I am new to WFA and having trouble to setup workflow to create export rule

[sp_1008]

 I am setting up a WFA workflow to create NFS share and export it. I am trying to use Netapp certified WF  "create export rule" but I don't see  the parameter "-DisableDev"  in the powershell script.  I want to add this pramnter in the create export rule. Having trouble to set the parameter "-DisableDev"  which will not allow to creation of devices on  NFS server.

I am not sure what is the exact syntex to add this paramter in the WFA powershell script. 

Any assistance on this will be a great help!

[csalitros]

I ran into this with some other certified commands, specifially 'Create CIFS Share', that didn't support all the options.

You'll basically want to copy that command to a new one, put on your Powershell hat, add the paramter at the top, then check if that parameter exists, then keep adding onto the command variable that it's building.

Here's the code block for the Create CIFS Share'  I hacked at .. parameters for 'Share Properties' and 'vscan profile' were what I added.

param (
  [parameter(Mandatory=$true, HelpMessage="Name or IP address of the cluster hosting the Storage Virtual Machine.")]
  [string]$Cluster,

  [parameter(Mandatory=$true, HelpMessage="Name of the Storage Virtual Machine in which the CIFS share will be created.")]
  [string]$Vserver,

  [parameter(Mandatory=$true, HelpMessage="File system path that is shared through this CIFS share.")]
  [string]$Path,

  [parameter(Mandatory=$true, HelpMessage="Name of the CIFS share to be created.")]
  [string]$ShareName,
 
  [parameter(Mandatory=$false, HelpMessage="A comment that gives a description of the CIFS share. CIFS clients see this description when browsing the Storage Virtual Machine's CIFS shares.")]
  [string]$Comment,

  [parameter(Mandatory=$false, HelpMessage="Share Prperties.")]
  [string]$share_properties,

  [parameter(Mandatory=$false, HelpMessage="Set Vscan Profile for Share")]
  [string]$vscanProfile
)

Get-WFALogger -Info -message $("Creating CIFS share: " + $ShareName + "at path: "+ $Path)

$command = "Add-NcCifsShare -Name " +  $ShareName + " -Path " + $Path 

if ($Comment)
{
    $command += " -Comment " + "'" + $Comment + "'"
}

if ($share_properties)
{
    $command += " -ShareProperties " + $share_properties

}

if ($vscanProfile) {
    $command +=  " -VscanProfile " + "'" + $vscanProfile + "'"
}

$command += " -VserverContext " + $Vserver

# connect to cluster
Connect-WfaCluster $Cluster

Try
{
    $result = Invoke-Expression -ErrorAction stop $command
}
Catch
{
    $ErrorMessage = $_.Exception.Message
    throw "Create CIFS share failed. Reason : " + $ErrorMessage 
}
if ($result.Status -eq "failed")
 {
    throw "Create CIFS share failed. Reason : " + $result.ErrorMessage
 }

[mbeattie]

Hi,

The certified content that comes with WFA may not enable all parameters that can be set via the PSTK\ZAPI. You can use it as an example to develop your own commands if you require additional parameters to be set. Here is an example for you:

