[NSX] Dump of the VMs list and its Security TAGs

Issue

Recently I had to create a script that periodically take a snapshot of the current situation regarding the list of Virtual Machines and the associated NSX Security Tags, via rest API calls.
To do this, I had to create some lines of code. Let's see below, the call to get the list of VMs and how it works....

Solution

The script must run on an Ubuntu machine, so I decided to make a bash script and use cURL. Information regarding api call, can be found at the following link https://developer.vmware.com/apis
More specific information regarding NSX, can be found here.

Our call to retrieve informations, looks like this:

curl -sk -u username:password -X GET 'https://{nsx_manager}/policy/api/v1/infra/realized-state/virtual-machines' > vms-all.json

... and from terminal using the "jq" command (with the options "-r '.results[]' ") ...

jq -r ' .results[]' vms-all.json

... the output is as below ...

Now, that we have the whole VMs list on a file, we are able to query it with 'jq' and retrieve information we need such as:

• we can search for a whole json configuration of a specific VM (for example "db-01a") ...

  jq -r ' .results[] | select(.display_name=="db-01a") ' vms-all.json

  
  
  
• we can search for the tags of a specific VM (for example "db-01a")
  

  jq -r ' .results[] | select(.display_name=="db-01a") | .tags' vms-all.json

  
  
  
• we can count how many VMs are present into the list

  jq -c ' .results[] | [.display_name, .tags]" vms-all.json | wc -l

  
  
  
• we can list all VMs with their tags

  jq -c ' .results[] | [.display_name, .tags]' vms-all.json

  
  
  
• .... and so on.
  

That's it.

[vCenter] - How to connect to vCenter via Rest API

Issue

Recently I had to create a script that grab some information from vCenter Server via Rest API calls. To do so, I had to create a few lines of code to authenticate on the vCenter, obtain a sessions and the c. Let's see bellow how does it works ....

Solution

The script must run on an Ubuntu machine, so I decided to make a bash script and use cURL. Information regarding api call, can be found at the following link https://developer.vmware.com/apis
More specific information regarding, for example, how to list the VMs already present on the inventory, can be found here.

First of all we have to create a session with the API. This is the equivalent of login. This operation exchanges user credentials supplied in the security context for a session token that is to be used for authenticating subsequent calls. To authenticate subsequent calls clients are expected to include the session token. For REST API calls the HTTP vmware-api-session-id header field should be used for this.

The call looks like this:

curl -sk -u username:password -X POST https://{vCenter}/api/session

The authentication, can be also be passed in a Base64 encoded value of username:password as header parameter, like this:

echo -n 'username:password' | base64

in a single line of code:

curl -ks -H "Authorization: Basic `echo -n 'username:password' | base64`" -X POST https://{vCenter}/api/session

For the rest API calls we can use the returned vmware-api-session-id.

Assembly the script all together it looks like the following :

#!/bin/bash

VC=192.168.1.90
ADMIN=administrator@vsphere.local
PASSWORD=VMware1!

Session_ID=`curl -sk -u ${ADMIN}:${PASSWORD} -X POST https://${VC}/api/session`

# Request sent through session ID
curl -ks -H "vmware-api-session-id: ${Session_ID:1:-1}" https://${VC}/api/vcenter/vm

Outcomes bellow

That's it.

[NSX-T] Stale logical-port(s) still connected in NSX-T 3.x

Issue

I was cleaning up a customer's NSX-T configuration to bring some changes, when I saw a lot of logical-ports still connected, more than hundred even if VM was no more present on vCenter.

Solution

I immediately thought of creating a script with rest APIs calls to remove the logical ports from NSX-T Manager. It is possible to find all the NSX-T API calls here.

For rest APIs calls within the bash script I will be using cURL with the suggestions provided here.

First, let's see the rest APIs to use:

1. to retrieve the IDs of the Logical Ports
   
2. to delete the connection
   

To get the list of Logical-Ports:
GET /api/v1/logical-ports

Below how it looks the command line ...

# lorenzo@ubuntu:~$ curl -ksn -X GET https://{NSX-T MANAGER IP}/api/v1/logical-ports 

... combining to the previous line the jq command and sed, we can extract only the ID field of our interst.

# lorenzo@ubuntu:~$ curl -ksn -X GET https://{NSX-T MANAGER IP}/api/v1/logical-ports |  jq '.results[] | .id' | sed 's/"//g' 

Outcome in the image below.

To get the deletion of the Logical-Port:
DELETE /api/v1/logical-ports/<LogicalPort-ID>?detach=true

We now have all the elements to build the bash script, which looks like the one below...

