vCenter Server & vCenter Orchestrator 5.1 integration tips

Version 2

    With installing and integrating vCenter Server/ vCenter Orchestrator 5.1 (vCO) virtual appliances on a regular basis I came up with a standard way of doing it. This differs from the minimum / base installation and integration with adding some additional steps that I think are useful for the person who want to setup a development / test vCenter Orchestrator environment. There are many other ways of doing it and even ways to automate this but this document can definitely help you to get started.



    Using the virtual appliance version of vCenter Server & vCenter Orchestrator is a convenient way to set up an Orchestration environment without requiring operating system licenses, IT compliance (i.e Anti Virus, other standard software, updates), maintenance (i.e updates, backup).

    • If you prefer to run vCenter Server & vCenter Orchestrator on Windows (Server, 64 bit, check compatible versions) then this document may not be relevant since vCenter Orchestrator 5.1 comes fully installed, configured and integrated with vCenter when using the Windows based installation of vCenter 5.1.
    • If you prefer to use the vCenter Server & vCenter Orchestrator Virtual Appliances then there are a minimal amount of steps to integrate these that are included in this document as well as optional steps providing further benefits.
    • You can also decide on having a mixed environment (i.e vCenter Server 5.1 on windows, vCenter Orchestrator 5.1 Virtual Appliance). If you do so only some sections of this document will be relevant.



    The components:

    • VMware vCenter Orchestrator Appliance 5.1.0
    • vCenter 5.1 Server


    The vCO appliance is the core requirement to author and test workflows. It provides the orchestration platform including the orchestration engine, plug-in adapters and their library workflows, a workflow designer.


    vCenter Server is required for creating workflows automating vCenter operations and also to provide the vSphere Web client that will likely be used to start these workflows. This last functionality requires using the vCenter Server Single Sign On server.


    Other components such as ESXi hosts are necessary to operate a virtual infrastructure but are out of scope for this document.

    For orchestrating vCloud Director, vCloud Director (1.5 or 5.1) and vCloud Director plug-in for vCO (1.5 or 5.1) are required.



    The goal of this tutorial is to deploy a vCenter Orchestrator demo / test / development environment setup with your own credentials.

    The demo licenses are valid for 60 days. These can be replaced by purchased licenses (Need at least Standard license level to be able to edit workflows).


    Installation & configuration instructions



    Import the appliances in either vCloud Director, vCenter, Workstation, Fusion.

    Depending on which of these you use you may have the option to set them up with a static IP address. You should do so since this is a both ways integration and an IP changing because of an expired DHCP lease will break the integration and will require fixing it manually. If you do not have the option we will handle this later as an optional step.


    If you are on an older version you may not be able to import an OVF file directly. If this is the case use the freely downloadable ovftool (Documentation & product download)



    Synchronize the time on the virtual appliances


    Since the integration relies on the Single Sign On feature it is really important that the VMs times are synchronized. Single sign on authentication fails when the VM authenticating time is drifting too much from the time on the SSO server.


    This step is optional but recommended if the VMs time are not synched (type date in the command line).


    There are different ways to accomplish this the easiest one I have found is to add this line to the vCenter Server and vCenter Orchestrator appliance  .VMX file


    tools.syncTime = "TRUE"


    If the VMs run on different hosts that may not be time synchronized and if the VMs have access to the internet another way is to use a NTP server. To do so log in the appliances (user = root, password = vmware), edit the /etc/ntpd.conf (for example using vi) and add the following lines




    Start the vCenter VA.


    If you did not setup a static IP & host name before it is recommended to do it before the first appliance configuration, otherwise go to the vCenter VA first configuration section


    Set a static IP Address and a hostname


    This is an optional step. Using static IP addresses is not required but recommended to avoid loosing the vCenter Server / vCenter Orchestrator both way integration.


    In the VM console press <Enter> to log in.

    Log in as root / vmware and start yast.




    Use the cursor keys to select the network settings.


    yast - network settings.png

    Use the tab key to edit the network configuration.


    yast - edit network.png


    Use the tab key to get to "Statically assigned IP Address". Use the space bar to select. Enter your IP Address, subnet mask and hostname. Use the tab key to get to [Next]



    yast - set IP.png


    Use tab and the cursor key to get to Hostname / DNS and set these. Once done use tab to get to [OK]. yast will save the configuration changes. You can now use tab to get to [Quit].


    vCenter VA first configuration


    This step is mandatory. It can be automated following this tutorial.


    Open a browser on https://IP_ADDRESS:5480. Authenticate with root / vmware


    vCenterVA config login.png


    The EULA will show up. Accept it and click next.


    vCenter VA EULA.png


    On the next screen come an interesting note:


    vCenter VA Static IP warning.png



    I tried that but did not find out how to relaunch the wizard as it seems that as soon as you accept the EULA a variable is set in the server for not restarting the wizard. There is definitely a way to reset this variable but since we have already managed the IP & hostname change we can move on anyway.