Param(
   [Parameter(Mandatory=$True, HelpMessage="The Cluster name or IP address")]
   [String]$Cluster,
   [Parameter(Mandatory=$True, HelpMessage="The Export policy name")]
   [String]$PolicyName,
   [Parameter(Mandatory=$True, HelpMessage="The Client match")]
   [String]$ClientMatch,
   [Parameter(Mandatory=$True, HelpMessage="The Vserver name")]
   [String]$VserverName, 
   [Parameter(Mandatory=$False, HelpMessage="The Rule index")]
   [Int]$RuleIndex,
   [Parameter(Mandatory=$True, HelpMessage="The Read only security flavor")]
   [String]$RoRule,
   [Parameter(Mandatory=$True, HelpMessage="The Read write security flavor")]
   [String]$RwRule, 
   [Parameter(Mandatory=$False, HelpMessage="The Protocols")]
   [String]$Protocol, 
   [Parameter(Mandatory=$False, HelpMessage="The Super user sec flavor")]
   [String]$Superuser,
   [Parameter(Mandatory=$False, HelpMessage="The User name or ID to which anonymous users are mapped")]
   [String]$AnonymousUserId,
   [Parameter(Mandatory=$False, HelpMessage="If specified, the NFS server will honor SetUID bits in SETATTR operation")]
   [Bool]$EnableSetUid,
   [Parameter(Mandatory=$False, HelpMessage="If specified, the NFS server will not allow creation of devices")]
   [Bool]$DisableSetUid,
   [Parameter(Mandatory=$False, HelpMessage="If specified, the NFS server will allow creation of devices")]
   [Bool]$EnableDev,
   [Parameter(Mandatory=$False, HelpMessage="If specified, the NFS server will not allow creation of devices")]
   [Bool]$DisableDev,
   [Parameter(Mandatory=$False, HelpMessage="Ignore or Fail unix security operations on NTFS volumes. Possible values are 'ignore', 'fail'. Default value is 'fail'")]
   [ValidateSet("ignore","fail")]
   [String]$NtfsUnixSecurityOps,  
   [Parameter(Mandatory=$False, HelpMessage="Change ownership mode. Possible values are 'restricted', 'unrestricted'. Default value is 'restricted'")]
   [ValidateSet("restricted","unrestricted")]
   [String]$ChownMode,
   [Parameter(Mandatory=$False, HelpMessage="The maximum number of ZAPI retry attempts")]
   [Int]$ZapiRetryCount
)
#'------------------------------------------------------------------------------
#'Ensure the input parameters are valid.
#'------------------------------------------------------------------------------
If($EnableSetUid -And $DisableSetUid){
   Throw "The input parameters ""EnableSetUid"" and ""DisableSetUid"" are both provided. Please provide either parameter, not both parameters"
}
If($EnableDev -And $DisableDev){
   Throw "The input parameters ""EnableDev"" and ""DisableDev"" are both provided. Please provide either parameter, not both parameters"
}
#'------------------------------------------------------------------------------
#'Connect to the cluster.
#'------------------------------------------------------------------------------
Connect-WFACluster $Cluster
#'------------------------------------------------------------------------------
#'Ensure the export policy exists.
#'------------------------------------------------------------------------------
[String]$command = "Get-NcExportPolicy -VserverContext $VserverName -Name $PolicyName "
If($ZapiRetryCount){
   [String]$command += "-ZapiRetryCount $ZapiRetryCount "
}
[String]$command += "-ErrorAction Stop"
Try{
   $policy = Invoke-Expression -Command $command -ErrorAction Stop
   Get-WFALogger -Info -Message "Executed Command`: $command"
   Get-WFALogger -Info -Message "Enumerated Export Policy ""$PolicyName"" on vserver ""$VserverName"""
}Catch{
   Get-WFALogger -Error -Message $("Failed Executing Command`: $command. Error " + $_.Exception.Message)
   Throw "Failed enumerating Export Policy ""$PolicyName"" on vserver ""$VserverName"""
}
#'------------------------------------------------------------------------------ 
#'Ensure the policy exists.
#'------------------------------------------------------------------------------
If(-Not($policy)){
   Get-WFALogger -Info -Message "Creating Export Policy ""$PolicyName"" on vserver ""$VserverName"""
