Trustgrid

https://docs.trustgrid.io/
Admin
Trustgrid is a secure, software-defined edge platform that connects cloud applications to remote...
Tokens:97,403
Snippets:1,648
Trust Score:8.5
Update:2 months ago
Show doc for...
Tokens:
Raw
### Start Netcat Listener

Source: https://docs.trustgrid.io/getting-started/trial/subnet-routing

Starts a netcat listener on the specified loopback interface to verify connectivity.

```bash
nc -k -l -p 5000 -s 172.31.255.1
```

--------------------------------

### SSH Connection Command

Source: https://docs.trustgrid.io/getting-started/trial/base-setup/ubuntu2204

Example command to connect to the provisioned EC2 instances.

```bash
ssh -i ~/.ssh/mykey ubuntu@ipaddress
```

--------------------------------

### Example Node Status Output

Source: https://docs.trustgrid.io/tutorials/deployments/api-node-registration

The expected JSON response format when querying a registered node.

```json
{
  "name": "my-edge-node.your-domain.trustgrid.io",
  "uid": "abc12345-...",
  "online": false,
  "state": "ACTIVE"
}
```

--------------------------------

### Test TCP Connectivity

Source: https://docs.trustgrid.io/getting-started/trial/subnet-routing

Start a netcat listener on the target agent and verify connectivity from the source agent.

```bash
nc -k -l -p 5000 -s 172.31.255.1
```

```bash
nc -vz -w 1 172.31.255.1 5000
```

--------------------------------

### Execute Registration Script

Source: https://docs.trustgrid.io/tutorials/deployments/api-node-registration

Commands to set credentials and run the registration helper script.

```bash
export TG_CLIENT_ID="your-client-id"
export TG_CLIENT_SECRET="your-client-secret"

./register-node.sh my-edge-node my-edge-node.lic
```

--------------------------------

### WAN Interface Configuration Output

Source: https://docs.trustgrid.io/release-notes/cloud/july-2023

Example of the configuration details copied to the clipboard using the new Copy All button in the network interface panel.

```text
IP: 172.16.11.31/24
Hardware Address: 00:50:56:8e:03:54
Gateway: 172.16.11.1
DNS1: 172.16.11.4
DNS2: 4.2.2.2

```

--------------------------------

### GET /group

Source: https://docs.trustgrid.io/docs/api

Retrieve a list of groups.

```APIDOC
## GET /group

### Description
Retrieve a list of groups.

### Method
GET

### Endpoint
/group
```

--------------------------------

### Deploy Trustgrid Appliance VM

Source: https://docs.trustgrid.io/tutorials/deployments/deploy-azure/azure-cli-deployment

Deploys the VM with specified NICs and enables boot diagnostics for serial console access.

```bash
az vm create \
  --resource-group $resourceGroup \
  --name $name \
  --image $imageID \
  --accept-term \
  --admin-user 'ubuntu' \
  --assign-identity '[system]' \
  --authentication-type 'ssh' \
  --nics $name-outside $name-inside \
  --nic-delete-option 'Delete' \
  --os-disk-size-gb $osDiskSize \
  --os-disk-delete-option 'Delete' \
  --size $size \
  --ssh-key-name $sshKeyName
```

```bash
az vm boot-diagnostics enable --name $name --resource-group $resourceGroup
```

--------------------------------

### GET /v2/observability-exporter

Source: https://docs.trustgrid.io/docs/api

Retrieve a list of observability exporters.

```APIDOC
## GET /v2/observability-exporter

### Description
Retrieve a list of observability exporters. Requires `observability::read` permission and `observability` feature flag.

### Method
GET

### Endpoint
/v2/observability-exporter
```

--------------------------------

### GET /audit/download/config

Source: https://docs.trustgrid.io/docs/api

Downloads configuration audit logs.

```APIDOC
## GET /audit/download/config

### Description
Downloads immutable configuration change audit logs. Requires `audits::read:config` permission.

### Method
GET

### Endpoint
/audit/download/config
```

--------------------------------

### Agent Diagnostic Output Example

Source: https://docs.trustgrid.io/tutorials/management-tasks/agent-mgmt/agent-diag

