Isilon | David Muegge's Blog

In my last post I talked about the Isilon REST based platform API. I have been experimenting more with the Isilon API and PowerShell. I thought I would share the progress so far.

I decided to create a PowerShell module to leverage the functionality exposed by the Isilon platform API. The module provides some advanced functions, script cmdlets if you prefer, to provide API access. Right now I have some ‘get’ cmdlets and a lot of work to do before I have full coverage of the API. Maybe I can catch up by the time there is full coverage of the Isilon functionality in the platform APIJ

The module uses basic authentication at this time as I am still working on other authentication options. The first step in using the module is to download it and place it in your modules directory. Then load the module and create a password file for logging on to the Isilon cluster. The New-PasswordFile command creates an encrypted file containing the supplied password. This file is used to supply authentication automatically. The file can only be used by the user who was logged on when the file was created.

import-module IsilonPlatform
 
PS C:Windowssystem32> New-PasswordFile -Path c:temp -Filename is7test01-admin_pwd.txt
Password: ********
 
 
    Directory: C:temp
 
 
Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---         3/10/2013   7:06 PM          0 pwdfile.txt

import-module IsilonPlatform

PS C:Windowssystem32> New-PasswordFile -Path c:temp -Filename is7test01-admin_pwd.txt

Password: ********

Directory: C:temp

Mode LastWriteTime Length Name

---- ------------- ------ ----

-a--- 3/10/2013 7:06 PM 0 pwdfile.txt

Once this is complete the following code will load a console with the cmdlets and setup authentication.

# Load Module
Import-Module IsilonPlatform
 
# Ignore certificate errors
Disable-CertificateValidation
 
# Set required connection information
Set-ISIAPIConnectionInfo -username "admin" -passwordfile "C:Tempis7test01-admin_pwd.txt" -baseurl "https://is7test01:8080"
 
# Show module commands
Get-Command -Module IsilonPlatform

# Load Module

Import-Module IsilonPlatform

# Ignore certificate errors

Disable-CertificateValidation

# Set required connection information

Set-ISIAPIConnectionInfo -username "admin" -passwordfile "C:Tempis7test01-admin_pwd.txt" -baseurl "https://is7test01:8080"

# Show module commands

Get-Command -Module IsilonPlatform

This code uses the password file we created earlier. Once it is executed we see the available Isilon cmdlets and we have a console to execute Isilon commands and scripts. I put this code into a script to launch an Isilon management console.

DM - Isilon Platform API Toolkit
 
CommandType     Name                                               ModuleName
-----------     ----                                               ----------
Function        Disable-CertificateValidation                      IsilonPlatform
Function        Get-ISIADSProvider                                 IsilonPlatform
Function        Get-ISIADSProviderDomainControllers                IsilonPlatform
Function        Get-ISIADSTrustedDomains                           IsilonPlatform
Function        Get-ISIFileProvider                                IsilonPlatform
Function        Get-ISIGroup                                       IsilonPlatform
Function        Get-ISIGroupMembers                                IsilonPlatform
Function        Get-ISINFSExports                                  IsilonPlatform
Function        Get-ISINFSExportsSummary                           IsilonPlatform
Function        Get-ISINFSSettings                                 IsilonPlatform
Function        Get-ISIProviderSummary                             IsilonPlatform
Function        Get-ISIQuota                                       IsilonPlatform
Function        Get-ISIQuotaLicense                                IsilonPlatform
Function        Get-ISIQuotaNotification                           IsilonPlatform
Function        Get-ISIQuotaReport                                 IsilonPlatform
Function        Get-ISIQuotaReportAbout                            IsilonPlatform
Function        Get-ISIQuotaReportSettings                         IsilonPlatform
Function        Get-ISIQuotaSummary                                IsilonPlatform
Function        Get-ISISMBOpenFiles                                IsilonPlatform
Function        Get-ISISMBSessions                                 IsilonPlatform
Function        Get-ISISMBSettings                                 IsilonPlatform
Function        Get-ISISMBShares                                   IsilonPlatform
Function        Get-ISISMBSharesSummary                            IsilonPlatform
Function        Get-ISISnapshot                                    IsilonPlatform
Function        Get-ISISnapshotLicense                             IsilonPlatform
Function        Get-ISISnapshotSummary                             IsilonPlatform
Function        Get-ISIUser                                        IsilonPlatform
Function        Get-ISIUserMappingRules                            IsilonPlatform
Function        Get-ISIUserMemberOf                                IsilonPlatform
Function        Get-ISIZone                                        IsilonPlatform
Function        Get-PasswordFromFile                               IsilonPlatform
Function        New-PasswordFile                                   IsilonPlatform
Function        Set-ISIAPIConnectionInfo                           IsilonPlatform

