PowerCLICore

Common PowerCLI examples for VM Provisioning in VMware Cloud on AWS

02/07/2019 by William Lam Leave a Comment

One of the huge benefits of VMware Cloud on AWS (VMC) is not only the ability to extend your existing on-premises environment and tap into the potentially unlimited capacity of the Cloud, but customers can continue to use the existing tools and scripts that they are already familiar with. When it comes to Automation, PowerCLI is still by far the most popular tool that our customers uses on a regular basis. With VMC, this is no different as the SDDC is simply made up of vSphere, vSAN and NSX which PowerCLI fully supports.

One learning curve that I have seen for some customers when working with VMC is around general provisioning and the implication of the restrictive permission model in VMC. Unlike your on-premises vSphere environment, in VMC, you are no longer running as a vSphere Administrator but rather a Cloud Administrator. This simply means you no longer have to worry about managing the underlying infrastructure (patch, upgrade, monitor, etc) and you get to focus deploying and managing your workloads.

What this technically translates to is that you are restricted to a particular part of the vSphere Inventory where you have permissions to actually deploy workloads. This is to help isolate your workloads and ensure that you do not negatively impact the VMware Management VMs by accident and thus affecting your SDDC.

From the Hosts/Clusters view, you must use the Compute-ResourcePool
From the VM view, you must use the Workloads Folder
From the Datastore view, you must use the WorkloadDatastore

When using the vSphere UI to deploy new workloads, the UI does a really good job of guiding you towards the right inventory objects, but this may not always be apparent when using the CLI or API, especially for new folks or folks who never use the UI 😉

Using NSX-T Policy API to retrieve the Routing Table in VMC

02/04/2019 by William Lam Leave a Comment

When configuring connectivity from your on-premises environment to your VMware Cloud on AWS (VMC) NSX-T SDDC, you can either use a Direct Connect (DX) or a Route/Policy-based VPN. During the configuration, it can really be useful to have insights into the network routing table, especially if you need to verify a specific route or for general network debugging. Today, the NSX-T routing table in VMC is not currently available in the Network and Security UI, however this information can be retrieved using the NSX-T Policy API, which I have written about quite extensively here, here, here and here.

The NSX-T routing table can be retrieved by performing a GET operation on /policy/api/v1/infra/tier-0s/vmc/routing-table?enforcement_point_path=/infra/deployment-zones/default/enforcement-points/vmc-enforcementpoint By default, you will get the entire routing table, but you also filter out specific route sources such as BGP, Static or Connected routes by appending the following query parameter to the request URL ?route_source={BGP,CONNECTED,STATIC}

To demonstrate how this API works, I have created a new function in my VMC NSX-T PowerShell Module as well as a quick shell script sample using cURL.

For PowerShell/PowerCLI users, I have a new Get-NSXTRouteTable function which will list the entire routing table by default as shown in the screenshot below.

You can also filter on a specific route source such as BGP, CONNECTED or STATIC routes by simply providing the -RouteSource argument and the route source type. In the screenshot below, I am only interested in the BGP routes.

Here is the output when running the list_vmc_nsxt_route_table.sh script which requires a valid CSP Refresh Token, OrgId and SDDCId

PowerShell for PhotonOS on Raspberry Pi 3

01/25/2019 by William Lam 4 Comments

Did you know VMware PhotonOS can also run on a Raspberry Pi (rPI) 3? I definitely did not until recently when I found out the latest 3.0 version also had an image for the rPI. This is great for anyone who is already familiar with PhotonOS and wish to run it in an even smaller form factor such as an rPI. There are definitely some interesting use cases for an rPI such as a tiny management host, troubleshooting tool for consultants or even a quick PowerShell/PowerCLI host that contains some basic tools and scripts which you can quickly access.

