How to get host properties

[John Calcote]

Hi Seba,

First, let me say: You rock man! This is an amazing piece of work. I
started writing my own wrapper around the vmWare SDK using SOAPpy, but
soon I ran into trouble. While searching for answers, I found your
package and it just works. I can't ask for more than that.

My experience with python is a bit limited, so this may seem like an
obvious question to one used to class properties and all, but I can't
figure out how to get host properties without calling internal methods
(e.g., VIServer._get_object_properties). Ultimately, what I'm looking
for is the host root username and password so I can query CIM
information from my vCenter plugin.

Am I even on the right track?

Thanks in advance,
John

[John Calcote]

So, a little more research has shown me what I should have already
known - you can't get ESX(i) host credentials from a vCenter server.
This makes sense: vCenter can of course talk to any ESX host because
you gave it the host root/pwd when you added it to a datacenter or
cluster, but providing host credentials to SDK users is a security no-
no.

This leaves me in a bit of a quandary. Do I have to configure my
vCenter plugin with host credentials for every ESX host added to my
vCenter server? I think not - that makes very little sense to me. It
would seem that a more likely approach would be to have the SDK
support SMI-s passthrough. That is, all SMI-s commands/operations are
passed through the vCenter SDK to the target host (via mor).

Am I getting warmer? :)

John

[Seba]

Hi John,

   Thanks for your words, I'm glad pysphere is useful for you.

That's right, I don't think you can get the hosts credentials from the API. Or at least I haven't found that property listed on the documentation. You should post your question in VMWare forums, and if there's a way to get those credentials via the webservice SDK, then we can get that with pysphere.

By the way to easily retrieve a host property (or from any managed object) you can use the VIProperty class.

You instance it by passing the server object and the MOR object you want to get the properties from as shown in the example below.

There are other more difficult but more efficient ways to retrieve properties from a whole set of managed objects in one single request.

However VIProperty provides you with a simple interface and access to the properties just as described in the vSphere SDK API reference.

For example: Check the documentation of the HostSystem object properties (http://pubs.vmware.com/vsphere-50/index.jsp?topic=/com.vmware.wssdk.apiref.doc_50/vim.HostSystem.html)

>>> from pysphere import *

>>> s = VIServer()

>>> s.connect("vcenter.example.com", "user", "pass")

>>> hosts = s.get_hosts()

>>> print hosts

{'host-1029': 'qa-esx1.example.com',

 'host-120': 'wa-esx1.example.com',

 'host-123': 'wa-esx3.example.com',

 'host-1263': 'qa-esx2.example.com',

 'host-1547': 'qa-esx3.example.com',

 'host-185': 'build-esx1.example.com',

 'host-203': 'dev-esx1.example.com',

 'host-206': 'dev-esx2.example.com',

 'host-399': 'staging.example.com',

 'host-444': 'ew-esx1.example.com',

 'host-5583': '192.168.10.10',

 'host-6577': 'dev-esx3.example.com',

 'host-720': 'qa-esx4.example.com',

 'host-9094': 'mgmt.eng.core.sec'}

#The keys in this dictionary look like regular strings

#But the're actually a subclass of str representing a MOR

# So you need to get the actual key object:

>>> host = [k for k,v in hosts.items() if v=="qa-esx1.example.com"][0]

>>>

# Now let's retrieve the properties of the host "qa-esx1.example.com"

>>> p = VIProperty(s, host)

>>>

>>> p.runtime.bootTime

(2012, 1, 15, 16, 47, 37, 557, 0, 0)

>>> p.runtime.powerState

'poweredOn'

>>> p.summary.config.name

'ew-esx1.es.core-sdi.com'

>>> p.summary.quickStats.overallCpuUsage

1057

>>> p.summary.quickStats.overallCpuUsage

1057

#Notice here that the second call returned the same result

#This is because pysphere caches all the host's properties

#when you requested the first property

#To refresh the properties execute:

>>> p._flush_cache()

>>>

>>> p.summary.quickStats.overallCpuUsage

428

Hope that helps,

Regards.

Sebastián.

2012/3/1 John Calcote

[John Calcote]

As it turns out (I've learned from another vmware plugin developer)
you can't get ESX credentials from vCenter. As I concluded above, this
would be a security hole. Instead, CIM requests are made by plugins
using CIM service tickets. Basically, you need to get a reference to
the target ESX system (as a mor) and call acquireCimservicesTicket().

Any idea how this might be done using pysphere?

[John Calcote]

I just wanted to post my final solution in case others wanted to do
this sort of thing. I'm rather surprised no one has asked about this
yet since all plugins are designed as management extensions for third-
party hardware installed into ESX servers. vmware discourages adding
any agent to the ESX operating environment except for a CIM provider.
But if you're writing a vCenter plugin to manage your add-on hardware,
you need to be able to communicate with your CIM provider, so you'll
need to authenticate to ESX hosts' SMI-s services running on
configured hosts within the vCenter infrastructure. Unless you plan to
have your users configure your plugin with credentials for each added
ESX server (not a very dynamic design), you'll need to acquire a CIM
services ticket from vCenter for a target ESX server.

CIM services tickets are basically login credentials accepted by ESX
hosts' SMI-s services and understood by them to be pre-configured, pre-
authenticated session ids. They have limited lifetimes - initial
access (SMI-s login) has to happen within 120 seconds from the time
they're handed out, or they'll expire. They then expire after 15
minutes of inactivity. They always expire within one hour, regardless
of the level of activity. An interesting thing is that CIM services
tickets are the ONLY way to contact an ESX server's SMI-s service if
the server has been placed in lock-down mode.

