Google Cloud plug-in for VMware vRealize

Introduction

The Google Cloud Plug-in for VMware vRealize Orchestrator lets you provision and manage Google Cloud resources using vRealize Orchestrator and VMware vRealize Automation, including Compute Engine instances, GKE clusters, Cloud Spanner and Cloud SQL instances, and Cloud Storage buckets.

Benefits

The Google Cloud Plug-in for vRealize provides a consistent management and governance experience across on-premises and Google Cloud-based IT environments. For example, you can use Google-provided blueprints or build your own blueprints for Compute Engine resources and publish to the vRealize service catalog. This means that you can select and launch resources predictably using a tool you're already familiar with when you orchestrate VMs in your on-premises VMware environment.

Prerequisites

You need a Google Billing account to complete the instructions in this guide. If you don't have an account, see Create, Modify, or Close Your Billing Account. New Google Cloud users might be eligible for a free trial.

This guide assumes that you have a working knowledge of the following:

• Google Cloud, especially the concepts in Google Cloud for Data Center Professionals
• VMware vRealize Orchestrator
• VMware vRealize Automation

Supported Google Cloud products

The plug-in supports the following Google Cloud resources:

• BigQuery
• Filestore
• Cloud KMS
• Pub/Sub
• Spanner
• Cloud SQL
• Cloud Storage
• Compute Engine
• IAM service accounts and keys
• Google Kubernetes Engine clusters
• Virtual Private Cloud networks and firewall rules
• Turnkey VM-based application servers:
  • ASP.NET
  • MS SQLServer Enterprise
  • WordPress
  • LAMP
  • HA load-balanced Compute Engine VM cluster

Setting up the Google Cloud plug-in for vRealize

This section explains how to install and configure the plug-in.

Note: Use of the plug-in is subject to the Google Cloud Terms of Service.

Set up your Google Cloud environment

1. Sign in to your Google Account.

   If you don't already have one, sign up for a new account.

2. In the Google Cloud Console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to the project selector page

3. Make sure that billing is enabled for your Cloud project. Learn how to confirm that billing is enabled for your project.

4. Enable the Compute Engine API.

   Enable the API

Download the plug-in

• On a computer where you have access to the vRealize Orchestrator Control Center, download the latest version of the Google Cloud plug-in for vRealize from the following location:

  https://storage.googleapis.com/cpe-ti-vmware/signed/o11nplug-in-gcp-plug-in-for-vro.vmoapp

Create and download service account JSON

In order to have the Google Cloud plug-in for vRealize interact with your Google Cloud resources, the plug-in needs to have a service account credential that is used to authenticate API calls to Google Cloud.

1. In the Cloud Console, go to the select IAM & admin page

   Go to the IAM & admin page

2. Select Service accounts and then click Create Service Account.

3. Give the service account a name and optionally provide a description.

4. Click Create.

5. Grant the following roles to the service account. (Use the filter box at the top to find these roles.)

   • To enable the plug-in to create and manage Compute Engine instances, add the Compute Admin and Service Account User roles.
   • To enable the plug-in to manage GKE clusters, add the Kubernetes Engine Admin role.
   • To enable the plug-in to manage Pub/Sub topics and subscriptions, add the Pub/Sub Admin role.

   To enable the plug-in to manage additional resource types, add the appropriate role. For more information, see Understanding Service Accounts.

6. Alternatively, to enable the plug-in to manage all Google Cloud resource types, give the service account the Editor role on the project. However, it's a best practice to grant the fewest privileges that are necessary in order for the plug-in to manage your Google Cloud resources.

7. When you've finished assigning roles, click Continue.

8. Click Create Key and select the JSON option.

Your browser downloads a new service account credential file in JSON format that contains the service account private key. Store this in a secure location, because you need it later to create the Google Cloud connection in the plug-in.

Note: You can change the roles assigned to a service account at any time. To do so, in the GCP Console, go to IAM & admin > IAM. Find your service account in the list of project members and then click .

Install the plug-in in vRealize Orchestrator

You can now configure the plug-in in vRealize Orchestrator.

1. In your browser, log in to the vRealize Orchestrator Control Center as an administrator. The URL is typically like the following:

   https://hostname:8283/vco-controlcenter

2. Go to the Manage Plug-Ins page.

3. Browse for the plug-in file you downloaded and click Upload.

4. If you accept the EULA, click Install.

5. If you're prompted, click Save Changes.

   Wait for vRealize Orchestrator to restart its services before you use the plug-in. The restart might take a few minutes. You'll know that vRealize Orchestrator has restarted when you see all green checkmarks in the Validate Configuration page.

   

Establish a Google Cloud connection in vRealize Orchestrator

The final stage in the setup is to use the service account credential file you downloaded earlier to establish a connection in the vRealize Orchestrator. Doing this allows the plug-in to execute operations on behalf of any logged-in vRealize Orchestrator user.

1. In the Workflows tab of vRealize Orchestrator, select Library > GCP > Configuration > Create GCP Connection.
2. Provide a name for the connection.

