Data Center on Cloud: Understaing vCAC User Role by creating a end-to-end VM provisioning workflow

Welcome: To stay updated with all my Blog posts follow me on Twitter @arunpande !

If you have been following my blogs and tweets, you will find that I am exploring automation options for NetApp Storage & VMware Infrastructure. I have discussed the following topics in my previous blogs which act as a building block for this automation solution.

Monitoring NetApp Clustered Data ONTAP using Unified Manager 6.0

NetApp Workflow Automation for VMware - Setup & Configuration

Integrate vCO with NetApp WFA & vCAC - Part 1

I haven’t included the steps required to install and configure vCAC since there are many documents/blogs already available. Assuming that you have already installed vCAC you should now be ready to explore the different features and solutions provided by vCAC.

Let’s understand the different user roles and responsibilities

available in vCAC. Here are the different types

of users available in vCAC:

System Administrator
Windows user account to create Identity Source
Tenant Administrator
Infrastructure Administrator
Fabric Administrator
Business Group Manager

Support Role
User Role

Service Architects

To explain the above roles and an end-to-end provisioning workflow in I have created a hypothetical company Newbie-Cloud (a.k.a. NB-CLOUD in the rest of the blog) that is trying to implement private cloud solution using vCloud Automation Center.

Assuming that NB-CLOUD has completed vCAC setup (IDA, vCAC, IAAS, vCO) and is now ready to login here is the sequence of events using the various user accounts available.

Initial Login as System Administrator

The initial login is done using the default SSO user account administrator@vsphere.local and its password that was set while configuring vCAC appliance.

Create Identity Source & Tenant

Once you have logged into vCAC a default tenant “vsphere.local” is already created. You may continue to use the default tenant to configure vCAC further or create a new one. For this example, I have created a new tenant “Oracle”. The “create new tenant” wizard also prompts you to create an identity source, where you can use an active directory for authentication. You can create Identity Source using the following options:

Open LDAP
Native Active Directory

Active Directory – You need a Windows User account (Login user DN) here.

Select Tenant Administrator

In the same “create new tenant” wizard, after creating an Identity Source, you can specify a user or group as Tenant & Infrastructure Administrator. These users would be able to perform the respective tasks assigned to a Tennant & Infrastructure administrator. In this example I have created the following user accounts.

Infrastructure Administrator Tasks (Create Credentials, Endpoints, Fabric Groups)

The infrastructure administrator now logs into the vCAC portal and has to perform the following tasks:

Create Credentials

Create credentials for vCenter Administrator user account i.e. administrator@domain.com & vCenter Orchestrator and other end points that you are going to use. Here is an example of vCenter Server credentials that I have created. Navigate to Infrastructure > Credentials > New Credentials

Create Endpoints

Create an endpoint and use the credential created in the above step for each endpoint. In this example I am creating a vCenter Server endpoint. IMPORTANT: The name “vCenter” should match what you have used while installing IaaS.

Create a Fabric group

The vSphere resources (Cluster, ESXi hosts etc.) discovered using the above vCenter Server endpoint can be grouped using Fabric Groups. For example, if you have two clusters in your ESXi host, you may want to assign Cluster1 to one fabric group and the second cluster to another fabric group.

In this case I have created a fabric group oracle_vc55 and assigned one of the clusters in the vCenter to this group. Note that I have assigned a different user account oracle_fabric@nb-cloud.com as the Fabric administrator.

Fabric Administrator Tasks (Create Machine Prefix, Network Profiles)

AFAIK, since the resources managed by fabric administrator can be shared between tenants, it would make sense to give administrative access to a user who is not a part of a specific tenant.

IMPORTANT: It’s the infrastructure administrator that defines who the fabric administrator would be.

The fabric administrator has to create a machine prefix and network profile. This information would be used by the Tenant Administrator while creating Business Group

Create Machine Prefix:

Machine Prefix: Enter the string value that should be prefixed for VM names deployed.
Number of Digits: Maximum number of digits included in the name. I chose 3 so the maximum number would be 999.
Next Number: This is the start number.

Create Network Profile:

Navigate to Infrastructure > Reservations > Network Profiles > New Network Profile

Create a new IP range – This IP range can be used along with the network profile.

Tenant Administrator - Create Business Group

On creating Business Group you can allocate resources (in this case VMs/Blueprints, Catalog items) to a set of specific users. For example, you can give access to certain VM images only to specific users. In this example, I have created an oracle_windows business group where I will share master images for Oracle on Windows VM to specific users who would need access only to this VM.

