Following on from my post on Creating a local user in vRA7 using the REST API i wanted to try and script the entire process of creating multiple vRealize Automation 7 tenants as in our lab as we often need to spin up multiple tenants for testing or development purposes.
Some assumptions:
- Each tenant has the same prefix of “dev-” and is appended with a 3 digit number starting at “001”
- Each tenant gets the same local user created with matching credentials
- Each tenant gets the same AD directory added
- Each tenant gets the same AD groups added
This script will do the following:
- Log into the default tenant
- Create a new tenant
- Create a local user for the tenant
- Add the local user as a tenant & IaaS admin
- Log into the new tenant as the local user
- Setup identity store directories
- Log back into the default tenant
- Edit the new tenant
- Add domain users/groups as tenant & IaaS admins
- Log into the new tenant as a tenant and IaaS admin and start configuring the tenant
So as to avoid the requirement to edit the powershell script directly i put all configuration variables in an external .cfg file. This file needs to be placed in the same directory as the powershell script.
Firstly here is the config file contents. Edit each variable to match your environment. Modify the numberOfTenants variable to set the number of tenants you want to create. The example below will create 20 tenants.
[vRA FQDN] VRA=vra-vip.domain.local [vRA Credentials to acquire authentication token] vRAUsername=administrator@vsphere.local vRAPassword=Password123! vRADefaultTenant=vsphere.local [Create tenant details] numberOfTenants=2 tenantIDPrefix=dev- tenantURLPrefix=dev- tenantNamePrefix=dev- tenantDescription=DevelopmentTenant tenantemailAddress=admin@vsphere.local [Local Admin User Details] firstName=vRA lastName=Admin emailAddress=vraadmin@vsphere.local description=vRAAdmin locked=false disabled=false password=Password123! domain=vsphere.local userName=vraadmin name=vraadmin [Tenant Directory Details] adDomain=domain.local adDomainalias=Domain type=AD adUserNameDn=cn=adbind_vra,OU=EHC,DC=domain,DC=local adBindPassword=Password123! adURL=ldap://domain.local:389 adGroupBaseSearchDn=ou=EHC,DC=domain,DC=local adUserBaseSearchDn=ou=EHC,DC=domain,DC=local [AD Domain Groups to add as Tenant & IaaS Admins] tenantAdmins=EHC_Tenant_Admins@domain.local tenantRoleID=CSP_TENANT_ADMIN iaasAdmins=EHC_IaaS_Admins@domain.local iaasRoleID=COM_VMWARE_IAAS_IAAS_ADMINISTRATOR
And here is the script to create the tenants. It is broken up into multiple functions
# Script to create vRA7 Tenants in bulk
# Ensure you update the associated cfg file
# with the details of your vRA environment
# and details of the tenants you wish to create
# Created by Brian O'Connell
# Version 1.0.0
# Import configuration variables from external cfg file
Get-Content createvRATenants.cfg | Foreach-Object{
if ($_.length -gt 0) {
$var = $_ -Split '=',2
New-Variable -Name $var[0] -Value $var[1]
}
}
Function getvRAAuthToken {
# Construct credentials from config file
$credentials=@{username=$vRAUsername;password=$vRAPassword;tenant=$vRADefaultTenant}
############# Get Auth token ###############
$headers=@{
"Accept"="application/json"
}
$Global:token = Invoke-RestMethod -Uri "https://$($VRA)/identity/api/tokens" -Method Post -Headers $headers -ContentType application/json -Body (ConvertTo-Json $credentials) | Select -ExpandProperty id
Write-Host "vRA Authentication Token Acquired" -ForegroundColor Green
}
Function createvRATenant {
# ############ Create Tenant ###############
$headers = @{"Accept" = "application/json"}
$headers.Add("Authorization", "Bearer $token")
#Create the Tenant
for ($firstTenantNumber=1; $firstTenantNumber -le $numberOfTenants; $firstTenantNumber++)
{
New-Variable -Name "var$firstTenantNumber" -Value $firstTenantNumber
$tenantNumber = $firstTenantNumber.ToString("000")
$tenantid = -join ($tenantIDPrefix,$tenantNumber)
$tenantURL = -join ($tenantURLPrefix,$tenantNumber)
$tenantName = -join ($tenantNamePrefix,$tenantNumber)
$tenantBody= @"
{
"@type": "Tenant",
"id": "$tenantid",
"urlName": "$tenantURL",
"name": "$tenantName",
"description": "$tenantDescription",
"contactEmail": "$tenantemailAddress"
}
"@
$createTenant = Invoke-RestMethod -Method PUT -URI "https://$($VRA)/identity/api/tenants/$($tenantID)" -headers $headers -ContentType application/json -body $tenantBody
