./deploy-workflow.sh encrypt --in=root --cert=encrypt.crt.
      • The encryption result will include the prefix enc: followed by the encrypted symmetric key, initialization vector and encrypted secret separated by space.
      • If an encrypted password is specified, then it will be decrypted using the Private Key file: ./deploy-workflow.sh <command> --password="enc:BF8J8KP7TPlxy..." --key=encrypt.key.
• --ca-cert
  • Specifies the path to a file in PEM format that holds the Root CA Certificate and optionally Intermediate CA Certificates to verify HTTPS connections to JOC Cockpit.
• --client-cert
  • Specifies the path to a file in PEM format that holds the Client Certificate if HTTPS mutual authentication is used..
• --client-key
  • Specifies the path to a file in PEM format that holds the Client Private Key if HTTPS mutual authentication is used..
• --timeout
  • Specifies the maximum duration for requests to the JS7 REST Web Service. Default: 60 seconds.
• --controller-id
  • Specifies the identification of the Controller.
• --controller-url
  • When used with the check command, specifies the protocol, host and optionally port of the Controller instance to which the connection is tested.
  • When using the terminate, restart, cancel and cancel-restart commands for a Controller Cluster, the Controller URL must be specified.
• --agent-id
  • The Agent ID specifies a unique identifier for a Standalone Agent or Agent Cluster. Agents are identified from their Agent ID.
  • When used with the enable-agent and disable-agent commands more than one Agent ID can be specified separated by comma.
• --subagent-id
  • The Subagent ID specifies a unique identifier for a Subagent in an Agent Cluster. Subagents are identified from their Subagent ID.
  • When used with the enable-subagent, disable-subagent and reset-subagent commands, the option specifies the related Subagent.
  • When used with the enable-subagent and disable-subagent commands more than one Subagent ID can be specified separated by comma.
• --key
  • When used with the decrypt command, specifies the path to a file that holds the Private Key used for decrypting in PEM format.
• --cert
  
  • When used with the encrypt command, specifies the path to a file that holds the CA signed or self-signed X.509 Certificate. Alternatively the path to a file holding the Public Key can be specified. The Certificate is expected in PEM format.
  • For encryption the Certificate must match the Private Key used for later decryption specified with the --key option.
• --key-password
  • When used with the decrypt command, specifies the password for access to the key file using the --key option.
  • Password input from the command line is considered insecure.
    • Consider use of the -k switch or more elaborate mechanisms, for example by temporarily populating the system keystore form a security key such as a YubiKey® or similar.
    • Consider use of encrypted passwords as explained with the --password option.
• --in
  • When used with the encrypt and decrypt commands, specifies the input value that should be encrypted or decrypted.,
  • One of the options --in or --infile can be specified.
• --infile
  • When used with the encrypt and decrypt commands, specifies the path to the input file that should be encrypted/decrypted.
  • One of the options --in or --infile can be specified. This option requires use of the --outfile option.
• --outfile
  • When used with the encrypt command, specifies the path to the output file that will be created holding the encrypted content of the input file.
  • When used with the decrypt command, specifies the path to the output file that will be created holding the decrypted content of the input file.
  • The option is required if the --infile option is specified
• --java-home
  • When used with the encrypt and decrypt commands or with encrypted passwords, specifies the Java home directory. By default the JAVA_HOME environment variable is used to determine the location of Java.
  • The Java home directory is the top-level directory of a Java installation. The directory includes the bin sub-directory and java executable.
• --java-lib
  • When used with the encrypt and decrypt commands or with encrypted passwords, a number of Java libraries are required to perform encryption/decryption.
  • The Java libraries are expected in the lib sub-directory of the JS7 Unix Shell CLI. Default: ./lib.
• --audit-message
  • Specifies a message that is made available to the Audit Log.
  • Specification of Audit Log messages can be enforced on a per user basis and for a JS7 environment.
• --audit-time-spent
  • Specifies the time spent to perform an operation which is added to the Audit Log.
  • The option can be specified if the --audit-message option is used.
• --audit-link
  • Specifies a link (URL) which is added to the Audit Log.
  • The option can be specified if the --audit-message option is used.
• --log-dir
  • If a log directory is specified then the script will log information about processing steps to a log file in this directory.
  • File names are created according to the pattern: deploy-workflow.<yyyy>-<MM>-<dd>T<hh>-<mm>-<ss>.log
  • For example: deploy-workflow.2022-03-19T20-50-45.log