DM - Isilon Platform API Toolkit

CommandType Name ModuleName

----------- ---- ----------

Function Disable-CertificateValidation IsilonPlatform

Function Get-ISIADSProvider IsilonPlatform

Function Get-ISIADSProviderDomainControllers IsilonPlatform

Function Get-ISIADSTrustedDomains IsilonPlatform

Function Get-ISIFileProvider IsilonPlatform

Function Get-ISIGroup IsilonPlatform

Function Get-ISIGroupMembers IsilonPlatform

Function Get-ISINFSExports IsilonPlatform

Function Get-ISINFSExportsSummary IsilonPlatform

Function Get-ISINFSSettings IsilonPlatform

Function Get-ISIProviderSummary IsilonPlatform

Function Get-ISIQuota IsilonPlatform

Function Get-ISIQuotaLicense IsilonPlatform

Function Get-ISIQuotaNotification IsilonPlatform

Function Get-ISIQuotaReport IsilonPlatform

Function Get-ISIQuotaReportAbout IsilonPlatform

Function Get-ISIQuotaReportSettings IsilonPlatform

Function Get-ISIQuotaSummary IsilonPlatform

Function Get-ISISMBOpenFiles IsilonPlatform

Function Get-ISISMBSessions IsilonPlatform

Function Get-ISISMBSettings IsilonPlatform

Function Get-ISISMBShares IsilonPlatform

Function Get-ISISMBSharesSummary IsilonPlatform

Function Get-ISISnapshot IsilonPlatform

Function Get-ISISnapshotLicense IsilonPlatform

Function Get-ISISnapshotSummary IsilonPlatform

Function Get-ISIUser IsilonPlatform

Function Get-ISIUserMappingRules IsilonPlatform

Function Get-ISIUserMemberOf IsilonPlatform

Function Get-ISIZone IsilonPlatform

Function Get-PasswordFromFile IsilonPlatform

Function New-PasswordFile IsilonPlatform

Function Set-ISIAPIConnectionInfo IsilonPlatform

Now that we have a console with the commands loaded we can use them to get information from the Isilon system. Here is an example of a command to return all Isilon groups.

PS C:Windowssystem32> get-isigroup
 
 
dn               :
dns_domain       :
domain           : UNIX_GROUPS
generated_gid    : False
gid              : @{id=GID:0}
id               : wheel
member_of        :
name             : wheel
provider         : lsa-file-provider:System
sam_account_name : wheel
sid              : @{id=SID:S-1-22-2-0}
type             : group
 
dn               :
dns_domain       :
domain           : UNIX_GROUPS
generated_gid    : False
gid              : @{id=GID:14}
id               : ftp
member_of        :
name             : ftp
provider         : lsa-file-provider:System
sam_account_name : ftp
sid              : @{id=SID:S-1-22-2-14}
type             : group
 
dn               :
dns_domain       :
domain           : UNIX_GROUPS
generated_gid    : False
gid              : @{id=GID:31}
id               : guest
member_of        :
name             : guest
provider         : lsa-file-provider:System
sam_account_name : guest
sid              : @{id=SID:S-1-22-2-31}
type             : group
 
.
.
.

