Netapp ONTAP Powershell toolkit BUG when upgrading from 9.13.1.2306 to 9.15.1.2410 (not the cert)

[WhollyJoe]

I am having an issue in many production scripts that are taking advantage of the 'Connect-NcController -Transient:$true' functionality to not set the global variable when connecting to a controller, and instead assign that connection to my own custom variable. 

It all works fine, except the first time I try to do ANYTHING with that connection it will fail with a generic error coming from the module commandlets. The same action will work fine the second and every other time after that first failure. 

Get-NcAggr : Object reference not set to an instance of an object.
At line:35 char:27
+                 $ncAggr = Get-NcAggr -Controller $ncController
+                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-NcAggr], NullReferenceException
    + FullyQualifiedErrorId : System.NullReferenceException,DataONTAP.C.PowerShell.SDK.Cmdlets.Aggr.GetNcAggr

Here is a simple script to reproduce the issue:

# Set this to $true to use the $global:CurrentNcController in the Get-NcAggr command 
# Set to $false to use the controller stored in a variable as an object $ncController
$useNcGlobal = $false

# update to your actual controller
$controllerIP = "xxx.xxx.xxx.xxx"


Import-Module NetApp.ONTAP
$global:CurrentNcController = $null

try {
    $ncCredential = Get-Credential -Message "Add Admin password" -UserName admin


    if ( -not ($useNcGlobal) ) {
    # Store controller in variable and use transient to NOT set the global 
        $ncController = Connect-NcController -Name $controllerIP -Credential $ncCredential -Transient:$true -ErrorAction Stop
        Write-Host "Controller varaible '`$ncController' type is '$($nccontroller.GetType())'"
    }
    else {
    # Store controller in the global 
        Connect-NcController -Name $controllerIP -Credential $ncCredential -ErrorAction Stop
        Write-Host "Controller varaible '`$global:CurrentNcController' type is '$($global:CurrentNcController.GetType())'"
    }

    [int]$i = 0
    $ints = 1..10
    foreach ($int in $ints) {
        try {
            $i++
            if ( $nccontroller ) {
                $ncAggr = Get-NcAggr -Controller $ncController
            }
            else {
                $ncAggr = Get-NcAggr
            }
            Write-Host "This time, '$i' and subsequent times will always succeed"
            if ( $int -eq $($ints | Select-Object -Last 1) ) {
                $ncAggr
            }
        }
        catch {
            $error[0]
            Write-Host "This time, '$i' always fails when using -controller and passing in a controller variable object"
        }
    }
}
catch {
    $error[0]
    Write-Host "Uncaught error" 
}

[Sanaman]

I am seeing the same issue with my toolkit version 9.15.x

1st time:

Scripts> Get-NcVol
Get-NcVol: The remote server returned an error: (400) Bad Request.

Second time

Scripts> Get-NcVol

Name State TotalSize Used Available Dedupe Aggregate Vserver
---- ----- --------- ---- --------- ------ --------- -------
prod_store1_v… online 13.1 TB 1.6 TB node_a_nlsas_aggr1 vserver61
svm61_rootvol online 1.0 GB 963.3 MB node_a_nlsas_aggr1 svm61

......................

[scalhoon]

What makes this problem worse is that the certificate that signed 9.14, and previous versions, is currently expired on the repository and did not include a timestamp server, so rolling back to any previous version is not possible unless you have your Execution Policy set to Unrestricted, which will ignore issue code-signing issues. The current guidance provided by NetApp regarding the expired code-signing certificate is to ignore code-signing with the Unrestricted policy, or download the code from NetApp support, however NetApp support only provides the latest 9.15 version containing the transient flag bug. Our company enforces code-signing, so setting the Execution Policy to Unrestricted is not an option.

Hey NetApp, next time you code-sign something, include a timestamp server, so the signature is not invalidated when your code signing certificate expires, since the timestamp server proves the signature was created when the certificate was valid, thus the signature stays valid even after the code-signing certificate expires.

I worked around this by downloading the nuget 'nupkg' file for the 9.14.1.2401 version from the manual tab on the repository page, which is just a renamed .zip file. I extraced everything to "C:\Program Files\WindowsPowerShell\Modules\NetApp.ONTAP\9.14.1.2401", minus the nuget specific folders: package, webhelp, webhelp.C, and _rels. I also did not extract the [Content_Types].xml file.