   [String]$command = "New-NcExportPolicy -Name $PolicyName -VserverContext $VserverName "
   If($ZapiRetryCount){
      [String]$command += "-ZapiRetryCount $ZapiRetryCount "
   }
   [String]$command += "-ErrorAction Stop"
   Try{
      Invoke-Expression -Command $command -ErrorAction Stop
      Get-WFALogger -Info -Message "Executed Command`: $command"
      Get-WFALogger -Info -Message "Created Export Policy ""$PolicyName"" on vserver ""$VserverName"""
   }Catch{
      Get-WFALogger -Error -Message $("Failed Executing Command`: $command. Error " + $_.Exception.Message)
      Throw "Failed creating Export Policy ""$PolicyName"" on vserver ""$VserverName"""
   }
}
#'------------------------------------------------------------------------------
#'Enumerate the export policy rules to check if a rule already exists.
#'------------------------------------------------------------------------------
If($policy){
   $query = Get-NcExportRule -Template
   $query.ClientMatch = $ClientMatch
   $query.PolicyName  = $PolicyName
   $query.Vserver     = $VserverName
   $query.RoRule      = $RoRule
   $query.RwRule      = $RwRule
   If($Protocol){
      $query.Protocol = $Protocol
   }
   Try{
      $exportRules = Get-NcExportRule -Query $query -ErrorAction Stop
   }Catch{
      Get-WFALogger -Error -Message $("Failed enumerating export policy rules for policy ""$PolicyName"" on vserver ""$VserverName"". Error " + $_.Exception.Message)
      Throw "Failed enumerating export policy rules for policy ""$PolicyName"" on vserver ""$VserverName"""
   }
}
#'------------------------------------------------------------------------------
#'Exit if the export policy rule already exists.
#'------------------------------------------------------------------------------
If($exportRules){
   Get-WFALogger -Info -Message "The client ""$ClientMatch"" is already exported in policy ""$PolicyName"" on vserver ""$VserverName"""
   Exit 0
}Else{
   Get-WFALogger -Info -Message "Creating export policy rule for client ""$ClientMatch"" in policy ""$PolicyName"" on vserver ""$VserverName"""
}
#'------------------------------------------------------------------------------ 
#'Set the command to create the export policy rule.
#'------------------------------------------------------------------------------
[String]$command = "New-NcExportRule -Policy '$PolicyName' -ClientMatch '$ClientMatch' -ReadOnlySecurityFlavor $RoRule -ReadWriteSecurityFlavor $RwRule -VserverContext $VserverName "
If($RuleIndex){
   [String]$command += "-Index $RuleIndex "
}
If($Protocol){
   [String]$command += "-Protocol $Protocol "
}
If($Superuser){
   [String]$command += "-SuperUserSecurityFlavor $Superuser "
}
If($AnonymousUserId){
   [String]$command += "-Anon $AnonymousUserId "
}
If($EnableSetUid){
   [String]$command += "-EnableSetUid "
}
If($DisableSetUid){
   [String]$command += "-DisableSetUid "
}
If($EnableDev){
   [String]$command += "-EnableDev "
}
If($DisableDev){
   [String]$command += "-DisableDev "
}
If($NtfsUnixSecurityOps){
   [String]$command += "-NtfsUnixSecurityOps $NtfsUnixSecurityOps "
}
If($ChownMode){
   [String]$command += "-ChownMode $ChownMode "
}
If($ZapiRetryCount){
   [String]$command += "-ZapiRetryCount $ZapiRetryCount "
}
[String]$command += "-ErrorAction Stop"
#'------------------------------------------------------------------------------
#'Create the export policy rule.
#'------------------------------------------------------------------------------
Try{
   Invoke-Expression -Command $command -ErrorAction Stop
   Get-WFALogger -Info -Message "Executed Command`: $command"
   Get-WFALogger -Info -Message "Created policy rule in export policy ""$PolicyName"" on vserver ""$VserverName"""
}Catch{
   Get-WFALogger -Error -Message $("Failed Executing Command`: $command. Error " + $_.Exception.Message)
   Throw "Failed creating policy rule in export policy ""$PolicyName"" on vserver ""$VserverName"""
}
#'------------------------------------------------------------------------------