PS C:Windowssystem32> get-isigroup

dn :

dns_domain :

domain : UNIX_GROUPS

generated_gid : False

gid : @{id=GID:0}

id : wheel

member_of :

name : wheel

provider : lsa-file-provider:System

sam_account_name : wheel

sid : @{id=SID:S-1-22-2-0}

type : group

dn :

dns_domain :

domain : UNIX_GROUPS

generated_gid : False

gid : @{id=GID:14}

id : ftp

member_of :

name : ftp

provider : lsa-file-provider:System

sam_account_name : ftp

sid : @{id=SID:S-1-22-2-14}

type : group

dn :

dns_domain :

domain : UNIX_GROUPS

generated_gid : False

gid : @{id=GID:31}

id : guest

member_of :

name : guest

provider : lsa-file-provider:System

sam_account_name : guest

sid : @{id=SID:S-1-22-2-31}

type : group

Here we can see all groups are returned with all properties. We also see the results are returned as PowerShell objects. This gives us all of the PowerShell goodness when working with the Isilon platform API. The next example uses PowerShell to display just the information we want in an easier to read format.

PS C:Windowssystem32> get-isigroup | select id,provider,domain
 
id                                             provider                                       domain
--                                             --------                                       ------
wheel                                          lsa-file-provider:System                       UNIX_GROUPS
ftp                                            lsa-file-provider:System                       UNIX_GROUPS
guest                                          lsa-file-provider:System                       UNIX_GROUPS
ifs                                            lsa-file-provider:System                       UNIX_GROUPS
admin                                          lsa-file-provider:System                       UNIX_GROUPS
Administrators                                 lsa-local-provider:System                      BUILTIN
Users                                          lsa-local-provider:System                      BUILTIN
Guests                                         lsa-local-provider:System                      BUILTIN
Backup Operators                               lsa-local-provider:System                      BUILTIN
Isilon Users                                   lsa-local-provider:System                      IS7TEST01

PS C:Windowssystem32> get-isigroup | select id,provider,domain

id provider domain

-- -------- ------

wheel lsa-file-provider:System UNIX_GROUPS

ftp lsa-file-provider:System UNIX_GROUPS

guest lsa-file-provider:System UNIX_GROUPS

ifs lsa-file-provider:System UNIX_GROUPS

admin lsa-file-provider:System UNIX_GROUPS

Administrators lsa-local-provider:System BUILTIN

Users lsa-local-provider:System BUILTIN

Guests lsa-local-provider:System BUILTIN

Backup Operators lsa-local-provider:System BUILTIN

Isilon Users lsa-local-provider:System IS7TEST01

The following example shows how we can query the groups, filter by type and control the display format. This example retrieves all users with the domain type of BUILTIN and displays the name and provider in a results table.

PS C:Windowssystem32> Get-ISIGroup | where domain -eq BUILTIN | select name,provider
 
name                                                                  provider
----                                                                  --------
Administrators                                                        lsa-local-provider:System
Users                                                                 lsa-local-provider:System
Guests                                                                lsa-local-provider:System
Backup Operators                                                      lsa-local-provider:System

PS C:Windowssystem32> Get-ISIGroup | where domain -eq BUILTIN | select name,provider

name provider

---- --------

Administrators lsa-local-provider:System

Users lsa-local-provider:System

Guests lsa-local-provider:System

Backup Operators lsa-local-provider:System

The cmdlets will also allow using the pipeline. Although, I do not have pipline functionality in all cmdlets yet. The user, group and provider cmdlets do. The following example shows a listing of all Isilon ADS BUILTIN groups and the members of each group.