Anchor
switches switches

Switches

• -h | --help
  • Displays usage.
• -v | --verbose
  • Displays verbose log output that includes requests and responses with the JS7 REST Web Service.
  • When used twice as with -v -v then curl verbose output will be displayed.
• -p | --password
  • Asks the user for interactive keyboard input of the password used for the account specified with the --user option..
  • The switch is used for secure interactive input as an alternative to use of the option --password=<password>.
• -k | --key-password
  • Asks the user for interactive keyboard input of the password used for access to a keystore or key file specified with the --keystore or --key options.
  • The switch is used for secure interactive input as an alternative to use of the --key-password=<password> option.
• -s | --switch-over
  • Specifies for terminate and restart commands to switch the active role in a Controller Cluster.
• -f | --force
  • When used with the reset-agent command for a Standalone Agent or Cluster Agent, and when used with the reset-subagent command for a Subagent, the option specifies that the Agent will terminate, will drop its journal and will restart. When resetting an Agent, job processes running in the Agent will be forcibly terminated and orders will be set to the failed state.
  • The operation forces an Agent to be reinitialized and to be dedicated to the current Controller or Agent Cluster in case of Subagents. Users are recommended to double-check that an Agent is not dedicated to a different Controller or Agent Cluster before using the switch.
• --show-logs
  • Displays log output created by the script if the --log-dir option is used.
• --make-dirs
  • If directories are missing that are indicated with the --log-dir option then they will be created.

Anchor
exit_codes exit_codes

Exit Codes

• 0: operation successful
• 1: argument errors
• 3: no objects found
• 4: JS7 REST Web Service is not reachable or reports errors

Examples

The following examples illustrate typical use cases for status operations on Controller and Agents.

Terminating, Restarting, Cancelling Controllers

Termination and restart of a Controller instance are offered by a number of commands.

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# terminate Standalone Controller
./operate-controller.sh terminate "${request_options[@]}"

# restart Standalone Controller
./operate-controller.sh restart "${request_options[@]}"

# cancel Standalone Controller
./operate-controller.sh cancel "${request_options[@]}"

# cancel and restart Standalone Controller
./operate-controller.sh cancel-restart "${request_options[@]}"

When terminating/restarting a member in a Controller Cluster then --controller-url option must be used to specify which Controller instance should be terminated/restarted.

...

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# export workflows
./deploy-workflow.sh export ${request_options[@]} \
    --file=export.zip --path=/ap/ap3jobs,/ap/Agent/apRunAsUser --type=WORKFLOW

# export draft schedules
./deploy-workflow.sh export =root --controller-id=controller)

# terminate Controller Cluster instance
./operate-controller.sh terminate "${request_options[@]} \
    --file=export.zip --path=/ap/Agent/apAgentSchedule01,/ap/Agent/apAgentSchedule02 --type=SCHEDULE --no-released" --controller-url=http://localhost:4444

# exportrestart objectsController fromCluster folderinstance
./deployoperate-workflowcontroller.sh exportrestart "${request_options[@]} \
    --file=export.zip --folder=/ap --recursive" --controller-url=http://localhost:4444

# exportcancel objectsController from folder using relative pathCluster instance
./deployoperate-workflowcontroller.sh exportcancel "${request_options[@]}" \
    --file=export.zip --folder=/ap/Agent --recursive --use-short-pathcontroller-url=http://localhost:4444

# export objects from folder, limiting object types and validity, feeding audit logcancel and restart Controller Cluster instance
./deployoperate-workflowcontroller.sh exportcancel-restart "${request_options[@]} \
    --file=export.zip --folder=/ap --recursive --type=WORKFLOW,JOBRESOURCE --no-invalid --audit-message="export to production"

Importing Objects

...

" --controller-url=http://localhost:4444

Switching-over, Appointing Nodes and Confirming Node Loss for Controller Cluster

Users can switch-over the active role in a Controller Cluster.

The appoint-nodes command is available in case that a Controller Cluster will not be coupled on initial operation.

...

The confirm-loss command can be used in a situation when the active JOC Cockpit Cluster Watch was not witness of failure of the active Controller Cluster member.