Hope that helps

/Matt

[mbeattie]

Hi,

Also as an example for you (related to creating an export rule), if your cluster is running ONTAP 9.6 or greater, you can invoke the REST API rather than use the PSTK however not all parameters that are currently available in the PSTK\ZAPI are currently available using the REST API however it's likely they will be supported in a future release. Hope this is a useful example:

Param(
   [Parameter(Mandatory=$True, HelpMessage="The Cluster name or IP Address")]
   [String]$Cluster,
   [Parameter(Mandatory=$True, HelpMessage="The Data ONTAP version running on the cluster")]
   [String]$Version,
   [Parameter(Mandatory=$True, HelpMessage="The vserver name")]
   [String]$VserverName,
   [Parameter(Mandatory=$True, HelpMessage="The Export Policy name")]
   [String]$PolicyName,
   [Parameter(Mandatory=$False, HelpMessage="The User ID To Which Anonymous Users Are Mapped")]
   [String]$AnonymousUserId,
   [Parameter(Mandatory=$False, HelpMessage="The client matches. Supports a comma delimited string of client matches")]
   [String]$ClientMatch,
   [Parameter(Mandatory=$False, HelpMessage="The Access Protocol that the export rule describes")]
   [String]$Protocol,
   [Parameter(Mandatory=$False, HelpMessage="The Authentication flavors that the read-only access rule governs")]
   [String]$RoRule,
   [Parameter(Mandatory=$False, HelpMessage="The Authentication flavors that the read-write access rule governs")]
   [String]$RwRule,
   [Parameter(Mandatory=$False, HelpMessage="The Authentication flavors that the superuser security type governs")]
   [String]$SuperUser 
)
#'------------------------------------------------------------------------------
Function Get-ObjectIdentity{
   Param(
      [Parameter(Mandatory=$True, HelpMessage="The Cluster name or IP Address")]
      [String]$Cluster,
      [Parameter(Mandatory=$True, HelpMessage="The Object name")]
      [String]$ObjectName,
      [Parameter(Mandatory=$True, HelpMessage="The Object type")]
      [String]$ObjectType,
      [Parameter(Mandatory=$True, HelpMessage="The Cluster name or IP Address")]
      [String]$Uri,
      [Parameter(Mandatory=$False, HelpMessage="If specified the ID is returned instead of the UUID")]
      [Bool]$Id,
      [Parameter(Mandatory=$True, HelpMessage="The credentials to authenticate to the cluster")]
      [System.Management.Automation.PSCredential]$Credentials
   )
   $result = @{};
   Try{
      $results = Invoke-RestMethod -Uri $uri -Method GET -Credential $Credentials -ErrorAction Stop
   }Catch{
      Get-WFALogger -Error -Message $("Failed enumerating $ObjectType ""$ObjectName"" on cluster ""$Cluster"" using URI ""$uri"". Error " + $_.Exception.Message)
      Throw "Failed enumerating $ObjectType ""$ObjectName"" on cluster ""$Cluster"" using URI ""$uri"""
   }
   If($Null -eq $results){
      Throw "Failed enumerating $ObjectType ""$ObjectName"" on cluster ""$Cluster"" using URI ""$uri"". No records where where returned from the query"
   }
   If($results.num_records -ne 1){
      Throw "Failed enumerating $ObjectType ""$ObjectName"" on cluster ""$Cluster"". The record was not returned from the query"
   }
   If($Id){
      [Int]$idNumber = $results.records.id
   }Else{
      [String]$uuid = $results.records.uuid
   }
   If(-Not($Id)){
      If([String]::IsNullOrEmpty($uuid)){
         Get-WFALogger -Info -Message "The UUID for $ObjectType ""$ObjectName"" is invalid"
      }Else{
         Get-WFALogger -Info -Message "Enumerated $ObjectType ""$ObjectName"" uuid ""$uuid"" on cluster ""$Cluster"""
      }
      $result.Add("uuid", $uuid)
   }
   $result.Add("name", $ObjectName)
   If($Id){
      $result.Add("id", $idNumber)
   }
   $result;
}#'End Function
#'------------------------------------------------------------------------------
#'Compare the ONTAP version.
#'------------------------------------------------------------------------------
[Int]$versionComparisionValue960 = Compare-OntapVersions $Version "9.6.0"
If($versionComparisionValue960 -lt 0){
   Throw "The cluster ""$Cluster"" is running ONTAP version ""$Version"". A minimum version of ""9.6.0"" is required to use this command"
}
#'------------------------------------------------------------------------------
#'Enumerate the WFA credentials.
#'------------------------------------------------------------------------------
[System.Management.Automation.PSCredential]$Credentials = Get-WfaCredentials -Host $Cluster
#'------------------------------------------------------------------------------
#'Enumerate the vserver UUID.
#'------------------------------------------------------------------------------
$uri = "https://$Cluster/api/svm/svms?name=$VserverName"
$svm = Get-ObjectIdentity -ObjectName $VserverName -ObjectType "Vserver" -Cluster $Cluster -Uri $uri -Credentials $credentials
#'------------------------------------------------------------------------------
#'Enumerate the export policy ID.
#'------------------------------------------------------------------------------
$uri    = "https://$Cluster.demo.netapp.com/api/protocols/nfs/export-policies?name=$PolicyName&svm.name=$VserverName"
$policy = Get-ObjectIdentity -ObjectName $PolicyName -ObjectType "Export Policy" -Cluster $Cluster -Id $True -Uri $uri -Credentials $credentials
#'------------------------------------------------------------------------------
#'Set the export policy rules and convert to JSON.
#'------------------------------------------------------------------------------
[HashTable]$rules = @{};
If($AnonymousUserId){
    [HashTable]$rules.Add("anonymous_user", $AnonymousUserId)
}
If($ClientMatch){
   If($ClientMatch.Contains(",")){
      [Array]$clients = $ClientMatch.Split(",")
   }Else{
      [Array]$clients = $ClientMatch
   }
   ForEach($ipAddress In $ipAddresses){
      [HashTable]$match = @{}
      [HashTable]$match.Add("match", $ipAddress)
      [Array]$clients += $match
   }
   [HashTable]$rules.Add("clients", $clients)
}
If($Protocol){
   [HashTable]$rules.Add("protocols", @($Protocol))
}
If($RoRule){
   [HashTable]$rules.Add("ro_rule", @($RoRule))
}
If($RwRule){
   [HashTable]$rules.Add("rw_rule", @($RwRule))
}
If($SuperUser){
   [HashTable]$rules.Add("superuser", @($SuperUser))
}
[HashTable]$rules.Add("svm", $svm)
$body = $rules | ConvertTo-Json
[String]$uri = $("https://$Cluster/api/protocols/nfs/export-policies/" + $policy.records.id + "/rules")
#'------------------------------------------------------------------------------
#'Create the export policy.
#'------------------------------------------------------------------------------
Try{
   $result = Invoke-RestMethod -Uri $uri -Method POST -Body $body -ContentType "application/json" -Credential $Credentials -ErrorAction Stop
   Get-WFALogger -Info -Message "Created Export Policy ""$ExportPolicyName"" on vserver ""$VserverName"" on cluster ""$Cluster"" using URI ""$uri"""
}Catch{
   Get-WFALogger -Error -Message $("Failed creating Export Policy ""$ExportPolicyName"" on vserver ""$VserverName"" on cluster ""$Cluster"" using URI ""$uri"". Error " + $_.Exception.Message + " Status Code " + $_.Exception.Response.StatusCode.value__)
   Throw "Failed creating Export Policy ""$ExportPolicyName"" on vserver ""$VserverName"" on cluster ""$Cluster"" using URI ""$uri"""
}
#'------------------------------------------------------------------------------

