Host Profiles Free in ESXi 5?

No, VMware is not giving away their vCenter Host Profile feature which is still part of Enterprise Plus suite. But VMware has secretly introduced a new host profile framework that runs directly on an ESXi 5 host that provides similar capabilities to vCenter Host Profile feature. This particular functionality is not exposed to end users but when going through the ESXi Shell, you can interface with this new framework by leveraging the esxhpcli and esxhpedit utilities.   

esxhpcli is used to access the host profiles on a given ESXi 5 host:

~ # esxhpcli
Usage: esxhpcli [options]

This program serves as a CLI tool to access Host Profiles. The CLI tool
is designed to test at various levels in the Host Profiles stack.
Based on the operation level chosen, this CLI can invoke host profiles
through Hostd via VI API, by invoking the Host Profile Engine directly,
or bypassing the Host Profile Engine and invoking profile plug-ins
directly.

To get help for an individual command, use the --help option, e.g.:
esxhpcli --help

Commands:
atl, applytasklist -- Performs an apply task list operation.
gtl, tasklist -- Performs a generate task list operation.
qprof, queryprofilemeta -- Queries for profile metadata.
cc, checkcompliance -- Performs a check host compliance operation.
vp, verify -- Performs a verify profile operation.
ppl, posprofilelist -- Retrieves a list of profiles that can be used in a profile list.
qpol, querypolicymeta -- Queries for policy metadata.
gd, gatherdata -- Performs a host profile data gather operation.
gaf, genanswerfile -- Generates an Answer File for the given profile.
ep, extractprofile -- Performs a profile extraction operation.
qexpr, queryexpressionmeta -- Queries for compliance expression metadata.


Available Modules:
hpengine -- Module that executes the CLI commands by
invoking the Host Profile Engine directly (i.e. does not
go through hostd).


Default Module: hpengine

esxhpedit is used to edit host profiles generated from esxhpcli:

~ # esxhpedit
Usage: esxhpedit [command] [options]

This program serves as an editor for host profiles that have been exported
by the esxhpcli utility's "extractprofile" command. If no command is
specified on the command line, then the interactive host profile editor
will automatically be launched.

To get help for an individual command, use the --help option, e.g.:
esxhpedit --help

Commands:
se, setenabled -- Sets the enabled status of a profile or profile type.
rp, removeprofile -- Removes the specified profile.
cp, createprofile -- Creates a new instance of the specified profile.
gopt, getpolicyopt -- Displays the currently selected option for a policy of the specified profile
gpos, getpossible -- Displays the possible options for a policy of the specified profile
fp, findprofiles -- Finds paths for profiles matching some criteria
eaf, editanswerfile -- Edits an answer file.
dp, displayprofile -- Displays a profile
epol, editpolicy -- Edits the policy option and parameters of a policy.
gpol, getpolicies -- Lists the policy Ids for a specified profile
gparms, getparameters -- Displays the current parameters for a policy of the specified profile
daf, answerfile -- Displays the values currently set in an answer file


Available Modules:
hpengine -- Module that executes the CLI commands by
invoking the Host Profile Engine directly (i.e. does not
go through hostd).


Default Module: hpengine

You now have three methods of accessing host profiles: using vCenter & vSphere APIs, new Host Profile engine or bypassing the host profile engine and directly accessing host profile plugins. Currently the default available plugin is the host profile engine module but I suspect there will be others from 3rd party vendors.

Disclaimer: This interface is an undocumented and most likely unsupported from VMware, please use this in a test/development environment before applying to any critical or production system.

As mentioned above, these are undocumented interfaces, but there is an hidden API on the ESXi host for this new host profile engine controlled by /etc/vmware/hostd/cmdMo.xml. The three managed objects are: ha-image-config-manager, ha-hostprofileengine-hostprofilemanager and ha-hostprofileengine-compliancemanager.

There are also logs store in /var/log/hostprofiletrace.log which deal with this new host profile engine, the output can be somewhat convoluted and hard to digest.

