A data center administrator running VMware products might organize the virtual resources in his or her enterprise into several different vSphere environments. The Cloud Manager Orchestration Server lets you discover and manage all of these enterprise VMs, discovering each relevant VM host, network, repository, and VM within the several vSphere environments and modeling them as objects in the Orchestration Console.
In the Explorer tree, select the vsphere provisioning adapter job to open the Admin view of this job.
Select the Job Configuration tab to open the Job Configuration page, then expand the Accounts table on this page.
On the Accounts table, select Add to open the Add a New Account dialog.
Fill in the fields of the dialog:
Account Name: This should match the name of the VCenter environment you are connecting to.
vSphere Webservice URL: Enter the URL of the vCenter Web Service server.
Credential Name: Enter the name of the credential from the Credential Manager that you want to use for logging in to the vCenter Web Service server.
Auto Portgroup Creation: (Optional) If selected and the vsphere_ignoreNetwork policy is used, port groups are automatically created on a host if it does not have access to the specified network.
Auto Portgroup Disconnect: (Optional) If selected, the vNIC on a VM is disconnected when it is shut down.
Auto Portgroup Deletion: (Optional) If selected, when the VM is shut down, it checks for port groups on the VM host that has no VMs associated with it and deletes them, if possible. This setting is best used with Auto Portgroup Creation and Auto Portgroup Disconnect.
Repeat Step 3 for every vCenter Server you want to connect to for VM discovery in that vSphere environment.
After you have created Orchestration accounts for each of the vCenter servers in your enterprise, you can continue with Configuring the vsphere.vcenters Fact to Include All Accounts Representing a vCenter Server.
The vsphere.vcenters fact can be set to include the definition for all the vCenter server accounts that you identified in Creating Accounts for Each vCenter Environment. This is required to ensure that only certain agents communicate with certain vSphere accounts. You can set this fact in the vsphere_client policy of the vsphere provisioning adapter or by using a policy to apply to the individual Orchestration Agents you installed in your respective vSphere environments.
After you have used one of these methods, continue with Optionally Specifying an Authentication Certificate for Each vCenter Server.
You can associate the vsphere.vcenters fact in the vsphere_client policy to the resources that access the respective vCenter Servers. When the vsphere provisioning adapter job starts, the policy applies the vsphere.vcenters fact to constrain the identified resources for the job to run the Web Service commands.
Use these steps to configure the vsphere.vcenters fact:
In the Explorer tree, expand the Policies group, then select the vsphere_client policy to open the Policy Editor page in the admin view.
In the Policy Editor, scroll to or search for the vsphere.vcenters fact, then uncomment it and enter a string value in the array, using the Account Name for each vCenter Server (identified in Creating Accounts for Each vCenter Environment) as a string value.
In the Explorer tree, expand the Resources group, select the client resource that is to access the vCenter Web Service server, then select the Policies tab in the admin view to open the Policies page.
On the Policies page, click Choose to open the Policy Selection dialog, then in the Source Policies list, select the vsphere_client policy, click Add, then click OK to associate this policy with this resource. For more information, see Resource Policies Page
in the Cloud Manager Administrator Reference.
If you want to connect multiple vCenter Servers, ensure that you modify the vsphere.vcenters fact of the vsphere_client policy as described in the policy comments.
You can use separate resources to connect to and manage the different vCenter environments that you have configured. To do this, create a custom policy for each vCenter that you want to manage and assign these policies to the resources that you designate to manage the respective vCenters.
The content of the policy should be similar to the following:
<policy>
<resource>
<fact name="vsphere.vcenters">
<array>
<string>VCENTER1_NAME</string>
</array>
</fact>
</resource>
</policy>
In this case, applying this policy along with the vsphere_client.policy to a resource would enable that resource to connect to and manage the vCenter with the name VCENTER1_NAME. This name must match the Account Name you configured in Creating Accounts for Each vCenter Environment.
The vsphere provisioning adapter job automatically enables a secure SSL connection between your Orchestration Agent and the vCenter Server. This involves some security risk if a malicious user is impersonating your vCenter Server. To avoid this risk, you can explicitly configure the SSL certificate that the Orchestration Agent accepts from the vCenter Server.
We recommend that you review VMware documentation regarding gathering the certificate used by your vCenter Server’s web interface before you proceed further.
When you have gathered the certificate, use the following steps to explicitly configure the certificate:
Ensure that the Orchestration Agent is installed and started on a computer in each vCenter environment.
For more information, see Section 5.0, Installing Cloud Manager Orchestration Components.
If you are installing the agent to a vSphere environment, you can install the agent either locally on the vCenter Server (the vCenter appliance is not supported), or on a dedicated system (virtual or physical) as long as the OS in that system is supported for the Orchestration Agent.
In the Cloud Manager Orchestration Console, log in to the Orchestration Server that you want to use to manage vSphere VMs.
In the Explorer tree of the Orchestration Console, select the Orchestration Server or “grid” object, then select the Authentication tab in the admin view to open the Authentication page.
Create a credential to authenticate to a unique vCenter Server in your enterprise. In most cases, the credential is for “administrator” account of the Windows machine where the vCenter Server is running.
On the Authentication page, scroll to the Credential Manager (consisting of the Stored Credentials panel and the Stored Certificates panel), then click Add Certificate to display the Add Certificate dialog.
Fill in the fields of the dialog:
Identifier: Specify a value in that uniquely identifies the certificate associated with this unique vCenter Server. the identifier should be of the form vsphere_<YOUR_VCENTER_NAME>, where <YOUR_VCENTER_NAME> is the account name that you configured earlier for the vCenter Server.
Location: Specify the file location of the certificate you gathered previously.
Group: Enter vsphere as the group name.
For more information, see Authentication Page
in the Cloud Manager Administrator Reference.
Click Add.
Repeat Step 4 for all of the vCenter Servers you want to connect to.
After you have completed the authentication configuration, continue with Running Discovery for Multiple Resource Environments.