HTML5

vYetti – Fun animated vSphere Login UI customization

05/15/2018 by William Lam 7 Comments

For those that have been asking about how to customize the vSphere Client Login UI to include this fun little animated login screen as shown below, you can find the complete instructions on my github repo: https://github.com/lamw/vyetti-vsphere-client-customization

I wanted to take a moment and give thanks and credit to the original author (Darin S) who created the animated login, which he referred to as an "Animated SVG Avatar". I remember seeing this on my Twitter stream a few months back where it was shared on codepen.io, which is a platform for web developers to easily show off their demos. From what I could gather, the original demo had used MorphSVGPlugin.min.js which is a Javascript library that provided the animation. Apparently, the use of this library required a membership which prevented anyone from consuming this outside of codepen.io for demo purposes. While searching online, I accidentally stumbled across another similiar project by Balram Chavan who developed an alternative solution simply using Angular 5. With Balram's solution, I was able to make the necessary minor modifications (thanks to Jeeyun from the Clairty team on helping me with some of my Anuglar questions) to get this fully incorporated into the vSphere Client UI. I am sure there are other improvements that can be made to the customization such as a more "clarity" look/feel as the old the old "blue marge" theme background is pretty dated but I will leave that to someone more creative than me 🙂

Changing “Password will expire in X days” notification for Active Directory users in vSphere Web/H5 Client

11/17/2017 by William Lam Leave a Comment

When logging into the vCenter Server using either the vSphere Web (Flex) or H5 Client, one of the validation checks that is automatically performed by the server is to check the current users password expiry. If you account expiry is less than the current password expiry configuration, then you will see the yellow notification pop up at the top stating:

Password will expire in X days

This is definitely a helpful feature to have automatically built into the vSphere UI and the default expiry actually depends on the type of user logging into the system. This last part is sometimes confusing as folks mix up the default Single Sign-On User Expiry with the Active Directory user expiry which is completely different.

Single Sign-On Users

For SSO Domain (vsphere.local by default) users, the password expiry AND notification by default is 90 days. This can be configured in the vSphere Web Client under Administration->Single Sign-On->Configuration->Password Policy as shown in the screenshot below. For those wanting to automate this configuration, there is currently not an SSO Admin API, but there are some options, have a look at this blog post here.

Active Directory Users

If you are logging in as an Active Directory user, the password expiry notification by default is 30 days but the actual password expiry will obviously depend on your Active Directory system. If you want to change the expiry notification in case your expiry is not 30 days or you wish to notify sooner or later, this is actually controlled by the vSphere Web and H5 Client.

How to audit vSphere Standalone VMRC or HTML5 VMRC connections?

07/11/2016 by William Lam Leave a Comment

An interesting question that came in last week from one of our TAMs was how to identify and audit Virtual Machine Remote Console (VMRC) logins from vSphere? The TAM was specifically interested in being able to correlate that a particular user had logged into the VMRC of a VM during a specific period of time. Luckily, this is easily retrievable through vCenter Servers's Event sub-system that stores information about everything that happens in your vSphere environment. The Events can be accessed using either the vSphere Web Client shown below or programmatically using the vSphere API which the UI is built on top of.

You can obviously filter your search in the UI and focus on a particular VM, but often times there can be dozens if not hundreds of "Events" generated for a given VM. I personally prefer to leverage Automation when needing to look for a specific type of Event and more importantly, you can further process the results to either send out reports or hook into other third party systems. Now that we know, "where" to find our data, the next thing is identifying the type of Event that is generated for a VMRC connection.

As of vSphere 5.5 Update 2b, the VMRC in the vSphere Web Client can be accessed in one of two ways: The new HTML5 VMRC by clicking onto the VM screenshot thumbnail or the Standalone VMRC by clicking on the link directly beneath the VM screenshot.

Each VMRC connection method will generate a unique vCenter Server Event. For HTML5 VMRC connections, the Event is called VmAcquiredMksTicketEvent and for Standalone VMRC connections, the Event is called VmAcquiredTicketEvent. As I mentioned earlier, the vCenter Server Event sub-system can be accessed using the vSphere API and you can find the complete list of Events documented here. To demonstrate the use of this particular vSphere API, below is a PowerCLI example using the Get-VIEvent cmdlet. My fellow colleague Alan Renouf has actually blogged about working with Events using PowerCLI which I will be adapting one of his examples for our use case.

We first retrieve the VM that we are interested in by running the following command (specify the name of your VM):

$vm = Get-VM -Name "VCSA-60u2"

To retrieve HTML5 VMRC connections, run the following PowerCLI command:

Get-VIEvent -Entity $vm | Where { $_.Gettype().Name -eq "VmAcquiredMksTicketEvent"} | Select CreatedTime, UserName, FullFormattedMessage | ft -wrap -AutoSize

Here is an example of what the output would look like

To retrieve Standalone VMRC connections, run the following PowerCLI command:

Get-VIEvent -Entity $vm | Where { $_.Gettype().Name -eq "VmAcquiredTicketEvent"} | Select CreatedTime, UserName, UserAgent, FullFormattedMessage | ft -wrap -AutoSize

Here is an example of what the output would look like:

How to bootstrap the VCSA using the ESXi Embedded Host Client?

