Narsing Shah

Part 2 - Building a Reusable Remote Script Execution Workflow in VMware vRealize Orchestrator

9/12/2015

Preparing the Environment

Before any automation can be executed reliably, the VMware environment and guest operating systems must be prepared for secure remote access. Spending time standardizing the environment significantly reduces workflow failures and eliminates the need for manual intervention during execution.

The objective is simple:

  • Discover virtual machines from vCenter.
  • Authenticate securely.
  • Execute a script.
  • Capture the output.
  • Log the result.

Once these prerequisites are in place, the same workflow can be reused for almost every administrative activity.

Prerequisites

The following software versions represent a typical enterprise deployment around 2015.

Component Version
VMware ESXi 5.5 / 6.0
VMware vCenter 5.5 / 6.0
VMware vRealize Orchestrator 6.x
Linux RHEL 6/7, CentOS 6/7, Oracle Linux
Windows Windows Server 2008 R2 / 2012 R2

The exact versions are not mandatory, but all components should be supported within the same VMware ecosystem.

Registering vRO with vCenter

The first step is integrating vRealize Orchestrator with vCenter Server.

Once connected, vRO automatically imports the complete VMware inventory including:

  • Datacenters
  • Clusters
  • ESXi Hosts
  • Resource Pools
  • Datastores
  • Virtual Machines
  • Folders
  • Networks

From this point onward, workflows can dynamically retrieve virtual machines without relying on manually maintained server lists.

Example inventory structure:

Datacenter
│
├── Production
│   ├── Web Servers
│   ├── Application Servers
│   ├── Database Servers
│   └── Middleware
│
├── Development
│
└── UAT

Instead of hardcoding IP addresses, workflows simply query the inventory and retrieve the required virtual machines.

Organizing Virtual Machines

One common mistake is maintaining static text files containing server names.

web01
web02
web03
db01
db02
...

This approach becomes outdated whenever virtual machines are added or removed.

A better practice is grouping VMs using VMware inventory.

Examples include:

  • Folder
  • Resource Pool
  • Cluster
  • vApp
  • Custom Attribute
  • Naming Convention

Example:

Folder
│
├── SAP
├── Oracle
├── Middleware
├── Linux
└── Windows

A workflow targeting the Linux folder automatically includes every newly provisioned Linux virtual machine without requiring modifications.

Preparing Linux Virtual Machines

Linux systems require only a few configurations before they can participate in automated workflows.

Enable SSH

Verify that the SSH daemon is running.

service sshd status

or

systemctl status sshd

Enable automatic startup.

chkconfig sshd on

or

systemctl enable sshd

Configure Firewall

Permit SSH access from the vRO server.

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
service iptables save

Configure Sudo

Avoid logging in directly as root whenever possible.

Example:

vroadmin ALL=(ALL) NOPASSWD: ALL

This allows workflows to execute privileged commands using sudo while maintaining accountability.

SSH Key Authentication

Although password authentication works, enterprise environments generally prefer SSH key authentication.

Benefits include:

  • Faster authentication
  • No interactive password prompts
  • Better security
  • Easier credential rotation

Preparing Windows Virtual Machines

Windows automation typically relies on PowerShell remoting through WinRM.

Verify that WinRM is enabled.

winrm quickconfig

Enable PowerShell remoting.

Enable-PSRemoting -Force

Allow the required firewall rule.

Enable-NetFirewallRule -DisplayGroup "Windows Remote Management"

Set an appropriate execution policy.

Set-ExecutionPolicy RemoteSigned

These settings allow vRO to execute PowerShell scripts remotely without requiring interactive logins.

Credential Management

Hardcoding passwords inside workflows should always be avoided.

Instead, credentials should be maintained centrally and injected into workflows only during execution.

Typical credential objects include:

Linux Root

Linux Service Account

Windows Administrator

Application User

Database User

A workflow simply references the required credential object.

Benefits include:

  • Easier password rotation
  • Reduced administrative effort
  • Improved security
  • Better auditability

Designing a Generic Script Execution Workflow

One of the biggest advantages of vRealize Orchestrator is that a single workflow can execute many different administrative tasks.

Instead of building separate workflows for every maintenance activity, create one reusable workflow that accepts the required inputs.

Example inputs:

Parameter Description
Target Folder VMware folder containing VMs
Guest OS Linux or Windows
Script Bash, BAT or PowerShell
Credentials Authentication object
Timeout Maximum execution time
Reboot Optional Yes/No

The workflow logic remains identical regardless of the task being performed.

