-
Notifications
You must be signed in to change notification settings - Fork 5
/
virtualservices.go
294 lines (247 loc) · 9.58 KB
/
virtualservices.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
package illumioapi
import (
"encoding/json"
"errors"
"fmt"
"math"
"net/url"
"strconv"
"strings"
)
// A VirtualService represents a Virtual Service in the Illumio PCE
type VirtualService struct {
ApplyTo string `json:"apply_to,omitempty"`
CreatedAt string `json:"created_at,omitempty"`
CreatedBy *CreatedBy `json:"created_by,omitempty"`
DeletedAt string `json:"deleted_at,omitempty"`
DeletedBy *DeletedBy `json:"deleted_by,omitempty"`
Description string `json:"description,omitempty"`
ExternalDataReference string `json:"external_data_reference,omitempty"`
ExternalDataSet string `json:"external_data_set,omitempty"`
Href string `json:"href,omitempty"`
IPOverrides []string `json:"ip_overrides,omitempty"`
Labels []*Label `json:"labels,omitempty"`
Name string `json:"name,omitempty"`
PceFqdn string `json:"pce_fqdn,omitempty"`
Service *Service `json:"service,omitempty"`
ServiceAddresses []*ServiceAddresses `json:"service_addresses,omitempty"`
ServicePorts []*ServicePort `json:"service_ports,omitempty"`
UpdateType string `json:"update_type,omitempty"`
UpdatedAt string `json:"updated_at,omitempty"`
UpdatedBy *UpdatedBy `json:"updated_by,omitempty"`
}
// ServiceAddresses are FQDNs for Virtual Services
type ServiceAddresses struct {
IP string `json:"ip,omitempty"`
Network *Network `json:"network,omitempty"`
Fqdn string `json:"fqdn,omitempty"`
Description string `json:"description,omitempty"`
}
// Network represents a network in the PCE
type Network struct {
Href string `json:"href,omitempty"`
Name string `json:"name,omitempty"`
}
// GetAllVirtualServices returns a slice of all Virtual services of a
// specific provision status in the Illumio PCE.
//
// The queryParameters are map["parameter"]="value" (e.g., queryParameters["name"]="name123")
// The provision status must be "draft" or "active".
// The first call does not use the async option.
// If the response array length is >=500, it is re-run enabling async.
func (p *PCE) GetAllVirtualServices(queryParameters map[string]string, provisionStatus string) ([]VirtualService, APIResponse, error) {
var api APIResponse
provisionStatus = strings.ToLower(provisionStatus)
if provisionStatus != "active" && provisionStatus != "draft" {
return nil, api, errors.New("get all Virtual services - provisionStatus must be active or draft")
}
// Build the API URL
apiURL, err := url.Parse("https://" + pceSanitization(p.FQDN) + ":" + strconv.Itoa(p.Port) + "/api/v2/orgs/" + strconv.Itoa(p.Org) + "/sec_policy/" + provisionStatus + "/virtual_services")
if err != nil {
return nil, api, fmt.Errorf("get all Virtual services - %s", err)
}
// Set the query parameters
for key, value := range queryParameters {
q := apiURL.Query()
q.Set(key, value)
apiURL.RawQuery = q.Encode()
}
// Call the API
api, err = apicall("GET", apiURL.String(), *p, nil, false)
if err != nil {
return nil, api, fmt.Errorf("get all Virtual services - %s", err)
}
var virtualServices []VirtualService
json.Unmarshal([]byte(api.RespBody), &virtualServices)
// If length is 500, re-run with async
if len(virtualServices) >= 500 {
api, err = apicall("GET", apiURL.String(), *p, nil, true)
if err != nil {
return nil, api, fmt.Errorf("get all Virtual services - %s", err)
}
// Unmarshal response to struct
var asyncVirtualServices []VirtualService
json.Unmarshal([]byte(api.RespBody), &asyncVirtualServices)
return asyncVirtualServices, api, nil
}
// Return if there are less than 500
return virtualServices, api, nil
}
// GetVirtualServiceByName returns a single Virtual Service that matches the name
// Using the queryParameters in GetAllVirtualServices reports partial matches on name values
// This method only returns a single value for exact match.
func (p *PCE) GetVirtualServiceByName(name string, provisionStatus string) (VirtualService, APIResponse, error) {
qp := map[string]string{"name": name}
vsMatches, api, err := p.GetAllVirtualServices(qp, provisionStatus)
if err != nil {
return VirtualService{}, api, err
}
for _, vs := range vsMatches {
if vs.Name == name {
return vs, api, nil
}
}
return VirtualService{}, api, nil
}
// CreateVirtualService creates a new virtual service in the Illumio PCE.
func (p *PCE) CreateVirtualService(virtualService VirtualService) (VirtualService, APIResponse, error) {
var newVirtualService VirtualService
var api APIResponse
var err error
// Build the API URL
apiURL, err := url.Parse("https://" + pceSanitization(p.FQDN) + ":" + strconv.Itoa(p.Port) + "/api/v2/orgs/" + strconv.Itoa(p.Org) + "/sec_policy/draft/virtual_services")
if err != nil {
return newVirtualService, api, fmt.Errorf("create Virtual service - %s", err)
}
// Sanitize
virtualService.Sanitize()
// Call the API
virtualServiceJSON, err := json.Marshal(virtualService)
if err != nil {
return newVirtualService, api, fmt.Errorf("create Virtual service - %s", err)
}
api.ReqBody = string(virtualServiceJSON)
api, err = apicall("POST", apiURL.String(), *p, virtualServiceJSON, false)
if err != nil {
return newVirtualService, api, fmt.Errorf("create Virtual service - %s", err)
}
// Unmarshal new Virtual service
json.Unmarshal([]byte(api.RespBody), &newVirtualService)
return newVirtualService, api, nil
}
// UpdateVirtualService updates an existing virtual service in the Illumio PCE.