If your cluster is running >= ONTAP 9.6 you can access the REST API documention using:

https://<%cluster%>/docs/api/#/NAS/export_rule_create

Please let me know if you have any questions?

/Matt

[mbeattie]

Hi,

Another option might be to use an alternative to WFA such as Ansible:

https://www.ansible.com/ 

However regardless of which orchestration application you choose for your enviroment, inevitably you may encounter a similar issue in that it may not support each and every parameter that is available via the CLI\ZAPI (EG for export rules "DisableDev") as you've discovered with the certified content in WFA.

https://docs.ansible.com/ansible/latest/modules/na_ontap_export_policy_rule_module.html 

In that instance can resort to using a CLI command if you wanted to include a parameter not available within the ansible module:

https://docs.ansible.com/ansible/latest/modules/na_ontap_command_module.html 

In WFA you can use either "Invoke-NcSsh" within your command or preferably "Invoke-NcSystemApi" or write your own code based on the PowerShell CmdLet. See "Get-Help New-NcExportPolicy -Full"

Please let me know if you have any questions?

/Matt

[sp_1008]

Thank you so much for your quick response yesterday! I really appreciate it.

I pasted script as below.  The export rule powershell script  is working fine except the -DisableDev parameter which is highlghted in RED in below script.

when I tested the scirpt I got below error. I tried  with null vlaue too instead  "true"  but same error message.

Can you pelase look into this and advise?

