Here is the problem I am having right now.
My script does this:
DOMAINS=$1
for DOMAIN in `echo $DOMAINS | sed -e 's/,/ /g'`
do
echo "DOMAIN = $DOMAIN"
if [ "$2" == "-install" ] ; then
start=`date +%s`
for POLICY in $(mgmt_cli show-packages -d $DOMAIN --root true --format text | grep -B1 package | grep name | awk '{print $2}' | tr -d '"' |sed 's/[][*]\|[[:space:]]//g')
do
echo "Policy = $POLICY"
mgmt_cli install-policy policy-package $POLICY -d $DOMAIN access true --root true --format json
done
end=`date +%s`
runtime=$((end-start))
echo "Elapsed time for $DOMAIN: $((runtime /60)) minutes and $(($runtime %60)) seconds"
echo " "
else
if [ -z "`mgmt_cli show domain name ${DOMAIN} --format json --root true | jq -r '."global-domain-assignments"[]'`" ]; then
echo "Domain \"${DOMAIN}\" has no Global Domain assigned, skipping it."
else
echo "Reassigning Global Domain \"${GPOL_NAME}\" to Domain \"${DOMAIN}\"..."
mgmt_cli assign-global-assignment global-domains ${GPOL_NAME} dependent-domains ${DOMAIN} --root true --format json
fi
fi
done
so, this works great except for one fatal flaw. A policy with no installation targets will cause you some headaches (speaking from experience)
One of our domains has about 8 policies. Someone has a new policy built that he is staging work for a future deployment. He does not have a cluster object built yet for it to be tied to.
so my script installed all the policies and then it got to that fresh policy and installed it to EVERY gateway...and it probably did it with glee!
If you tried this in the GUI it would prompt you in hopes to avoid your own stupidity. If you do a Global Policy assignment from the GUI with the option to install policy it will do it based on the gateway and not the policy.
The API does not allow this same type of logic. I have to pass either the policy (which gives me the above results) or policy + gateway which I would have to generate some sort of list to be able to do that.