Sample output showing successful DNS resolution, connectivity, TLS, and MTLS checks for Trustgrid services.

```text
tg-agent diag
--------------------------------------------------------------------------------
-------------------------------------- DNS -------------------------------------
--------------------------------------------------------------------------------

keymaster.trustgrid.io:
	35.171.100.28

gatekeeper.trustgrid.io:
	35.171.100.26
	35.171.100.25
	35.171.100.27

zuul.trustgrid.io:
	35.171.100.19
	35.171.100.20

repo.trustgrid.io:
	35.171.100.29

--------------------------------------------------------------------------------
--------------------------------- CONNECTIVITY ---------------------------------
--------------------------------------------------------------------------------

keymaster.trustgrid.io:443:
	35.171.100.28:443:              OK

gatekeeper.trustgrid.io:8443:
	35.171.100.26:8443:             OK
	35.171.100.27:8443:             OK
	35.171.100.25:8443:             OK

zuul.trustgrid.io:8443:
	35.171.100.20:8443:             OK
	35.171.100.19:8443:             OK

repo.trustgrid.io:443:
	35.171.100.29:443:              OK

--------------------------------------------------------------------------------
-------------------------------------- TLS -------------------------------------
--------------------------------------------------------------------------------

keymaster.trustgrid.io:443:
	35.171.100.28:443:              OK

repo.trustgrid.io:443:
	35.171.100.29:443:              OK

--------------------------------------------------------------------------------
------------------------------------- MTLS -------------------------------------
--------------------------------------------------------------------------------

gatekeeper.trustgrid.io:8443:
	35.171.100.27:8443:             OK
	35.171.100.26:8443:             OK
	35.171.100.25:8443:             OK

zuul.trustgrid.io:8443:
	35.171.100.20:8443:             OK
	35.171.100.19:8443:             OK
```

--------------------------------

### Define a JSONinator plan file

Source: https://docs.trustgrid.io/tutorials/tools/jsoninator

A complete YAML configuration example demonstrating HTTP input, data filtering, field transformation, and PUT request output.

```yaml
input:
  http:
    url: https://portal.trustgrid.io/api/node?projection[0]=uid&projection[1]=name&projection[2]=tags&projection[3][0]=config&projection[3][1]=gateway&projection[4]=fqdn
    headers:
      Authorization: "trustgrid-token ${TRUSTGRID_API_KEY_ID}:${TRUSTGRID_API_KEY_SECRET}"
      Accept: application/json

pipeline:
  processors:
    - filter:
        prefix:
          name: gw-
        query: |
          {{if (eq .type "Node")}}true{{else}}false{{end}}
    - map:
        field: config.gateway
    - transform:
        fields:
          udpEnabled: true
          udpPort: |
            {{if .udpPort}}{{.udpPort}}{{else if .port}}{{.port}}{{else}}8443{{end}}
          maxClientWriteMbps: |
            {{if or (eq .maxClientWriteMbps 0.0) (not .maxClientWriteMbps)}}nil{{else}}{{.maxClientWriteMbps}}{{end}}
          cert: |
            {{if .cert}}{{.cert}}{{else}}nil{{end}}

output:
  http:
    url: https://portal.trustgrid.io/api/node/{{.uid}}/config/gateway
    method: PUT
    status_codes: [200]
    headers:
      Authorization: "trustgrid-token ${TRUSTGRID_API_KEY_ID}:${TRUSTGRID_API_KEY_SECRET}"
      Content-Type: application/json

report:
  path: ./reports
```

--------------------------------

### GET /upgrade-manager/api/v1/upgrades

Source: https://docs.trustgrid.io/docs/api

Retrieves a list of software upgrades.

```APIDOC
## GET /upgrade-manager/api/v1/upgrades

### Description
Retrieves a list of software upgrades for nodes and clusters. Requires `upgrade-manager::read` permission.

### Method
GET

### Endpoint
/upgrade-manager/api/v1/upgrades
```

--------------------------------

### GET /v2/alert

Source: https://docs.trustgrid.io/docs/api

Retrieves a list of system alerts.

```APIDOC
## GET /v2/alert

### Description
Retrieves a list of security and operational alerts.

### Method
GET

### Endpoint
/v2/alert
```

--------------------------------

### Create Loopback Interface

Source: https://docs.trustgrid.io/getting-started/trial/subnet-routing

Commands to create a dummy interface named lo2 and assign it an IP address to simulate an adjacent network.

```bash
sudo ip link add name lo2 type dummy
sudo ip addr add 172.31.255.1/32 dev lo2
sudo ip link set lo2 up
```

--------------------------------

### GET /v2/idp

Source: https://docs.trustgrid.io/docs/api

Retrieve a list of identity provider integrations.

```APIDOC
## GET /v2/idp

### Description
Retrieve a list of identity provider integrations (Okta, Azure AD, Google, SAML, OIDC). Requires `identity-providers::read` permission.

### Method
GET

### Endpoint
/v2/idp
```

--------------------------------

### Create Network Resources

Source: https://docs.trustgrid.io/tutorials/deployments/deploy-azure/azure-cli-deployment/az-cli-example