Here's the code I used to acquire a CIM services ticket:

from pysphere import VIServer
from pysphere.resources import VimService_services as VI

def get_host_service_ticket(server, mor):
"""Request host (mor) cim services ticket from vCenter
(server)."""
try:
request = VI.AcquireCimServicesTicketRequestMsg()
request.set_element__this(mor)
response = server._proxy.AcquireCimServicesTicket(request)
return response.Returnval.SessionId
except:
logging.warn("Failed to retrieve CIM services ticket from
vCenter server.")
return None

The way it's used is trivial - just pass the services ticket as both
username and password when logging into the SMI-s service. I'm using
pywbem, but any CIM client will work the same way.

Thanks Seba for a great package in pysphere. It's helped me do
everything I've wanted to do.

Regards,
John

[Seba]

Thanks John for sharing this. I really didn't have much idea about CIM, I'm glad you got it working

2012/3/6 John Calcote

[pyjog]

Hi John,

ok it is near 1 year ago as you wrote this :o) but I also try to use the service tickets like you. Unfortunately the code you pasted is not working for me. 

I need to say that I'm a python noobie and so i may miss some basic stuff here but I can't figure out where the problem is.

as far as I understood I need to add the line for 'executing' the definition like this:

get_host_service_ticket(my-esx-ip, Network)

But the result is always:

"Failed to retrieve CIM services ticket from vCenter server."

Well it is clear that I first need to open a valid server connection with user and password like this:

s = VIServer()

host = "192.168.56.99"

user = "root"

password = "abc123456"

s.connect(host, user, password)

so I added this code, too. Same result. I need to say that a connection with the above parameters works fine. E.g. I can get the Network Labels etc.

Hope that you or someone else can help me out here..

Here is my full python code:

#####################################################

#!/usr/bin/env python

from pysphere import VIServer

from pysphere.resources import VimService_services as VI

s = VIServer()

host = "192.168.56.99"

user = "root"

password = "abc123456"

s.connect(host, user, password)

def get_host_service_ticket(server, mor):

    """Request host (mor) cim services ticket from vCenter (server)."""

    try:

        request = VI.AcquireCimServicesTicketRequestMsg()

        request.set_element__this(mor)

        response = server._proxy.AcquireCimServicesTicket(request)

        return response.Returnval.SessionId

    except:

        print("Failed to retrieve CIM services ticket from vCenter server.")

        return None

get_host_service_ticket('192.168.56.99', 'Network')

#####################################################

Thanks

Thomas

On 6 Mrz. 2012, 08:43, John Calcote <john.calc...@gmail.com> wrote:

[....]

> 

> CIM services tickets are basically login credentials accepted by ESX

> hosts' SMI-s services and understood by them to be pre-configured, pre-

> authenticated session ids. They have limited lifetimes - initial

> access (SMI-s login) has to happen within 120 seconds from the time

> they're handed out, or they'll expire. They then expire after 15

> minutes of inactivity. They always expire within one hour, regardless

> of the level of activity. An interesting thing is that CIM services

> tickets are the ONLY way to contact an ESX server's SMI-s service if

> the server has been placed in lock-down mode.

> 

> Here's the code I used to acquire a CIM services ticket:

> 

> from pysphere import VIServer

> from pysphere.resources import VimService_services as VI

> 

> def get_host_service_ticket(server, mor):

>     """Request host (mor) cim services ticket from vCenter

> (server)."""

>     try:

>         request = VI.AcquireCimServicesTicketRequestMsg()

>         request.set_element__this(mor)

>         response = server._proxy.AcquireCimServicesTicket(request)

>         return response.Returnval.SessionId

>     except:

>         logging.warn("Failed to retrieve CIM services ticket from

> vCenter server.")

>         return None

> 

[...]

[pyjog]

Hi,

anyone else  who could help me out?

Thanks

Thomas

[Seba]

Hi Thomas,

  Have you tried removing the try-except statement? You're catching all possibles exceptions that block might be raising and hiding them behind a simple message that does not provide any useful information at all (i.e. "Failed to retrieve CIM ....")

First remove the try-except lines, so the real error with the whole stack trace is printed.

Besides you're calling the method with wrong parameters

get_host_service_ticket('192.168.56.99', 'Network')

the first parameter should be a VIServer instance (in your code: s), the second is a managed object reference.

for example:

a_host_mor= s.get_hosts().keys()[0]
session_id = get_host_service_ticket(s, a_host_mor)

Regards,

Seba.

  try:

       request = VI.AcquireCimServicesTicketRequestMsg()

       request.set_element__this(mor)

       response = server._proxy.AcquireCimServicesTicket(request)

        return response.Returnval.SessionId

    except:

        logging.warn("Failed to retrieve CIM services ticket from

[chendong...@gmail.com]

Hi Seba,

I read this article and still have a question. Some functions or attributes can not be found.

how can I know the attributes of these properties. such as p.runtime.bootTime.

I tried to get attributes by buildin function dir. But can't show all attributes.

Is there any API guide of pysphere or documents?

thanks.

Seba於 2012年3月3日星期六 UTC+8上午5時46分47秒寫道：

[Stuart Reynolds]

Is there a reference where we can find what can be requested in 

  _retrieve_properties_traversal

?

Thanks,

- Stuart