Automating vCenter inventory configuration

Apr 17, 2019
Share on:

For one of my customers I had to come up with a solution to automate the vCenter inventory creation. The solution needed to:

  • Support multiple vCenters
  • Standardise the vCenter inventory configuration
  • Support multiple vCenter environments eg. Production, Lab.
  • vCenter permissions depend on the environment, each environment uses different AD groups.
  • Engineers without extensive PowerCLI knowledge need to be able to make changes to the vCenter configuration
  • Support regular changes eg. additional folders, permissions

A static PowerCLI script would not have been verry usefull so I had to come up with a different solution. Instead I stored the configuration data in a JSON file. Which is then imported and used to create the vCenter inventory.

The JSON file is structured in such way that the VM folder structure and roles are identical accross all vCenters regardless of the environment. The permissions are environment specific, each environment uses its own set of AD groups to configure the permissions on the vCenter inventory structure. Datacenters, clusters, vDswitches are vCenter specific. By using the JSON file to store the configuration data only this file needs to be updated when vCenter inventory modifications are needed. This removes the need for PowerCLI knowledge and makes it easy for the operational teams to implement the modifications.

The JSON file consists of following elements, which are discussed in more detail below:

  • Folders
  • Roles
  • Permnissions
  • vCenters
  • Settings

Folders

The Folders sections contains an array of folder items. The folder structure will be identical accross all vCenters and environments. Each folder element consists of

  • Name: Name of the folder
  • Type: Contains the type of vCenter folder to create eg. VM/HostAndCluster/Storage/Network/Datacenter.
  • Level: Contains the number on which the folder needs to be created. Toplevel folders start at number 2. The script has been created with 2 folders levels in mind.
  • Parent: Contains an array of folder names in which this folder needs to be created. A new folder will be created in each of the specified parent folders.
 1"Folders": [
 2    {
 3        "Name": "<Folder Name A>",
 4        "Type": "VM",
 5        "level": "<2/3>",
 6        "Parent": []
 7    },
 8    {
 9        "Name": "<Folder Name B>",
10        "Type": "VM",
11        "level": "<2/3>",
12        "Parent": [
13            "Folder Name A",
14            "Folder Name C",
15        ]
16    },
17    <...>
18]

Roles

The Roles section contains the info reaquired to create the vCenter server roles. For each role a name and an array of privilege IDs needed for this role are required. You can get the Privilege IDs of a role by executing Get-VIRole -Name <roleName> |Get-VIPrivilege |select id from an existing role.

 1"Roles": [
 2    {
 3        "Name": "Homelab - VMadmin",
 4        "PrivilegeIDs": [
 5            "System.Anonymous",
 6            "System.View",
 7            "System.Read",
 8            "VirtualMachine.Interact.PowerOn",
 9            "VirtualMachine.Interact.PowerOff",
10            "VirtualMachine.Interact.Reset",
11            "VirtualMachine.Interact.AnswerQuestion",
12            "VirtualMachine.Interact.ConsoleInteract",
13            "VirtualMachine.Interact.DeviceConnection",
14            "VirtualMachine.Interact.SetCDMedia",
15            "VirtualMachine.Interact.SetFloppyMedia",
16            "VirtualMachine.Interact.ToolsInstall"
17        ]
18    },
19    {
20        "Name": "Homelab - VMadminNoReboot",
21        "PrivilegeIDs": [
22            "System.Anonymous",
23            "System.View",
24            "System.Read",
25            "VirtualMachine.Interact.PowerOn",     
26            "VirtualMachine.Interact.AnswerQuestion",
27            "VirtualMachine.Interact.ConsoleInteract",
28            "VirtualMachine.Interact.DeviceConnection",
29            "VirtualMachine.Interact.SetCDMedia",
30            "VirtualMachine.Interact.SetFloppyMedia",
31            "VirtualMachine.Interact.ToolsInstall"
32        ]
33    },
34    {
35        "Name": "Homelab - VMware LogInsight user",
36        "PrivilegeIDs": [
37            "System.Anonymous",
38            "System.View",
39            "System.Read"
40        ]
41    },
42    <...>
43    ]

Permissions

The permissions section contains the data required to configure the permissions on the different inventory items. Each item of the permissions array looks as follows:

 1"Permissions": [
 2    {
 3        "InventoryItem": "<Inventory item name>",
 4        "ItemType": "<vCenter/Datacenter/vmFolder>",
 5        "Parent": "<Parent Name>",
 6        "level": "<# level>",
 7        "ItemPermissions": [
 8            {
 9                "AdGroup": "<AD Group Name A>",
10                "Environment": "<Production/Design>",
11                "AdDomain": "<AD Domain>",
12                "Role": "<vCenter role name 1>",
13                "Propagate": <true/false>
14            },
15            {
16                "AdGroup": "<AD Group Name B>",
17                "Environment": "<Production/Design>",
18                "AdDomain": "<AD Domain>",
19                "Role": "<vCenter role name 2>",
20                "Propagate": <true/false>
21            }
22        ]
23    }

Each inventory item requiring permissions needs to be added to the permissions JSON array. Each of these permissions array elements consists of following items:

