Problem Statement
ipctl has native export gctree / import gctree commands
(internal/runners/gctrees.go, pkg/services/golden_config.go) that work correctly for
moving Golden Config trees between Platform instances. There is no equivalent for
Configuration Manager compliance plans — a separate object that references a gctree by
treeId/version and binds specific devices/deviceGroups to each tree node (e.g. a plan
named "NERC-CIP Cisco IOS Compliance Plan" with 4 nodes, each listing treeId, version,
nodeId, devices[], deviceGroups[]).
Without this, promoting any project that depends on a compliance plan (e.g. a NERC-CIP
compliance agent) between instances requires hand-rolling REST calls, and we ran into a
platform API gap while doing so: POST /configuration_manager/compliance_plans accepts
description and nodes in the request body but silently discards both (response comes
back description:"", nodes:[], no error). No endpoint we could find (PATCH, PUT,
POST .../nodes, POST .../nodes/bulk — all 404) allows attaching nodes[] after
creation. So even a hand-rolled REST-based workaround is currently blocked, not just an
ipctl convenience gap.
Proposed Solution
- Add
ipctl export compliance-plan / ipctl import compliance-plan commands, analogous
to the existing gctree commands.
- This depends on the underlying platform API accepting
nodes/description on create (or
exposing a documented update endpoint) — worth confirming with the platform API owners
before or alongside the ipctl work, since the current silent-drop behavior would block
the new command too.
Alternatives Considered
- Hand-rolling the promotion via direct REST calls against
/configuration_manager/compliance_plans — attempted, but blocked by the create-endpoint
gap described above (nodes/description don't persist, and no update path was found).
Checklist
Problem Statement
ipctlhas nativeexport gctree/import gctreecommands(
internal/runners/gctrees.go,pkg/services/golden_config.go) that work correctly formoving Golden Config trees between Platform instances. There is no equivalent for
Configuration Manager compliance plans — a separate object that references a gctree by
treeId/versionand binds specific devices/deviceGroups to each tree node (e.g. a plannamed "NERC-CIP Cisco IOS Compliance Plan" with 4 nodes, each listing
treeId,version,nodeId,devices[],deviceGroups[]).Without this, promoting any project that depends on a compliance plan (e.g. a NERC-CIP
compliance agent) between instances requires hand-rolling REST calls, and we ran into a
platform API gap while doing so:
POST /configuration_manager/compliance_plansacceptsdescriptionandnodesin the request body but silently discards both (response comesback
description:"",nodes:[], no error). No endpoint we could find (PATCH,PUT,POST .../nodes,POST .../nodes/bulk— all 404) allows attachingnodes[]aftercreation. So even a hand-rolled REST-based workaround is currently blocked, not just an
ipctlconvenience gap.Proposed Solution
ipctl export compliance-plan/ipctl import compliance-plancommands, analogousto the existing
gctreecommands.nodes/descriptionon create (orexposing a documented update endpoint) — worth confirming with the platform API owners
before or alongside the
ipctlwork, since the current silent-drop behavior would blockthe new command too.
Alternatives Considered
/configuration_manager/compliance_plans— attempted, but blocked by the create-endpointgap described above (nodes/description don't persist, and no update path was found).
Checklist