Using the fit assessment tool

Currently, Migrate for Anthos and GKE provides the Linux discovery tool and the Windows discovery tool that you run on a source VM workload to determine the workload's fit for migration to a container.

This release of Migrate for Anthos and GKE includes a new tool, called the fit assessment tool, that is intended to eventually replace the existing Linux and Windows discovery tools. The new fit assessment tool provides you with:

  • Ability to get the assessment information about VMware VMs through a direct connection to vCenter.
  • Enhanced HTML output that makes it easier to view the assessment results.
  • New collection scripts and new assessment tool, mfit.

Like the existing tool, the new fit assessment tool outputs a report describing the assessment results for the VM. This assessment describes any issues that must be resolved before migration and an overall fit assessment of either:

  • Excellent fit.
  • Good fit with some finding that might require attention.
  • Needs minimal work before migrating.
  • Needs moderate work before migrating.
  • Needs major work before migrating.
  • No fit.
  • Insufficient Data.

See Calculating the fit assessment for a description of how the tool determines the overall fit assessment for a VM.

Updates for version 1.8.1

The fit assessment tool was originally released in Public Preview as part of Migrate for Anthos and GKE version 1.8. The fit assessment tool for version 1.8.1 adds new functionality, including:

How the tool works

The fit assessment tool operates in the following distinct phases:

  • Data discovery and collection phase - Gather data about the VMs to be migrated. You can gather this data in two ways:

    • Data discovery (VMware only): Run the mfit tool to perform an inventory discovery using the vSphere API to collect data about VMs in a vCenter. The mfit tool connects to the remote vCenter using the username and password passed to the tool.

      With discovery, you can quickly determine the characteristics of the VMs, such as operating system type, storage, number of cores, and other basic information. However, to calculate a complete fit assessment, you must run the mfit-linux-collect.sh bash script on the VM.

      The mfit tool stores assessment data and log information in the ~/.mfit directory on the host machine.

    • Collection: Run the data collection script on a VM to be migrated to collect the detailed information used to determine the VM's overall containerization fit assessment. You must run the collection script on the VM to be able to generate a complete fit assessment.

      The script collects data about the VM and writes that data to an output, tar file (Linux) or zip file (Windows). For Linux VMs, a copy of the data optionally remains on the VM file system for later usage during migration.

      You can run the script locally on the VM, or run the script remotely using mfit. Remote execution is supported by mfit for Linux and Windows VMs deployed on VMware, and for Linux VMs accessible by mfit over ssh.

  • Assessment phase: Use the mfit tool to parse the data from the data discovery and collection phase, apply a set of rules, and create a fit assessment score for each VM assessed.

    Typically, you install mfit on a single Linux machine, then upload the tar files (Linux) or zip files (Windows) created by the collection scripts to that machine for assessment.

  • Report phase: Use the mfit tool to produce a detailed report describing the assessment for each VM. You can create the report as an HTML, JSON, or CSV file.

Integration with workload migration

Data obtained by the fit assessment tool about a source VM during the collection phase can be used by Migrate for Anthos and GKE to generate parts of the migration plan for the VM.

For example, data collected by the fit assessment tool is used to discover information about service endpoints exposed by a source VM. Therefore, you must run the tool on a source VM if you want to auto-populate information about service endpoints. See Customizing Service endpoints for more information.

View the fit assessment report

To view the detailed report output by the mfit tool, you can either:

  • Open the HTML file in a browser. The fit assessment tool provides an enhanced HTML output that makes it easier to view the assessment results.

  • Upload the JSON file to the Google Cloud Console.

  • Import the CSV file to your own data visualization utility.

View the HTML output

Open the HTML file in a browser to view the report. The following image shows the HTML output of the tool for the evaluation of 41 VMs (only the first six rows of summary table are visible):

The HTML output of the mfit tool.

Where:

  • The top area contains information about who ran the report and when.

  • The Summary, Journey Scores, and OS Distributions areas give you a high-level overview of the results for all the VMs analyzed.

  • The top row of the table lets you specify search criteria in the report.

  • The table contains one row for each VM analyzed and shows:

    • The Fit result.
    • The Recommended path indicates the recommended path. For example in Migrate for Anthos and GKE it can be Containerize or the field is empty in case there is no fit.
    • The Operating System field includes the long format of the OS name.
    • The OS Type shows the operating system of the VM.
  • Expand each row of the table to view information about a VM, including a description of each rule and the results from applying a rule to the VM.

Install the fit assessment tool

Install mfit and the collection scripts:

  • mfit: Download the mfit tool to a central Linux machine. You then upload the data generated by the collection scripts to this machine for analysis.

  • mfit-linux-collect.sh (Linux): Download the collection script to a Linux VM to perform data collection.

  • mfit-windows-collect.ps1 (Windows): Download the collection script to a Windows VM to perform data collection.

