Allow integrating JSS AutoPkg Addon with Cloud Distribution Points (S3)

[luisgiraldo]

When enabling the JSS AutoPkg Addon, AutoPkgr is not able to connect to my cloud distribution point, as it asks for Casper read/write credentials, but these do not work with cloud distribution point.

[homebysix]

Thanks for pointing this out! For now, you are correct — the jss-autopkg-addon only works with distribution points that use a username/password, which means Amazon and Rackspace hosted DPs aren't supported yet.

In order for cloud distribution points to work, I think @sheagcraig will need to update jss-autopkg-addon to add a space for the host's API key into the JSS_REPOS array. Then we can update AutoPkgr to prompt for that API key instead of the read/write password.

[luisgiraldo]

Happy to help test with Rackspace or S3 repositories as needed!

[sheagcraig]

Howdy @luisgiraldo, and thanks for the interest. I'm in the midst of a lengthy leave due to the birth of an adorable daughter; I'm hoping to get some sneak-in-and-code time sometime soon.

On tap are updates to the underlying python-jss code to handle JDS repositories. I should think that hosted distribution points would be easy to add in, with the only problem being that we don't have any to test with at our organization.

So forgive my ignorance, but what all information is needed for these? @homebysix mentioned an API key. Is this in addition to a user/pass, or in exclusion to?

When you add packages to a hosted DP, do you use Casper Admin, and the DP gets mounted? If so, what protocol does it use? SMB? NFS? AFP?

Or do you use the web interface and the packages get POSTed to the hosted server (like a JDS).

I'm loath to go in and jack up the repos input variable array by adding a type key, but on the other hand, it seems appropriate to group JDS and hosted DP's under repos rather than create separate input variables for each of them. Have to balance between organizational elegance and breaking recipes that are in use.

(It's possible that, lacking a type key, a repo could default to assuming it was a SMB/AFP share and check the JSS.distributionpoint() results).

[luisgiraldo]

Hey @sheagcraig - Congrats on the little one! When I define a Cloud Distribution Point in JSS (for Amazon S3 for instance), I provide an Access Key ID and Secret Access Key. When launching Casper Admin, it does not seem to mount anything, but when dragging and dropping a package in to Casper Admin, Casper Admin will upload it to the Distribution Point. I'm unsure of what magic Casper Admin is using to upload the package, and unsure of how to check on my end for what it's doing. My guess is it's just doing an https connection via S3 API, as no other protocol would be allowed for connecting. It's possible they're using one of the tools out there that provide a Mac CLI interface for this, such as s3cmd - http://s3tools.org/s3cmd. In fact, using these tools (including cli53), I built a little backup utility for making backups of Route 53 zones and uploading them to S3 https://github.com/luisgiraldo/cli53export.

Set-up-wise, when JSS is given the Cloud Distribution Point credentials, it goes out to S3 and creates the bucket it will use for uploading files, and unlike a typical DP, it does not create subfolders. Rather, it just creates the bucket and packages are uploaded to the root directory of said bucket.

Hope that's a helpful starting point...perhaps we can tap into Jamf folks as well to find out how Casper Admin is uploading packages.

[sheagcraig]

@luisgiraldo Just to give you an update-I just released all of the bugfixes and improvements I had stockpiled while I was out.

We have JDS distribution points "working", aside from this nagging issue where, oh, just the packages and scripts get corrupted with a little HTML cruft. We're working to sort that out, and then hopefully I can focus on CDP support. I still think it should be pretty easy once we solve the JDS issues.

[luisgiraldo]

That's great news – thanks for the update!