Provision a public IP address, network security group, and security rules for the appliance.

```bash
sales@Azure:~$ az network public-ip create --name $name-pubIP \
  --resource-group $resourceGroup --location $location \
  --sku "Standard" --allocation-method "Static"
[Coming breaking change] In the coming release, the default behavior will be changed as follows when sku is Standard and zone is not provided: For zonal regions, you will get a zone-redundant IP indicated by zones:["1","2","3"]; For non-zonal regions, you will get a non zone-redundant IP indicated by zones:null.
{
  "publicIp": {
    "ddosSettings": {
      "protectionMode": "VirtualNetworkInherited"
    },
    "etag": "W/\"d976ed14-bf3d-4f1a-964d-9ff7dd0783b4\"",
    "id": "/subscriptions/#######-####-####-####-#########/resourceGroups/DocsExample/providers/Microsoft.Network/publicIPAddresses/docs-node-pubIP",
    "idleTimeoutInMinutes": 4,
    "ipAddress": "20.168.241.169",
    "ipTags": [],
    "location": "eastus",
    "name": "docs-node-pubIP",
    "provisioningState": "Succeeded",
    "publicIPAddressVersion": "IPv4",
    "publicIPAllocationMethod": "Static",
    "resourceGroup": "DocsExample",
    "resourceGuid": "73fc5b1b-bc3e-4670-9af2-65545bb381b6",
    "sku": {
      "name": "Standard",
      "tier": "Regional"
    },
    "type": "Microsoft.Network/publicIPAddresses"
  }
}

sales@Azure:~$ 
sales@Azure:~$ az network nsg create --name $name-outside \
  --resource-group $resourceGroup --location $location
{
  "NewNSG": {
    "defaultSecurityRules": [
      {
        "access": "Allow",
        "description": "Allow inbound traffic from all VMs in VNET",
        "destinationAddressPrefix": "VirtualNetwork",
...Truncated....
        "sourceAddressPrefixes": [],
        "sourcePortRange": "*",
        "sourcePortRanges": [],
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules"
      }
    ],
    "etag": "W/\"57d825f4-e5eb-407f-8eec-ad9f3be06486\"",
    "id": "/subscriptions/#######-####-####-####-#########/resourceGroups/DocsExample/providers/Microsoft.Network/networkSecurityGroups/docs-node-outside",
    "location": "eastus",
    "name": "docs-node-outside",
    "provisioningState": "Succeeded",
    "resourceGroup": "DocsExample",
    "resourceGuid": "3796f81b-d50c-4d43-89ed-f41da1523fd8",
    "securityRules": [],
    "type": "Microsoft.Network/networkSecurityGroups"
  }
}
sales@Azure:~$ az network nsg rule create --name "TGControlPlaneTCP" \
  --nsg-name $name-outside \
  --resource-group $resourceGroup \
  --priority 1000 \
  --access 'Allow' \
  --description 'TCP ports required Trustgrid Control Plane networks' \
  --destination-address-prefixes '35.171.100.16/28' '34.223.12.192/28' \
  --destination-port-ranges 443 8443 \
  --direction 'Outbound' \
  --protocol 'Tcp' 
{
  "access": "Allow",
  "description": "TCP ports required Trustgrid Control Plane networks",
  "destinationAddressPrefixes": [
    "35.171.100.16/28",
    "34.223.12.192/28"
  ],

```

--------------------------------

### GET /repositories

Source: https://docs.trustgrid.io/docs/api

Retrieves a list of container image repositories.

```APIDOC
## GET /repositories

### Description
Retrieves a list of container image repositories for storing and distributing Docker images. Requires `repositories::read` permission.

### Method
GET

### Endpoint
/repositories
```

--------------------------------

### GET /group/{uid}/members

Source: https://docs.trustgrid.io/docs/api

Retrieves the list of members in a group.

```APIDOC
## GET /group/{uid}/members

### Description
Retrieves the list of members belonging to the specified group.

### Method
GET

### Endpoint
/group/{uid}/members

### Parameters
#### Path Parameters
- **uid** (string) - Required - The unique identifier of the group
```

--------------------------------

### GET /group/{uid}

Source: https://docs.trustgrid.io/docs/api

Retrieves details for a specific user group.

```APIDOC
## GET /group/{uid}

### Description
Retrieves details for a specific user group by its UID.

### Method
GET

### Endpoint
/group/{uid}

### Parameters
#### Path Parameters
- **uid** (string) - Required - The unique identifier of the group
```