Instead of downloading the collection script locally to each VM, you can optionally use the mfit tool to run the data collection scripts remotely. This option is supported for VMs running on VMware, or for Linux VMs that allow a remote ssh connection from the machine hosting mfit.

Prerequisites

To perform a fit assessment, you must meet the following prerequisites:

  • mfit

    • The fit assessment tool, mfit, runs on Linux kernel version later than 2.6.23.

    • To use mfit to collect data using VMware discovery:

      • The Linux machine running mfit must be able to connect to your vCenter.

      • The vSphere vCenter server version must be 5.5 or higher.

      • The username passed to the tool must have read privileges on one or more VMs. The tool is only able to discover information about VMs that are accessible to the specified user. The read privilege is typically assigned to all roles except for No Access.

      • The username passed to the tool must have read privileges on the host ESX. If there are multiple ESX servers, read privileges are required for every ESX that hosts a discovered VM.

    • To use mfit to run the collection scripts remotely for VMware VMs:

      • You need the permissions described above for running VMware discovery.

      • The username passed to the tool to connect to vSphere must have the following privileges on the VM: Guest operation modifications, Guest operation program execution, and Guest operation queries.

      • The VM user credentials used by mfit to execute the script must have admin privileges (Windows VM).

    • To use mfit to run the collection scripts remotely using ssh:

      • The Linux machine hosting mfit must have ssh access to the source Linux VM (Windows VMs are not supported).
  • Collection scripts

    • mfit-linux-collect.sh (Linux), runs on all Linux versions.

    • mfit-windows-collect.ps1 (Windows) requires PowerShell 2.0 or later (not PowerShell Core), and either a GUI shell (not server core) or .Net framework 4.5 or higher.

Installation

The following procedures describe how to install mfit and the collection scripts.

To install mfit:

  1. Create a directory for the mfit tool on a Linux VM:

    mkdir m4a
    cd m4a
  2. Download the assessment tool and make it executable:

    wget https://anthos-migrate-release.storage.googleapis.com/v1.8.1/linux/amd64/mfit
    chmod +x mfit
  3. To view help information for an mfit command, use the --help option. For example:

    ./mfit --help

    To view help for a specific command, use the --help option with the command. For example:

    ./mfit discover import --help

To install mfit-linux-collect.sh:

  1. Log in to the VM.

  2. Create a directory for the collection script:

    mkdir m4a
    cd m4a
  3. Download the collection script to the VM and make it executable:

    wget https://anthos-migrate-release.storage.googleapis.com/v1.8.1/linux/amd64/mfit-linux-collect.sh
    chmod +x mfit-linux-collect.sh

To install mfit-windows-collect.ps1:

  1. Log in to your VM.

  2. Open PowerShell using the Run as Administrator option.

  3. Create a directory for the collection script:

    mkdir ~\m4a
    cd ~\m4a
  4. Download the collection script to the VM by using the following URL:

    https://anthos-migrate-release.storage.googleapis.com/v1.8.1/windows/amd64/mfit-windows-collect.ps1

Perform an assessment

Perform an assessment by performing all of the following assessment phases:

Discover and collect data

Gather data by:

  • Discovery (VMware only): Run the mfit tool to perform an inventory discovery using the vSphere API to collect data about all VMs in a vCenter visible to the user running the tool. The mfit tool connects to the remote vCenter using a username and password passed to the tool. Therefore you require these credentials before you can run the tool.

  • Collection: Run the data collection script on a VM to be migrated. The script collects data about the VM and writes that data to a tar file (Linux) or zip file (Windows). Upload the file to a central machine for assessment by the mfit tool.

    You can run the script locally on the VM, or run the script remotely using mfit. Remote execution is supported by mfit for Linux and Windows VMs deployed on VMware, and for Linux VMs accessible by mfit over ssh.

The following sections describe how to perform a discovery (VMware only) and how to run the collect scripts:

Perform a discovery (VMware only)

  1. Change to the m4a directory:

    cd m4a
  2. Run the following command to perform the discovery:

    ./mfit discover vsphere -u USERNAME --url https://VSPHERE_URL
  3. Enter the vCenter password when prompted.

  4. You can now Assess the collected data as described below.

Collect data remotely using VMware tools

For VMs hosted on vSphere, mfit can use VMware tools to deploy and run the collection scripts remotely on both Linux and Windows VMs. When using VMware tools, the mfit tool:

  • Uploads the collection script to the VM
  • Runs the script on the VM
  • Downloads and imports the results

You require two sets of credentials to collect the data remotely:

  • The vCenter server username passed to the tool to connect to vSphere must have the following privileges on the VM: Guest operation modifications, Guest operation program execution, and Guest operation queries.

  • The VM user credentials used by mfit to execute the script must have admin privileges (Windows VM). While the VM user credentials do not require root access, having root access guarantees that mfit can collect all fit assessment data.