I was definitely interested in getting PowerShell and PowerCLI running on top PhotonOS on the rPI. Although you can already run PowerShell on an rPI using the Raspbian OS, the current distribution from Microsoft is actually only 32-Bit, which is a problem for PhotonOS as it is a 64-Bit OS. I was about to give up but while browsing the Microsoft PowerShell repo, I came across their upcoming PowerShell 6.2.0 (Preview) release which now looks to include a 64-Bit ARM build, which is exactly what I needed. For PowerCLI, although I was able to get the modules loaded, I was not able to connect to a vCenter Server or ESXi endpoint, you can find more details at the bottom of this post.

Below are the instructions for installing PhotonOS on the rPI and getting PowerShell setup:

Step 1 - Download and install the Etcher tool which will be used to flash our rPI

Step 2 - Download and install PhotonOS 3.0 RC rPI image using Etcher

Once PhotonOS has been installed, you can login (default credentials are root/changeme) and we now have PhotonOS running on our rPI!

Next we will install PowerShell as well as the latest PowerCLI modules.
[Read more...] about PowerShell for PhotonOS on Raspberry Pi 3

Automating Customer Experience Improvement Program (CEIP) configuration using vSphere API and PowerCLI

01/24/2019 by William Lam 2 Comments

After publishing my recent article on the new the vSphere Health capability which takes advantage of VMware's Customer Experience Improvement Program (CEIP), I had a couple of folks reach out asking how their customers could check whether CEIP is enabled for a given vCenter Server and if not, how to enable it using Automation. For one of these customers, they had over 25+ vCenter Server, so they were not interested in doing this by hand and nor should they.

For those interested in the vSphere UI, the CEIP settings is configured in the Administration menu under the Deployment section as shown in the screenshot below.

We can also manage the CEIP settings programmatically using vSphere API and this is controlled by an Advanced vCenter Server setting called VirtualCenter.DataCollector.ConsentData. The value of this property is actually a JSON payload as you can see in the screenshot below and when updating this property, we need to update both the change version as well as whether we want CEIP enabled or disabled for a given vCenter Server.

Instant Clone Microsoft Windows & VM Keystroke VMworld demo and code posted

01/08/2019 by William Lam 1 Comment

Apologies for the delay in getting my VMworld 2018 demo and code posted online, I know a number of you have been asking about the Windows Instant Clone samples to get an idea on how to create your own customization scripts for managing more "recent" Microsoft Windows releases 😉 and perhaps you might even consider submitting a pull request to share with the community. I have posted both the videos and code samples below. Enjoy and happy Automating!

Instant Clone Microsoft Windows

To demonstrate the power of the newly re-architected Instant Clone feature in vSphere 6.7 and to help make the point clear that the Instant Clone feature is really Guest Operating System agnostic, meaning you can Instant Clone any to Virtual Machine that can run VMware Tools, I thought it would be fun to see how old of a Microsoft OS that I could Instant Clone. After a bit of trial/error, that turned out to be Windows 98 and Windows 2000 🙂

Windows 98 Demo

Windows 2000 Demo

Managing Distributed Firewall Rules in VMC using PowerShell & NSX-T Policy API

01/04/2019 by William Lam Leave a Comment

Back in November 2018, VMware Cloud on AWS (VMC) SDDC 1.5 Patch 1 was released and it was one of the most highly anticipated release by our customers. Although this was a "patch" release, it included a ton of new features and also brought the full power of the NSX-T platform to VMC as a generally available feature!

With NSX-T, customers also now have access to the highly requested Distributed Firewall (DFW) capability which enables granular control over East-West traffic between application workloads. In addition to enabling micro-segmentation in VMC, customers can now easily manage DFW rules using a number of grouping constructs (Tags, Virtual Machines & Conditional Statements) to create dynamic policies which follow their workloads.

Customers can configure DFW (as well as Edge Firewall) rules using the VMC Console UI but many of you have been asking for an automated method, especially if you need to create a large number of policies for more than a couple of workloads. After returning from the holiday, I spent the last couple of days updating my NSX-T Policy PowerShell Module which now includes basic support for managing DFW. For those of you who are new to using the NSX-T Policy API and PowerCLI, be sure to give these two articles a read here and here before proceeding further.