WilliamLam.com

Listing all VMware Horizon Events

by // Leave a Comment

One very useful feature in the latest VMware Horizon (2106) release is the introduction of a new Audit Events API, that will finally allow users to retrieve all Horizon events in a programmatic manner. Previously, the only method of extracting the Horizon events was to unfortunately query the SQL Server database directly.

Since VMware Horizon is not a solution I normally work with, I was actually curious on how many events are produced by Horizon? Back in 2019, I shared how to retrieve and list all vCenter Server Events and ended up publishing a Github repo that folks can quickly view and search for a specific event, which is especially useful if you are using the VMware Event Broker Appliance (VEBA) solution.

After speaking with Chris Halstead, one of the most knowledgable person on VMware Horizon that I know, a list of all known Horizon events has never been published.

[Read more...]

Quick Tip - Preserving FQDN hostname on Photon OS

by // 1 Comment

Over the weekend, I was troubleshooting an issue that was reported by one of our VMware Event Broker Appliance (VEBA) users who was helping with testing one of our upcoming features. The user found that after rebooting the VEBA appliance, the Antrea interfaces were no longer being re-created and pod networking seems to have been broken.

We initially thought it was related to switching to the latest Photon OS version or updating to the latest Antrea CNI release, since everything else was pretty much the same. Even after reverting both versions back to what we initially had, the reboot issue continued to persist. What was even more strange was that the current shipping version of the VEBA (v0.6.1) OVA was not experiencing this issue and had no problems with an OS reboot, which is something I have done many times.

The only logical conclusion that I could come up with to explain this problem is that a behavior change must have occurred within Photon OS from the time we built the previous appliance to what we are seeing now. While troubleshooting Antrea, it was pointed out that Kubernetes (K8s) node is probably unhealth and if so, I may want to look at the kubelet logs to see if it provided any hints. I initially did not both looking at the K8s layer, thinking this was related to change in Antrea since it handled pod networking. Looking at the kubelet logs, I found a ton of entries with the following:

396 kubelet.go:2243] node "veba" not found

I thought this was a bit strange, especially as our appliance has its hostname configurred with a Fully Qualified Domain Name (FQDN) which is veba.primp-industries.local and we had proper entries in both /etc/hostname and /etc/hosts.

Sure enough, when I ran hostname, they all returned the short hostname instead of the FQDN (which it returned properly prior to the reboot)

[Read more...]

How to restrict vSphere UI access while maintaining vSphere API functionality?

by // 2 Comments

Although I come across a fair amount of interesting and challenging questions posed by our customers, I have to say this is certainly one of the more stranger question that continues to surface every so often. The question itself is fairly straight forward, but what I find strange is the reasoning and justifications for needing such a solution.

In case the title was not a give away, the question is having the ability to restrict a set of user(s) from the vSphere UI while still allowing access to the vSphere API for these same user(s). To be clear, the behavior of vSphere is that if you have vSphere UI access, then you also have vSphere API access which is all based on the permissions a user or group has been granted. There is no way to distinguish or limit access between these interfaces including any vSphere SDK or PowerCLI usage which also relies on vSphere API access.

There may be valid use cases for needing such a capability, however from my experience in talking with our customers and field, it feels like this is an attempt to solve organizational and/or process issues. Let give you a few examples that I have come across over the years:

  • I need to prevent [team|individual] from using the vSphere UI, because they are not using the internal provisioning tools we have built
  • I need to prevent [team|individual] from using the vSphere UI, because they need to learn how to automate using the vSphere API
  • I need to prevent [individual] in [team] from using the vSphere UI, because they are making changes to VMs without filing support tickets
  • I need to prevent [individual] on my [team] from using the vSphere UI, because they are bypassing our change control policies

[Read more...]