Hello,
We are running into a bit of an special request, we need to enable Virtualization Based Security at a VM level (not windows).
Rather than having a dedicated VM template with this setting enabled. I was wondering if this is something we could do via cloud template. I am unaware of a way to manage VM Options via vRA blueprints but maybe someone knows a way to do it.
I do see some PowerCLI post perhaps, a way to use flags.VbsEnabled = $true within the bluprint?
Thank you!
Accepted Solutions
Yep. You'd put a boolean input on the request form, bind it to a customProperty on the resource, and then set a filter on the subscription so that it will only call the vRO workflow if the boolean is true.
So something like this in the Cloud Assembly template:
inputs:
enableVBS:
type: boolean
title: Enable VBS
[...]
resources:
VM_1:
type: Cloud.vSphere.Machine
properties:
enableVBS: ${input.enableVBS}
[...]
And you could put something like this in the condition filter when creating the subscription:
event.data["customProperties"]["enableVBS"] == "true"
Alternatively, put a check for that boolean at the top of the script in the vRO workflow:
// Input: inputProperties from vRA
var enableVBS = inputProperties.customProperties.enableVBS
if (enableVBS == "true") {
var name = inputProperties.resourceNames[0]
var vms = VcPlugin.getAllVirtualMachines(null, name)
vm = vms[0]
var bootOpts = new VcVirtualMachineBootOptions()
var flags = new VcVirtualMachineFlagInfo()
var spec = new VcVirtualMachineConfigSpec()
bootOpts.efiSecureBootEnabled = true;
flags.vbsEnabled = true;
flags.vvtdEnabled = true;
spec.firmware = VcGuestOsDescriptorFirmwareType.efi;
spec.nestedHVEnabled = true;
spec.bootOptions = bootOpts;
spec.flags = flags;
vm.reconfigVM_Task(spec)
}
Hi John - I've reviewed the end to end one more time and I had a typo in the vRO input/output. Once I got that fixed then run the request again from vRA everything worked! 🙂
...now the last piece of the puzzle! Not every single VM request requires VBS, currently this is happening as part of a subscription (computer initial power on), would be possible to limit this to a user input something like a boolean so when the users checks the option while selection other stuff they will execute the workflow/script when vRA creates the VM request.
Inputs:
app11:
type: boolean
title: Nested Virtualization
default: false
resources:
Cloud_vSphere_Machine_1:
...
app11:'${input.app1 == true ? "Something that will trigger the vRO VM workflow
that will enable VBS" : ""}'
I am trying to make the above work but no luck so far....
Thank you!
Yep. You'd put a boolean input on the request form, bind it to a customProperty on the resource, and then set a filter on the subscription so that it will only call the vRO workflow if the boolean is true.
So something like this in the Cloud Assembly template:
inputs:
enableVBS:
type: boolean
title: Enable VBS
[...]
resources:
VM_1:
type: Cloud.vSphere.Machine
properties:
enableVBS: ${input.enableVBS}
[...]
And you could put something like this in the condition filter when creating the subscription:
event.data["customProperties"]["enableVBS"] == "true"
Alternatively, put a check for that boolean at the top of the script in the vRO workflow:
// Input: inputProperties from vRA
var enableVBS = inputProperties.customProperties.enableVBS
if (enableVBS == "true") {
var name = inputProperties.resourceNames[0]
var vms = VcPlugin.getAllVirtualMachines(null, name)
vm = vms[0]
var bootOpts = new VcVirtualMachineBootOptions()
var flags = new VcVirtualMachineFlagInfo()
var spec = new VcVirtualMachineConfigSpec()
bootOpts.efiSecureBootEnabled = true;
flags.vbsEnabled = true;
flags.vvtdEnabled = true;
spec.firmware = VcGuestOsDescriptorFirmwareType.efi;
spec.nestedHVEnabled = true;
spec.bootOptions = bootOpts;
spec.flags = flags;
vm.reconfigVM_Task(spec)
}