Part-V vCloud Director
vCloud Director Automation & Integration
This section explores how VMware vCloud Director (vCD) integrates with automation tools and DevOps ecosystems, enabling true Infrastructure-as-Code (IaC) and self-service cloud provisioning.
We'll cover REST APIs, Terraform, PowerCLI, Ansible, vRealize Automation (vRA), event-driven extensibility, and CI/CD pipelines for tenant operations.
1️⃣ Introduction: Why Automate vCloud Director
Automation is at the heart of any cloud platform. While vCD already provides a graphical portal for tenants and providers, API-driven automation enables:
● Rapid, repeatable provisioning
● Consistent configuration enforcement
● Integration with DevOps tools
● Tenant self-service workflows
● CI/CD-based environment lifecycle management
Automation Goal:
“Transform manual VM and network provisioning into repeatable, code-defined operations across tenants.”
2️⃣ vCloud Director REST API Overview
The vCloud Director REST API provides programmatic access to nearly every function available in the vCD UI. It allows you to create, manage, and monitor VMs, networks, VDCs, catalogs, and users.
🔹 API Basics
Feature | Description |
Protocol | REST over HTTPS |
Authentication | Basic Auth, OAuth, or SAML |
Response Formats | XML and JSON |
Versioning | Each vCD release introduces API version updates |
Base Endpoint | https://<vcd-fqdn>/api |
🔹 Authentication Workflow
Send a POST request with credentials: curl -i -k -H "Accept: application/*+xml;version=37.0" \
-u "admin@system:password" \
Receive a Session Token in the response header.
Use the token for subsequent API calls.
🔹 Example: Create an Organization
POST /api/admin/orgs
Content-Type: application/vnd.vmware.admin.organization+xml
<Org name="TenantA" isEnabled="true">
<FullName>TenantA Cloud Org</FullName>
</Org>
Result: A new organization (“TenantA”) is created via API — the same as doing it manually in the UI.
🔹 API Hierarchy
vCD API
├── /org (Organizations)
├── /vdc (Org Virtual Data Centers)
├── /vApp (Applications)
├── /vm (Virtual Machines)
├── /network (Org / vApp Networks)
├── /catalog (Templates / Media)
├── /user (Users and Roles)
└── /task (Tasks and Events)
🔹 Common API Operations
Function | Method | Endpoint |
List all organizations | GET | /api/org/ |
Create vApp | POST | /api/vApp/instantiateVAppTemplate |
Power On VM | POST | /api/vApp/{id}/power/action/powerOn |
Upload Catalog Item | POST | /api/catalogItem |
Query Tasks | GET | /api/query?type=task |
🔹 REST API Tools
● Postman: Easily test API calls and automation workflows.
● curl: Lightweight CLI for quick testing.
● Python SDK (pyvcloud): Simplifies scripting complex workflows.
3️⃣ Terraform vCloud Director Provider
Terraform is one of the most popular Infrastructure-as-Code tools, and VMware provides an official vCD provider (vmware/vcd).
It allows full automation of:
● Organizations and OrgVDCs
● Networks and Edge Gateways
● vApps and VMs
● Storage Profiles
● NAT, Firewall, and Load Balancing
🔹 Provider Setup Example
Provider Block:
provider "vcd" {
user = "tenant-admin"
password = "VMware123!"
org = "TenantA"
url = "https://vcd.cloud.local/api"
allow_unverified_ssl = true
}
🔹 Example: Deploy vApp with VM and Network
resource "vcd_vapp" "webapp" {
name = "WebApp01"
org = "TenantA"
vdc = "TenantA-VDC"
}
resource "vcd_vapp_vm" "vm1" {
vapp_name = vcd_vapp.webapp.name
name = "webserver01"
catalog_name = "TenantA-Catalog"
template_name = "Ubuntu-Template"
power_on = true
network {
type = "org"
name = "TenantA-Network"
ip_allocation_mode = "POOL"
}
}
Terraform Output:
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
🔹 Example: Automating Network Creation
resource "vcd_network_routed_v2" "app_network" {
org = "TenantA"
vdc = "TenantA-VDC"
name = "AppNet"
gateway = "192.168.10.1"
prefix_length = 24
edge_gateway_id = vcd_nsxt_edge_gateway.tenant.id
}
🔹 Advantages of Terraform for vCD
Feature | Benefit |
Repeatable Deployments | Define entire cloud environments as code. |
Version Control | Track configuration changes in Git. |
Automation | Integrate with Jenkins, GitLab CI, or ArgoCD. |
Multi-Tenant Templates | Create reusable modules for each tenant. |
4️⃣ PowerCLI for vCloud Director
PowerCLI provides a PowerShell-based scripting interface for vCD through the VimAutomation.Cloud module.
