In this recipe, we connect Orchestrator to vCenter. This will allow Orchestrator to access vCenter objects as well as vSphere Web Client users to access Orchestrator workflows. For an Orchestrator used with vRA, you need to use the endpoint configuration, see the How it works... section.
We need a running Orchestrator that needs to be registered with vSphere (SSO or vRA works as well).
Tip
If you are planning to use a customer SSL certificate for your Orchestrator, then exchange the certificate before you continue here. See the recipe Configuring the Orchestrator service SSL certificate in Chapter 2, Optimizing Orchestrator Configuration.
You should consider having a technical user that is able to log into vCenter as a vCenter administrator as well as being a member of the Orchestrator admin group. Using a dedicated user will go in the right direction for automation, see the How it works... section. I will use my dedicated user,srv_vro@mylab.local.
To configure the vCenter connection we need to follow these steps:
Open the Orchestrator Client with an Orchestrator Administrator.
Start the workflow Library | vCenter | Configuration | Add a vCenter Server instance.
Enter your vCenter FQDN.
Select that you would like to orchestrate this instance as well and that you would like to accept SSL certificates even if they are self-signed.
Click on Next.
Select No, meaning that you will use a technical user for the connection between Orchestrator and vCenter. This is also the recommended setting if you are using the vRA integrated Orchestrator.
Enter a vCenter server administrative user or a technical user you specified, such as
srv_vro@mylab.localand the password of that user.Click on Submit.
Wait until the workflow is successfully finished.
Start the workflow Library | vCenter | Configuration | Register vCenter Orchestrator as a vCenter Server Extension.
Select your vCenter from the Orchestrator Library.
If you have a load balancer or NAT between Orchestrator and vCenter, enter the external Orchestrator address here.
Click on Submit.
Now log in to the vSphere Web Client as a technical user.
Navigate to vRealize Orchestrator | vRO Home | Summary. Your Orchestrator should be registered there.
For more information and usage, see the recipe Using Orchestrator through the vSphere Web Client in Chapter 7, Interacting with Orchestrator.
Sometimes the vSphere Web Client - Orchestrator integration doesn't work out-of-the-box after you have set it up. Here are some things to do in that case:
Check the VMware Product Interoperability Matrixes for interaction with your vRO version and the vSphere Web Client.
Use the same versions of vRO and vCenter. For example, vRO7.0.1 (or newer) doesn't integrate into vCenter 6.0U2 (or earlier) due to an SSL problem, it works fine with vCenter 6.0U3 (and newer). This is due to a change in encryption.
Have some patience. It may take some 15 minutes until the Web Client gets it (in a slow lab). The Web Client will continue to show the following error message: Error occurred while processing request. Check vSphere Web Client logs for details.
Restart the vSphere Web Client.
Check your vCenter logs. When you register an extension, a plugin is downloaded. In Orchestrator's case, the URL is:
https://[Orchestrator IP]:8281/vco/vsphere-web-client/vco-plugin.zip.Make sure that the vCenter user has access rights on Orchestrator (see the recipes User management and Using Orchestrator through the vSphere Web Client in Chapter 7, Interacting with Orchestrator).
Unregister all Orchestrator extensions using the MOB and then try again. See kb.vmware.com/kb/1025360 .
If you use a cluster, you need to use the external address. The register workflow registers the Orchestrator extension with its IP:
https://[Loadbalancer_Address]:8281. Also see the recipe Load-balancing Orchestrator in Chapter 3, Distributed Design.
Since vCenter Server 5.1, vSphere Web Client is (or better, should be) the main method to access vCenter. Orchestrator completely integrates with vSphere Web Client, making it possible for Orchestrator workflows to be executed directly from vSphere Web Client.
The access from Orchestrator to vCenter works with the technical user we used to make the connection.
When a workflow is started from Orchestrator, vCenter will log the user who started the workflow but the execution of the workflow will be logged with the technical user.
For a vSphere Web Client user to be able to start a workflow they need to have access to Orchestrator. Either they need to be a member of the Orchestrator admin group or they need non-administrative access.
The idea of a technical user is to use a dedicated user that connects between Orchestrator and vCenter. This technical user would be a full vCenter admin. The alternative is to use a per-user base, which means that each user uses his/her vCenter rights to run workflows. The difference is that we either need to set rights and roles throughout vCenter for different users/groups or we create good workflows and security in Orchestrator.
As we already discussed in the recipe Configuring external authentication in this chapter, the difference between vSphere and vRealize Automation authentication, namely SSO or vIDM. When you configure an Orchestrator, especially for vRA, you should not configure the vCenter plugin but use the endpoints, as we show in the recipe Adding Orchestrator, as an infrastructure endpoint in the final chapter.
To learn more about the Orchestrator user management, see the recipe User management in Chapter 7, Interacting with Orchestrator.
To configure the Orchestrator workflows in vSphere Web Client, see the recipe Using Orchestrator through the vSphere Web Client in Chapter 7, Interacting with Orchestrator.
