Illumio Core What's New and Release Notes 21.5

Users have the ability to change port numbers on which a specific core service is running so that they can adjust them to their environment. They cannot change ports using the UI, only the APIs.

The user authorized to manage core services is the Organization Administrator.

GET /api/v2/orgs/1/detected_core_services/ ddfe5204-ad29-4bcd-9821-fcb62353a985

{
	"href" :  "/orgs/1/detected_core_services/ddfe5204-ad29-4bcd-9821-fcb62353a985" ,
	"ip_address" :  "103.10.11.44" ,
	"workload" : {
		"hostname" :  "SE555Q5" ,
		"href" :  "/orgs/2/workloads/e62d71b3-36c4-4c27-926b-411b93ba6d6f" ,
		"labels" : []
	},
	"core_service_type" : {
		"href" :  "/orgs/1/core_service_type/3555d1e4-fcb2-49c2-9a4a-215c4d5e86dc"
	},
	"confidence" :  100 ,
	"method_name" :  "process_based" ,
	"created_at" :  "2020-08-04T05:02:46.648Z" ,
	"updated_at" :  "2020-08-04T05:02:46.648Z" ,
	"last_detected_at" :  "2020-09-05T05:02:46.648Z"
}  

PUT /api/v2/orgs/1/detected_core_services/3ddd5204-ad29-4bcd-9821-fcb62353a98f

Example  1 :
	{ "action" : "accept" }
 
Example  2 :
	{ "action" : "accept" ,  "workload" :{ "href" :  
	"/orgs/2/workloads/e62d71b3-36c4-4c27-926b-411b93ba6d6f" }} # 
	for   the  case   when an IP is converted to UMWL and
 	accepted as core service
  
Example  3 :
	{ "action" : "reject" }
 
Example  4 :
	{ "action" : "reject" ,  "feedback" : "Not a core service." }
 
Example  5 :
	{ "action" : "skip" ,  "feedback" : "Check with Ops if this 
	is a core service." }
  
Example  6 :
	{ "labels_applied" : true }

GET /api/v2/orgs/ :xorg_id /core_service_types/44dd5204-ad29-4bcd-9821-fcb62353a98f

{
	"href" : "/orgs/2/core_service_type/44dd5204-ad29-4bcd-9821-fcb62353a98f" ,
	"core_service" : "splunk" ,
	"required_ports" :[{ "port" : 9997 ,  "to_port" : 10000 }],
	"optional_ports" :[{ "port" : 112 }, { "port" : 455 }],
	"labels" : [
	{
		"value" : "app-splunk" ,
		"key" :  "app"
		"href" : "/orgs/1/labels/2"
	},
	{
		"value" : "role-splunk" ,
		"key" :  "role" ,
		"href" : "/orgs/1/labels/12"
	} ],
		"created_at" :  "2020-08-04T05:02:46.648Z" ,
		"updated_at" :  "2020-08-05T05:02:46.648Z"
}

PUT /api/v2/orgs/ :xorg_id /core_service_types/44dd5204-ad29-4bcd-9821-fcb62353a98f

{
"labels" : [
	{
		"href" : "/orgs/1/labels/3"
	},
	{
		"href" : "/orgs/1/labels/10"
	}]
}

This API was introduced to help avoid issues with misconfigured DNS, which can cause problems with VEN connectivity. Likewise, misconfiguring DHCP can cause problems with IP addresses.

When you invoke /optional_features API to enable editable_dns_client_rule or editable_dhcp_client_rule , a key is required. Such a key involves a portion that is tightly controlled so that it cannot be randomly generated.

Once the key is generated, it cannot be used in more than one place, which means that an API call provided to customer #1 cannot be replayed at customer #2 who must request their own key.

An example of the generated key:

secret =  '...'   # value embedded in code
 
	data = Base64.strict_encode64({
	'pce_fqdn'   => Illumio::RuntimeEnvironment.pce_fqdn,
	'org_id'   => xorg_id,
	'optional_feature'   =>  'editable_dns_client_rule' ,
	'not_valid_after'   => Time.now.utc.iso8601
})
 
key = data + OpenSSL::HMAC.hexdigest( 'SHA256' , secret, data)

A new schema as well as two endpoints were added:

PUT /orgs/ 1 /optional_features
[
	{ "name" :  "editable_dns_client_rule, " enabled ": true,
		 " key": ( key as generated above )}
]

The APIs GET roles and GET role_name have been promoted from Internal to Public Experimental.

They allow the users to list user roles and role names:

Several APIs have been introduced to provide a mechanism to generate a support bundle on each node, including a time range and possibly additional options.

The APIs have the following functions:

This new common schema defines the network types to which a rule should apply.

This schema exposure is both Public Stable and Public Experimental.

{
	$schema": "http://json-schema.org/draft-04/schema#",
	"description": "Network types that this rule should apply to.",
	"type": "string",
	"enum": ["brn", "non_brn", "all"],
	"default": "brn"
}

This common schema is referenced from multiple APIs, such as:

The new APIs are:

This API was DEPRECATED and replaced (use /orgs/:xorg_id/vens/:ven_uuid instead).