12/22/2015 by William Lam 5 Comments

In the past, I have written about various ways of "bootstrapping" vCenter Server (here and here) which can be useful for setting up greenfield vSphere deployments. This topic has always been of interest to me because it can be the most challenging to solve, especially when you only start out with a single ESXi host. Historically, these "bootstrapping" options have mostly been driven from a CLI standpoint which is not a bad thing when you think about it from an Automation standpoint and needing to replicate this a few dozen times. However, from a user experience point of view, it may not be as ideal, especially if this is an infrequent task. One of the other cool features of the ESXi Embedded Host Client (EHC) which recently had its v4 release is that it can be used to deploy Virtual Appliances stored in the OVF format.

OVF deployment had been around since v2 of EHC if I recall correctly, but it did not support all the different types of OVF capabilities such as Deployment Option as one example until most recently. One of the difficulties with OVF support on ESXi is not just supporting the ability to import/export but it is also supporting the full OVF specification which ESXi does not currently support today. This means, to provide full OVF support through EHC, it would have to implement a similar capability to what ovftool does today with the --injectOvfEnv option. Luckily, this was something that was added very early on based on my feedback which in my opinion is critical when it comes to greenfield deployments and one of the core use cases that I see for EHC.

Without further ado, below are the instructions on how to bootstrap the vCenter Server Appliance (VCSA) using the Embedded Host Client.

Step 1 - Download the VCSA OVA and then convert it to an OVF using either 7zip or ovftool. The reason you need to convert it to an OVF is that there is currently a known issue when trying to extract larger OVAs within the EHC. By doing this, you also speed up the time it takes to perform the upload and not have to wait for UI to extract it into the actual consumable format which is the OVF and VMDKs.

Step 2 - Click on the "Create/Register VM" option and then choose "Deploy a virtual machine from an OVF or OVA file" option. You will need to specify the name for your VCSA along with the OVF and the 3 VMDKs that is included if you are using vSphere 6.0/6.0 Update 1.

Step 3 - Next you will configure the VM Network and the disk provisioning option. You will also be asked to select the "Deployment Type" which is an option in vSphere 6.0/6.0 Update 1 that allows you to specify whether you are deploying an Embedded VCSA, External vCenter Server or External Platform Services Controller (PSC). You may notice the drop down includes duplicate entries and the reason for this is how the VCSA OVA was built which re-uses the same description in each of the labels but they actually have different meanings. Below is a quick table of the correct mappings to the current ordering parsed by EHC to the different VCSA Deployment Types:

Label	Actual Deployment Type
Tiny (up to 10 hosts 100 VMs)	Embedded VCSA Node
Small (up to 100 hosts 1K VMs)	Embedded VCSA Node
Medium (up to 400 hosts 4K VMs)	Embedded VCSA Node
Large (up to 1K hosts 10K VMs)	Embedded VCSA Node
Tiny (up to 10 hosts 100 VMs)	External vCenter Server Node
Small (up to 100 hosts 1K VMs)	External vCenter Server Node
Medium (up to 400 hosts 4K VMs)	External vCenter Server Node
Large (up to 1K hosts 10K VMs)	External vCenter Server Node

Step 4 - You will need to fill out the OVF properties which are required to properly configure the VCSA. The following 3 sections are the ONLY ones you need to modify for install:

Networking Configuration
SSO Configuration
System Configuration

Step 4a - The Networking Configuration section will require you to specify the following:

Host Network IP Address Family - ipv4 or ipv6
Host Network Mode - static or dhcp
Host Network IP Address - IP Address of the VCSA
Host Network Prefix - This is the CIDR notation of the network you plan to place the VCSA on. Example would be /24 (255.255.255.0) which you need to specify as just 24
Host Network Default Gateway - Gateway to use
Host Network DNS Servers - DNS Server to use
Host Network Identity (optional) - This is the FQDN of the VCSA. If you are in a DHCP enabled environment, you can leave this blank which it will automatically default to localhost.localdomain

Step 4b - The SSO Configuration section will require you to specify the following:

Directory Password - SSO Admin password
Directory Password confirm - SSO Admin password
Directory Domain Name - SSO Domain (select vsphere.local if you want the default which I would recommend)
Site Name - SSO Site Name
New Identity Domain - This is required if it is a new setup and you are not setting up SSO replication with an existing PSC

Step 4c - The System Configuration section will require you to specify the following:

Root Password - The root password for the OS
Root Password confirm - The root password for the OS
SSH Enabled (option) - If you wish for SSH to be enabled after deployment
Tools-based Time Sync Enabled - If you do not have an NTP server, you should select this option
NTP Servers (optional) - Specify a valid NTP server that you wish to use

Step 5 - You will have the ability to review your configurations before starting the deployment. You should double check to ensure that all OVF properties are correct, else you may get a failed deployment.