🔹 Connection
Connect-CIServer -Server vcd.provider.local -User "sysadmin" -Password "VMware123!"
🔹 Common Commands
Task | Command |
List Organizations | Get-Org |
Get OrgVDCs | Get-OrgVdc |
Create Network | New-OrgVdcNetwork |
Deploy vApp | New-CIVApp |
Power On vApp | Start-CIVApp |
Export Catalog Items | Export-CICatalogItem |
🔹 Example: Batch Create VMs
$org = Get-Org -Name "TenantA"
$vdc = Get-OrgVdc -Org $org -Name "TenantA-VDC"
$catalog = Get-Catalog -Org $org -Name "TenantA-Catalog"
1..5 | ForEach-Object {
New-CIVApp -OrgVdc $vdc -Name "AppVM$_" -Catalog $catalog -Template "Ubuntu-Template"
}
🔹 Example: Enable Network Services
$edge = Get-EdgeGateway -Name "TenantA-Edge"
New-NatRule -EdgeGateway $edge -Type SNAT -OriginalIp 192.168.10.0/24 -TranslatedIp 203.0.113.10
🔹 PowerCLI Benefits
● Ideal for admins and DevOps scripting.
● Easy integration with Windows-based automation pipelines.
● Compatible with vCenter and NSX scripts — unified automation stack.
5️⃣ Ansible Automation for vCloud Director
Ansible offers agentless automation, using modules and playbooks that interact with vCD’s REST API.
🔹 Setup
Install the VMware vCloud Director collection:
ansible-galaxy collection install vmware.vcloud
Define authentication in ansible.cfg or environment variables.
🔹 Example Playbook: Create Network and Deploy vApp
- name: Deploy Tenant Environment
hosts: localhost
collections:
- vmware.vcloud
tasks:
- name: Create Org Network
vcd_network:
org: TenantA
vdc: TenantA-VDC
network_name: WebNet
gateway: 192.168.20.1
netmask: 255.255.255.0
state: present
- name: Deploy vApp
vcd_vapp:
org: TenantA
vdc: TenantA-VDC
vapp_name: WebApp
template_name: Ubuntu-Template
catalog_name: TenantA-Catalog
power_on: true
🔹 Ansible Use Cases
Use Case | Description |
Tenant Onboarding | Create org, VDCs, networks, and roles. |
Network Management | Configure NAT, Firewall, VPN rules. |
VM Lifecycle Automation | Deploy or decommission workloads on demand. |
Integration with CI/CD | Trigger playbooks via Jenkins or GitLab CI. |
6️⃣ Integration with vRealize Automation (vRA)
vRealize Automation (now Aria Automation) integrates directly with vCloud Director, enabling policy-driven service delivery and governance.
🔹 vCD as an Endpoint in vRA
● vCD is registered as a cloud endpoint.
● vRA consumes OrgVDCs, catalogs, and templates as blueprints.
● Supports multi-tenant provisioning with predefined policies.
🔹 Typical Architecture
[ vRealize Automation ]
↓
[ vCloud Director ]
↓
[ vCenter + NSX-T ]
↓
[ Physical Infrastructure ]
🔹 Benefits
Feature | Description |
Blueprint Automation | Define multi-tier application stacks. |
Governance Policies | Approval workflows, cost controls. |
Cloud Agnostic | Manage vCD, AWS, Azure, and VCF from one interface. |
Self-Service Catalog | Users request vApps via vRA Service Broker. |
🔹 Example: vRA Blueprint Snippet for vCD
resources:
WebApp:
type: Cloud.vApp
properties:
image: "Ubuntu-Template"
flavor: "medium"
networks:
- name: "WebNet"
count: 2
7️⃣ Event Notifications and Webhooks
vCloud Director supports AMQP-based event messaging and webhook notifications to integrate external systems.
