PowerCLI – Page 51

VMware PowerCLI for Mac OS X, Linux & More? Yes, please!

09.06.2016 by William Lam // 10 Comments

There were a several announcements at last weeks VMworld US Conference, but one of the most exciting piece of news in my opinion was from Alan Renouf, Product Manager for all things API/SDK/CLI at VMware. During Alan's What's New PowerCLI session, he announced that PowerCLI is finally coming to both Mac OS X as well as Linux! As you can imagine, the news was very well received from customers and partners. In fact, after I had tweeted the update here & here, I literally had folks pinging/IM'ing/DM'ing me non-stop about when they could get access 🙂

UPDATE (10/18/16) - PowerCLI Multi-Platform (MP) for Linux and Mac OS X has now been released as a VMware Fling. Please find the download here and provide any feedback in the comments section.

This exciting update was only possible with the help of our friends over at Microsoft who had recently open sourced both .NET Core & PowerShell. Once that news broke, Alan and the PowerCLI Engineering team have been working hard on porting over the existing PowerCLI code which uses the Windows .NET library over to the new .NET Core which is now open sourced. I have been very impressed at how fast the PowerCLI team have already made available many of the default cmdlets as well as the Get View cmdlet which exposes the entire functionality of the vSphere API.

Now, before you get too excited, this new version of PowerCLI is currently not available yet. As Alan mentioned in his session, we plan to release an early Tech Preview of PowerCLI for both Mac OS X and Linux as a VMware Fling shortly after VMworld. It is also very important to note that Microsoft PowerShell for Mac OS X & Linux which PowerCLI uses is just at an Alpha release milestone. There is still much work to do on both sides but I am really looking forward to enabling our customers with the choice of platform when it comes to consuming PowerCLI.

A few of us have been quite fortunate to have been involved in the early development of this new version of PowerCLI. In fact, we even built a simple Docker Container for PowerCLI which will allow you to easily access PowerCLI from any system that can run Docker. Here is a quick screenshot of spinning up a PowerCLI Docker Container which will also be part of the Fling release.

Lastly, we want customers to be able to quickly and securely set up a persistent PowerCLI environment in which they can use to manage and configure their VMware-based products that support PowerCLI. With that, we have also built a PowerShell package for Photon OS which is VMware's minimal Linux container host distribution. Not only is it free to download and use, but it literally takes a few seconds to install (tdnf -y install powershell) and even less time to boot up and import the PowerCLI module. This was literally done the week before VMworld by the Photon team and huge kudos for their support! As you can see, not only do we want to provide choice for our customers but also simplifying how you might consume PowerCLI whether its natively on Windows, Mac OS X, Linux, Docker Container or running on top of VMware Photon OS. I hope you are excited as I am and stay tuned for more details on the Fling release!

If you have any feedback or what you are most excited regarding this news, please leave a comment and I will make sure it makes it way back to our Product Manager.

Quick Tip - How to retrieve the ESXi Update Level using the vSphere API?

08.17.2016 by William Lam // Leave a Comment

Using the vSphere API, it is very easy to extract the version and build of all your ESXi hosts. This information is exposed in the Product property of an ESXi host. For example, Product.Version will return something like 6.0.0 and Product.Build will return something like 3029758. However, one thing that is not available in this property is the Update Level information for an ESXi host such as Update 1 or Update 2.

Historically, customers would have to rely on ESXCLI to pull the Update level information using the following command: esxcli system version get and though this can be run remotely or integrated into PowerCLI as shown in the example below, it would be ideal if this information was just available using the vSphere API.

	$esxcli = Get-EsxCli

	### To retrieve Major/Update version number of ESXi via ESXCLI

	PS C:\Users\lamw\Desktop> $esxcli.system.version.get().version + " Update" + $esxcli.system.version.get().update
	6.0.0 Update1

	### To retrieve all version information from ESXi via ESXCLI

	PS C:\Users\lamw\Desktop> $esxcli.system.version.get()

	Build : Releasebuild-3029758
	Patch : 17
	Product : VMware ESXi
	Update : 1
	Version : 6.0.0

view raw

gistfile1.txt

hosted with ❤ by GitHub

This exact same question was brought up internally again today and Etienne Le Sueur actually shared an awesome tidbit on how to retrieve this information using the vSphere API. You can find the ESXi Update Level information in an ESXi Advanced Setting called Misc.HostAgentUpdateLevel