Here I am creating a Business Group named “Oracle” where I will use the VM prefix created earlier. “oracle_bsgrp” will be the business group manager and “oracle_win” would be one of the users for this business groups. Its “oracle_win” who would be have access to specific to catalogs that are published only to this group.

Fabric Administrator - Create Reservations

We created a fabric administrator earlier to create VM prefix and Network profiles. This fabric administrator was also assigned while creating a Fabric Group. The fabric administrator now has to create a Reservation to assign the resources of a Fabric Group to a specific Business Group. While creating the reservation, you map the resources in a tenant with specific business group.

In this example, nb-cloud-lab is a Cluster in vCenter server. I am assigning this resource to “Oracle” tenant and business group.

In the next tab, you can define which specific vCenter resource i.e. memory, datastores, resource pools can be used by the business groups.

You can also select the desired network profile for this business group

Tenant Administrator/Business Manager - Create & Publish Blueprint, Create Service.

Create Blueprint

Blueprint has a virtual machine (VM template or vApp) specification and it determines how this VM template would be provisioned. When you create a blueprint you have to specify the name and virtual machine prefix. While selecting the build information all the different templates would be displayed. Select the blueprint type (server), action (clone, linked clone, netapp flex clone). I have created blueprint oracle_win2k8 by loggin in oracle_tenant. NOTE: Shared blueprint can be edited only by tenant administrator.

Provide a descriptive name for this blueprint. If you chose “Shared blueprint” then only the tenant administrator can edit this blueprint.

Select one of the actions from the available list, for this example I chose “Clone” to create clones from template. The template has to select from the “Clone from” option, here you can browse existing templates in the inventory.

You may restrict specific actions for this blueprint

Publish Blueprint

IMPORTANT: The blueprint must be published so that it can be used in the catalog.

To publish the blueprint you can continue to login as tenant administrator or business group manager and navigate to Infrastructure > Blueprints > Blueprints > Select the blueprint and click Publish.

Create Service

A service is an offering that is provided to the end user, in this example I have created a service/offering to clone oracle on windows VMs. To create a service login as tenant administrator, business group manager, service architect and navigate to Administration > Catalog Management > Services > Add Service

Here you can provide the name, description, status, hours when this service would be active, users/groups for owner and support team.

Once the service has been created, you can add one or more blueprints to this service. For this example, I will add only the oracle_win2k8 blueprint that I created earlier. Continue to use the same session as tenant administrator, business manager or service architect and navigate to the service that you created in the above step. Click on the drop down under Actions and select Manage Catalog Items.

Here you can chose multiple blueprints that you want to share in the offerings. If you have a use case where you want to provide multi-tiered applications you may chose multiple blueprints in this step. For this example, I have will provide a single blueprint in the offerings. Click on + to select from the available blueprints and click on add.

Tenant Administrator/Business Group Mgr/Service Architect - Create Catalog Items

As tenant administrator, business group manager or service architect you can add different services in catalogs. Catalog items are blueprints that are created earlier. Here you can add multiple services in a catalog.

NOTE: If you have a shared blueprint then the business group manager cannot add the services of that blueprint to the catalog.

Continue to use the same session as tenant administrator i.e. used to create services and navigate to Administration > Catalog Management > Catalog Items

Here you will see all the available blueprints. Click Configure under Actions to configure this catalog item

Make sure that the state is set to Active and select the service/offering that you want this blueprint to be associated with. You may also upload an image for this catalog item to make it more presentable.

Tenant Administrator/Business Group Mgr - Create Entitlements

Continue to login as tenant administrator and create a group which would have access to the one or more services that you created earlier. Where entitled services = service, entitled catalog items = blueprints. I have created oracle_win_grp entitlement. Entitlement is assigned to a specific business group.

Navigate to Administration > Catalog Management > Entitlements > Click on + to add entitlements.

While creating an Entitlement, you have to select the a Business Group and note that ONLY the users and group that are part of this business group can be selected in the Users & Groups section. The users mentioned in the Users & Groups section would have access to the catalog items and services.

Click Next to go to Items & Approvals tab

Add the service that the above user should have access to

Similarly, select the catalog items

Select the Actions that the user should be entitled to

Business Group Users/Manager – Request Catalog

Now let’s login as the oracle_win to see if this user has access to the catalog items. The user can now request this catalog item by click on Request.