🔹 Event System Overview
● Each action (VM creation, power on, Org change) generates an event.
● Events can be:
○ Published to RabbitMQ (AMQP).
○ Sent via Webhooks to HTTP endpoints.
🔹 Common Use Cases
Use Case | Description |
Automation Triggers | Automatically deploy firewall rules or backups on VM creation. |
SIEM Integration | Send audit logs to Splunk or Log Insight. |
Custom Workflows | Trigger Jenkins or Ansible pipelines on vApp changes. |
🔹 Example: Webhook for VM Deployment Event
Payload:
{
"eventType": "com.vmware.vcloud.event.vm.create",
"vmName": "webserver01",
"org": "TenantA"
}
8️⃣ CI/CD Pipeline Automation
Automation extends to Continuous Integration / Continuous Delivery (CI/CD) pipelines, integrating vCD with GitLab, Jenkins, or ArgoCD.
🔹 Example: GitLab CI + Terraform Pipeline
stages:
- plan
- apply
plan:
script:
- terraform init
- terraform plan -out=tfplan
apply:
script:
- terraform apply tfplan
when: manual
Outcome: Automatically deploys or updates tenant environments in vCD based on Git commits.
🔹 Example: Jenkins + Ansible
Jenkins pipeline step:
stage('Deploy vApp') {
steps {
ansiblePlaybook credentialsId: 'vcd-creds',
playbook: 'deploy_vapp.yml'
}
}
This triggers vApp deployment automatically after successful build/test steps.
🔹 Benefits of CI/CD with vCD
Benefit | Description |
Speed | Instant environment creation for developers. |
Repeatability | Consistent cloud deployments across tenants. |
Governance | Version control and approval workflows. |
Self-Healing | Automatically rebuild failed environments. |
✅ In Summary
Area | Tools / Methods | Purpose |
Core API | REST API, pyvcloud SDK | Full programmatic control of vCD |
Infrastructure as Code | Terraform | Declarative provisioning for OrgVDCs, VMs, and networks |
Scripting Automation | PowerCLI | Administrative and bulk operations |
Configuration Management | Ansible | Agentless automation for vCD tenants |
Orchestration | vRealize Automation (Aria) | Policy-based provisioning and governance |
Extensibility | AMQP, Webhooks | Event-driven integrations |
DevOps Pipelines | GitLab CI / Jenkins | CI/CD for cloud deployment and lifecycle automation |
—------------------------------------------------------------------------------------------------------------------------------------------
🏗️ Part 7: vCloud Director Administration & Maintenance
1️⃣ vCloud Director Installation Overview
A vCD deployment consists of several components:
Component | Function |
vCD Cell(s) | Application nodes providing Web UI, API, and task execution. |
PostgreSQL DB | Stores configuration, inventory, and metadata. |
NSX-T / NSX-V | Provides software-defined networking. |
vCenter Server(s) | Supplies compute + storage resources. |
RabbitMQ (AMQP) | Event bus for asynchronous task messaging. |
Load Balancer | Distributes user/API traffic across multiple Cells. |
🔹 Prerequisites
Category | Requirements |
OS | VMware Photon OS 3 / RHEL 8 / Ubuntu 20.04 LTS |
Database | PostgreSQL 10 – 15 (external HA recommended) |
Java | Bundled OpenJDK 17 in vCD 10.5+ |
vSphere/NSX | vCenter 7 / 8 • NSX-T 3.2+ |
Hardware | 4 vCPU, 16 GB RAM min per Cell (prod ≥ 3 Cells) |
🔹 Installation Workflow
Deploy vCD OVA or Linux Package rpm -ivh vmware-vcloud-director-10.x.x.rpm
Run Configuration Tool /opt/vmware/vcloud-director/bin/configure
○ Specify DB connection (Host, User, Password)
○ Choose HTTPS ports (443 default)
○ Provide SSL certificate paths
Start Services systemctl enable vcloud-director
systemctl start vcloud-director
Access UI https://<vcd-fqdn>/provider
https://<vcd-fqdn>/tenant/<org_name>
🔹 Database Schema Initialization
The configuration wizard automatically creates required tables on first startup. Verify connectivity:
psql -h <db-server> -U vcloud -d vcloud
2️⃣ High Availability (HA) Design
Production clouds require redundancy across every vCD layer.
