purestorage-openconnect / pure1-unplugged

An on-premises storage fleet management system leveraging Kibana

Pure1 Unplugged

Pure1 Unplugged is Pure Storage's open-source on-premises fleet management system.

Installation

Pure1 Unplugged can be installed from an ISO or an OVA. The latest versions, along with documentation, are pre-created and are available to download for free. Documentation is also available online.

Links

http://dl-west.purestorage.com/pure/pure1-unplugged/download

https://support.purestorage.com/Pure1/Pure1_Unplugged.

Development

Pure1 Unplugged can be built and run locally.

Prerequisites

1. Forked and cloned source code
2. Minikube and required hypervisor: https://kubernetes.io/docs/tasks/tools/install-minikube/

Building

There are two separate Makefiles for building and testing. The main Makefile builds all available targets. The sub-Makefile Makefile-golang has targets for building golang in a docker container. The top level Makefile looks for any target that matches the pattern go-% and will launch a container and make inside the container with the targets matching pattern.

Example: make go-clean go-prep go-auth-server runs the targets clean prep auth-server in a container.

Testing

• Golang: make go-unit-tests
• Web content: make test-web-content

Local deployment

1. Start minikube with at least 6GB memory and 40GB disk, and with the proper Kubernetes version.
   • minikube start --memory 6144 --disk-size 40g --kubernetes-version v1.13.4
2. Build with make all-minikube
   • Note that build output goes into ./build/*, and this minikube build mode will not create the installer ISO
3. Deploy with ./scripts/deploy/helm_install.sh $(minikube ip)
   • Note that the deployment name must be pure1-unplugged
4. Run minikube ip and navigate to it in your browser
5. Log in with example

Hint: Set kubectl to use pure1-unplugged namespace by running kubectl config set-context $(kubectl config current-context) --namespace=pure1-unplugged for easier use.

Updating a deployment

Updating golang

make go-bins
make pure-elk-image-minikube
make lorax-image
make helm-chart
helm upgrade pure-elk build/chart/*.tgz --force

Updating web content

make web-content
make pure-elk-image-minikube
make lorax-image
make helm-chart
helm upgrade pure-elk build/chart/*.tgz --force

Contributions

Changes

As Pure1 Unplugged is open-source, we welcome all contributions. We will also be providing improvements and new features.

1. Create a public fork of the repository
2. Send a pull request (we need to create a reviewer group for us)
3. We will test and validate your code
4. Merge the pull request
5. We will update the ISO and OVA to download and comment on the pull request

Issues

We will also monitor issues listed on GitHub, as well as create issues ourselves. All changes should reference an issue.

pure1-unplugged's Issues

Arrays Dash board showing blanks

Pure Unplugged was installed and all the FA and FB were added successfully. It is collecting Data fine. But after running for awhile, the array dash board will show empty and all the analytics dash are not showing blank data as well. When we get to that stage,
1, Unable to add the new FA or existing FA from Pure-Unplugged website.
2. Run the "df -h" command and file systems were not 100% full. May be docker container file system was full. Don't know as I am not too familiar with docker container.
3. Reboot sees to fix the issue. After reboot all the FA and FB are listed again in Arrays dashboard.
4. All the historical analytic data were gone after reboot.

`puctl pure1-unplugged uninstall` doesn't remove SSL cert secret

Discovered while attempting to reproduce #9. While this may not be the cause of the issue (customer did a full infra reset), it definitely isn't correct behavior.

500 Internal Server Error nginx/1.15.8

Hi ,

After installing pure1 unplugged , tried accessing the url .It gives error 500 Internal Server Error
nginx/1.15.8.
Tried running "puctl infra delete-pod auth dex" to reset the pods, which may be a common source of issue, but still fails

Volume capacity dashboard

As requested by a customer, we have dashboards for array and volume performance but only array capacity. We do have volume capacity metrics stored and it would be nice to display them as well.

How to backup and restore datas ?

Hello,

It's not really an issue, I apologize.
I want to backup datas stored in the VM.
And I'd like to be able to restore them, in case of reinstallation.

I didn't see anything about that in the documentation. The only subject I found is here : https://github.com/pure-garyyang/pureelk#data-persistence
But that seems not to be relevant for Pure1-unplugged.

Can you help me ?

Best regards.

error message: "error validating callback request: Error parsing state token: signature is invalid"

Customer reinstalled unplugged several times but still getting following error message. Appears to be an some sort of authentication error... what should we be looking...?
Customer has installed latest 1.0.1 and using ESX6.

Still using self-signed SSL

Hello,

Testing "Pure1-unplugged" for several weeks, all is fine except that I can't make it to use my own SSL certificates.