Write-Host "Tenant $($tenantName) created successfully" -ForegroundColor Green
}
}
Function createvRALocalAdminUser {
############# Create Local Admin User ###############
$headers = @{"Accept" = "application/json"}
$headers.Add("Authorization", "Bearer $token")
$userBody= @"
{ "@type": "User",
"firstName": "$firstName",
"lastName": "$lastName",
"emailAddress": "$emailAddress",
"description": "$description",
"locked": false,
"disabled": false,
"password": "$password",
"domain": "$domain",
"userName": "$userName",
"principalId": {
"domain": "$domain",
"name": "$name"
}
}
"@
for ($firstTenantNumber=1; $firstTenantNumber -le $numberOfTenants; $firstTenantNumber++)
{
New-Variable -Name "var$firstTenantNumber" -Value $firstTenantNumber
$tenantNumber = $firstTenantNumber.ToString("000")
$tenantid = -join ($tenantIDPrefix,$tenantNumber)
#Create the user
$createUser = Invoke-RestMethod -Method Post -URI "https://$($VRA)/identity/api/tenants/$($tenantID)/principals" -headers $headers -ContentType "application/json" -body $userBody
Write-Host "Local Admin User for tenant $($tenantid) created successfully" -ForegroundColor Green
}
}
Function updatevRALocalAdminUserRoles {
############# Add Local Admin User to Tenant & IaaS Admin groups ###############
$headers = @{"Accept" = "application/json"}
$headers.Add("Authorization", "Bearer $token")
$principal = "vraadmin@vsphere.local"
$roleIDs = @("CSP_TENANT_ADMIN","COM_VMWARE_IAAS_IAAS_ADMINISTRATOR")
for ($firstTenantNumber=1; $firstTenantNumber -le $numberOfTenants; $firstTenantNumber++)
{
New-Variable -Name "var$firstTenantNumber" -Value $firstTenantNumber
$tenantNumber = $firstTenantNumber.ToString("000")
$tenantid = -join ($tenantIDPrefix,$tenantNumber)
#Add the user to tenant & IaaS admins
foreach ($roleID in $roleIDs) {
$makeUserAdmin = Invoke-RestMethod -Method PUT -URI "https://$($VRA)/identity/api/authorization/tenants/$($tenantID)/principals/$($principal)/roles/$($roleID)" -headers $headers -body "{}"
}
Write-Host "Local Admin User Added to Tenant & IaaS Admins for tenant $($tenantid) " -ForegroundColor Green
}
}
Function createvRATenantDirectory {
############# Add AD Tenant directory ###############
$headers = @{"Accept" = "application/json"}
$headers.Add("Authorization", "Bearer $token")
$directoryBody= @"
{"@type": "IdentityStore",
"domain": "$adDomain",
"name": "$adDomain",
"alias": "$adDomainalias",
"type": "$type",
"userNameDn": "$adUserNameDn",
"password": "$adBindPassword",
"url": "$adURL",
"groupBaseSearchDn": "$adGroupBaseSearchDn",
"userBaseSearchDn": "$adUserBaseSearchDn"
}
"@
for ($firstTenantNumber=1; $firstTenantNumber -le $numberOfTenants; $firstTenantNumber++)
{
New-Variable -Name "var$firstTenantNumber" -Value $firstTenantNumber
$tenantNumber = $firstTenantNumber.ToString("000")
$tenantid = -join ($tenantIDPrefix,$tenantNumber)
#Create the directory
$createDirectory = Invoke-RestMethod -Method Post -URI "https://$($VRA)/identity/api/tenants/$($tenantID)/directories" -headers $headers -ContentType "application/json" -body $directoryBody
Write-Host "Tenant Directory Created for tenant $($tenantid) " -ForegroundColor Green
}
}
Function addDomainGroupstovRAAdmins {
############## Add AD Domain Groups to vRA Tenant & IaaS Admin groups ###############
$headers = @{"Accept" = "application/json"}
$headers.Add("Authorization", "Bearer $token")
#Add the user to tenant & IaaS admins
for ($firstTenantNumber=1; $firstTenantNumber -le $numberOfTenants; $firstTenantNumber++)
{
New-Variable -Name "var$firstTenantNumber" -Value $firstTenantNumber
$tenantNumber = $firstTenantNumber.ToString("000")
$tenantid = -join ($tenantIDPrefix,$tenantNumber)
$addTenantAdmins = Invoke-RestMethod -Method PUT -URI "https://$($VRA)/identity/api/authorization/tenants/$($tenantID)/principals/$($tenantAdmins)/roles/$($tenantRoleID)" -headers $headers -body "{}"
$addIaaSAdmins = Invoke-RestMethod -Method PUT -URI "https://$($VRA)/identity/api/authorization/tenants/$($tenantID)/principals/$($iaasAdmins)/roles/$($iaasRoleID)" -headers $headers -body "{}"
Write-Host "Domain groups added to as tenant & IaaS admins for tenant $($tenantid) " -ForegroundColor Green
}
}
# Call All functions to setup tenants
getvRAAuthToken; createvRATenant; createvRALocalAdminUser; updatevRALocalAdminUserRoles; createvRATenantDirectory; addDomainGroupstovRAAdmins
LifeOfBrianOC 