🔹 Multi-Cell Architecture
Deploy at least three vCD Cells:
+-------------------+
| Load Balancer |
+--------+----------+
|
+------------+------------+
| Cell 1 | Cell 2 | Cell 3 |
+------------+------------+
|
PostgreSQL DB
● Cells are stateless → safe for horizontal scaling.
● Shared transfer storage (NFS/S3) for catalog/media exchange.
● Use Layer-7 LB with session persistence for UI sessions.
🔹 Database HA
Method | Description |
Streaming Replication | Primary + standby PostgreSQL nodes. |
Patroni Cluster | Automatic failover with Etcd or Consul. |
vSphere HA | Restart DB VMs on host failure (basic). |
Always separate the DB from vCD Cells; never co-locate.
🔹 RabbitMQ HA
● Deploy a 3-node RabbitMQ cluster.
● Use mirrored queues for event durability.
Configure AMQP URL with all brokers in vCD: amqp://user:pass@mq1,mq2,mq3/vcloud
●
🔹 Load Balancing
Use NSX-T Edge, AVI (Aria Load Balancer), or F5:
Service | Port | Persistence |
UI/API | 443 HTTPS | Source IP affinity |
Console Proxy | 8443 | Optional |
Health-check endpoint: /cloud/server_status.
3️⃣ Certificate Management
Proper SSL configuration ensures secure API/UI access and SAML federation.
🔹 Generate Keystore
keytool -genkeypair -alias vcd -keyalg RSA -keysize 2048 -keystore /opt/vmware/vcloud-director/certs.ks
🔹 Import CA Certificate
keytool -import -alias rootCA -keystore certs.ks -file rootCA.crt
🔹 Configure HTTPS Endpoints
/opt/vmware/vcloud-director/bin/cell-management-tool certificates -j /opt/vmware/vcloud-director/certs.ks
🔹 Let’s Encrypt Option
● Use certbot for automated renewal → symlink renewed certs into certs.ks.
🔹 Console Proxy Certificate
● vCD uses a separate cert for port 8443 (console proxy).
● Can use the same SAN certificate as API endpoint.
4️⃣ LDAP / Active Directory Integration
Integrating vCD with corporate AD enables centralized user management.
🔹 Configuration Steps
Navigate → System > Administration > Identity Sources
Select LDAP or LDAPS.
Enter:
○ Server URL (e.g. ldaps://ad01.corp.local:636)
○ Base DN (e.g. DC=corp,DC=local)
○ Bind DN and password
Test and Save.
🔹 User Mapping
LDAP Group | vCD Role |
Cloud-Admins | Org Administrator |
Dev-Ops | vApp Author |
Audit-Team | Read-Only |
Synchronize groups periodically using:
cell-management-tool ldap --sync-users
🔹 Security Tips
● Always use LDAPS (port 636).
● Restrict search filter (e.g., (memberOf=CN=vCDUsers,OU=Groups,DC=corp,DC=local)).
● Enable SAML or VMware Identity Manager for SSO/MFA.
5️⃣ Backup and Disaster Recovery
Regular backups are critical to restore configuration and tenant data.
🔹 What to Back Up
Component | Method | Frequency |
vCD Database | pg_dump / Veeam DB Job | Daily |
Cell Config | Backup /opt/vmware/vcloud-director/etc/ | After changes |
Transfer Storage (NFS/S3) | File-level backup | Daily / Weekly |
Certificates | Export keystore | When updated |
NSX/vCenter Configs | Follow respective product best practices | Daily |
🔹 Database Backup Command
pg_dump -U vcloud -h db01 -F c -f /vcd-backup/vcloud_$(date +%F).bak vcloud
Restore:
pg_restore -U vcloud -h db01 -d vcloud /vcd-backup/vcloud_YYYY-MM-DD.bak
🔹 Disaster Recovery Strategy
Layer | DR Method |
vCD Cells | Redeploy from OVA; restore config from backup. |
DB | Restore latest dump or failover to replica. |
Catalog Content | Sync from offsite NFS/S3 copy. |
NSX Edges | Replicate with vCloud Availability (vCDA). |
Comments