9:39:02.704 INFO [Create export rule_sp] Creating export rule : New-NcExportRule -ErrorAction Stop -VserverContext gbbed61ns10svm_mm -Policy test_nfs4 -ClientMatch '0.0.0.0' -ReadOnlySecurityFlavor sys -ReadWriteSecurityFlavor never -Index 1 -Protocol nfs -SuperUserSecurityFlavor none -Anon 65534-DisableDev true
09:39:02.735 ERROR [Create export rule_sp] A positional parameter cannot be found that accepts argument 'true'.
09:39:02.923 ERROR [Create export rule_sp] Failed executing command. Exception: A positional parameter cannot be found that accepts argument 'true'.

param (
[parameter(Mandatory=$true, HelpMessage="Cluster address")]
[string]$Cluster,

[parameter(Mandatory=$true, HelpMessage="Policy name")]
[string]$PolicyName,

[parameter(Mandatory=$true, HelpMessage="Client match")]
[string]$ClientMatch,

[parameter(Mandatory=$true, HelpMessage="Storage Virtual Machine name")]
[string]$VserverName,

[parameter(Mandatory=$false, HelpMessage="Rule index")]
[int]$RuleIndex,

[parameter(Mandatory=$true, HelpMessage="Read only security flavors")]
[string]$RoRule,

[parameter(Mandatory=$true, HelpMessage="Read write security flavors")]
[string]$RwRule,

[parameter(Mandatory=$false, HelpMessage="Protocols")]
[string]$Protocol,

[parameter(Mandatory=$false, HelpMessage="Super user sec flavors")]
[string]$Superuser,

[parameter(Mandatory=$false, HelpMessage="User name or ID to which anonymous users are mapped")]
[string]$AnonymousUserId,

[parameter(Mandatory=$false, HelpMessage="IsAllowDevIsEnabled")]
[string]$IsAllowDevIsEnabled

)

# connect to cluster
Connect-WFACluster $Cluster

$policy = Get-NcExportPolicy -VserverContext $VserverName -Name $PolicyName

# If policy does not exists create it.
if(!$policy)
{
Get-WFALogger -Info -message $("Creating policy : " + $PolicyName)
New-NcExportPolicy -Name $PolicyName -VserverContext $VserverName
}

$expression = "New-NcExportRule -ErrorAction Stop -VserverContext " + $VserverName + " -Policy " + $PolicyName + " -ClientMatch '" + $ClientMatch + "' -ReadOnlySecurityFlavor " + $RoRule + " -ReadWriteSecurityFlavor " + $RwRule

if($RuleIndex)
{
$expression = $expression + " -Index " + $RuleIndex
}

if($Protocol)
{
$expression = $expression + " -Protocol " + $Protocol
}

if($Superuser)
{
$expression = $expression + " -SuperUserSecurityFlavor " + $Superuser
}

if($AnonymousUserId)
{
$expression = $expression + " -Anon " + $AnonymousUserId
}

if($IsAllowDevIsEnabled)
{
$expression = $expression + "-DisableDev " + $IsAllowDevIsEnabled

}

Get-WFALogger -Info -message $("Creating export rule : " + $expression)

Invoke-Expression -ErrorAction Stop $expression

[csalitros]

Looks like you need to add another space to "-DisableDev "

if($IsAllowDevIsEnabled)
{
$expression = $expression + " -DisableDev " + $IsAllowDevIsEnabled
}

[sp_1008]

I added another space to "-DisableDev" and still the same issue.

15:09:04.163 INFO [Create export rule_sp] Creating export rule : New-NcExportRule -ErrorAction Stop -VserverContext gbbed61ns10svm_mm -Policy test_nfs4 -ClientMatch '0.0.0.0' -ReadOnlySecurityFlavor sys -ReadWriteSecurityFlavor never -Index 1 -Protocol nfs -SuperUserSecurityFlavor none -Anon 65534 -DisableDev true
15:09:04.210 ERROR [Create export rule_sp] A positional parameter cannot be found that accepts argument 'true'.
15:09:04.351 ERROR [Create export rule_sp] Failed executing command. Exception: A positional parameter cannot be found that accepts argument 'true'.

[sp_1008 · Accepted solution]

The issue is resolved now. No need to give "true" or "false" after -DisableDev

If($DisableDev){

   [String]$command += "-DisableDev "

[mbeattie]

Hi,

Good to hear you got it working, that's correct the "-DisableDev" parameter does not require a boolean value. Whilst the input parameter in the command is a boolean:

   [Parameter(Mandatory=$False, HelpMessage="If specified, the NFS server will not allow creation of devices")]
   [Bool]$DisableDev,

The command expression that is set adds the parameter as a flag without a value:

If($DisableDev){
   [String]$command += "-DisableDev "
}

Glad you got it working, hope the example code was useful

/Matt