3. Provide the key in either of these ways:

   • Attach the service account credential file that you downloaded earlier
   • Paste the credential in the Paste JSON-encoded Service Account field.

   

4. If your vRealize Orchestrator server needs to connect to a proxy server before reaching the public internet, check the Use proxy? option and provide your proxy server details:

   

5. When workflow completes, go to the Inventory tab in the vRealize Orchestrator client.

   In the Google Cloud Platform tree entry, you see a new subtree with your connection name and project ID. Unless you already have Google Cloud resources, most of the tree nodes are empty except for the ones available by default in a project. These include Compute Regions/Zones, the default network and firewall rules, and the service account that you created and used to establish the connection from vRealize Orchestrator.

   

You have now completed the configuration of the plug-in, and you can run any of the other workflows available in the Google Cloud directory.

Working with Google Cloud resources in vRealize Orchestrator and vRealize Automation

This section provides an overview of using workflows in the Google Cloud plug-in for vRealize.

Note: This tutorial provides instructions for working with this app: vRealize Orchestrator version 7.5. The instructions might not represent newer versions of the app. For more information, see the documentation: vRealize Orchestrator.

Authenticating and authorizing users

vRealize administrators and users authenticate to vRealize Orchestrator and vRealize Automation using vRealize role-based access management. vRealize roles are not mapped to IAM permissions. Instead, all vRealize user and administrator actions are performed using the same Google Cloud service account that was used when creating the connection. The service account must have appropriate IAM permissions to allow vRealize users to provision resources in Google Cloud, as described earlier.

You can create more than one connection, each one using different Google Cloud projects and service accounts. This lets you isolate user and administrator actions by granting specific user groups access to a connection. You can specify a different connection for each workflow that's used to create a new resource, and each workflow that operates on an existing resource infers the connection from the project ID where the resource is located.

Note: Because a service account is used to connect to Google Cloud, Google Cloud audit logs show the service account as the user. To see audit activity by individual users, refer to the vRealize Orchestrator and vRealize Orchestrator log.

Running Google Cloud workflows in vRealize Orchestrator

The workflows included in the Google Cloud plug-in for vRealize Orchestrator allow your users to create many common Google Cloud resources, including Compute Engine instances, GKE clusters, Virtual Private Cloud firewall rules, Cloud Storage buckets. In general, workflows for creating these resources can be accessed within the folder for the resource type (for example, Instances for Compute Engine instances).

As an example of how to run a Google Cloud workflow, the following section describes how to build a Compute Engine instance.

Create a Compute Engine instance

1. In the vRealize Orchestrator folder, open GCP > Instances, and then click Create Instance.

   

2. Select a Google Cloud connection. This provides the authorization credential to be able to interact with Google Cloud APIs.

   

3. Use the fields to customize the configuration of the VM instance, such as specifying the region, zone, instance name, machine type, and so on. Required fields are marked with a red asterisk.

   

4. Click Next to move to additional pages that let you specify options like a startup script, tags, an external IP address, and an SSH key.

   

5. Optionally, examine the information in the Price estimate form. This page provides an estimated calculation of the monthly cost for running the VM. This is not intended to be an exact measure of your expected billing charges, but can provide a rough estimate to use for budgeting purposes.

   

6. When you've finished specifying options, click Submit.

   In the Logs tab of the workflow execution page, you see diagnostic information that indicates the status of the create operation.

   

   The workflow completes after a few seconds. You can then reload the VM instances node to view the new instance in the vRealize Orchestrator inventory tree.

   

7. To show attributes of the new instance, click it in the listing.

   

8. Optionally, in the Cloud Console, go to the VM Instances page and find your new instance.

   

Execute a Day 2 workflow on an existing Compute Engine instance

In VMware documentation, Day 2 operations are those that you perform after initial provisioning. This section describes how to execute an operational workflow on a Google Cloud resource.

As an example, the following procedure shows how to run a workflow on an existing Compute Engine instance.

1. In vRealize Orchestrator, right-click the resource and select Run workflow.

   

2. Click on the workflow to execute, and then click Select.

   

   The VM instance is populated in the form field.

3. Run the workflow to perform the action. (In this case, to reset the instance.)

   

   A dialog appears and remains on the screen until the workflow completes. You may optionally choose to send the workflow to the background if you want to perform other tasks while it runs.

4. Optionally, go to the Cloud Console and note the effect of running the workflow.

   

Using vRealize Automation with Google Cloud

The Google Cloud plug-in for vRealize Orchestrator enables vRealize Automation administrators to create blueprints of Google Cloud resources and publish them to the vRealize Automation catalog. End users can request and deploy blueprints.

For more information, see Designing and Publishing Blueprints in the VMware documentation.

Creating XaaS blueprints in vRealize Automation from vRealize Orchestrator

This section describes the procedure for using workflows provided by vRealize Orchestrator and by the Google Cloud plug-in for vRealize Orchestrator to import the XaaS resource types and blueprints that you intend to use inside of vRealize Automation.