I started with
createSelfSignedCerts: true
in my /etc/pure1-unplugged/config.yaml

But now, even with :
createSelfSignedCerts: false
"Pure1-unplugged" never use my customized key and cert files :

sslCertFile: /etc/pure1-unplugged/ssl/myhost1.dev1.cea.fr.pem.crt
sslKeyFile: /etc/pure1-unplugged/ssl/myhost1.dev1.cea.fr.key

It looks like if it was using:
/var/lib/docker/overlay2/c22d8964391591b87defffc4bd778cdab2b501bd887e05534371ac2bf90f6758/merged/etc/ingress-controller/ssl/default-fake-certificate.pem

and not:
/var/lib/docker/overlay2/c22d8964391591b87defffc4bd778cdab2b501bd887e05534371ac2bf90f6758/merged/etc/ingress-controller/ssl/pure1-unplugged-pure1-unplugged-https-cert.pem

I have re-compliled (how do you call that ?) with these commands:

puctl infra reset ; puctl infra init ; puctl infra status
puctl pure1-unplugged install ; puctl pure1-unplugged status

and even reboot my Linux server...

Any ideas ? Bug ?

Best regards.

pure1unplugged - Pure1-unplugged-v1.0.2.iso

I intsalled this product but our environement is a high security enviroment and does not support any software that is on CentOS due to the vulnerabilities when scanned. Is there anyway this product can be installed on redhat 7 or above?
This is the current setup using our virutalization environment
Guest OS: CentOS 6 (64-bit)
Compatibility: ESXi 6.7 and later (VM version 14)
VMware Tools: Running, version:10309 (Guest Manag

We have rhel7 base templates that can be used. Will this pure1unplugged work with with rhel7?

Thanks

Lochini
703-625-7215
[email protected]

Metrics are not showing

After the installation (puctl infra status and puctl pure1-unplugged status are OK), the array card does not show metrics.

We are able to connect to the array (« Connecting, waiting for metrics data »), but we have the following error : « Error patching information from array : may not be updated properly on server. »

So we have the information of the array as version and type of the bay, but not the metrics.

Also, we have a problem when connecting to LDAP with dex. By default, the service search on the network serviceCIDR when we use FQDN, so we had to use the IP of our LDAP for it to work.

[RFE] Can this have a toggle that can help message for each metric when it is clicked on GUI?

Overall, there is no proper explanation about what other Latency, Data Reduction, Total Reduction mean and so on.

Can this have a toggle that can help message for each metric when it is clicked on GUI?

[RFE] Are there any plan in a load map to import "Load" metric from Pure1 into Pure1 Unplugged?

It would be much beneficial to have a "Load" metric existing in Pure1 to Pure1 Unplugged.
Are there any load maps for this?

The Pure1 Unplugged OVA file is not working for VMWare ESXi 6.5.

The Pure1 Unplugged OVA file failed to be imported to for VMWare ESXi 6.5, while it works for VMware 6.7

It is understandable that this product has tested virtualization software:

• VMWare Fusion 10.x
• VMWare ESXi 6.7

Can I have OVA/ISO for VMware ESXi 6.5 for arrays in secure area?
It is because VMware ESXi 6.5 version is still commonly used to keep any change controls conservative, safe, and secure.

[RFE] Clicking a Help tab in the left pane fails to open a link Pure1 Unplugged KB

Most of arrays in secure area is not allowed to access any external URL links.

1. Clicking a Help tab in the left pane of Pure1 Unplugged(version 1.0.1) GUI leads to open an external link https://support.purestorage.com/Pure1/Pure1_Unplugged.
2. However, this failed to open KBs in external network
3. This results in a failure of access contents in Help materials.

So therefore, I am requesting there should be a sub-popup page to open a new tab that lead users to have two options upon user's choice in secure environment.

1. open a URL https://support.purestorage.com/Pure1/Pure1_Unplugged.
2. navigate embedded help pages(troubleshooting, explanation in admin guide)

DL link is invalid - Access Denied

The DL link of http://dl-west.purestorage.com/pure/pure1-unplugged/download is invalid. The XML "Access Denied" return message screenshot is attached.

"power_supply ch0.pwr0 failure" but Pure1-unplugged still display "0 open alerts"

Hi,
On my FA/m50 bay, one power supply is broken...
But Pure1-unplugged is still displaying "0 open alerts" on "Arrays" tab (and turning tile of my array with "i" button).
On "Messages" tab, I can see nothing but closed messages.
It looks like a bug... Thanks for help.
Best regards.