I spent some time playing with the two utilities and I have gotten some of the commands to work, but you may get some odd warning messages when trying to apply a profile that has been exported. I will walk you through a very simple example of how to configure an existing ESXi 5 host and export a profile to be applied to another host.

The host profile engine has a concept of different types of profiles such as Authentication, Users, vSwitch, etc. to get a listing of the available profiles, you will run the following command: esxhpcli ppl

You can get more details about a given profile such as all the meta data associated with the profiles on an ESXi host by using esxhpcli qprof and esxhpcli qpol for the meta data polices.

Note: The output from both of these commands are pretty verbose, you may want to pipe the output to either less or a file.

To extract a profile from an ESXi host, you will using the esxhpcli ep and you can extract a specific type of profile as listed above using "ppl" option or extract all profiles for the host.

Here is an example of extracting the ActiveDirectoryProfile from an ESXi 5 host:

As you can see in this example, the ESXi host has joined an AD domain and you will see information about the configuration based on the profile you have selected.

If you wanted to extract all profiles, you would just run the following command esxhpcli ep and the output will be displayed on the screen. If you wanted to export the host profile and store it into a file to be used later, you will need to run the following command: esxhpcli ep -o /tmp/ghetto-profile where -o specifies an output file to be generated. You can also export a specific profile using the -p option in conjunction

Here is an example of exporting the ActiveDirectoryProfile and storing the profile in /tmp/ghetto-profile

If you the profile requires user input such as IP Addresses or credentials such as in the ActiveDirectoryProfile, you will need to generate an answer file that goes along with that exported profile. You will be using the esxhpcli eaf to generate the answer file which will be stored in /tmp/ghetto-answer

At this point, we have a host profile (/tmp/ghetto-profile) exported from an already configured ESXi host and the respective answer file (/tmp/ghetto-answer). Next we'll need to use the esxhpedit to update the answer file before we can actually use it.

To view the exported host profile, we can use the following command esxhpedit dp

To get more details on the host profile, we can specify the -r option to recursively display the sub-profiles.

Now to view the answer file, you will need to use esxhpedit daf

As you can see since we exported a profile that included AD specific profile, we have an answer file that requires some user input which can then work in-conjunction with the host profile to be applied to another ESXi 5 host.

To edit the answer file and fill in the meta data, we will need to use esxhpedit eaf and we will store the output into the same answer file /tmp/ghetto-answer. First let's update the "authentication.activeDirectory.JoinDomainMethodPolicy.userName" which will be the username to use to join the ESXi host to AD domain.

You need to specify the answer file, then the meta data key and it's respective entry and then we output the changes back into the answer file. To verify the changes were successful, we'll go ahead and perform another profile display using esxhpedit daf

Now we'll finish editing the answer file by specify the password to join the AD domain for "authentication.activeDirectory.JoinDomainMethodPolicy.password" key. It's important to know that the password is store in plaintxt, so make sure this answer file has limited access if you do not want to have it exposed.

Now one both entries have been successfully updated, we can now hop onto a new ESXi 5 host and apply this host profile with the respective answer file just like you would using a vCenter Host Profile. We will be using the /sbin/applyHostProfile which is a python wrapper around the host profile engine.

First we will need to scp over the ghetto-profile and ghetto-answer to the ESXi host and we'll store it in /tmp

We'll also verify using the vSphere Client to ensure this ESXi host has not been joined to an AD domain

We'll now apply the profile using the following command /sbin/applyHostProfile -d /tmp/ghetto-profile -a /tmp/ghetto-answer

Let's also verify using the vSphere Client that the ESXi host has joined the domain

There you have it, you just successfully applied a host profile generated from another ESXi host without the need of vCenter. I have only scratched the surface with this new host profile engine, but as you can see the possibilities are pretty endless. You can easily script this in a kickstart %firstboot option, here is a quick snippet of what that could look like: