OIT VMware Upgrade project (public page)

This page will provide OIT's VMWare service client community with information about our upgrade project, and will be updated to reflect progress with the project. The parent to this page is available to all OIT people and has more detailed technical information.

OIT primarily runs two VMWare vSphere 5.5 environments as a consequence of the OIT Consolidation. This project will finally combine the environments. The effort will bring the following benefits to our clients:

• Streamlined access management through use of self-service KSAMS authorization and UCInetID for logins (replacing 'AD' and 'SERVERAD' Active Directory)
• Enhanced security through use of mandatory DUO Two Factor authentication and trusted "signed" digital certificates as well as infrastructure security enhancements
• Preparation for enhanced integration with services such as ServiceNow for change management, notifications, alerting, etc.

The upgrade is designed to be non-disruptive to all VMs. That is, all virtual machines are expected to run non-disruptively as the upgrade takes place. However, due to the architecture changes needed, there may be gaps in access to low-level VM management operations (powering on/off, snapshots, console, etc.), which can be minimized based on each clients' level of preparation and cooperation with the migration process.

Client Action Items

KSAMS action items

KSAMS roles are used to provide authorization or permissions within vCenter.  vCenter permissions are granted to members of LDAP groups that are automatically populated from KSAMS roles. Even an individual who needs vCenter permissions on a single VM needs to have a KSAMS role to get those permissions. KSAMS roles usually come in pairs; one role is used for the permissions, and another to approve memberships to the permission role. Figure A shows the list of these Roles as they appear in KSAMS.

• Via KSAMS ZotPortal App, request the Approver role for those who will approve the "Admin" role to those needing vCenter access to VMs.  Generally, a manager and director would have Approver roles.  OIT recommends having 2 or more Approvers. Approvers do NOT gain access to VMs.
• After the Approver role is set up, direct everyone requiring vCenter access to VMs to the KSAMS ZotPortal App to request the "Admin" role.
  • NOTE: Requests for "Admin" roles submitted before the corresponding group's "Approver" request is completed will result in KSAMS ERRORS so please make sure at least one Approver is set up before adding Admins.
• For simplicity and expediency, all users will initially be assigned permissions per Figure B for their designated group of VMs. We welcome input for other permission levels, as well as different user groupings going forward.

KSAMS example:

• OIT's Data Center Infrastructure team uses the "vCenter - OIT vSphere Admins" and "vCenter - OIT vSphere Admins Approvers" roles.
• Using the KSAMS ZotPortal App, a request was made to add Ken Cooper and Brian Buckler to the "vCenter - OIT vSphere Admins Approvers" role.
• Each team member requested the "vCenter - OIT vSphere Admins" role.
• Ken approved each request using the app.
• vCenter access was granted.

DUO action items

Make sure all users requiring vCenter VM access have a DUO token set up through the DUO Enrollment App

VM identity data action items

VM ownership claim period has ended.

Due to various histories and actions, there may be mismatches and ambiguities about ownership and responsibility roles for VMs. In order to repair these issues and to help facilitate future automation plans, we are requiring all VMs to be 'tagged' with a mandatory set of data per Figure C. We have created a Google Apps form (UCI Google Apps registration required) to collect this information. If you have a large number of VMs under ownership and would like a bulk submission method, please contact Jason Noennig jnoennig@uci.edu for data import information. VMs in the end not claimed through this process will be placed in an 'Animal Shelter' environment where we will attempt to match them with their owners, and if one cannot be identified after a to-be-determined number of days, will be powered off, then deleted.

vCenter Login Procedure

Can be found at New OIT VMware vCenter Login Procedure

Future action items

As the migration moves forward, this page will be updated with new action items. These will include logistics for the migration itself, operational changes in the new environment, and other information.

Fig. A: KSAMS Roles

Fig. B: VM Permissions

Initially, all assigned users will have the set of permissions listed below:

• • Virtual Machine
    • Configuration
      • Modify Device Settings
      • Settings
      • Upgrade virtual machine compatibility
    • Interaction
      • Answer Questions
      • Configure CD Media
      • Console Interaction
      • Device Connection (NICs and removable media)
      • Power On
      • Power Off
      • Reset
      • VMware Tools Install
    • Snapshot Management
      • Create Snapshot
      • Remove Snapshot
      • Rename Snapshot
      • Revert Snapshot
  • Folder (This will only work on the sub-folders of where the role is assigned.)
    • Create
    • Delete
    • Rename
    • Move
  • Datastore (This is only to facilitate mounting ISO images from the shared ISO repository)
    
    • Browse datastore
    • Low level file operation

Fig. C: VM Tag data