Skip to main content
Version: 6.2

Managing Keystore via API

The API allows you to retrieve information about keys within the keystore, add, update, and delete them.

Secrets for saved storage connections are stored in the sme.core.system_connections.password.<name> or sme.core.system_connections.api_key.<name> keys. Verify the result on the nodes: a successful HTTP status code alone does not confirm that the key was updated on every node.

If a password is set on the keystore, it must be passed in the request body. Example:

GET _core/keystore
{
  "keystore_password": "MyP@ssw0rd"
}

To run a request only on selected nodes, use the nodeid parameter.

The value can be a server name, IP address, or attribute. Wildcard patterns are supported (details).

Examples:

Add the password uba.sme.pass to all nodes whose names start with smos-m:

POST _core/keystore/uba.sme.pass?nodeid=smos-m*
{
  "value" : "UbaPASS"
}

Add the password plugins.security.ssl.transport.external_truststore_password to all nodes with the role data:

POST _core/keystore/plugins.security.ssl.transport.external_truststore_password?nodeid=data:true
{
  "value" : "ExternalTruststorePASS"
}

You can add a key via the console:

curl -XPOST -k -u admin "https://127.0.0.1:9200/_core/keystore/plugins.security.ssl.transport.external_truststore_password?nodeid=data:true" -H "Content-Type: application/json" -d '{"value" : "ExternalTruststorePASS"}'

Add the password jobscheduler.email.pass to all nodes with the role data:

POST _core/keystore/jobscheduler.email.pass?nodeid=routing_mode:hot
{
  "value" : "JobSchedulerPASS"
}

Operations​

Permissions

To interact with keys within the keystore, you must grant cluster permissions. The permission name is specified in each operation.

Retrieving the list of keys​

The request returns information about the placement of keys on the servers.

Example:

GET _core/keystore

Permission:

cluster:admin/sm/keystore/list

Example response:

{
  "HIPMpNAmSuC7JUpBm1T33w": [
    "jobscheduler.email.pass",
    "keystore.seed",
    "uba.sme.pass"
  ],
  "Pd779Sf9RrSYiLrpA4wyxA": ["keystore.seed", "uba.sme.pass"]
}

Adding a key​

This request allows you to add a new key.

Key Names

Only key names defined in Smart Monitor Data Storage or Smart Monitor modules are available. Adding third-party keys will result in an error.

The key value must be passed in the request body using the value field.

Example:

POST _core/keystore/jobscheduler.email.pass?nodeid=172.16.0.3*
{
  "value" : "emailPass"
}

Permission:

cluster:admin/sm/keystore/add

Updating a key​

This request allows you to update an existing key. The new key value, similar to the add request, is passed in the request body within the value field.

Permission:

cluster:admin/sm/keystore/update

Deleting a key​

This request allows you to delete an existing key.

Example:

DELETE _core/keystore/uba.sme.pass

Permission:

cluster:admin/sm/keystore/delete