VMware vSphere SDKs and Tools 8.0

8.0 7.0 6.7 6.5

Remediate a Trusted Cluster

You can use
HTTP requests
 to remediate
vSphere Trust Authority
 component configurations in a Trusted Cluster or remove the configurations.
  • Verify that you have access to a working
    vSphere Trust Authority
     environment.
  • Verify that you have Trusted Infrastructure administrative privileges.
You can update the applied Key Provider Service or Attestation Service configurations in a Trusted Cluster to become consistent with the desired state or you can remove the applied Key Provider Service or Attestation Service configurations. You can also update all applied
vSphere Trust Authority
 component configurations in a Trusted Cluster or remove the configurations. By removing the configurations, you can move hosts from a Trusted Cluster to another cluster.
The operations require you to specify parameters in the body of the HTTP request according to your
vSphere Trust Authority
 environment. For details about the syntax of each HTTP request body, see the
API Reference
 documentation.
  1. Remediate all Key Provider Service instances configured for use in a Trusted Cluster.
    PATCH https://<vcenter_ip_address_or_fqdn>/api/vcenter/trusted-infrastructure/trusted-clusters/<
    cluster
    >/kms/services-applied-config?vmw-task=true
    You receive the task ID in the response body. You can use the task ID to check the status of the task by running the following HTTP request.
    GET https://<vcenter_ip_address_or_fqdn>/api/cis/tasks/<
    task_ID
    >
    If the operation is successful, the Key Provider Service configuration of every host in the cluster is consistent with the desired state.
  2. Remove all Key Provider Service configurations from a Trusted Cluster.
    DELETE https://<vcenter_ip_address_or_fqdn>/api/vcenter/trusted-infrastructure/trusted-clusters/<
    cluster
    >/kms/services-applied-config?vmw-task=true
    You receive the task ID in the response body. You can use the task ID to check the status of the task by running the following HTTP request.
    GET https://<vcenter_ip_address_or_fqdn>/api/cis/tasks/<
    task_ID
    >
    If the operation is successful, the applied Key Provider Service configurations are removed from the configuration of every host in the cluster without affecting the desired state.
  3. Remediate all Attestation Service instances configured for use in a Trusted Cluster.
    PATCH https://<vcenter_ip_address_or_fqdn>/api/vcenter/trusted-infrastructure/trusted-clusters/<
    cluster
    >/attestation/services-applied-config?vmw-task=true
    You receive the task ID in the response body. You can use the task ID to check the status of the task by running the following HTTP request.
    GET https://<vcenter_ip_address_or_fqdn>/api/cis/tasks/<
    task_ID
    >
    If the operation is successful, the Attestation Service configuration of every host in the cluster is consistent with the desired state.
  4. Remove all Attestation Service configurations from a Trusted Cluster.
    DELETE https://<vcenter_ip_address_or_fqdn>/api/vcenter/trusted-infrastructure/trusted-clusters/<
    cluster
    >/attestation/services-applied-config?vmw-task=true
    You receive the task ID in the response body. You can use the task ID to check the status of the task by running the following HTTP request.
    GET https://<vcenter_ip_address_or_fqdn>/api/cis/tasks/<
    task_ID
    >
    If the operation is successful, the applied Attestation Service configurations are removed from the configuration of every host in the cluster without affecting the desired state.
  5. Remediate all
    vSphere Trust Authority
     components configured for use in a Trusted Cluster.
    PATCH https://<vcenter_ip_address_or_fqdn>/api/vcenter/trusted-infrastructure/trusted-clusters/<
    cluster
    >/services-applied-config?vmw-task=true
    You receive the task ID in the response body. You can use the task ID to check the status of the task by running the following HTTP request.
    GET https://<vcenter_ip_address_or_fqdn>/api/cis/tasks/<
    task_ID
    >
    If the operation is successful, the
    vSphere Trust Authority
     component configuration of every host in the cluster is consistent with the desired state.
  6. Remove all
    vSphere Trust Authority
     component configurations from a Trusted Cluster.
    DELETE https://<vcenter_ip_address_or_fqdn>/api/vcenter/trusted-infrastructure/trusted-clusters/<
    cluster
    >/services-applied-config?vmw-task=true
    You receive the task ID in the response body. You can use the task ID to check the status of the task by running the following HTTP request.
    GET https://<vcenter_ip_address_or_fqdn>/api/cis/tasks/<
    task_ID
    >
    If the operation is successful, the applied
    vSphere Trust Authority
     component configurations are removed from the configuration of every host in the cluster without affecting the desired state.
You can recheck the Trusted Cluster health after the remediation. See Check Trusted Cluster Health.

Content feedback and comments