PS C:Windowssystem32> Get-ISIGroup | where domain -eq BUILTIN | foreach {Write-Host $_.id; $_ | Get-ISIGroupMembers | select name,type | out-string}
 
Administrators
 
name                                                                  type
----                                                                  ----
LABdomain admins                                                     group
 
 
Users
 
name                                                                  type
----                                                                  ----
Authenticated Users                                                   wellknown
LABdomain users                                                      group
 
 
Guests
 
name                                                                  type
----                                                                  ----
Guest                                                                 user
 
 
Backup Operators

PS C:Windowssystem32> Get-ISIGroup | where domain -eq BUILTIN | foreach {Write-Host $_.id; $_ | Get-ISIGroupMembers | select name,type | out-string}

Administrators

name type

---- ----

LABdomain admins group

Users

name type

---- ----

Authenticated Users wellknown

LABdomain users group

Guests

name type

---- ----

Guest user

Backup Operators

Hopefully someone finds this interesting and I will try to provide more useful examples as I add functionality to the module. Here are the download links for the module and the console launch script. You will need to modify the console launch script(Start-IsilonPlatform.ps1) for your environment.

IsilonPlatform
Start-IsilonPlatform

This module is a work in progress so use at your own risk. I hope to provide more functionality soon and I hope to see EMC add more coverage to the API. I would really like to see more around cluster configuration and performance statistics. I think this is great functionality provided by EMC, more please!

Feedback on the module is welcome.

Regards,

Dave

EMC recently released Isilon 7.0 “Mavericks” version of the OneFS operating system. This release has many great new features, which you can read all about here and here. One of these great new Isilon features is the ReST API, which allows programmatic access to the platform. If you are not familiar with ReST, it stands for Representational State Transfer. This is a lightweight, platform independent and stateless method of programming web services.

PowerShell allows an easy method to access the Isilon ReST API. Working with ReST is a new for me, but I thought it might be useful for some to follow along while I am learning. Also, if anyone has tips for me on this process I welcome the knowledge.

The Isilon ReST API is not enabled by default. To enable the functionality it requires changing options on the HTTP settings page in the protocols section, see below.

Isilon_HTTP_Settings

The HTTP interface can use active directory authentication, but in this post I will use basic authentication and show examples of reading data from the cluster. I hope to show more advanced examples as I learn.

PowerShell v3 has some great built-in functionality for working with ReST API’s. The Invoke-RestMethod cmdlet is exactly the functionality required to leverage the Isilon ReST API. The first challenges when working with the API will be related to authentication and certificates. The Isilon cluster will use a self-signed certificate by default. This results in a certificate error when connecting via HTTPS and can be seen when connecting to the Isilon cluster via a browser. The following code will allow a work around to the problem by ignoring the error.

# Ignore SSL errors
add-type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;

    public class IDontCarePolicy : ICertificatePolicy {
    public IDontCarePolicy() {}
    public bool CheckValidationResult(
        ServicePoint sPoint, X509Certificate cert,
        WebRequest wRequest, int certProb) {
        return true;
    }
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = new-object IDontCarePolicy

# Ignore SSL errors

add-type @"

using System.Net;

using System.Security.Cryptography.X509Certificates;

public class IDontCarePolicy : ICertificatePolicy {

public IDontCarePolicy() {}

public bool CheckValidationResult(

ServicePoint sPoint, X509Certificate cert,

WebRequest wRequest, int certProb) {

return true;

}

[System.Net.ServicePointManager]::CertificatePolicy = new-object IDontCarePolicy

In a production environment the correct way to handle this would be to install a certificate issued by a trusted certificate authority. The next step is to setup a proper HTTP header for basic authentication.