WARNING: It provided witout warranty. Use it at your own risk and only if you are aware of what you are doing

#!/bin/bash
curl -ksn -X GET https://{NSX-T MANAGER IP}/api/v1/logical-ports |  jq '.results[] | .id' | sed 's/"//g' | while read -r LP_ID
do
 curl -ksn -X DELETE https://{NSX-T MANAGER IP}/api/v1/logical-ports/${LP_ID}?detach=true
 echo " -> "${LP_ID}" removed "
done

... launch the script as below ...

lorenzo@ubuntu:~$ bash remove_all_logical_port.sh 

... the result is the following. All Logial-Ports have been cancelled.

That's it.

Quick tip for cURL users

Issue

I often use Rest API calls with the cURL command to interact with NSX manager, and every time I have to enter the login credentials.
It would be useful to have a place somewhere to store them so that you don't have to enter them every time (especially when you are on a call with customer, and you cannot write in clear text the password with the -u option ..... and you are therefore forced to type and/or copy password several times).

Solution

Looking around in "Using curl" site I discovered .netrc .
In short, it is possible to store username, password and IP/FQDN of the machine to connect to, in file ~/.netrc so that you do not need to type username and password in every API call you invoke.
The ~/.netrc file format is simple: you specify lines with a machine name and follow that with the login and password that are associated with that machine, and looks like the below:

% cat .netrc 
machine <IP/FQDN_1> login <username_here> password <password_1_here>
machine <IP/FQDN_2> login <username_here> password <password_2_here>
% 

Below an example

lorenzo@moglielL0KPF ~ % cat .netrc 
machine 172.25.251.31 login admt1lm@dominio.local password VMware1!VMware1!
machine nsxtmgr01.customer2.local login admin password VMware!123VMware!123
lorenzo@moglielL0KPF ~ % 

It is now possible to invoke the Rest API call with the -n switch to cURL to use netrc file.
We can check NSX Manager FQDNs using NSX-T Data Center API with -n option as below:

curl -k -n -X GET https://172.25.251.31/api/v1/configs/management

Further information about the parameters you can use in file .netrc or how to use it in Windows can be found on this site.

That's it.

vRA 8.5.1 REST Api calls - API Authentication

Issue

I need a quick guide (step-by-step) on how to authenticate to vRA 8.5.1 via REST API calls.

Solution

To do that, I found a VMware well documented guide "vRealize Automation 8.5 API Programming Guide"

First of all, we need to know that the process to obtain the access token is different depending upon the vRealize Automation version.
In our case, we need to get the token used to authenticate our session, we use the Identity Service API to get an API token. Then we use the API token as input to the IaaS API to get an access token.

Let's see below the steps on how to do it, using Postman and Curl:

1. Open Postman.
   
   
2. Execute the following REST API call:
   
   

   URL: https://<vRA-FQDN>/csp/gateway/am/api/login?access_token
   Method: POST
   Headers: 'Content-Type: application/json'
   Body: {
   	"username": "username",
   	"password": "password"
   }

   NOTE: If you don't need to authenticate locally (as in our case) replace the above username with your own username in the form username@domain.
   
3. Take note of the refresh_token.
   
4. Execute the following REST API call:
   
   

   URL: https://<vRA-FQDN>/iaas/api/login
   Method: POST
   Headers: 'Content-Type: application/json'
   Body: {
   	"refreshToken": "api_token"
   }

   ... and as output you will receive the token to be used for subsequent vRA queries.
   

Let's see the same procedure, this time using Curl:

1. Open a session Terminal with both command, curl and jq already installed.
   
   
2. Assign values to the variables for the hostname of our vRealize Automation appliance, our user name, and password.

   url='https://<vRA-FQDN>'
   username='username'
   password='password'

3. Execute the following curl command to retrive the API token:
   

   api_token=`curl -k -X POST \
     "$url/csp/gateway/am/api/login?access_token" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json' \
     -d '{
     "username": "'$username'",
     "password": "'$password'"
   }' | jq -r .refresh_token`

   
4. With the API token assigned, execute the following curl command to retrieve the Access token:
   

   access_token=`curl -k -X POST \
     "$url/iaas/api/login" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json' \
     -d '{
     "refreshToken": "'$api_token'"
   }' | jq -r .token`

   
   Note: After 25 minutes of inactivity, the access token times out and we must request it again.
   
   
5. We can now try to obtain more information such as the Organization ID, using the Access Token, by executing the command ...
   

   curl -k -X GET "$url/csp/gateway/am/api/loggedin/user/orgs" -H "csp-auth-token: $access_token"

   

That's it.