FlashBlade device name is not appearing in Percent Full Gauge

This has been found on the Pure-internal demo server. The issue persisted across removing and re-adding the device (including from forcefully removing metrics). Device name appears in other visualizations fine but for some reason is not visible on the "Array Percent Full Gauge".

Data seems to be in the correct format in Elasticsearch, so I don't see anything immediately obvious that would be causing this.

(see the far right gauge)

Cannot add new array into Pure1 unplugged

I cannot add a new array into Pure1unplugged. It shows an error as below.

"Unable to connect. Error: Get https://192.168.122.14/api/api_version: dial tcp 192.168.122.14:443: getsockopt: connection timed out"

According to https://support.purestorage.com/Pure1/Pure1_Unplugged/001%3A_Pure1_Unplugged_Installation
I wonder why my flash array with purity version 5.1.1 with have api version {"version": ["1.0", "1.1", "1.2", "1.3", "1.4", "1.5", "1.6", "1.7", "1.8", "1.9", "1.10", "1.11", "1.12", "1.13", "1.14"]} does not support with Purity//FA 4.8.0 with REST API 1.7 and above.

I'm thinking about upgrading to purity version 5.3.x to get the rest API version 2.x, Is this going to fix the issue?

Configuring installation of Pure1-Unplugged fails with Unable to find default route, ensure it is present (see 'ip route' output

See attached screen shot for more information.

In fleets with >10 devices, only 10 devices appear at a time in the card view

All arrays are registered, but only the first ten will show in the current sorting arrangement. Changing the filter or sort will update which ten are shown. All metrics are still collected as expected and should render properly, only the card view is affected.

Array capacity Percent Full visualization shows array Percent Full Gauge

ISO fails to install

Trying to install via ISO on ESXi 7.0.2

The installer is failing giving the error "missing dosfstools"

pure1-unplugged - kubelet node status | ERROR | kubelet node is not ready

I'm experiencing an issue with a brand new .ISO install.

After completing the guide and browsing to the pure1-unplugged IP I am getting err_connection_refused. After checking the CLI and running puctl infra status the kubelet node status is showing an error. Everything is passed and is green.

I have never used Kubernetes before so I am not sure where to look for help on this, especially as this looks to be a non-standard implementation. I have tried to check the logs specified in the infra status command but there is nothing that draws any attention to itself.

Can you let me know how best to troubleshoot this. I have also experienced the same error when installing from the .OVA as well.

Just to note, Zubair from Pure is also engaged from professional services and ideally we need to get Pure1 up and running ASAP. Cheers.

"error validating callback request: error parsing state token: Token is expired"

Description

Brought up by Pure internal employee. Testing in UK, attempting to log in results in the error in the title. My suspicion is time zones aren't being transferred/accounted for in the state token expiry time, but this is unconfirmed as of yet.

Attempted steps

• Tried running puctl infra delete-pod auth dex to cycle the auth servers, didn't work

Next steps

• Attempting to reproduce locally
• Waiting on answers for questions:
  • How was the time zone set? During the .iso GUI install, or some other way?
  • Are there any NTP servers set up?
  • Was time zone set before or after running puctl infra init?

metricRetentionPeriod changed from 31 to 365, but still 31 days only

Hi,
When I installed pure1-unplugged v1.0.0 last year, I changed metricRetentionPeriod from 31 (default) to 365 in /etc/pure1-unplugged/config.yaml configuration file.

Dashboards still display values on 31 days max, even if I request 2 months or more. It looks like 31 days max are stored.

Is it an issue or have I done something wrong ?

Best regards.

Unable to access Pure1 Unplugged

This tool no long works for us. Please advise.

/]# puctl infra status

Logging to /tmp/pure1-unplugged/GUwqYKieTh.log
--| Checking Firewall... done! --| Checking Selinux... done!hecking Selinux | --| Checking IP route... done!hecking IP route | --| Checking Kubelet... done!hecking Kubelet | --| Checking Docker... done!hecking Docker | --| Checking Kubernetes node... done!hecking Kubernetes node | --| Checking Kubernetes system pods... done!hecking Kubernetes system pods |
+-------------------------+--------+--------------------------------+
| CHECK | STATUS | DETAILS |
+-------------------------+--------+--------------------------------+
| calico-node | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+
| calicoctl | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+
| coredns | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+
| default ip route | OK | default ip route is set |
+-------------------------+--------+--------------------------------+
| docker systemd service | OK | active (running) since Mon |
| | | 2022-02-14 11:04:25 MST; 2min |
| | | 20s ago |
+-------------------------+--------+--------------------------------+
| etcd | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+
| firewalld | OK | firewalld must be running and |
| | | allow https |
+-------------------------+--------+--------------------------------+
| kube-apiserver | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+
| kube-controller-manager | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+
| kube-proxy | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+
| kube-scheduler | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+
| kubelet node status | ERROR | kubelet node is not ready |
+-------------------------+--------+--------------------------------+
| kubelet systemd service | ERROR | exit status 3 |
+-------------------------+--------+--------------------------------+
| selinux | OK | selinux state is 'Enforcing' |
+-------------------------+--------+--------------------------------+
| tiller | ERROR | unable to get pod details |
+-------------------------+--------+--------------------------------+