To collect data using VMware tools:

  1. Log in to your Linux VM hosting mfit.

  2. Change to the m4a directory:

    cd ~/m4a
  3. Pass the vCenter server user and VM user credentials to the command:

    mfit discover vsphere guest --url https://VSPHERE_URL \
       -u VCENTER_USER  --vm-user VM_USER VM_ID

    You are prompted to enter the password for the VCENTER_USER and VM_USER.

    If you have vSphere cluster has multiple data centers, you must use the --dc option to specify the data center name:

    mfit discover vsphere guest --url https://VSPHERE_URL --dc DATACENTER_NAME \
       -u VCENTER_USER --vm-user VM_USER VM_ID

Collect data remotely over SSH

If the Linux machine hosting mfit has ssh access to the source Linux VM (Windows VMs are not supported), mfit can connect to the remote VM over ssh to collect data.

When using ssh, the mfit tool:

  • Uploads the collection script to the VM.
  • Runs the script on the VM with the VM user credentials passed to mfit. While the VM user credentials do not require root access, having root access guarantees that mfit can collect all fit assessment data.
  • Downloads and imports the results.

You can use two modes to run ssh:

  • native (default): Uses the ssh binary and configurations on the mfit machine. Native mode can use the local SSH configuration files by default, such as ~/.ssh/config and ~/.ssh/known_hosts, of the workstation hosting it.

    You cannot specify the VM user password or SSH private key file passphrase on the command line. You must enter them when prompted.

  • embedded: Uses the built-in ssh library. This mode lets you use the embedded ssh client if, for some reason, native mode malfunctions in your environment. However, it does not use the local SSH configuration files by default. You can use the -i option to specify an SSH private key file.

To collect data over ssh:

  1. Log in to the Linux VM hosting mfit.

  2. Change to the m4a directory:

    cd ~/m4a
  3. Run mfit:

    1. Use native mode (default) to collect data:

      mfit discover ssh VM_IP_HOSTNAME

      The SSH private key file of the user invoking mfit is used for SSH authentication.

      Enter the username of an account on the Linux VM when prompted. The collection script runs using these credentials. You are also prompted for a password if the SSH private key of the user invoking mfit fails authenticating to the VM with the user name.

    2. Specify the VM user with native mode:

      mfit discover ssh -u USER VM_IP_HOSTNAME

      Enter the password for the user when prompted.

    3. Use the -v option to specify verbose mode:

      mfit discover ssh -u USER -v VM_IP_HOSTNAME
    4. Use the -i option to specify the SSH private key file. For example, to specify .ssh/my_private_key:

      mfit discover ssh -i ~/.ssh/my_private_key -u USER VM_IP_HOSTNAME
    5. Use embedded mode to specify the password on the command line:

      mfit discover ssh --ssh-client embedded -u USER -password PASSWORD VM_IP_HOSTNAME

      Because the embedded form of the command does not use the local SSH configuration files by default, the USER specified in the command must be able to access the VM over ssh and have privileges on the VM to execute the collection script.

    6. Use the -i option with embedded mode:

      mfit discover ssh --ssh-client embedded -i ~/.ssh/id_rsa -u USER -password PASSWORD VM_IP_HOSTNAME
    7. The mfit command lets you specify most ssh flags. These flags are then passed to the ssh command using the -a/--ssh-args option. For example:

      mfit discover ssh -u USER \
        -a '-o' -a 'ProxyCommand=nc -X 5 -x 127.0.0.1:proxy port %h %p'
        VM_IP_HOSTNAME

Collect data on an individual Linux VM

You typically run the script by specifying the sudo option. You can optionally run the script using the privileges of the user running the tool. However, the script might not be able to collect all assessment data.

  1. Log in to your VM.

  2. Change to the m4a directory:

    cd m4a
  3. Run the collection script on the VM:

    sudo ./mfit-linux-collect.sh

    The script outputs a tar file named m4a-collect-MACHINE_NAME-TIMESTAMP.tar to the current directory and to /var/m4a/m4a-collect-TIMESTAMP.tar. The timestamp is in the format YYYY-MM-DD-hh-mm. See collection script operation for a description of the tar file format.

    You can pass the optional arguments to the script:

    • --user to run this script using the privileges of the user running the tool (omit sudo when running with this option). Running with --user means some data that requires sudo access might not be collected, which can decrease the quality of the fit assessment.
    • --readonly to omit writing the output to /var/m4a/m4a-collect-TIMESTAMP.tar. Note that some features of Migrate for Anthos and GKE rely on this information. See Integration with workload migration for more information.
    • --output to save the tar file under the specified path.
  4. You can now Assess the collected data as described below.