Below is a quick PowerCLI example which exercises this vSphere API to retrieve the Version, Build and Update Level information:

$vmhost = Get-VMHost -Name nuc.primp-industries.com

$esxi_version = $vmhost.ExtensionData.Config.Product.Version
$esxi_build = $vmhost.ExtensionData.Config.Product.Build
$esxi_update_level = (Get-AdvancedSetting -Entity $vmhost -Name Misc.HostAgentUpdateLevel).value

Write-Host "$vmhost" 
Write-Host "`tVersion: $esxi_version"
Write-Host "`tUpdate: $esxi_update_level"
Write-Host "`tBuild: $esxi_build"

Here is a screenshot of the output for my ESXi host which is running latest vSphere 6.0 Update 2 (including the recent patch release).

Its great to hear that the ESXi Update Level information is available through the vSphere API, although I would have liked to have seen it exposed within the Product property. Perhaps its time to file an internal Feature Request? 🙂

How to easily disable vMotion & Cross vCenter vMotion for a particular Virtual Machine?

07.20.2016 by William Lam // 6 Comments

The question of disabling vMotion for a specific set of Virtual Machine(s) is not a new one. In fact, this topic comes up on some what of a frequent basis and usually driven by arcane change management processes or worse licensing restrictions. Do not get me wrong, there are definitely some valid use cases where you would not want a particular VM to be migrated off. The classic example is a 3rd Party VM solution that provides Anti-Malware, Intrusion Detection & Firewall capabilities for your workload VMs. For this particular use case, VMware provides our partners with an integration hook into the vSphere platform called ESX Agent Manager (EAM) that ensures these "Service VMs" are not allowed to be powered off or migrated to another ESXi host, even in the case of a Maintenance Mode operation. This solutuion even allows you to configure custom icons for your Service VMs!

For all other use cases outside of the "Service VMs", there really is not an easy way of disabling vMotion for a particular VM. There have been many solutions that have been suggested in the past ranging from disabling DRS for a specific VM, DRS Affinity Rules, VM miss-configurations to break vMotion compatibility to using vSphere Permissions to prevent vMotion operations. However, many of these solutions do not work very well or is very difficult to manage at scale. I actually like the idea of using vSphere Permissions to prevent a vMotion, however, I have seen some customers push back on this because the vSphere Administrator still has the ability to perform this operation. For these cases, customers just want to be able to completely disable vMotion for a given VM and prevent anyone from migrating the VM, including the vSphere Administrators.

Given that this topic had recently come up again, I was wondering if there was an easier way in which this could be achieved and made more manageable for our customers. After thinking about about how EAM handles "disabling" certain operations for a VM and recalling an article I wrote last year which leveraged this exact capability to resolve an NSX Controller issue, I thought why not apply it to this use case here?

UPDATE (09/27/18) - As of vSphere 6.5, the MigrateVM_Task() method has been deprecated in favor of the RelocateVM_Task() which is used to handle BOTH vMotion, Storage vMotion and other variants. This means that as of 6.5, you no longer have the ability to disable a specific migration type and when you apply the settings, both migration types will be disabled for the specific VM.

Disclaimer: The use of internal APIs are not officially supported by VMware and can change at any time. Please use at your own risk.

Each VM has a property called DisableMethod which lists the specific vSphere API methods that are currently disabled. These are not governed by vSphere Permissions but rather the runtime state of the VM. For example, if you have a VM that is currently powered on, then the PowerOnVM_Task API would not be available and would show up in the disabled list.

Here is a quick PowerCLI snippet on how to retrieve the current set of disable methods for a VM:

$vm = Get-Vm -Name TestVM-1
$vm.ExtensionData.DisabledMethod

As mentioned in this article, the ability to enable and disable these methods are only available as an internal vCenter Server API. However, it is possible to access these APIs using the vSphere MOB, but it is not very user friendly nor intuitive. Below is a screenshot of invoking the disableMethods API using the vSphere MOB.

A couple of weeks back I started to investigate on how we might be able to automate against the vSphere MOB. The result of that investigation lead to the creation of a simple PowerCLI script that allows you to automate operations using the vSphere MOB which I had published here. That work became the foundation for the new PowerCLI script that I had created for disabling and enabling the vMotion capability for a particular VM.

