11.2 Managing the vSphere Provisioning Adapter

After you set up the vSphere Provisioning Adapter, you can modify the configuration to manage VMs in your environment.

11.2.1 VM Management Policies for the vSphere Provisioning Adapter

The following table provides detailed information about policies associated with the vSphere provisioning adapter that are used to manage the vSphere hosts and the VMs in the grid. The policy settings are applied to all the VMware VMs in the grid.

Table 11-1 Virtual Machine Management Policies for vSphere

Policy Name	Description	Additional Details
vsphere	Contains the constraints used to select the vCenter Server resources.	Do not modify this policy.
vsphere_assignPool	If you need to assign the VMs to a certain cluster (for example, a cluster root pool), or if you want to assign VMs to pools “owned” by your customers, use this policy.	When applied this policy allows the VM to reside only on VM hosts that have access to the assigned resource pool (resource.vm.pool).
vsphere_client	Contains the settings used to run the vsphere job on the associated vSphere resource.	You need to associate the vsphere_client policy to a vSphere resource before the discovery works. For more information, see Step 9.
vsphere_ignoreNetwork	Includes special facts that allow VMs to consider a VM host despite a missing required Network.	If ignoreNetworkCheck is set, a vBridge (portgroup) can be dynamically created on a VM power-on event. This works in conjunction with the auto_portgroups_creation fact found in the vpshere.policy. Ensure that you set the auto_portgroups_creation fact to true or else the portgroup will not be created during the VM power-on event.
vspherePA	Includes the basic constraints for the vsphere provisioning adapter.	Do not modify this policy.
vSphereUpdate	Includes settings for the vsphereUpdateDaemon job. The policy can be modified directly or the user can edit job arguments in the schedule that is created by default installation of the Cloud Manager Orchestration Server.	For more information, see Configuring the vSphereUpdate Client.
vsphereVmHostVnc	Includes port settings to identify a range of ports to be used for remote connections on a specified VM host.	When applied, this policy defines a range of port numbers to be used for remote connections. As VMs are provisioned, they are assigned a port number within the configured range for remote access. This applies only when the VNC mode is automatic (the default) as defined in the vsphereVnc policy.
vsphereVnc	Includes a setting to allow remote desktop connections to vSphere VMs.	For more information, see Setting Up Orchestration VNC for a VM Managed by vSphere.

11.2.2 Synchronizing vSphere vCenter System Changes to the Orchestration Server

The vSphereUpdate tool connects to the vSphere vCenter system to get the changes made outside of Cloud Manager, and synchronize them to the appropriate objects in Cloud Manager. After you congure the provisioning adapter and discover the vSphere Server environments, set up vSphereUpdate jobs for them. See Section 12.0, Configuring vSphereUpdate Client and Monitoring Jobs.

11.2.3 Assigning a vSphere VM to a Resource Pool

All VMs managed by vSphere are assigned to either the default (named “Resources”) or a named resource pool. When vSphere VM images are discovered by the Orchestration Agent, the resource.vm.pool fact for each VM is set with what is known by vSphere as a “pool assignment.”

If you do not need to restrict VMs based on resource pool assignment, then no policy configuration is necessary and you can provision the VMs as usual, but if you need to assign the VMs to a certain cluster (for example, the cluster root pool), or if you want to assign VMs to pools “owned” by your customers, you can configure the vsphere_assignPool policy to accomplish this.

To ensure that the Orchestration Server always provisions a VM to the resource pool where that VM resides:

Assign the vsphere_assignPool policy to the VM or a group of VMs. No changes to the actual policy file are necessary.

During provisioning of the VM, the Orchestration Server verifies and relocates the VM (as necessary) to maintain the validity of the pool assignment.
(Conditional) If the VM does not reside in the correct resource pool, look up the ID of the resource pool in vCenter and modify the resource.vm.pool fact to reflect the correct pool assignment. The Orchestration Server relocates the VM to the specified resource pool at the next provision.

Alternatively, use vSphere to move the resource to the proper pool and re-run the VM discovery process.

NOTE:Because Cloud Manager deploys workloads managed by the VMware ESX hypervisor only into resource pools that have been configured on an associated cluster, the Cloud Manager administrator must assign these VMware resource pools to Cloud Manager resource groups. For more information, see Creating Resource Groups in the Cloud Manager Procedures Guide.

11.2.4 Setting Up Orchestration VNC for a VM Managed by vSphere

When you right-click a VM resource, you have the option of launching a remote virtual network computing (VNC) session console of that VM’s desktop. This section provides information about setting up the Orchestration Server to accommodate a VNC session for a VM.

ESX 4.x servers managed by vSphere might have a firewall in place to protect some ports from being open or closed. The vsphere provisioning adapter opens the appropriate ports to accommodate VNC connections from a remote console. These ports are opened when the Orchestration Server discovers the servers. This is not true for ESX 5.x servers managed by vSphere, where the ports require manual opening.

NOTE:With the vSphere 5 release, VMware removed VNC Server as a service than can be directly administered by using the VMware Client or the VMware Client libraries and APIs. Although the VNC functionality still works on ESXi servers, the firewall must be opened to allow access.

