VEN Operations
Overview of VEN Suspension
The VEN Update API (PUT [api-version][ven-href]
) allows you to mark a VEN as either suspended or unsuspended in the PCE. It does not, however, actually suspend or unsuspend the VEN.
To suspend a VEN, use the illumio-ven-ctl
command-line tool, which isolates a VEN on a workload so that you can troubleshoot issues and determine if the VEN is the cause of any anomalous behavior.
When you suspend a VEN, the VEN informs the PCE that it is in suspended mode.
However, if the PCE does not receive this notification, you must mark the VEN as "Suspended" in the PCE web console (select the VEN and click Edit), or you can use this API to mark the VEN as suspended.
When you don't mark the VEN as suspended in the PCE, after one hour, the PCE assumes that the workload is offline and removes it from the policy. When you mark the VEN as suspended, that VEN’s workload is still included in the policy of other workloads.
When a VEN is suspended:
The VEN still appears in the PCE in the VEN list page.
The VEN's host cannot be unpaired.
An organization event (
server_suspended
) is logged. This event is exportable to CEF/LEEF and has the severity of WARNING.Heartbeats or other communications are not expected, but when received, all communications are logged by the PCE.
If the PCE is rebooted, the VEN remains suspended.
Any custom iptables rules are removed, and you need to reconfigure them manually.
When a VEN is unsuspended:
The PCE is informed that the VEN is no longer suspended and is able to receive policy from the PCE. If existing rules affect the unsuspended workload, the PCE reprograms those rules.
An organization event (
server_unsuspended
) is logged. This event is exportable to CEF/LEEF and has the severity of WARNING.The workload reverts to the policy state it had before it was suspended.
Custom iptables rules are configured back into the iptables.
VEN upgrade APIs allow you to specify an array of VEN hrefs to upgrade to a specific version instead of a list of agent ID's.
Rules when validating with the VEN upgrade APIs are as follows:
No downgrades are allowed
Users cannot upgrade to a VEN version higher than the PCE version
No AIX, Solaris, or C-VEN are allowed
Users can only upgrade VENs paired to the same region
Only workload managers can upgrade VENs, and they can only upgrade VENs within their scope.
VEN API Methods
In addition to the page in the PCE web console that lists all VENs and shows the details of a single VEN, there is a Public Experimental API for getting VEN collections and VEN instances. Other new APIs support VEN filtering in the PCE web console, and update and unpair VENs.
VEN Methods | HTTP | URI |
---|---|---|
Get the collection of all VENs |
|
|
Get details on a VEN instance |
|
|
Use to get the default release without iterating through the whole collection. |
|
|
Support VEN filtering in the PCE web console |
|
|
To set the on a VEN |
|
|
Update a VEN |
|
|
Upgrade a VEN. This API accepts a list of The upgrade endpoint falls under the
instead of the |
|
|
List VEN releases |
|
|
Unpair a VEN: trigger the unpairing of one or more VENs. NOTE: This endpoint replaces /workloads/unpair, which is deprecated. |
|
|
Provided so that users can set the default version for VEN pairing. |
|
|
Query Parameters
Parameter | Description | Type | Required |
---|---|---|---|
| Cluster FQDN for the target PCE | String | No |
| Friendly name for the VEN | String, NULL | No |
| The current status of the VEN. Options are: "active", "suspended", "uninstalled" | String | No |
| Hostname of VEN(s) to return. Supports partial matches. | String | No |
| Operating System of VEN(s) to return. Supports partial matches. | String | |
| The unique ID of the host managed by the VEN | String | No |
| Additional OS details from the host managed by the VEN | String | |
| OS platform of the host managed by the VEN | String | No |
| Software version of the VEN. Two parameters are used:
| String | |
| |||
| The method in which the VEN was activated. Options are: "pairing_key", "kerberos", "certificate" | String | No |
| The FQDN of the PCE that the VEN last connected to | String | No |
| Labels assigned to the host managed by the VEN. | String | |
| |||
| Array of container cluster URIs, encoded as a JSON string | String | No |
| Organization | Integer | Yes |
| Return VENs in or not in authentication recovery | Boolean | No |
| A specific error condition to filter by | String | No |
| Return VENs that have been disconnected since the given time | date/time | |
| IP address of VEN(s) to return. Supports partial matches | String | |
| The time (rfc3339 timestamp) of the last goodbye from the VEN. There are two parameters: last_goodbye_at[gte]: Greater than or equal to value for last goodbye at timestamp last_goodbye_at[lte]: Less than or equal to value for last goodbye at timestamp | Bollean | |
| The last time (rfc3339 timestamp) a heartbeat was received from this VEN. There are two parameters: last_heartbeat_at[gte]: Greater than or equal to value for last heartbeat timestamp last_heartbeat_at[lte]: Less than or equal to value for last heartbeat timestamp | Boolean | |
| Only return VENs with/without a pending upgrade | Boolean | No |
| The { "properties": { "ven_type": { "$ref": "../common/ven_type.schema.json" } | String | No |
Response Properties
Property | Description | Type | Required |
---|---|---|---|
| URI of the VEN | Stgring | |
| The hostname of the host managed by the VEN | String | Yes |
| Friendly name for the VEN | String | |
| The unique ID of the host managed by the VEN | String | |
| OS identifier of the host managed by the VEN | String | |
| Additional OS details from the host managed by the VEN | Sring | |
| OS platform of the host managed by the VEN | String | |
| Software version of the VEN. Two parameters are used:
| String | |
| Network interfaces of the workload, only present in expanded representations | Array | |
| The only required property is
| Array | |
| Property: Issuer name match criteria for certificate used during establishing secure connections.
| Object String | |
| Last reported time when policy was applied to the workload (UTC), only present in expanded representations. |
| |
| Last reported time when policy was received by the workload (UTC), only present in expanded representations. |
| |
| Policy enforcement mode, only present in expanded representations. Reference to | String | |
| Visibility level of the workload, only present in expanded representations | String |
Network Enforcement Node Reassignment
network_enforcement_nodes_put
This new API is used to change the target PCE FQDN of an agent.
It updates the target_pce_fqdn
property so that the NEN can be managed by a different PCE in a Supercluster.
Change Target PCE
When you have the NEN HREF, you can update the target PCE with the PCE FQDN the NEN will use. In your JSON request body, pass the following data:
"target_pce_fqdn": "new-pce-fqdn.example.com" }
The URI for this operation is:
PUT [api_version][nen_href]/update
This curl example shows how you can pass the target_pce_fqdn
property containing the FQDN
of the new PCE:
curl -u api_xxxxxxx64fcee809:'xxxxxxx5048a6a85ce846a706e134ef1d4bf2ac1f253b84c1bf8df6b83c70d95' -H "Accept: application/json" -H "Content-Type:application/json" -X PUT -d '{"target_pce_fqdn":"new-pce-fqdn.example.com"}' https://my.pce.supercluster:443/api/v1/orgs/3/network_enforcement_nodes/f67d35d5-ea71-42da-b40d-8dcc3b1420c2/update
GET VENs
To get a collection of VENs that have a specific label applied to them, take a label string that was returned when you got a collection of VENs, and then add a query parameter to GET all VENs with that specific label.
Curl Command to Get VENs with a Specific Label
curl -i -X GET https://pce.my-company.com:8443/api/v2/orgs/2/vens?labels="[[/orgs/2/labels/1642]]" -H "Accept: application/json" -u $KEY:$TOKEN
To restrict the type of VENs you want returned and set a limit on how many results you want returned, use the relevant query parameters. For example, you might want to get a collection of no more than 50 VENs running CentOS 6.3 that have an active status.
Curl Command to Get VENs using other Query Parameters
curl -i -X GET https://pce.my-company.com:8443/api/v2/orgs/2/vens?os_id=centos-x86_64-6.3&max_results=50&status=active -H "Accept: application/json"-u $KEY:$TOKEN
Unpairing and Suspending VENs
Instead of unpairing and suspending workloads, use the new VEN APIs to unpair and suspend VENs.
Note
The endpoint workloads/unpair
is DEPRECATED. Use /vens/unpair
instead.
Curl Command for Unpairing VENs
curl -i -X PUT https://pce.my-company.com/api/v2/orgs/3/vens/unpair -H "Content -Type:application/json" -u $KEY:$TOKEN -d '{"vens": [{"href": "/orgs/7/vens/xxxxxxxx-9611-44aa-ae06-fXXX8903db65"}, {"href": "/orgs/7/vens/xxxxxxxx-9611-xxxx-ae06-f7bXXX03db71"}], "firewall_restore": "default"}'
Curl Command to Mark VEN as Suspended
curl -i -X PUT https://pce.my-company.com/api/v2/orgs/3/vens/xxxxxxxx-9611-xxxx-ae06-f7bXXX03db71 -H "Content-Type:application/json" -u $KEY:$TOKEN -d'{"status":"suspended"}'