Add a vRealize Automation host

1. In vRealize Orchestrator, go to the Workflows tab and then open vRealize Automation > Configuration.

2. Run the Add a vRA Host workflow.

   

3. Provide the information for your vRealize Automation host. Be sure to use a user account that has IaaS administrative roles assigned to it.

Import XaaS custom resources

1. In vRealize Orchestrator, go to the Workflows tab and then open GCP > vRA Blueprints.

2. Run the Import XaaS Custom Resources workflow.

   

3. Choose your vRealize Automation host and select the Google Cloud resource types that you want to have available in vRealize Automation. For example, if you want to manage Cloud Storage resources in vRealize Automation, select Google Cloud:Bucket and Google Cloud:StorageObject. By default, all Google Cloud types available in the plug-in are selected.

   

4. Submit the workflow.

   When it completes, you see the imported custom resources in the Design > XaaS > Custom Resources section of vRealize Automation.

   

Import XaaS service blueprints

1. In vRealize Orchestrator, go to the Workflows tab and open GCP > vRA Blueprints.

2. Run the Import XaaS Services Blueprints workflow.

   

3. Choose your vRealize Automation Host and select the workflows that create instances of the custom resource types that you imported in the previously. For example, the BigQuery > Create Dataset workflow is available because it is used to create a Google Cloud:Dataset.

   You can select as many workflows as you want based on the custom resource types known to your vRealize Automation Host. The service name field is used to define the name of the vRealize Automation service catalog.

   

4. Submit the workflow.

   When it completes, you see all of the imported blueprints under the Design > XaaS > XaaS Blueprints section in vRealize Orchestrator.

   

5. To verify the workflows, in vRealize Orchestator, go to Administration > Catalog Management > Catalog Items.

   You see that the new Google Cloud service has been added and that each of the XaaS blueprints has been added as a catalog item within the new service.

   

Create an entitlement for Google Cloud service catalog items

To allow users to create and manage Google Cloud resources, you create an entitlement that specifies the Google Cloud service, along with the catalog items and actions that will be available.

For details, see Entitlements in the VMware documentation.

After the entitlement is created and made active, users that are a part of the assigned business group see the Google Cloud catalog items as options.

Create actions for custom resources

Day 2 operations on custom resources need to be created as actions.

1. In vRealize Orchestrator, go to the Workflows tab and then open GCP > vRA Blueprints.

2. Run the Create Actions for Custom Resource workflow.

   

3. Choose your vRealize Automation host and then type the name of the custom resource type you want to create actions for.

   

4. Submit the workflow.

   When it completes, you see the actions as published resource actions in the Design > XaaS > Resource Actions section of vRealize Automation.

   

5. Optionally, enable the actions in the entitlement established for your users. This makes sure that they appear on created resources managed by vRealize Automation.

   

Note: Resource actions that are used to dispose of deployments in vRealize Automation need to be marked as Disposal actions after you create them. In the Design > XaaS > Resource Actions section of vRealize Automation, edit the deletion actions and select the Disposal box.

Manually creating XaaS blueprints in vRealize Automation

The procedures in this section describe the manual steps for configuring vRealize Automation to allow your users to run workflows from the Google Cloud Plug-in for VMware vRealize Orchestrator in a vRealize Automation service catalog. This guide assumes you have XaaS Administrator privileges and are familiar with the instructions described in Creating XaaS Blueprints and Actions in the VMware documentation.

For a more efficient means of building vRealize Automation XaaS artifacts, we recommend following the steps in the Creating XaaS Blueprints in vRealize Automation from vRealize Orchestrator section above.

Create a multi-resource blueprint

You can use the vRealize Automation blueprint designer to build reusable templates that consist of multiple XaaS blueprint components.

For example, you can create a blueprint that creates a Compute Engine instance that's running Microsoft SQL Server and that has the associated network and firewall rules. You can use the blueprint designer interface to add Google Cloud resources and create custom blueprints.

Updates and release notes

To get the latest version of the Google Cloud plug-in for vRealize, download it from the following Cloud Storage bucket:

https://storage.googleapis.com/cpe-ti-vmware/signed/o11nplug-in-gcp-plug-in-for-vro.vmoapp

If you are running an older version of the plug-in, you will receive a warning message when you run workflows indicating that a newer version is available.

You can use vRealize Orchestrator to download the latest version of the plug-in.

1. In the Cloud Console, make sure the Cloud Storage JSON API is enabled.

   Go to the Cloud Storage JSON API page

2. In vRealize Orchestrator, go to the GCP > Configuration folder.

3. Run the Download Latest Plugin workflow and provide your Google Cloud connection.

   

   Running the workflow downloads the plug-in's .dar file to a temporary folder.

4. Follow the steps in this VMware KB article 2151653 to copy the plug-in's file to the appropriate location on the vRealize Orchestrator server. Use cp in place of rm in Step 4 to move the downloaded .dar file to the /usr/lib/vco/app-server/plugins/ folder.

   

Release notes are maintained at https://storage.googleapis.com/cpe-ti-vmware/RELEASE_NOTES.txt.

Issues

To report product defects, send an email to [e-mail].