  • Inventory item: The name of the item on which it needs to be configured. This can be the name of the vCenter, Datacenter or vmFolder on which the permissions need to be configured.
  • Item Type: The type of item on which the permissions need to be configured. This can be vCenter, Datacenter or vmFolder. Other item types have not been implemented.
  • Parent:
    • Parent can be empty in case the item is vCenter.
    • Parent contains “vCenter” in case item type is datacenter.
    • Parent contains “Datacenter” in case the item is a top level vmFolder.
    • Parent needs to contain the name of the parent vmFolder when it is a subfolder of a top level vmFolder.
  • Level: Contains a number indicating the items structure level.
    • vCenter = 0
    • Datacenter = 1
    • Top level vmFolder = 2
    • Sublevel vmFolder = 3
  • Item Permissions: This contains an array of items listing the permissions who need to be applied to the item. Each array element contains following information.
    • AD group: AD group name who needs to be granted permissions on the item
    • Environment: Indicates in which environment the permissions need to be granted.
    • AD Domain: AD domain in which the AD group is located
    • Role: The vCenter role that needs to be used to assign the permissions
  • Propagate:
    • True: The permissions will be propagated to the underlying inventory items.
    • False: The permission will not be propagated to the underlying inventory items. The AD group will not have any permission on the child items, unless configured seperately.

vCenters

The vCenters section contains an element for each vCenter. Each vCenter element consists of four sections:

  • vCenter specific information
  • DvSwitches
    • The vLANgroups array element allows to specify multiple portgroup name prefixes. For each vLANgroup element in the array the script will iterate on the vLANs and/or vLAN ranges specified and will create a dedicated portgroup.
  • Clusters
  • Datastore clusters Each of these parts contain the data required to create the vCenter specific inventory items. The DvSwitches, Clusters and Datastore clusters will create empty vCenter elements, no hosts, VMs or datastores will be linked to them.
 1"vCenters": [
 2    {
 3        "<vcenter hostname>": [
 4            {
 5                "Datacenter": "<Physical datacenter name>",
 6                "Site": "<Pysical datacenter site>",
 7                "Domain": "<vCenter domain name eg. homelab.local>",
 8                "Environment": "<vCenter Environment eg. Production, Design, Lab>",
 9                "Country": "<Country>",
10                "PSC": "<PSC FQDN>",
11                "vDataCenters": [<list of vCenter datacenters seperated by commas>],
12                "DvSwitches": [
13                    {
14                        "Name": "<DvSwitch name>",
15                        "Datacenter": "<vDatacenter name in which it needs to be created>",
16                        "NumOfUplinks": "<# of uplinks>",
17                        "LinkDiscoveryProtocol": "<CDP/LLDP>",
18                        "LinkDiscoveryProtocolOperation": "<listen/advertise/both>",
19                        "Version": "<DvSitch version eg. 6.5.0>",
20                        "mtu": "<MTU size>",
21                        "TeamingPolicy": "",
22                        "vLANgroups": [
23                            {
24                                "Name": "<Portgroup name prefix. The VLANID will be added to create the full portgroup name.>",
25                                "GroupType": "<Portgroup type identifier eg. LAN, used to distinguish between multiple types of portgroups>",
26                                "vlanType": "VLANID",
27                                "vLANs": "<vlan IDs seperated by commas, vlan ranges can be supplied with a "-" eg. 1000,1001,1002-1010>",
28                                "LoadBalancingPolicy": "<Loadbalancing mechanism>"
29                            },
30                                                            {
31                                "Name": "<Portgroup name prefix. The VLANID will be added to create the full portgroup name.>",
32                                "GroupType": "<Portgroup type identifier eg. BACKUP, used to distinguish between multiple types of portgroups>",
33                                "vlanType": "VLANID",
34                                "vLANs": "<vlan IDs seperated by commas, vlan ranges can be supplied with a "-" eg. 2000,2001,2002-2010>",
35                                "LoadBalancingPolicy": "<Loadbalancing mechanism>"
36                            }
37                        ]
38                    }
39                ],
40                "Clusters": [
41                    {
42                        "Name": "<Cluster name>",
43                        "Datacenter": "<Parent datacenter name>",
44                        "EVCmode": "<EVC mode>",
45                        "HAEnabled": <true/false>,
46                        "HAAdmissionControlEnabled": <true/false>,
47                        "HAFailoverLevel": "1",
48                        "HAIsolationResponse": "",
49                        "DrsEnabled": <true/false>,
50                        "DrsAutomationLevel": "<DRS automation level eg. FullyAutomated>"
51                    }
52                ],
53                "DatastoreClusters": [
54                    {
55                        "Name": "<Datastore cluster name>",
56                        "Datacenter": "<Parent datacenter>",
57                        "SDRS": <true/false>,
58                        "IOLoadBalanceEnabled": <true/false>,
59                        "SdrsAutomationLevel": "Enabled/Disabled"
60                    }
61                ]
62            }
63        ]
64    }

Settings

The settings sections contains a number of (advanced) vCenter settings which will be configured on each vCenter.

 1"Settings": [
 2    {
 3        "vCenter": [
 4            {
 5                "StatisticslevelPastDay": "4",
 6                "StatisticslevelPastWeek": "4",
 7                "StatisticslevelPastMonth": "4",
 8                "StatisticslevelPastYear": "4",
 9                "task_maxAgeEnabled": true,
10                "task_maxAge": "90",
11                "event_maxAgeEnabled": true,
12                "event_maxAge": "90",
13                "config_log_outputToSyslog": true,
14                "config_log_level": "info"
15            }
16        ]
17    }
18]

The script and json file can be found at https://github.com/svermoes/Automate-vCenter-configuration. The supplied JSON file is empty and needs to be adapted to align with your environment before it can be used.