Step 6 - Once you are ready, go ahead and click the "Finish" button. This will start the OVF import which you can monitor using the Recent Tasks pane. As part of the OVF/OVA workflow, once the import has completed, it will automatically power on the VM for you. Please do NOT interrupt this process as EHC will be injecting the OVF properties you had specified earlier to the VM to ensure the VCSA will be properly configured.

Once the VM has been powered on, you can then click into the VM Console to view the status of the deployment and hopefully in a couple of minutes, you will have a fully configured and functional VCSA ready for use!

Although EHC today has implemented a pretty generic OVF/OVA interface in the UI to support almost any OVF/OVA, you can see how this could be further improved specifically for the VCSA deployments from a user experience perspective. Who knows, this might get even easier in the future 🙂

How to restrict access to both the Standalone VMRC & HTML5 VM Console?

12/08/2015 by William Lam 10 Comments

Several weeks back there were a couple of questions from our field asking about locking down access to a Virtual Machine's Console which includes both the new Standalone VMRC (Windows & Mac OS X) which runs on your desktop as well as the new HTML5 VM Console which runs in the browser. Below is a screenshot of the vSphere Web Client showing how to access the two different types of VM Consoles.

To prevent users from accessing either of the VM Consoles which also applies to the vSphere C# Client, you can leverage vSphere's extensive Role Based Access Control (RBAC) system. The specific privilege that governs whether a user can access the VM Console is under VirtualMachine->Interaction->Console interaction as seen in the screenshot below.

If a user is not granted the following privilege for a particular VM, when they click on either the Standalone VMRC link or the HTML5 VM Console, they will get permission denied and the screen will be blank. Pretty simple if you want to prevent users from accessing the VM Console or allowing only VM Console access when they login.

UPDATE (01/31/17): If you are using VMRC 8.1 or greater, you no longer need the additional permission assignment on the ESXi level if you ONLY want to provide VM Console access, just assign it to the VM. However, if you need to provide device management such as mounting an ISO on the client side, then you will still need to assign VMRC role (along with the required privileges for device management) at the ESXi host level.

UPDATE (12/15/15): If you want to restrict users from having ONLY VM Console access which may include the Standalone VMRC, you will need to ensure that the user has the role applied not only on the VMs you wish to restrict but also at the ESXi host level since Standalone VMRC still requires access to ESXi host. You do not need to grant read-only permissions for the user at the ESXi level, but you just need to assign the user "VMRC" only role at the ESXi level or higher to ensure they can connect to the VMRC.

Embedded Host Client Fling v3 released!

10/23/2015 by William Lam 8 Comments

I just wanted to give everyone a quick heads up that version 3 of the awesome Embedded Host Client Fling has just been released! In addition to all the new features and bug fixes which you can find more details below, there is now also an offline bundle for ESXi 5.x as well as ESXi 6.x which can then be used to distribute to your vSphere environment using vSphere Update Manager. One of my favorite features in this new release is the ability to edit or delete existing disk partitions which is super handy when repurposing existing disk devices for use with VSAN. You can find the download on the Embedded Host Client Fling page here.

If you have v1 or v2 installed, you can perform an "update" by simply running the following ESXCLI command:

[[email protected]:~] esxcli software vib update -v /esxui-signed.vib
Installation Result
Message: Operation finished successfully.
Reboot Required: false
VIBs Installed: VMware_bootbank_esx-ui_0.0.2-0.1.3172496
VIBs Removed: VMware_bootbank_esx-ui_0.0.2-0.1.3015331
VIBs Skipped:

What's new in v3 -

VM
- Answer question support
- Upgrade virtual hardware to the latest supported by the host
- Hot edit VM settings
- VM table column configuration (show/hide columns), remembered across browser refresh
- VM startup/shutdown priority (simple increase/decrease)
Host
- Change host power management policy, advanced power configuration
- Generate IP/FQDN certificate signing request and import new certificate
- Join a host to an active directory domain controller
Storage
- Disk device partition editor
- Adapter rescan for new LUNs
- Disk device rescan for new VMFS volumes
- Clear a disk's partition table
- Disk device partition diagram
- Increase datastore size onto disk that already contains a partition table
Performance charts
- Ability to change performance chart colors (two choices: default VMware colors and high contrast colors)
- Added Network and Disk charts to Host performance UI
- Improve VM performance UI, still missing some charts
- Improved performance UI on tablets
  - Always hide the top legend in the chart
  - Hide the focus widget to increase vertical space
General
- In-app update tool: provide a URL to a new version of the VIB, refresh the browser, et voila!
- For tabbed UIs, the selected tab is remembered as you navigate around the UI to avoid un-necessary clicks
- Better scrolling performance on tablets (tested on iPad)
- Hide-able navigator allowing more space on tablets
- Shortcut buttons to Host, Host Manage, Host Monitor, VMs, Storage, Networking when navigator is collapsed
- Improved Actions menu behavior on tablets:
  - Menu navigation no longer hides the actions menu
  - Added an explicit close button on actions menus
  - A second press on the Actions button will close the menu
Bugfixes
- VM table sizing with small number of VMs
- In-browser consoles:
  - Will now attempt to reconnect when losing a connection to a powered on VM
  - Reverting to a powered-on snapshot while a console is open to that VM will reconnect the console