    Use the "Configure with default settings"


    Keep embedded for Database & SSO settings.

    Click Next and then Start
    Wait it completes or better have a small break.


    Create vCO user, group, role and permissions


    This step is optional since the vCenter Server Appliance is coming with default root & admin users but recommended so you can authenticate with your own username to create and operate the workflows.


    Since vCO will be using vCenter SSO we have the option to create a specific vCO user and group with administrator role and permissions on the vCenter server objects. For this we will use the default System Domain identity. It is possible to add other entities such as Active Directory Domains but is out of scope in this document.


    Log in the vSphere web client: https://IP_ADDRESS:9443


    vSphere Web Client Login.png


    Browse to Administration / Access / SSO Users and Groups
    In the Users tab click on the + icon to add an user.
    Fill the fields and select Administrator user. Click OK.


    SSO New User.png


    In the Groups tab click on the + icon to add a vcoadmins group. Click OK.


    SSO New Group.png


    Select vCO Admins click add principal (the icon with a + and a character).


    SSO Add principals 1.png


    Add your user and root (Search for your user in System-Domain and root user in localos identity source).


    SSO Add principals 2.png


    In home / venter / vCenter Servers / your venter Server name select Manage tab and then permission tab
    click + to add a permission
    Click add.

    Select System-Domain
    Select vcoadmins and click add and OK.


    vCenter VA permissions 1.png


    To assigned role select administrator. click OK


    vCenter VA permissions 2.png



    vCenter Orchestrator Configuration


    This step is mandatory. This is the one that provides the vCenter Server to vCenter Orchestrator bidirectional integration.


    Start the vCO VA.

    Once started follow the "Set a static IP Address and a hostname" section.


    Open a browser on https://IP_ADDRESS. This will get you to the vCO greeting page.

    vCO VA greeting page.png

    Click on the "Orchestrator Configuration" link.


    Authenticate with vmware / vmware


    vCO VA configuration 1.png


    Once you click on Login you will have to enter & verify a new password.



    vCO VA configuration 2.png


    Click "Apply changes"


    On the left section click on the Startup Options Tab. Click on Stop Service.


    vCO VA Stop Service.png



    The vCenter Orchestrator Appliance is configured to run stand alone. We are going to change its settings so it can use vCenter SSO for authentication and configure the vCenter Server plug-in.


    First in the network tab Change the default IP ( to the one you set for vCO. If you did set a host name it will show up in the DNS name field.

    vCO VA network config.png

    Click on "Apply changes"


    Now we need to import the vCenter Server and vCenter SSO certificates. Click on the SSL Trust Manager tab.


    In the URL from which to import a certificate enter the IP_of_the_vCenter_Server:443

    Click import. This will display the certificate. Click on the import link.


    Repeat the operation on IP_of_the_vCenter_Server:7444


    Your SSL certificates should look like this:


    vCO VA SSL certificates.png


    On the left section click on the Authentication tab. You will see that as default the vCO VA is configured for the local LDAP server. Change Authentication mode to SSO Authentication. Enter the IP of the vCenter VA and the root / vmware credential. Click on "Register Orchestrator"


    vCO VA SSO Authentication.png

    You will be greeted by a

    The Orchestrator solution user is registered. You must complete the SSO configuration.


    To do so in the "vCO Admin - domain and group" select "SYSTEM-DOMAIN vcoadmins"

    As you can see clock tolerance is set to 300 seconds. This should be fine since we synched the two VMs time previously.


    vCO VA SSO Configuration.png


    Click on Accept Orchestrator Configuration.



    On the left section click on the Plug-ins tab. We need to provide a vCO admin user to install the plug-ins when the vCO server will be restarted. Use the user previously created in vCenter SSO. Then we need to enable the vCenter Server plug-in. Check it. Click on Apply changes.



    vCO VA Plug-ins config.png


    On the left section click on the vCenter Server (5.1.0) tab. Click on the New vCenter Server Host.


    Enter the IP of the vCenter host. You can use "Share a unique session" if you want all the operations on vCenter to be performed as the user you provide or use a Session per user if you want to authenticate in vCenter as the user that will authenticate in vCO. In this case you still have to provide an admin credential for the configuration session. Click on "Apply Changes"


    vCO VA vCenter Config.png


    In order to make all the configuration changes active and in order to install the vCenter plug-in it is necessary to restart the vCO service.


    On the left section click on the Startup Options Tab. Click on "Start Service".




    Testing the integration


    This section is completely optional. It is a walk through the different components to check everything work as expected.