Collect data on an individual Windows VM

  1. Log in to your VM.

  2. Open PowerShell using the Run as Administrator option.

  3. Change to the m4a directory:

    cd ~\m4a
  4. Run the collection script on the VM:

    powershell -ExecutionPolicy ByPass -File .\mfit_windows_collect.ps1

    The script outputs a zip file named m4a-collect-MACHINE_NAME-TIMESTAMP.zip to the current directory. Include an output path to specify a different location:

    .\mfit_windows_collect.ps1 \path\to\output\file.zip
  5. You can now Assess the collected data as described below.

Assess the collected data

To perform an assessment, run mfit on the data collected during the collection phase.

To perform an assessment:

  1. Change to the m4a directory:

    cd m4a
  2. If you ran the data collection scripts manually on a VM gather data:

    1. For each VM you are assessing, upload the tar file (Linux) or zip file (Windows) from the VM to the machine running mfit.

    2. Import the tar file (Linux) or zip file (Windows) to the mfit repository:

      ./mfit discover import m4a-collect-MACHINE_NAME-TIMESTAMP.tar
      ./mfit discover import m4a-collect-MACHINE_NAME-TIMESTAMP.zip

      Repeat this step for every tar file and zip file you created. Alternatively, import multiple files in a single command by separating each file with a space:

      ./mfit discover import m4a-collect-MACHINE_NAME_1-TIMESTAMP.tar  m4a-collect-MACHINE_NAME_2-TIMESTAMP.tar ...
  3. To see the list of VMs with data imported into mfit:

    ./mfit discover ls
  4. Perform the assessment:

    ./mfit assess
  5. You can now Generate a report to view the assessment results.

To delete the collected data for a VM:

  1. To delete the data for a VM from the mfit repository:

    ./mfit discover delete --vm VM-ID

    Where VM-ID is the value of the ID column for the VM returned by the ./mfit discover ls command.

  2. To delete the data for all VMs:

    ./mfit discover delete --all

    You are prompted to confirm the delete.

Generate a report

Use the mfit tool to produce a detailed report describing the assessment for each VM. You can create the report as an HTML, JSON, or CSV file.

  1. Change to the m4a directory:

    cd m4a
  2. To generate an HTML report of the assessment:

    1. Run the following command:

       ./mfit report --format html > REPORT_NAME.html

      The tool outputs to the current directory an HTML file named REPORT_NAME.html.

    2. Open REPORT_NAME.html in a browser to view the report. See Report content for a description of the file format.

  3. To generate an JSON report of the assessment:

    1. Run the following command:

      ./mfit report --format json >  REPORT_NAME.json

      The tool outputs to the current directory a JSON file named REPORT_NAME.json.

    2. Upload the JSON file to the Google Cloud Console.

      The output files contain information about the assessment, including the fit assessment. See Report content for more information.

  4. To generate a CSV report of the assessment:

    1. Run the following command:

      ./mfit report --format csv >  REPORT_NAME.csv

      The tool outputs to the current directory a JSON file named REPORT_NAME.csv.

    2. Import the CSV report into your data visualization utility.

      The output files contain information about the assessment, including the fit assessment. See Report content for more information.

Collection script operation

The collection script runs a series of Linux commands to gather information about the source VM and also collects information from several files on the VM.

The public preview performs the same collection operation as the current Linux discovery tool. See collection script operation for more information.

Assessment operation

The mfit tool examines the data collected from a VM, applies a set of rules, and creates a report containing the fit assessment results.

Linux VM assessment rules

The public preview uses the same assessment rules as the current Linux discovery tool. See Analyze tool operation for more information.

Windows assessment rules

The public preview uses the following assessment rules for Windows VMs:

Rule ID Description Severity Notes
A1W-APP-1 No Windows IIS applications found. No fit Migrate for Anthos and GKE requires Windows VMs to run Microsoft IIS 7 or higher.
A1W-APP-2 Windows version not supported for migration. No fit Migrate for Anthos and GKE requires Windows Server 2008 R2 or higher.
A1W-APP-3 Windows IIS not installed. No fit Migrate for Anthos and GKE requires Windows VMs to run Microsoft IIS 7 or higher.
A1W-APP-4 Failed to locate Windows IIS configuration. Needs moderate effort Ensure shared configuration is disabled for Windows IIS.
A1W-APP-5 Docker running on VM. Nesting Docker inside containers is not supported. Good fit Consider running the container directly on GKE/Anthos.
A1W-APP-6 ASP.NET Core applications are not supported. Needs major effort
A1W-APP-7 IIS site with virtual directory located on a network drive. Needs moderate effort Consider moving the Windows IIS application to a local drive.
A1W-APP-8 Found an IIS application with a missing virtual directory. Needs moderate effort Consider disabling the Windows IIS application.
A1W-APP-9 Found an application pool with an Active Directory identity. Needs moderate effort Configure a Group Managed Service Account (GMSA).