//
// The provided Virtual Service struct must include an Href.
// Properties that cannot be included in the PUT method will be ignored.
func (p *PCE) UpdateVirtualService(virtualService VirtualService) (APIResponse, error) {
var api APIResponse
var err error
// Build the API URL
apiURL, err := url.Parse("https://" + pceSanitization(p.FQDN) + ":" + strconv.Itoa(p.Port) + "/api/v2" + virtualService.Href)
if err != nil {
return api, fmt.Errorf("update virtual service - %s", err)
}
virtualService.Sanitize()
// Call the API
virtualServiceJSON, err := json.Marshal(virtualService)
if err != nil {
return api, fmt.Errorf("update Virtual service - %s", err)
}
api.ReqBody = string(virtualServiceJSON)
api, err = apicall("PUT", apiURL.String(), *p, virtualServiceJSON, false)
if err != nil {
return api, fmt.Errorf("update Virtual service - %s", err)
}
return api, nil
}
// BulkVS takes a bulk action on an array of workloads.
// Method must be create, update, or delete
func (p *PCE) BulkVS(virtualServices []VirtualService, method string) ([]APIResponse, error) {
var apiResps []APIResponse
var err error
// Check on method
method = strings.ToLower(method)
if method != "create" && method != "update" && method != "delete" {
return apiResps, errors.New("bulk vs error - method must be create, update, or delete")
}
// Sanitize update
if method == "update" {
sanitizedVSs := []VirtualService{}
for _, vs := range virtualServices {
vs.Sanitize()
sanitizedVSs = append(sanitizedVSs, vs)
}
virtualServices = sanitizedVSs
}
// Build the API URL
apiURL, err := url.Parse("https://" + pceSanitization(p.FQDN) + ":" + strconv.Itoa(p.Port) + "/api/v2/orgs/" + strconv.Itoa(p.Org) + "/sec_policy/draft/virtual_services/bulk_" + method)
if err != nil {
return apiResps, fmt.Errorf("bulk vs error - %s", err)
}
// If the method is delete, we can only send Hrefs
if method == "delete" {
hrefVSs := []VirtualService{}
for _, vs := range virtualServices {
hrefVSs = append(hrefVSs, VirtualService{Href: vs.Href})
}
// Re-assign virtual services to just the HREF
virtualServices = hrefVSs
}
// Figure out how many API calls we need to make
numAPICalls := int(math.Ceil(float64(len(virtualServices)) / 1000))
// Build the array to be passed to the API
apiArrays := [][]VirtualService{}
for i := 0; i < numAPICalls; i++ {
// Get 1,000 elements if this is not the last array
if (i + 1) != numAPICalls {
apiArrays = append(apiArrays, virtualServices[i*1000:(1+i)*1000])
// Get the rest on the last array
} else {
apiArrays = append(apiArrays, virtualServices[i*1000:])
}
}
// Call the API for each array
for _, apiArray := range apiArrays {
vsJSON, err := json.Marshal(apiArray)
if err != nil {
return apiResps, fmt.Errorf("bulk vs error - %s", err)
}
// Uncomment this line if you want to print the JSON object
// fmt.Println(string(vsJson))
api, err := apicall("PUT", apiURL.String(), *p, vsJSON, false)
api.ReqBody = string(vsJSON)
apiResps = append(apiResps, api)
if err != nil {
return apiResps, fmt.Errorf("bulk vs error - %s", err)
}
}
return apiResps, nil
}
// Sanitize removes fields for an update
func (vs *VirtualService) Sanitize() {
// Remove fields for marshaling an update
vs.CreatedAt = ""
vs.CreatedBy = nil
vs.DeletedAt = ""
vs.DeletedBy = nil
vs.Href = ""
vs.UpdateType = ""
vs.UpdatedAt = ""
vs.UpdatedBy = nil
vs.PceFqdn = ""
// Make the service HREF only
if vs.Service != nil {
vs.Service = &Service{Href: vs.Service.Href}
}
// Adjust the labels and services to be HREF only
hrefOnlyLabels := []*Label{}
for _, l := range vs.Labels {
hrefOnlyLabels = append(hrefOnlyLabels, &Label{Href: l.Href})
}
vs.Labels = hrefOnlyLabels
}
// SetActive changes the HREF of the Virtual Service Object to Active
func (vs *VirtualService) SetActive() VirtualService {
vs.Href = strings.ReplaceAll(vs.Href, "draft", "active")
return *vs
}