    Open the vCO appliance in a browser and click on the "Start Orchestrator Client" link. This will download a Java web start link (works on Linux, MacOS, Windows). Open the file. Alternatively you can download the client for your platform and install it locally. Enter your vCO IP and your credentials.


    vCO VA Client start.png


    Install / Ignore the certificate. If you manage to log in it means SSO authentication worked. The next step is to create a workflow. This will prove you are part of the vCO Admins group and that you have the right type of license to author workflows. On the workflow tab Right Click on the workflow tree root and select "Add folder". Name the folder as you want.


    vCO Create folder.png


    Now right click on the folder and slect "new workflow". Name it "Create Datacenter".

    vCO create workflow.png

    Our workflow will call a library workflow with changing the workflow presentation to allow this workflow to be used contextually on the vCO inventory. This is called "wrapping" a workflow and is a good alternative to change the original workflow as it permits to have several different versions based on the same one. Also most Library workflows are read only so wrapping them is a good choice and a better one than duplicating the library workflows because you will not benefit from Library workflow updates.


    Go on the Schema tab, drag and drop the "Workflow Element from the "Generic" Palette on the left to the blue arrow on the schema.



    vCO drop wf on schema.png

    Now choose the Create Datacenter workflow version 0.2.0 with typing "create datacenter" in the filter field.


    vCO Create Datacenter workflow.png


    vCO 5.1 will ask you if you want to propagate the create datacenter input and outputs to your workflow. Click on Setup.


    vCO input wizard.png


    Just let the default and click promote.

    vCO input promote.png



    At this point our workflow is doing the same thing as the library "Create Datacenter" workflow. One difference is the presentation properties. To propagate these to our workflow richt click on the Create Datacenter workflow, select synchronize, synchronize presentation.

    vCO synchronize parameters.png

    Now if you go to the Presentation tab of the main workflow and click on the folder input and on the Properties tab you will see that it is set as a "Mandatory input". If you click on the left icon with the + sign you can add the "Show in inventory" property. This is the one needed to have this input contextual to inventory objects.

    vCO show in inventory.png

    Click ok, save the workflow. vCO 5.1 will ask you to add to version history. You can click increase version.

    vCO save and increase version.png


    Now switch to the inventory tab. Unfold the inventory. if it works vCO has access to vCenter. Right Click on the Datacenters Folder and select the Create Datacenter workflow. This will start the workflow you have just created.


    vCO create datacenter1.png

    The parent folder is already selected. Just enter a name.

    vCO create datacenter2.png


    Once submited you can reload the inventory by right clicking / refresh on the Datacenters folder. If the workflow completed successfully (meaning you have the right level of permissions to create a datacenter in vCenter) you will see your datacenter and the subfolders.

    vCO Datacenter in inventory.png


    Now let's check What we have in vCenter. Log in the vSphere web client: https://vCenter_IP_ADDRESS:9443. This time you will log with the user you have created and not with the root account.

    vCenter VA log in.png


    Now Click on the vCO home. You will be getting to this page. You can see:

    • that you have 1 vCO server registered.
    • the recent Create Datacenter task in the right.


    This mean that the vSphere server talks to vCO. Now let's start te workflow we have created.

    vCenter VA vCO home.png


    Click on workflows. Then in the search field type datacenter. Right click / Run a workflow on the "Create Datacenter" workflow that has no description (it is usually good practice to put your own description)

    vCenter VA create datacenter workflow.png


    If this is the first time you run a workflow you may be prompted for approving permission for token delegation. Approve & remember decision.

    vCenter VA token.png


    The workflow will prompt you for Patent Datacenter folder and for a datacenter folder name. vCenter use container folders for each object and hide these in the user interface. vCO display these in the inventory. Click + to set the folder.

    vCenter VA create datacenter workflow 2.png


    Instead of spending time browsing you can use the filter tab that will list all the datacenter folders. We have a single one. Select it.

    vCenter VA create datacenter workflow3.png


    Set a name and finish.

    vCenter VA create datacenter workflow4.png


    Once the workflow is finished you can go to vCenter home and check for the datacenters. You will find the two datacenter created by vCO workflow: one started from the vCO client and one from the vSphere web client.

    vCenter VA check datacenters.png


    Since you have been reading all of this here is a bonus : If you create a cluster you can right click on it to see all possible actions. At the end you will see "All vCenter Orchestrator actions". There are some vCO workflows that have been set to be contextual to vCenter objects.

    vCenter VA contextual workflow.png


    If you want to make your own workflow contextual to the vCenter objects you can do so with going in the "Manage" tab of vCenter Orchestrator home.

    A workflow can be contextual to a single object or a list of objects of the same type.

    vCenter VA add contextual workflow.png


    So now you have everything you need to extend vSphere Web client with any functionality you can build in a vCO workflow so basically anything you can imagine.