Page Comparison

This page will provide OIT's VMWare service client community with information about our upgrade project, and will be updated to reflect progress with the project. The parent to this page is available to all OIT people and has more detailed technical information.

OIT primarily runs two VMWare vSphere 5.5 environments as a consequence of the OIT Consolidation. This project will finally combine the environments. The effort will bring the following benefits to our clients:

• Streamlined access management through use of self-service KSAMS authorization and UCInetID for logins (replacing 'AD' and 'SERVERAD' Active Directory)
• Enhanced security through use of mandatory DUO Two Factor authentication and trusted "signed" digital certificates as well as infrastructure security enhancements
• Preparation for enhanced integration with services such as ServiceNow for change management, notifications, alerting, etc.

The upgrade is designed to be non-disruptive to all VMs. That is, all virtual machines are expected to run non-disruptively as the upgrade takes place. However, due to the architecture changes needed, there may be gaps in access to low-level VM management operations (powering on/off, snapshots, console, etc.), which can be minimized based on each clients' level of preparation and cooperation with the migration process.

...

vShere service utilizes the campus' centralized authorization (KSAMS) and authentication systems (UCINetID/LDAP) for access. OIT DCI does not provision this access and is intended to be a self-service process.

KSAMS action items

KSAMS roles are used to provide authorization or permissions within vCenter.  vCenter permissions are granted to members of LDAP groups that are automatically populated from KSAMS roles. Even an individual who needs vCenter permissions on a single VM needs to have a KSAMS role to get those permissions. KSAMS roles usually come in pairs; one role is used for the permissions, and another to approve memberships to the permission role. Figure A shows the list of these Roles as they appear in KSAMS.

...

• OIT's Data Center Infrastructure team uses the "vCenter - OIT vSphere Admins" and "vCenter - OIT vSphere Admins Approvers" roles.
• Using the KSAMS ZotPortal App, a request was made to add Ken Cooper and Brian Buckler to the "vCenter - OIT vSphere Admins Approvers" role.
• Each team member requested the "vCenter - OIT vSphere Admins" role.
• Ken approved each request using the app.
• vCenter access was granted.

DUO action items

Make sure all users requiring vCenter VM access have a DUO token set up through the DUO Enrollment App

vCenter Login Procedure

Can be found at New OIT VMware vCenter Login Procedure

...

As the migration moves forward, this page will be updated with new action items. These will include logistics for the migration itself, operational changes in the new environment, and other information.

Fig. A: KSAMS Roles

...

Fig. B: VM Permissions

Initially, all assigned users will have the set of permissions listed below:

• • Cryptographic Operations
    • Direct Access (allows console access to vTPM enabled VMs)
    • Encrypt (allows console power on/off vTPM enabled VMs)
    • Encrypt new (allows console power on/off vTPM enabled VMs)
    • Register VM (allows console power on/off vTPM enabled VMs)
  • Virtual Machine
    • Configuration
      • Modify Device Settings
      • Settings
      • Upgrade virtual machine compatibility
    • Interaction
      • Answer Questions
      • Configure CD Media
      • Console Interaction
      • Device Connection (NICs and removable media)
      • Power On
      • Power Off
      • Reset
      • VMware Tools Install
    • Snapshot Management
      • Create Snapshot
      • Remove Snapshot
      • Rename Snapshot
      • Revert Snapshot
  • Folder (This will only work on the sub-folders of where the role is assigned.)
    • Create
    • Delete
    • Rename
    • Move
  • Datastore (This is only to facilitate mounting ISO images from the shared ISO repository)
    
    • Browse datastore
    • Low level file operation

Fig. C: VM Tag data