# Set username and password
$username = '****'
$upassword = '****'

# Encode basic authorization header
$auth = $username + ':' + $upassword
$Encoded = [System.Text.Encoding]::UTF8.GetBytes($auth)
$EncodedPassword = [System.Convert]::ToBase64String($Encoded)
$headers = @{"Authorization"="Basic $($EncodedPassword)"}

# Set username and password

$username = '****'

$upassword = '****'

# Encode basic authorization header

$auth = $username + ':' + $upassword

$Encoded = [System.Text.Encoding]::UTF8.GetBytes($auth)

$EncodedPassword = [System.Convert]::ToBase64String($Encoded)

$headers = @{"Authorization"="Basic $($EncodedPassword)"}

Once this is complete all we have to do is build the proper URL and issue the request. The code below will retrieve and display the SMB and NFS settings of the cluster.

# Setup base address and objects
$baseurl = 'https://192.168.1.239:8080'

# Create full address of resource to be retrieved
$resource = '/platform/1/protocols/smb/settings/global'
$url = $baseurl + $resource

# Execute request and display SMB Settings
$SMBGlobal = Invoke-RestMethod -Uri $url -Headers $headers -Method Get 
$SMBGlobal.settings

# Create full address of resource to be retrieved
$resource = '/platform/1/protocols/nfs/settings/global'
$url = $baseurl + $resource

# Execute request and display NFS Settings
$NFSGlobal = Invoke-RestMethod -Uri $url -Headers $headers -Method Get
$NFSGlobal.settings

# Setup base address and objects

$baseurl = 'https://192.168.1.239:8080'

# Create full address of resource to be retrieved

$resource = '/platform/1/protocols/smb/settings/global'

$url = $baseurl + $resource

# Execute request and display SMB Settings

$SMBGlobal = Invoke-RestMethod -Uri $url -Headers $headers -Method Get

$SMBGlobal.settings

# Create full address of resource to be retrieved

$resource = '/platform/1/protocols/nfs/settings/global'

$url = $baseurl + $resource

# Execute request and display NFS Settings

$NFSGlobal = Invoke-RestMethod -Uri $url -Headers $headers -Method Get

$NFSGlobal.settings

The output from the above examples is shown below. As you can see this gives a quick concise view of the protocol settings.

access_based_share_enum     : False
audit_fileshare             : none
audit_global_sacl           : {}
audit_logon                 : all
dot_snap_accessible_child   : True
dot_snap_accessible_root    : True
dot_snap_visible_child      : False
dot_snap_visible_root       : True
enable_security_signatures  : False
guest_user                  : nobody
ignore_eas                  : False
onefs_cpu_multiplier        : 1
onefs_num_workers           : 0
require_security_signatures : False
server_string               : Isilon Server
service                     : True
srv_cpu_multiplier          : 4
srv_num_workers             : 0
support_netbios             : False
support_smb2                : True

lock_protection : 2
nfsv2_enabled   : True
nfsv3_enabled   : True
nfsv4_domain    : localdomain
nfsv4_enabled   : False
rpc_maxthreads  : 16
rpc_minthreads  : 16
service         : True

access_based_share_enum : False

audit_fileshare : none

audit_global_sacl : {}

audit_logon : all

dot_snap_accessible_child : True

dot_snap_accessible_root : True

dot_snap_visible_child : False

dot_snap_visible_root : True

enable_security_signatures : False

guest_user : nobody

ignore_eas : False

onefs_cpu_multiplier : 1

onefs_num_workers : 0

require_security_signatures : False

server_string : Isilon Server

service : True

srv_cpu_multiplier : 4

srv_num_workers : 0

support_netbios : False

support_smb2 : True

lock_protection : 2

nfsv2_enabled : True

nfsv3_enabled : True

nfsv4_domain : localdomain

nfsv4_enabled : False

rpc_maxthreads : 16

rpc_minthreads : 16

service : True

While this is only a simple example of retrieving data from the cluster, the possibilities are endless. When considering where we are in the transformation to cloud and automation. This type of enabling technology will be the foundation of great things to come.

Stay tuned…

Regards,

Dave

Tag Archives for Isilon

EMC Isilon Platform API and PowerShell Part II

Using the Isilon 7.0 ReST API with PowerShell

Share this:

Share this: