VCF 9 – Configuration Drift Management Part 1 – vCenter
Today we’ll be looking at one of the new features of VCF 9, Configuration Drift Management. This is the evolution of Host Profiles which were available in vSphere, but unfortunately they were never compatible with VCF so many customers had challenges managing their ESX advanced settings at scale.
We’ll start by creating a vCenter Config Template, running drift detection, then scheduling the drift detection to ensure compliance is maintained.
Log into VCF Operations and browse to Lifecycle / Configuration Drift
Click Next and we’ll see the screen to configure the template. I’m going to create a very simple example here to push out the root password expiry policy to 9999 days, as this is a lab environment.
Policies can be used to target specific vCenters in your environment, but in our example we’ll just be targeting all vCenters so we’re just selecting the default policy.
Click Create and it’ll save our Config Template.
Now that we have created the template, we can run the drift detection.
Go back to Fleet Management / Configuration Drift. We’ll select the Holo-A Instance, then Drifts.
Select the two vCenters and click Detect Drift.
After the Drift Detection runs, we can click on the vCenter to show the results.
At this stage, it looks like we can only detect the drifts and any remediation must be manually performed. Hopefully we’ll get one-click remediation as a feature in the future.
A great use-case for this would be for Security Compliance, where the assigned roles & permissions must match a template, and a drift alert can be raised if we detect new or modified permissions.
Now to schedule the detection to run, we click on “Schedule Drift Detection”
Drag and Drop the vCenters we want to schedule.
We can create some additional scope filters if required.
Create your desired schedule and click Save. We can also schedule notifications once you enable to email plugin.
And that’s it. In Part 2 we’ll set up a Configuration Profile for our Cluster configuration.