Golden Configuration (JSON)

Golden Configurations can also be used to evaluate the compliance of services that use adapters to communicate with Itential Automation Platform (IAP). To do this, Configuration Manager queries those adapters and grades their responses.

Because adapters communicate in JSON format, they can only be managed by Golden Configurations of the JSON OS type. JSON Golden Configurations follow many of the same conventions as CLI Golden Configurations. As such, this guide will only cover the Golden Configuration elements that differ when working with JSON data.

How JSON Golden Configurations Work

Every node in a JSON Golden Configuration also has an associated baseline configuration, though it behaves slightly differently than when working with devices. It consists of:

• Lines of JSON data that mimic the expected adapter response.
• Rules that determine how those lines are interpreted (e.g., whether the line should be present or absent from the response).

Once an adapter task (represented in JSON Golden Configurations as a task instance) has been added to a node, you can run compliance checks against it. The adapter task is executed, and the response received from it is compared to the node's baseline configuration. A compliance report is then generated from this comparison.

Figure 1: JSON Golden Configuration

JSON Configuration Options

The configuration that task instances must be compliant with is created on the Configuration tab. JSON configurations function similarly to CLI configurations — type the JSON data you would like to verify incoming responses against into the text editor, then define any needed rules. However, there are some key differences.

In JSON configurations, rules are defined on a line-by-line basis using the JSON Configuration Options modal. To open the modal, right-click on the line you would like to edit. The selected line, or path, is displayed at the top of the modal in JSONPath dot notation.

Figure 2: JSON Configuration Options

For example, if you selected line 15 from the configuration snippet below (also shown in Figure 1), the path would be displayed as vpcs[1].interfaces.

{
  "interfaces": [],
  "vpcs": [
    {
      "vpcId": "none"
    },
    {
      "vpcId": "test",
      "sysNtp": [
        "13.202.18.187",
        "129.135.229.181",
        "47.132.55.37",
        "13.79.253.232"
      ],
      "interfaces": [
        {
          "name": "1.1",
          "ifIndex": "48",
          "mac-address": "00:10:58:81:34:c2",
          "A": [],
          "hello": "A"
        },
        {
          "name": "1.2",
          "ifIndex": "65",
          "mac-address": "00:21:27:42:12:d3",
          "A": []
        }
      ]
    }
  ]
}

Tabs

Different tabs are made available on the modal depending on the context of the path:

• The Rules tab is always available.
• The Key Validation tab is only available if the path references a key-value pair.
• The Array Operations tab is only available if the path is at the root of (opens or closes) an array.

The rules provided by these tabs are also contextual. For example, even if the Rules tab is currently available, it will not display rules that are irrelevant to the current path.

Rules

The Rules tab provides general-purpose rules that can be applied to most paths.

Key Validation

The Key Validation tab provides rules that determine how key-value pairs are interpreted in the current path. In practice, these rules are only used when the path is an array of objects. In such scenarios, these rules can evaluate keys that should (or should not) appear in every object of the array.

Array Operations

The Array Operations tab provides rules that determine how the array referenced by the current path is interpreted.

Reporting Key

By default, noncompliant objects present in an array are designated by index value. For example, if an object at the second index of an array named vpcs is noncompliant, it will be referred to by the path vpcs[1]. However, because index values are not always static, it can sometimes be challenging to locate the noncompliant object.

To address this issue, you may use the value of an object key as a reporting identifier:

1. Click the + Reporting Key button near the top of the modal. A text input field will appear.
2. Enter the key you would like to use as an identifier into the text input field.
3. Click the Save Keys button.

Itential recommends that you use a key that appears in every array object and has a unique value across all array objects.

Variable and Regular Expression Support

To prevent syntax errors, different delimiters are used in JSON configurations to define variables than in CLI configurations.

To utilize variables in a JSON configuration, use the $_ _$ delimiters. In the following example, the value of "vpcName" will be replaced by the variable value:

{
    "vpcName": "$_varName_$"
}

Regular expressions can be utilized in a similar manner by using the $/ /$ delimiters. For example, to ensure that the value of "deviceName" begins with Itential:

{
    "deviceName": "$/Itential.*/$"
}

Managing Task Instances

Once your baseline configuration has been defined, you can use it to measure the compliance of any applicable task instances. All operations related to task instances are performed from the Manage tab.

Creating a Task Instance

To create a task instance:

1. Select the Add Task (+) button from the toolbar at the top of the Manage tab. The Add Adapter Task modal will appear.
2. Select an adapter from the list on the right side of the modal. All related adapter tasks will be displayed.
3. Click the adapter task that you would like to run compliance checks against.
4. Click the Add (+) button at the bottom of the modal.

Figure 3: Add Adapter Task Modal

After clicking Add (+), the parameters dialog will appear. Define the following for the adapter task:

• A unique (within the node) instance name
• Any parameters required to execute the task

After all required parameters have been defined, click the Submit button located at the bottom of the dialog to create the task instance.

Figure 4: Adding an Adapter Task

Run Compliance

To run a compliance check against a task instance:

1. Click the menu button (⋮) of the task you would like to run a compliance check against.
2. Select Run Compliance (►) from the menu that appears.

Figure 5: Run Compliance

3. Once the compliance process has finished running, select the View Compliance menu option to display the Compliance and Reporting window.

Figure 6: Compliance Report