资料课件讲义V4ACIMSO-TDM

JohnWeston,TechnicalMarketingEngineer,March2019,CustomSSLCertificates,StreamingLogs,Swagger/PatchAPI,ACI4.1/MSO2.1NewFeatures,CustomSSLCertificates,TheMSOshipswithanSSLcertificatethatisstoredin/data/msc/secretsoneverynodeItispossibletochangethesecertificatesbutisamanualprocesspriortothe2.1releaseCopycerts,keystoallnodesUpdateconfiguration(nginx)RestartservicesMSO2.1addssupportforupdatingcustomcertificatesdirectlyfromtheMSOUI,MSOSSLCertificates,TwocustomercertificateoptionsaresupportedSelf-signedcertificates:usercreatestheirownpublicandprivatekeysCA-issuedcertificates:usercanprovideanexistingCertificateAuthorityalongwithkeysMultipleCAsandkeyringscanbeaddedtotheMSObutonlyonecanbeactiveatanygiventimeMSOdoesnotgenerateCSR(certificatesigningrequests)privatekeyswillbeuploadedtothenodesfromtheUI,MSOCustomSSLCertificates,AddingaCertificateAuthority,AddingaCertificateAuthority,Addthecertificatechainincludingallintermediatecertsandtherootcert,AddingaCustomKeyring,AddingaCustomKeyring,SelectapreviouslyaddedCAifaddingakeyforaCAorselectNoneforselfsignedcert,ActivateKeyring,Addingkeyringdoesnotmakeitactive.ToactivatenewkeyringselectMakeKeyRingActiveOnlyonekeyringcanbeactiveatanygiventime,ActivateKeyring,WhenactivatingthekeyringahostservicerunningontheclusterwillcopythecertandprivatekeytoallnodesThisisdoneoverSSHandrequirestherootpasswordforeachnodeThisactionwillalsorestarttheUIservice(confirmationwindowdisplayed),Note:Ifanynodesarereplacedthekeyringwillhavetobeactivatedagain,StreamingLogs,Pre2.1behaviorLogsarestoredinthedatabase.LogsareaccessiblefromtheUIorAPIcallbutthisisnotrealtime.Logscannotbestreamedtoanexternalcollector/toolNew2.1StreamingfeatureLogswillbestoredinthefilesystem.PluginswillbeabletoreadlogsfromfilesystemandstreamtoexternaldeviceThe2.1releasesupportsonlySplunkastheserviceprovider,StreamingLogs,MSOisamicroservicesarchitecture.LogsgeneratedbycontainersaresenttothefilesystemusingstdoutfromeachcontainerMSOchangein2.1willaddwhatiscalledthesidecarapproachforlogging.Anewlightweightcontainer(fluentd)willrunoneachnodereadinglogsfromthefilesystem,MSOloggingOverview,Thefluentdcontainerwillhavetwopluginstailinputplugin(similartotailfcommandforreadinglogsfromfilesystem)Splunk-HEC(HTTPeventcollector)pluginforpushinglogstoSplunk,MSOloggingfluentd,Streaminglogconfiguration,SelectSystemLogsfromthesettingsdropdown,Streaminglogconfiguration,SelectAllLogsoronlyAuditlogs.CustomersmaywantonlyauditlogstoreducetheamountoflogssenttoSplunkserver,Spunkserverandport,AuthenticationtokenfromSplunkserver,RootpasswordforallMSOnodes,Swagger/PatchAPI,OpensourceprojectAccesstoAPIreferencedocumentationdirectlyfromtheUIVisualinteractionwithMSOAPIdirectlyfromtheUIAuthenticationishandledautomaticallybySwaggerSupportsGET,POST,PUT,PATCH,andDELETE,Swagger/OpenAPI,AccesstoSwaggerfromMSO,LaunchSwaggerUIfromMSOGUI,AllowsusertointeractwithSwaggerUIdirectlyfromMSO,SwaggerAPIServices,TheSwaggerUIprovidesthefollowingAPIservices,APIServices,OnlyHTTPSsupported,MSOlogintokenissharedwithSwaggerUIandincludedintheAPIrequests,ServiceName,Serviceendpoints(paths),Endpoints(paths)arelogicallyseparatedineachservice.SiteserviceforexamplehasFabricConnectivityAPI,EndpointAPI,ACIinformationAPI,andSiteAPIs,ExpandinganAPIdisplaysthedifferentGET,POST,PUT,PATCH,andDELETEAPIs,GETexample,TryitoutletsyousendAPIrequestsfromtheGUI,Swaggerdocumentationexample,Exampleoutput,Modeldocumentation,ExamplesandmodeldocsareprovidedintheSwaggerUI,ExecuteAPIcall,WhenyouexecutearequesttheUIdisplaystheCurlrequestthatwassetincludingthetokenItalsodisplaystheresponsecodeandresponsebodyOtherresponsecodesanderrormessageswillbedisplayedifanerroroccurs,POSTexample,POSTexamplesandmodeldocsintheUI,WithPOSTyouneedtoprovideabody,DELETEExample,Everyobjecthasanid.ObjectscanbedeletedbyspecifyingtheobjectID.,ResponsefromtenantGETrequest,PUTExample,PerformaGETtoreceivethefullschemaGettheschemaIDModifythefullschemaandchangethefieldstobemodifiedPUTtheentireschemabackspecifyingtheIDandtheentirepayloadwithchanges/additions,UsingPUTrequiressendingbacktheentireschemapayload.Thissimpleschemawith2EPGs,BDs,andoneVRFis365lines.Arealworldcasecanhaveschemaswith1,000soflines.,Modifyingalargeschemaforsimplemodificationsisinefficientandmoreerrorprone.UsingPATCHAPIcanhelpforthesecases,PUTExample,schemaID,Sendbackentireschemapayloadwithchanges/additions,PATCHAPI,PATCHvsPUT,PATCHAPIforMSOisimplementedusingJSONPATCHRFC6902JSONPATCHsupportsanumberoperationsaddremovereplacecopytestMSOwillsupporttheadd,replace,andremoveoperations,JSONPATCH:RFC6902,PATCHAPI,PATCHAPIallowstheusertomakemoregranularchangeswithouthavingtosendbacktheentirepayload,JSONPATCHusesthreefieldsop=operation(MSOsupportsadd,replace,anddeleteoperations)path=pathofthefieldyouwanttomodifyvalue=value(valuecanbeaJSONpayload),PATCHExample,Example:ChangeEPGtoBDreferenceinaschemaEPG1referencesBD1.WewanttochangeittoreferenceBD2.GETschema(togettheschemaID)CreatePATCHAPIpayloadwithoperation“replace”,pathtoEPGBDreference,andreplacedvalue,op:replace,path:/templates/Stretched-template/anps/AP1/epgs/EPG1/bdRef,value:schemaId:5ba3d041110000b804e4c841,templateName:Stretched-template,bdName:BD2,PATCHExample,schemaID,PATCHpayload,PATCHpayloads,MultipleoperationscanbesentinthePATCHrequest,op:replace,path:/templates/Stretched-template/anps/AP1/epgs/EPG1/bdRef,value:schemaId:5ba3d041110000b804e4c841,templateName:Stretched-template,bdName:BD2,op:replace,path:/templates/Stret