You can download the PowerCLI script here called enable-disable-vsphere-api-method.ps1 which includes two functions Enable-vSphereMethod and Disable-vSphereMethod. You will need to edit the script to provide a couple of pieces of information.

Credentials to your vCenter Server
Name of the VM you wish to either disable or enable vMotion capability on
Name of the vSphere API method you wish to disable (by default this is MigrateVM_Task which maps to the vMotion capability)

By default, I have commented out both functions usage, you will need to manually uncomment one of the lines based on the operation you wish to perform.

To Disable the vMotion capability, run the following:

Disable-vSphereMethod -vc_server $vc_server -vc_username $vc_username -vc_password $vc_password -vmmoref $vm_moref -disable_method $method_name

To Enable the vMotion capability if you had disabled it, run the following:

Enable-vSphereMethod -vc_server $vc_server -vc_username $vc_username -vc_password $vc_password -vmmoref $vm_moref -enable_method $method_name

After the script has completed, you can now re-run the command that we ran earlier to see which methods have been disabled and you should see that the MigrateVM_Task is now part of the disable methods.

If we now login to either the vSphere Web/C# Client and right click on the VM that we had disabled vMotion on, you should also see that the Migrate option is now grayed out and unavailable. This behavior will be true for ALL users including those in the vSphere Administrators group.

It is important to note that vMotion is not only disabled from the UI, but it is also disabled from the vSphere API standpoint which the UI is built on top of. Here is an example of trying to perform a vMotion using the PowerCLI Move-VM cmdlet and you can see that an error is thrown immediately stating that the method has been disabled.

Note: The "self" text output from the PowerCLI command is actually something that you can specify as part of disabling the vMotion capability. This might be useful to specify a change control ID or some string to signal to the user who might be trying to perform the operation. Please refer to the script and search for the "self" keyword if you wish to change it.

The really nice thing about this solution is not only is it really easy to enable or disable, but it can also be managed at scale which many of the other solutions mentioned earlier start to break down. The last thing anyone would want is additional operational overhead to manage manage complex DRS rules (which can still be overridden through manual migrations) or additional vSphere Permissions which also runs into the same problem where a vSphere Administrator can still override by performing a manual migration. This solution does prevent both standard vMotion as well as the new Cross vCenter vMotion capability (both between same/different SSO Domain) that was introduced in vSphere 6.0. You do not need to be running vSphere 6.0 to be able to leverage this solution, this should actually work for almost all versions of vSphere. Lastly, enabling or disabling the functionality does not require any type of system restart or impact to your VM other than the ability to vMotion.

Limitations

Beyond artificially limiting what vSphere DRS and HA can do, I did observe an interesting behavior when a Maintenance Mode operation is performed. If you leave the "Move powered-off and suspended virtual machines to other hosts in the cluster" uncheck, then all VMs will be migrated off and the VMs that have vMotion disabled will reside on the ESXi host while it goes into Maintenance Mode. However, if you do check the box, I did find that the system would override setting and actually move the VM to another ESXi host. This is something to be aware of and may not be a bad thing depending on your requirements.

Disabling Storage vMotion

You may have noticed that if the VM is in a powered off state, that the Migrate option is still available in the UI. The reason for this is that we only disabled vMotion but you are still allowed to perform a Storage vMotion. If you wish to also disable the Storage vMotion capability, then you will need to disable RelocateVM_Task vSphere API method as well.

Auditing vMotion and Storage vMotion Operations

With or without this solution, you may still want another level of confidence that a VM has either not migrated or migrated to authorized set of ESXi hosts. We can easily do so by auditing the VM's Event system and looking for migration events. The name of the vMotion event is called VmMigratedEvent and the name of the Storage vMotion event is called VmRelocatedEvent. Here is a sample script using the vSphere SDK for Perl that exercises this specific vSphere API and provides you with all the ESXi hosts a given VM might have migrated to. For those that rather consume the vSphere API using something like PowerCLI, here is a quick one-liner to extract vMotion events:

$vm = Get-VM TestVM-2
Get-VIEvent -Entity $vm | Where { $_.Gettype().Name -eq "VmMigratedEvent"} | Select CreatedTime, UserName, FullFormattedMessage | ft -wrap -AutoSize