Skip to main content
Version: 5.0

Managing Keystore via API

The API allows you to retrieve information about keys within the keystore, add, update, and delete them. If a password is set on the keystore, it must be passed in the request body. Example:

GET _core/keystore
{
  "keystore_password": "MyP@ssw0rd"
}

If you need to filter the servers on which the request should be executed, you can use additional filters. The parameter for specifying the filter is nodeid.

The value can be a server name, IP address, attribute, etc. Wildcard support is available (see more details).

Examples:

Add the password uba.sme.pass to all nodes whose names start with saf-m:

POST _core/keystore/uba.sme.pass?nodeid=saf-m*
{
  "value" : "UbaPASS"
}

Add the password plugins.security.ssl.transport.external_truststore_password to all nodes with the role data:

POST _core/keystore/plugins.security.ssl.transport.external_truststore_password?nodeid=data:true
{
  "value" : "ExternalTruststorePASS"
}

You can add a key via the console:

curl -XPOST -k -u admin "https://127.0.0.1:9200/_core/keystore/plugins.security.ssl.transport.external_truststore_password?nodeid=data:true" -H "Content-Type: application/json" -d '{"value" : "ExternalTruststorePASS"}'

Add the password jobscheduler.email.pass to all nodes with the role data:

POST _core/keystore/jobscheduler.email.pass?nodeid=routing_mode:hot
{
  "value" : "JobSchedulerPASS"
}

Operations​

Permissions

To interact with keys within the keystore, you must grant cluster permissions. The permission name is specified in each operation.

Retrieving the list of keys​

The request returns information about the placement of keys on the servers.

Example:

GET _core/keystore

Permission:

cluster:admin/sm/keystore/list

Example response:

{
  "HIPMpNAmSuC7JUpBm1T33w": [
    "jobscheduler.email.pass",
    "jobscheduler.sme.pass",
    "keystore.seed",
    "uba.sme.pass"
  ],
  "Pd779Sf9RrSYiLrpA4wyxA": ["keystore.seed", "uba.sme.pass"]
}

Adding a key​

This request allows you to add a new key.

Key Names

Only key names defined within SA Data Storage or in SAF system modules are available. Adding third-party keys will result in an error.

The key value must be passed in the request body using the value field.

Example:

POST _core/keystore/jobscheduler.email.pass?nodeid=172.16.0.3*
{
  "value" : "emailPass"
}

Permission:

cluster:admin/sm/keystore/add

Updating a key​

This request allows you to update an existing key. The new key value, similar to the add request, is passed in the request body within the value field.

Example:

PUT _core/keystore/jobscheduler.sme.pass
{
  "value": "SMEpass"
}

Permission:

cluster:admin/sm/keystore/update

Deleting a key​

This request allows you to delete an existing key.

Example:

DELETE _core/keystore/uba.sme.pass

Permission:

cluster:admin/sm/keystore/delete