--------------------------------

### Deploy VM for Manual Serial Console Registration

Source: https://docs.trustgrid.io/tutorials/deployments/deploy-gcp

Deploys a GCP VM instance without a license key, enabling the serial console for manual registration.

```bash
gcloud compute instances create NODE_NAME \
  --project=PROJECT_ID \
  --zone=ZONE \
  --machine-type=MACHINE_TYPE \
  --image-family=trustgrid-node \
  --image-project=trustgrid-images \
  --boot-disk-size=30GB \
  --can-ip-forward \
  --network-interface=network=MANAGEMENT_NETWORK,subnet=MANAGEMENT_SUBNET,nic-type=GVNIC \
  --network-interface=network=DATA_NETWORK,subnet=DATA_SUBNET,no-address,nic-type=GVNIC \
  --service-account=tg-node@PROJECT_ID.iam.gserviceaccount.com \
  --scopes=https://www.googleapis.com/auth/compute \
  --tags=tg-node \
  --metadata=serial-port-enable=true
```

--------------------------------

### Deploy VM with Automated Registration

Source: https://docs.trustgrid.io/tutorials/deployments/deploy-gcp

Deploys a GCP VM instance with a license key in the metadata to trigger automatic registration with the Trustgrid control plane.

```bash
gcloud compute instances create NODE_NAME \
  --project=PROJECT_ID \
  --zone=ZONE \
  --machine-type=MACHINE_TYPE \
  --image-family=trustgrid-node \
  --image-project=trustgrid-images \
  --boot-disk-size=30GB \
  --can-ip-forward \
  --network-interface=network=MANAGEMENT_NETWORK,subnet=MANAGEMENT_SUBNET,nic-type=GVNIC \
  --network-interface=network=DATA_NETWORK,subnet=DATA_SUBNET,no-address,nic-type=GVNIC \
  --service-account=tg-node@PROJECT_ID.iam.gserviceaccount.com \
  --scopes=https://www.googleapis.com/auth/compute \
  --tags=tg-node \
  --metadata=tg-license-key=LICENSE_KEY,serial-port-enable=true
```

--------------------------------

### GET /v2/certificates

Source: https://docs.trustgrid.io/docs/api

Retrieve a list of TLS certificates provisioned for nodes.

```APIDOC
## GET /v2/certificates

### Description
Retrieve a list of TLS certificates provisioned for nodes. Requires `certificates::read` permission.

### Method
GET

### Endpoint
/v2/certificates
```

--------------------------------

### GET /group/{uid}/idps

Source: https://docs.trustgrid.io/docs/api

Retrieves identity providers associated with a group.

```APIDOC
## GET /group/{uid}/idps

### Description
Retrieves the identity providers (IDPs) associated with the specified group.

### Method
GET

### Endpoint
/group/{uid}/idps

### Parameters
#### Path Parameters
- **uid** (string) - Required - The unique identifier of the group
```

--------------------------------

### Virtual Network Command Template

Source: https://docs.trustgrid.io/tutorials/deployments/deploy-azure/azure-cli-deployment/az-cli-example

A clean template of the virtual network and subnet creation commands for easy copy-pasting.

```bash
export vNetName=""
export outsideSubnet=""
export insideSubnet=""
az network vnet create --name $vNetName --resource-group $resourceGroup --location $location --address-prefix 192.168.0.0/16
az network vnet subnet create --name $outsideSubnet --resource-group $resourceGroup --vnet-name $vNetName --address-prefix 192.168.1.0/24
az network vnet subnet create --name $insideSubnet --resource-group $resourceGroup --vnet-name $vNetName --address-prefix 192.168.2.0/24
```

--------------------------------

### GET /tags

Source: https://docs.trustgrid.io/docs/api

Retrieves a list of all tags. Requires nodes::read permission.

```APIDOC
## GET /tags

### Description
Retrieves a list of all tags attached to nodes and clusters.

### Method
GET

### Endpoint
/tags
```

--------------------------------

### Enable Compute Engine API

Source: https://docs.trustgrid.io/tutorials/deployments/deploy-gcp

Command to enable the required API for managing VM instances in your GCP project.

```bash
gcloud services enable compute.googleapis.com --project=PROJECT_ID
```

--------------------------------

### Create Virtual Network and Subnets

Source: https://docs.trustgrid.io/tutorials/deployments/deploy-azure/azure-cli-deployment/az-cli-example

