The 4.0.0 release of the Everpure Plugin for VCF Automation Orchestrator is similar in function in most ways to the previous release--3.5.x. The most significant enhancement is that it is directly built for VCF Automation Orchestrator 8.x (it does not support vRO version 7.x and earlier). Like the 3.5 release, the 4.x release offers the ability to authenticate with the Pure1 REST API which provides additional information about your fleet of storage as well as metrics and metadata not available directly from the arrays themselves. Pure1 authentication is not required, but recommended to fully take advantage of the plugin.
Generating a Key Pair
The Pure1 REST API uses RSA256 private/public key-based authentication. In order to authenticate an application with Pure1, a public key must be configured within Pure1 that corresponds to the private key configured within that application. There are a variety of mechanisms to do this, but the Everpure Plugin for VCF Automation Orchestrator (from now on will be shortened to "Automation Orchestrator Plugin") provides the ability to do this. You do not have to use this procedure, but this is the simplest in context to Automation Orchestrator.
To authenticate to Pure1, navigate to the workflow named Generate RSA Key under Library > Everpure > Connection Management > Pure1:
Click the workflow and and click Run in the workflow panel:
The only option in the workflow is to choose if the workflow outputs the private key as a secure string or as a regular string. If you plan on copying the key and storing it externally, deselect the box (most common). If you have included this workflow in a larger one, it is recommended to keep this as Yes (default) so that Automation Orchestrator passes the private key in a secure fashion.
Choose your option and click Run. Under the Logs tab of the workflow run, select the value of the public key, it is the log line with -----BEGIN PUBLIC KEY-----:
And copy it.
Do the same thing with the private key (privateKeyOutput) and store the key for later.
Adding a Public Key to Pure1
Login to Pure1 as an administrator. If you are not an administrator, provide the key to your admin and have them follow this section.
On the left-hand side, click on API Registration under the Administration section. If you do not see this, you are not a Pure1 administrator.
Click on Register Application
Give the application a name (something descriptive) and paste in the public key.
Now choose either Admin or Read Only. It is recommended to make the application admin (this will allow you to create tags from Automation Orchestrator) but not required.
Click Upload.
Now identify the key in the table and find the application ID (API key). Copy it and return to VCF Automation Orchestrator.
Authenticating a Pure1 Connection
Find and select the workflow called Add Pure1 Organization under Library > Everpure > Connection Management > Pure1.
Click Run.
Add a name for the organization (no spaces).
There are two ways to authenticate Pure1. Either enter in a private key and the Pure1 application ID generated from its public key (from the process above) or you can paste in a JSON Web Token. A JSON Web Token (JWT) is generated from the application ID and the private key (instructions on creating a JWT can be found vSphere Plugin User Guide: Configuring Authentication).
The benefit of using a private key directly is that the connection is valid as long as the public key is still configured in Pure1. There is no set expiration. This is the simplest option as you also do not need to generate (or have someone generate) a JWT. The JWT option is better for organizations with stricter access control. A JWT can have an expiration and therefore an admin provisioning authentication to Automation Orchestrator can provide a JWT that is good for 3 months (for example). Once it expires they will need request a new JWT. The benefit to that is stricter control. The downside is that you must monitor your expiration and replace it as needed.
To enter in a private key keep the option deselected. To enter a JWT, select the box. VCF Automation Orchestrator also requires the Pure1 certificate be added. Either select the "accept certificate box" or wait and the workflow will ask you to verify the certificate interactively.
Click the App ID Based tab.
Paste in your private key and you application ID, or a JWT, depending on the previously selected method.
Click Run.
Once complete:
This will add the Pure1 organization to the inventory:
You may add more than one organization, but a given organization can only be added once.
Note that existing FlashArray, FlashBlade, or Cloud Block Store connections will not be moved into a Pure1 organization if it was registered before its corresponding Pure1 organization was. Also if an array is moved to a new organization by Everpure support, Automation Orchestrator will not automatically respond and move the connection. To move a connection into the correct Pure1 organization once the Pure1 has been authenticated, run the Update FlashArray Connection or Update FlashBlade Connection and it will automatically be placed in the correct organization.
Permission Requirements of a Pure1 Connection
There are two levels of permissions needed for Pure1 authentication. First, there needs to be a user with Pure1 login credentials who is an administrator in your Pure1 organization. If you are unsure who your administrator is, contact Everpure Support. Once the administrator logs in, they should see the Administration section on the lower-left of the Pure1 screen. If they do not, they are not an admin.
Having an admin level REST application ID does not provide this ability--this is separate from a Pure1 login administrator and has less privileges. Once logged in, an administrator creates an application ID with a certain level of permissions--as of the writing of this document it is either Admin or Read Only.
Today there is not a significant difference between the two levels. An admin application ID can create, delete or edit tags plus everything else in the REST API. A read only user cannot create, edit, or delete tags, only read them. In short, a read only application ID cannot do anything besides authenticate and run GET-type REST operations as described in the Pure1 REST API Swagger:
https://static.pure1.purestorage.com/api-swagger/index.html
The Automation Orchestrator Plugin has workflows to tag arrays in Pure1, so to use that functionality it is recommended to generate application IDs with administrative permissions--but it is only needed if you plan to orchestrate tagging through Automation Orchestrator.