High-Level Workflow

The execution flow is intentionally simple.

Start

↓

Get Virtual Machines

↓

Check Power State

↓

Identify Guest Operating System

↓

Authenticate

↓

Copy Script

↓

Execute Script

↓

Collect Output

↓

Log Result

↓

Generate Report

↓

Finish

Every maintenance activity follows this same sequence.

Dynamic Virtual Machine Selection

Instead of selecting individual virtual machines, workflows should identify systems dynamically.

Examples include:

  • All Linux VMs inside a folder
  • Every VM beginning with APP-
  • Every VM tagged Production
  • Every VM within a resource pool
  • Selected virtual machines from user input

Pseudo-code:

foreach(vm in folder.virtualMachines){

    if(vm.powerState=="poweredOn"){

        ExecuteWorkflow(vm);

    }

}

The workflow automatically scales as new virtual machines are added.

Executing Bash Scripts

For Linux systems, the workflow copies a Bash script to a temporary location before execution.

Example maintenance script:

#!/bin/bash

echo "Hostname: $(hostname)"

yum clean all

yum install -y openssl

echo "Completed Successfully"

Typical execution sequence:

Authenticate

↓

Upload Script

↓

chmod +x script.sh

↓

Execute

↓

Capture Output

↓

Delete Temporary Script

Temporary files should always be removed after execution.

Executing Windows Scripts

Windows systems can execute either Batch files or PowerShell scripts.

Example Batch file:

@echo off

hostname

ipconfig

echo Completed

pause

PowerShell example:

Write-Host "Server:" $env:COMPUTERNAME

Get-Service spooler

Write-Host "Completed"

The workflow uploads the script, executes it remotely, captures the console output, and removes temporary files.

Logging Execution Results

Every workflow execution should generate a log entry.

Example:

------------------------------------------------
VM          : APP-LINUX-001
Status      : Success
Start Time  : 22:01
End Time    : 22:03
Duration    : 2 Minutes
------------------------------------------------

VM          : APP-LINUX-002
Status      : Failed
Reason      : SSH Authentication Failed
------------------------------------------------

VM          : DB-WIN-001
Status      : Success
------------------------------------------------

Keeping execution logs simplifies troubleshooting and provides valuable audit records.

Error Handling

Failures are inevitable in large environments.

Common causes include:

  • SSH timeout
  • WinRM unavailable
  • Incorrect credentials
  • Firewall restrictions
  • VM powered off
  • Disk full
  • Script syntax error

Rather than terminating the workflow, errors should be recorded while processing continues for the remaining virtual machines.

Example:

VM01 ✓

VM02 ✓

VM03 Failed

VM04 ✓

VM05 ✓

VM06 Failed

VM07 ✓

This approach ensures that a single failure does not interrupt the maintenance window.

Retry Logic

Transient failures often resolve automatically.

A practical retry strategy is:

Attempt 1

↓

Failed?

↓

Wait 30 Seconds

↓

Retry

↓

Failed Again?

↓

Log Failure

↓

Continue

Implementing a limited retry mechanism significantly improves overall success rates without manual intervention.

Notifications

At the end of execution, administrators should receive a summary report.

Example:

Workflow Name

Linux Password Rotation

--------------------------------

Target VMs : 150

Successful : 146

Failed : 4

Execution Time : 18 Minutes

Log File : PasswordRotation_20150912.log

This provides immediate visibility into the maintenance activity and highlights any systems requiring manual follow-up.

Best Practices

The following operational practices have consistently proven effective in enterprise environments:

  • Keep workflows generic and reusable.
  • Store scripts in a centralized repository.
  • Use VMware inventory instead of static server lists.
  • Authenticate using service accounts or SSH keys.
  • Validate connectivity before execution.
  • Capture both standard output and error output.
  • Implement retry logic for transient failures.
  • Continue processing even when individual virtual machines fail.
  • Generate detailed execution reports.
  • Remove temporary files after script execution.
  • Test every workflow in Development before Production.

Following these practices results in workflows that are easier to maintain, safer to execute, and capable of scaling from a few virtual machines to several hundred with minimal changes.

Coming Up in Part 3

With the reusable workflow now in place, the next section demonstrates practical enterprise use cases, including rotating root passwords, changing application user passwords, deploying RPM packages for security remediation, applying operating system hardening scripts, executing PowerShell maintenance tasks on Windows virtual machines, and rebooting project-specific groups of virtual machines using a single vRealize Orchestrator workflow.