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# import objects switch-over active role in Controller Cluster
./deployoperate-workflowcontroller.sh importswitch-over "${request_options[@]} \
    --file=export.zip --overwrite"

# importterminate objectsController toinstance aand new topswitch-levelover folder and apply suffixController Cluster
./deployoperate-workflowcontroller.sh importterminate "${request_options[@]} \
    --file=export.zip --folder=/Version22 --suffix=v22

# revalidate objects from folder
./deploy-workflow.sh revalidate }" --controller-url=http://localhost:4444 --switch-over

# restart Controller instance and switch-over Controller Cluster
./operate-controller.sh restart "${request_options[@]} \
    --folder=/Version22 --recursive

Exporting, Signing and Importing/Deploying for High Security Level

...

• Digital signing includes that based on the user's Private Key and Certificate signature files are created that have to be added to the archive file for later import & deployment.
• The steps to import and to deploy are available from a single operation to prevent tampering of objects after import.

" --controller-url=http://localhost:4444 --switch-over


# appoint nodes for Controller Cluster
./operate-controller.sh appoint-nodes "${request_options[@]}"

# confirm node loss for Controller Cluster
./operate-controller.sh confirm-loss "${request_options[@]}" 

Enabling, Disabling, Resetting Agents

When Agents are disabled, they are not considered for job execution. 

When an Agent is reset then the Agent will terminate and will restart. Users are recommended to double-check if an Agent is not dedicated to a different Controller before using the --force switch

...

.

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# export objects from folder for signing
./deploy-workflow.sh export ${request_options[@]} \
    --file=export.zip --folder=/myFolder --recursive --for-signing

# digitally sign objects
mkdir -p ./temp
rm -fr ./temp/*
unzip -d ./temp ./export.zip

./js7_sign_workflow.sh --dir=./temp --key=./ecdsa.key --cert=./ecdsa.crt --hash=sha512

rm -f ./import-from-signing.zip
cd ./temp
zip -r ../import-from-signing.zip *
cd -

# import/deploy objects
./deploy-workflow.sh import-deploy request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# enable Standalone Agent
./operate-controller.sh enable-agent "${request_options[@]}" --agent-id=StandaloneAgent

# disable Standalone Agent
./operate-controller.sh disable-agent "${request_options[@]}" --agent-id=StandaloneAgent

# reset Standalone Agent
./operate-controller.sh reset-agent "${request_options[@]}" --agent-id=StandaloneAgent

# reset/force Standalone Agent
./operate-controller.sh reset-agent "${request_options[@]} \
    --file=import-from-signing.zip

Deploying and Revoking Objects

...

" --agent-id=StandaloneAgent --force

For an Agent Cluster the reset-agent command is available. Enabling/disabling is performed at Subagent level.

When resetting an Agent Cluster then similar behavior applies as for Standalone Agents. Users should be aware that all Subagents in an Agent Cluster will be reset

...

.

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# deployreset workflows and update daily planAgent Cluster
./deployoperate-workflowcontroller.sh deployreset-agent "${request_options[@]} \
    --path=/ap/ap3jobs,/ap/apEnv --type=WORKFLOW --date-from=now

# deploy objects from folder recursively and update daily plan
./deploy-workflow.sh deploy ${request_options[@]} \
    --folder=/ap/Agent --recursive --date-from=now

# revoke workflows
./deploy-workflow.sh revoke " --agent-id=AgentCluster

# reset/force Agent Cluster
./operate-controller.sh reset-agent "${request_options[@]}" --agent-id=AgentCluster --force

Switching-over and Confirming Node Loss for Agent Cluster

Users can switch-over the active role in an Agent Cluster.

The confirm-loss-agent command can be used in a situation when the active Controller Cluster Watch was not witness to failure of the active Director Agent in an Agent Cluster.

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# switch-over active role in Agent Cluster
./operate-controller.sh switch-over-agent "${request_options[@]} \
   " --path=/ap/ap3jobs,/ap/apEnv --type=WORKFLOWagent-id=AgentCluster

# revoke objects from folderconfirm node loss for Agent Cluster
./deployoperate-workflowcontroller.sh revokeconfirm-loss-agent "${request_options[@]}  \
    --folder=/ap/Agent --recursive

Releasing and Recalling Objects

...

" --agent-id=AgentCluster

Enabling, Disabling and Resetting Subagents

When Subagents in an Agent Cluster are disabled, they are not considered for job execution. 

When a Subagent is reset then the Subagent will terminate and will restart. Users are recommended to double-check if a Subagent is not dedicated to a different Agent Cluster before using the --force switch

...

.