For information about enabling VNC access for ESXi 5 servers, see Enabling VNC Access to vSphere 5 VM Guest Consoles in the Cloud Manager Administrator Reference.

Although you can change these settings at any time, they take effect for a vSphere VM after a non-running VM is provisioned, or after you perform an Apply Config action on a running VM.

To set up VNC session connectivity for the VM managed by the vsphere provisioning adapter job:

In the Explorer tree of the Orchestration Console, select the Grid Server object where you are logged in, then select the Authentication tab to open the server’s authentication page.
In the Stored Credentials panel (also known as the “Credential Manager”) of the Authentication page, click Add Credential to open the Add Credential dialog.
In the Add Credential dialog, specify a credential that includes the VNC password you want to use, then click Add. List the credential type as vnc.

Although a user is required when you create the credential, this value is not used in the remote session. Only the secret field is used when making the connection.
Configure the vsphereVNC policy.
1. In the Explorer tree, expand the Policies folder to display the list of policies, then select vsphereVNC policy to open the Policy Editor.
2. In the Policy Editor, modify the vnc.credential fact value to be the name of the credential you created in Step 3, then click the Save icon.
  
  Modifying this policy is not necessary unless you want to assign the same credential to every vSphere VM or groups of vSphere VMs. Otherwise, you can select the credential on a per-VM basis from the VNC Credential drop-down list on the Resource Information panel of the VM’s Info/Groups page.
(Conditional) Configure the vsphereVmHostVnc policy for a VM host.

Modifying this policy is not necessary unless the resource.vnc.mode fact of the vsphereVNC policy is set to automatic. When the ports defined in this range have been consumed, further vSphere VM provisioning fails.

The default port range in the policy is 1000-9999. If you want to provide remote capabilities to more VMs on a host or cluster, you need to alter the policy configuration to add more ports to the range. You can also reconfigure the policy to use a different range of ports.
1. In the Explorer tree, expand the Policies folder to display the list of policies, then select vsphereVmHostVnc policy to open the Policy Editor.
2. In the Policy Editor, modify the vpshere.port.min fact value as the lower end of the range of ports you want to be used as remote connections for this VM host.
3. In the Policy Editor, modify the vpshere.port.max fact value as the upper end of the range of ports you want to be used as remote connections for this VM host, then click the Save icon.
Associate the vsphereVNC policy to a VM Resource Group or VM.
1. In the Explorer tree, select the VM Resource Group (or an individual VM) managed by the vsphere provisioning adapter, then in the admin view, select the Policies tab to open the Policies page for this group.
2. On the Policies page, select Choose to open the Policy Selection dialog.
3. In the Source Policies list of the Policy Selection dialog, select the vsphereVnc policy, click Add to move it to the associated Policies list, then Click OK.
Associate the vsphereVmHostVnc policy to a VM host.
1. In the Explorer tree, select the VM host managed by the vsphere provisioning adapter, then in the admin view, select the Policies tab to open the Policies page for this group.
2. On the Policies page, select Choose to open the Policy Selection dialog.
3. In the Source Policies list of the Policy Selection dialog, select the vsphereVMHostVnc policy, click Add to move it to the associated Policies list, then Click OK.
On the Orchestration Console Menu Bar, click Provision > Discover VM Hosts and Repositories.

In vSphere 4.x environments, this action opens or closes the firewall on the VM hosts to allow VNC access. This access is based on the vsphere.openVncFirewallPort fact in the vsphere policy.

For ESX 5.x servers managed by vSphere, the ports require manual opening. See Enabling VNC Access to vSphere 5 VM Guest Consoles in the Cloud Manager Administrator Reference.
(Conditional: For VMs that are running) From the Explorer tree, right-click a vSphere-managed VM, then select Apply Config.

If the VM for which you want to open a VNC session is not running, simply reprovision the VM.
If the vSphereUpdate Client is running for your vCenter server, refresh the Orchestration Console.

or

If the vSphereUpdate Client is not running for your vCenter server, right-click the VM object and select Resync State.

If you don’t want to resync before using the VNC console, ensure that you configure the vSphereUpdate Client beforehand. See Configuring the vSphereUpdate Client.
Right-click the VM object and select Launch Remote Desktop to open the login dialog for the VNC session.
In the login dialog, enter the VNC password that you created in the Credential Manager in Step 3.

The following table lists the VNC-related facts in the vsphere provisioning adapter and provides a description of each of those facts.

Table 11-2 vSphere VNC Facts

Fact Name	Description
resource.vnc.ip	The IP address of the VM host where the VM is running
resource.vnc.port	The port currently assigned to the VM. The value is -1 if VNC is disabled for the VM.
resource.vnc.credential	The credential containing the VNC password. This is the name of the credential itself, not the user name or the password contained in the credential.
resource.vnc.mode	Determines how VNC port assignments are handled. This value must be automatic, manual, or off. If mode = automatic: the Orchestration Server attempts to select the next available VNC port. If mode = manual: The port value specified in the VM’s resource.vnc.port fact is used. If mode = off: The VNC console is disabled.
resource.remotedesktop	Controls enabling or disabling the Launch Remote Desktop action in the Orchestration Console.