Successful Checks 4/15

System has ERROR's
See log for error details!

getsockopt: connection timed out

Dear Team,

I completed successfully, but I couldn't add an array of the following message.
"Unable to connect. Error: Get https://192.168.0.110/api/api_version: dial tcp 192.168.0.110:443: getsockopt: connection timed out"

• Need your help *

1. Would you hint how to figure this problem out?

When I click "the array name" at "Add New Array" page during connecting the array, I was able to access the array, so I thought that the network was no problem.
A ping test from array to Pure1-Unplugged VM host was fine.

Thank you and regards,
Joonmoon Lee

Stays in loop on "Connecting..." when Array added

Hello !

We installed Pure1 Unplugged with the OVA version 1.0.1

In the dashboard of Pure1 Unplugged we added a new Array for manage our storage array PureStorage.
After created our array, it stays in loop on "Connecting..." .

Our management endpoint is valid.
The API Token is valid (POST Request success).

We thought a problem of MTU (here it's 1150), maybe the appliance have a limit ?

Or have you an another idea ?

Thank for your help,

pure1-unplugged installation fails (helm deployment error)

Hi all,

I am trying to deploy Pure1 Unpluged version v1.0.1.
But encounter error during the step: "puctl pure1-unplugged install".

It failed on helm deployment.

I checked with "puctl pure1-unplugged install", total 4 components are in error state:

1. elasticsearch-client
2. elasticsearch-data
3. elasticsearch-master
4. helmdeployment (error msg: timed out waiting for the condition)

What i have change on "config.yaml" are just as below:

publicAddress: 192.168.101.212

podCIDR: "172.16.0.0/16"
serviceCIDR: "10.96.0.0/12"

Error while upgrading pure1-unplugged v1.0.0 to v1.0.1

Hi,
I want to upgrade pure1-unplugged v1.0.0 to v1.0.1. So, I did as expected in "Pure1-Unplugged-Installation-v1.0.1-June-15-2020.pdf":
$ /bin/puctl --version
puctl version 'v1.0.1-7d4c7826' (remplaced binary with new version)
$ mount /dev/sr0 /mnt/cdrom
$ puctl upgrade mount-iso /dev/sr0 (worked fine)
$ puctl upgrade yum-upgrade
ERROR: Couldn't find package pure1-unplugged.x86_64 in list of available packages
If I try to go further:
$ puctl pure1-unplugged upgrade (worked fine !)

But I have:

$ puctl pure1-unplugged version
Pure1 Unplugged Available Version: 'v1.0.1-7d4c7826'
Pure1 Unplugged Running Version: 'v1.0.0'

A reboot didn't solve the issue: I'm still in v1.0.0.
What can I do to upgrade to v1.0.1 ?

Best regards.

Can not connect Pure1 Unplugged on Purity 5.1.x.

Hi,

I have a plan to implement the Pure1 Unplugged on Purity 5.1.x.
So I am testing now with https://support.purestorage.com/Pure1/Pure1_Unplugged
It works well on the Purity 4.10.x and Flashblade as well.

But it's not working on Purity 5.1.10 and on Purity 5.1.3.

I checked the API version as below;

Could you let me know how to solve this problem?

Thanks,
Richard

How to fix potential vulnerabilities

One of my customers is using Pure1 Unplugged in a high security environment. After security scanning, they want to fix the following vulnerabilities in their Unplugged server. What is the best course of action they should take?

・CVE-2019-20372
・CVE-2019-9511
・CVE-2019-9513
・CVE-2019-9516
・CVE-2021-23017

Regards,
--mura
[email protected]

FlashArray alerts collection does not properly mark alerts as open or closed

As noted by a customer, an open alert on an array was not being shown as open on Pure1 Unplugged, but rather as closed. This is due to an issue with how alerts are marked as open/closed by the collector.

There is an undocumented ?timeline=true parameter on the FlashArray REST API that returns the alert state and can be used by the collector instead.