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

 # releaseenable schedulesSubagent andin updateAgent daily planCluster
./deployoperate-workflowcontroller.sh releaseenable-subagent "${request_options[@]} \
  "  --path=/ap/Agent/apAgentSchedule01,/ap/Agent/apAgentSchedule02 --type=SCHEDULE --date-from=now
 subagent-id=Subagent_01

# releasedisable objectsSubagent fromin folder and update daily planAgent Cluster
./deployoperate-workflowcontroller.sh releasedisable-subagent "${request_options[@]} \
    --folder=/ap/Agent --recursive --date-from=now

# recall schedules
./deploy-workflow.sh recall " --subagent-id=Subagent_01

# reset Subagent in Agent Cluster
./operate-controller.sh reset-subagent "${request_options[@]}" \
    --path=/ap/Agent/apAgentSchedule01,/ap/Agent/apAgentSchedule02 --type=SCHEDULE--subagent-id=Subagent_01

# recall objects from folderreset/foce Subagent in Agent Cluster
./deployoperate-workflowcontroller.sh recallreset-subagent "${request_options[@]} \
    --folder=/ap/Agent" --subagent-id=Subagent_01 --recursiveforce

...

Encrypting and

...

Decrypting

• Secrets can be encrypted and decrypted as explaind with JS7 - Encryption and Decryption.
• Encryption/decryption require related Java libraries that are available from the ./lib sub-directory.
• For creation of a Private Key and Certificate see JS7 - How to create X.509 Encryption Keys
• Objects can be added to the inventory from files in JSON format related to the object type such as a workflow, schedule. Newly added objects are set to draft status.
• Objects can be removed from the inventory which will move them to the trash from which they can be restored or deleted.
  
  

# commoncreate options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# store object
./deploy-workflow.sh store ${request_options[@]} \
    --path=/ap/NewFolder01/NewWorkflow01 --type=WORKFLOW --file=NewWorkflow01.workflow.json

# remove object, update daily plan
./deploy-workflow.sh remove ${request_options[@]} \
    --path=/ap/NewFolder01/NewWorkflow01 --type=WORKFLOW --date-from=now

# remove objects from folder, update daily plan
./deploy-workflow.sh remove ${request_options[@]} \
    --folder=/ap/NewFolder01 --date-from=now

Restoring and Deleting Objects

...

# common options for connection to JS7 REST APIPrivate Key
openssl ecparam -name secp384r1 -genkey -noout -out encrypt.key

# create Certificate Signing Request
openssl req -new -sha512 -nodes -key encrypt.key -out encrypt.csr -subj "/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=Encrypt"

# create Certificate
openssl x509 -req -sha512 -days 1825 -signkey encrypt.key -in encrypt.csr -out encrypt.crt -extfile <(printf "keyUsage=critical,keyEncipherment,keyAgreement\n")


# encrypt a secret such as a password using the Certificate, the encryption result will be returned and will look like: enc:BEXbHYa...
 ./deploy-controller.sh encrypt --in="root" --cert=encrypt.crt

# options for connection to the JS7 REST API can specify the encryption result as password and the Private Key for decryption
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# restore object from trash, using suffix for restored objectd
./deploy-workflow.sh restore ${request_options[@]} \
    --path=/ap/NewFolder01/NewWorkflow01 --type=WORKFLOW --new-path=/ap/NewFolder01/NewWorkflow01 --suffix=restored

# delete object from trash
./deploy-workflow.sh delete ${request_options[@]} \
    --path=/ap/NewFolder01/NewWorkflow01 --type=WORKFLOW

# delete objects from trash by folder
./deploy-workflow.sh delete "enc:BEXbHYa..." --key=encrypt.key --controller-id=controller)

# for example, when restarting a Controller the Private Key is used to decrypt the password for access to the REST API on-the-fly
./operate-controller.sh restart "${request_options[@]} \
    --folder=/ap/NewFolder01"

# decrypt an encrypted secret using the Private Key
./deploy-controller.sh decrypt --in="enc:BEXbHYa..." --key=encrypt.key

Resources

• API
  • JS7 - REST Web Service API
  • JS7 - PowerShell Module
  Workflow
• Controller Deployment Operations
  • JS7 - Deployment of Scheduling ObjectsUnix Shell CLI for Controller Deployment
• Workflow Deployment
  • JS7 - Secure Deployment of Scheduling ObjectsUnix Shell CLI for Workflow Deployment 
• Workflow Status Operations
  • JS7 - Unix Shell CLI for Workflow Status Operations

...