Part 19 – Building a VMware Tools Policy Playbook

A while back I wrote about setting VM tools policies via powercli but today we are going to build a single AWX Workflow Template called a VMware Tools Policy via Ansible to ensure we keep the VMware Tools upgrade policy consistent.

Ansible Gives us Orchestration around the API calls but what APIs calls give is one action so even thou Broadcom seems to be pushing everyone the API way, both can coexist.

The community.vmware Ansible collection doesn’t support tools_upgrade_policy in the version available in the AWX Execution Environment so we called the vSphere REST API directly using Ansible’s built-in uri module.

Get vSphere API session token

- name: Get vSphere API session token
  uri:
    url: "https://{{ lookup('env', 'VMWARE_HOST') }}/api/session"
    method: POST
    user: "{{ lookup('env', 'VMWARE_USER') }}"
    password: "{{ lookup('env', 'VMWARE_PASSWORD') }}"
    force_basic_auth: true
    validate_certs: false
    status_code: 201
  register: vsphere_session
  when: mode is search('Apply')

Set VMware Tools upgrade policy via vSphere API

Create VM Tools Policy Template

Name        : VM Tools Policy
Inventory   : vCenter Home Lab
Project     : VMware Automation
Playbook    : vm_tools_policy.ym
Credentials : Home vCenter

AWX Survey:

The playbook has two modes — Dry Run and Apply — controlled via an AWX survey. You always run Dry Run first to see exactly what would be changed. Happy with the list, you run Apply.

Test the playbook syntax

ansible-navigator run playbooks/vm_tools_policy.yml --syntax-check

Run the playbook

ansible-navigator run playbooks/vm_tools_policy.yml -e "cluster_name=Home-Cluster" -e "os_version=Both" -e "policy=UPGRADE_AT_POWER_CYCLE" -e "mode=Dry Run"

Ok, lets apply it via AWX

Name        : Home-Cluster
Os Version : 2019
Policy : Upgrade At powercycle or Manual

Mode : Apply or Precheck

Run the playbook

Validate the output

The VM tools policy has been changed

Ansible collections will always lag behind vSphere releases. The vSphere REST API is stable, versioned, and always current. The modern approach is to use community.vmware for the things it does well like VM info, tags, attributes and call the REST API directly for anything the collection can’t handle. Ansible provides the orchestration, logic, and AWX integration. The API provides the action. Together they cover everything.