Defines the virtual network and two subnets (outside and inside) for the appliance.

```bash
sales@Azure:~$ export vNetName="TrustgridvNet"
export outsideSubnet="tg-outside"
export insideSubnet="tg-inside"
sales@Azure:~$ az network vnet create --name $vNetName --resource-group $resourceGroup --location $location --address-prefix 192.168.0.0/16
{
  "newVNet": {
    "addressSpace": {
      "addressPrefixes": [
        "192.168.0.0/16"
      ]
    },
    "enableDdosProtection": false,
    "etag": "W/\"1#######-####-####-####-#########\"",
    "id": "/subscriptions/#######-####-####-####-#########/resourceGroups/DocsExample/providers/Microsoft.Network/virtualNetworks/TrustgridvNet",
    "location": "eastus",
    "name": "TrustgridvNet",
    "provisioningState": "Succeeded",
    "resourceGroup": "DocsExample",
    "resourceGuid": "#######-####-####-####-#########",
    "subnets": [],
    "type": "Microsoft.Network/virtualNetworks",
    "virtualNetworkPeerings": []
  }

}
sales@Azure:~$ az network vnet subnet create --name $outsideSubnet --resource-group $resourceGroup --vnet-name $vNetName --address-prefix 192.168.1.0/24
{
  "addressPrefix": "192.168.1.0/24",
  "delegations": [],
  "etag": "W/\"#######-####-####-####-#########\"",
  "id": "/subscriptions/#######-####-####-####-#########/resourceGroups/DocsExample/providers/Microsoft.Network/virtualNetworks/TrustgridvNet/subnets/tg-outside",
  "name": "tg-outside",
  "privateEndpointNetworkPolicies": "Disabled",
  "privateLinkServiceNetworkPolicies": "Enabled",
  "provisioningState": "Succeeded",
  "resourceGroup": "DocsExample",
  "type": "Microsoft.Network/virtualNetworks/subnets"
}
sales@Azure:~$ az network vnet subnet create --name $insideSubnet --resource-group $resourceGroup --vnet-name $vNetName --address-prefix 192.168.2.0/24
{
  "addressPrefix": "192.168.2.0/24",
  "delegations": [],
  "etag": "W/\"468e9585-daa2-4908-9484-9708e4cac8d4\"",
  "id": "/subscriptions/#######-####-####-####-#########/resourceGroups/DocsExample/providers/Microsoft.Network/virtualNetworks/TrustgridvNet/subnets/tg-inside",
  "name": "tg-inside",
  "privateEndpointNetworkPolicies": "Disabled",
  "privateLinkServiceNetworkPolicies": "Enabled",
  "provisioningState": "Succeeded",
  "resourceGroup": "DocsExample",
  "type": "Microsoft.Network/virtualNetworks/subnets"
}
```

--------------------------------

### Create Network Interfaces and Security Groups

Source: https://docs.trustgrid.io/tutorials/deployments/deploy-azure/azure-cli-deployment

Configures public IP, network security groups with outbound rules, and network interfaces for the appliance.

```bash
az network public-ip create --name $name-pubIP \
  --resource-group $resourceGroup --location $location \
  --sku "Standard" --allocation-method "Static"

az network nsg create --name $name-outside \
  --resource-group $resourceGroup --location $location

az network nsg rule create --name "TGControlPlaneTCP" \
  --nsg-name $name-outside \
  --resource-group $resourceGroup \
  --priority 1000 \
  --access 'Allow' \
  --description 'TCP ports required Trustgrid Control Plane networks' \
  --destination-address-prefixes '35.171.100.16/28' '34.223.12.192/28' \
  --destination-port-ranges 443 8443 \
  --direction 'Outbound' \
  --protocol 'Tcp' 

az network nsg create --name $name-inside \
  --resource-group $resourceGroup --location $location

az network nic create --resource-group $resourceGroup \
 --location $location --name $name-outside \
  --vnet-name $vNetName --subnet $outsideSubnet \
  --accelerated-networking false --public-ip-address $name-pubIP \
  --network-security-group $name-outside
  
az network nic create --resource-group $resourceGroup \
  --location $location --name $name-inside \
  --vnet-name $vNetName --subnet $insideSubnet \
  --accelerated-networking false --ip-forwarding true \
  --network-security-group $name-inside
```

--------------------------------

### GET /group

Source: https://docs.trustgrid.io/docs/api

Retrieves a list of user groups. Requires users::read permission.

```APIDOC
## GET /group

### Description
Retrieves a list of all user groups.

### Method
GET

### Endpoint
/group
```

--------------------------------

### Authenticate with Registry

Source: https://docs.trustgrid.io/tutorials/containers/quickstart

Command to authenticate with the private registry using a token from the Trustgrid portal.

```bash
docker login -u trustgrid -p <token> https://docker.<your-domain>
```
Tokens:
Raw