CloudBolt Documentation

Action context

Mon, 01 Jan 0001 00:00:00 +0000

Actions are one of the most powerful ways to extend CMP. Besides the action inputs you define, several CMP objects are available as context to any template-enabled action attribute, such as plugin source, a webhook payload, or an email hook body. To see which attributes can be templated for each type, see Action types.

This context is also available outside actions, when custom YAML files provision Kubernetes objects. See Container orchestrators.

Built-in context by use case

Single server action

Run by a user on an existing server.

AD module best practices

Mon, 01 Jan 0001 00:00:00 +0000

The CloudBolt OneFuse integration platform offers an Active Directory Module that provides enterprise-grade Active Directory integration for Organizational Unit (OU) and Group Members for provisioned servers.

The OneFuse Active Directory module offers flexible support for dynamically creating computer objects into Organizational Units, including OUs for use during build time.

Resources

For additional information regarding OneFuse Active Directory, refer to the following documentation:

Prerequisites

For each Active Directory Policy you create, gather the following information:

Add a data protection plan

Mon, 01 Jan 0001 00:00:00 +0000

The connection tells CMP where your backup system is and how to authenticate to it. The imported plans are the subset you want CMP users to choose from.

Prerequisites

At least one protection plan exists in your external backup system.
You must be an administrator to access the Data Protection page.
For Azure Backup, an Azure resource handler is already configured.

Configure your resource handler to identify servers by fully qualified domain name rather than by IP address, since most backup systems track machines by host name.

Add an environment

Mon, 01 Jan 0001 00:00:00 +0000

An environment pairs a resource handler with the groups, parameters, OS builds, and networks available to anyone ordering into it. You need the environment.manage permission to create one.

Create an environment

Go to Admin > Environments.
Select Add, then Create New.
Complete the dialog.
Select Create.

Field	Description
Name	Required. Users see this name when they choose where to deploy, so name it based on what distinguishes it, such as its location, purpose, or the technology behind it.
Description	Optional.
Resource Handler	The handler CMP contacts for every server in this environment. The list shows only those you have access to. See Resource handlers.
Tenant	Appears only when you can choose a tenant. See Multi-tenancy.

CMP opens the new environment’s detail page, where you can associate groups, parameters, OS builds, and networks.

Advanced AWS account configuration

Mon, 01 Jan 0001 00:00:00 +0000

This is an advanced configuration guide

Refer to the configure AWS accounts guide for simplified configuration using our recommended defaults.

Preparing your AWS environment for CloudBolt Platform integration requires IAM roles and an S3 bucket. This page describes how to use a CloudBolt-provided AWS CloudFormation template to create them.

The template creates the following:

Cross-account IAM roles: Least-privilege IAM roles enabling cost report access. The FOCUS role can also create cost report exports on CloudBolt’s behalf (but not delete them).
Permissions for the cost report exports: The template grants CloudBolt the permissions needed to create the FinOps Open Cost and Usage Specification (FOCUS) 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports. When a connection is established, CloudBolt creates any that do not exist.
S3 bucket: Created when CreateS3Bucket=true (default), with policies for report storage. Set CreateS3Bucket=false to use an existing bucket.

Prerequisites

Before you begin, ensure the following:

Alibaba Cloud

Mon, 01 Jan 0001 00:00:00 +0000

Adding the handler creates a Cloud Management Platform (CMP) environment for the region. Before ordering a server, import at least one image and one network into that environment.

Before you begin

Collect an access key pair and decide which region the handler connects to. A handler covers one region, so add a handler for each region you use.

Log in to the Alibaba Cloud user center.
Select Create AccessKey, then Save AccessKey Information.
Keep the downloaded CSV file. It holds the Access Key and the Access Key Secret.

Add an Alibaba Cloud resource handler

Go to Admin > Resource Handlers, select Add, then select Alibaba Cloud, under Public Cloud.
Enter the Region, Access Key, and Access Key Secret, then select Continue.

(opens full-size image in a new tab)
Enter a name and an optional description, then select Done.

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

CMP keeps an inventory file on the management server, adds each new server to the Ansible groups it was ordered with, and runs the playbooks mapped to those groups. Playbooks and ad hoc commands can also be run against a server or a group later.

Prerequisites

Build the management server first, following Ansible’s documentation. The integration then expects the following.

SSH on port 22 from the CMP appliance to the management server, and from the management server to the servers it manages.
A username on the management server, with either a password or an SSH key stored in CMP.
sshd installed on the Linux servers being built, started on boot.
Credentials in CMP for the servers being built. See Authentication requirements.
A writable directory on the management server. CMP runs Ansible by copying and executing a script there, so the connected account must be able to write to and run scripts from the named directory in Admin > Miscellaneous Settings > Resource management tab > *nix Temporary Directory for Remote Scripts, or /tmp when empty.
The SSH host key of each managed server in the management server’s known_hosts. Ansible will not connect until it is present, unless host key checking is disabled on the management server.
A user for Ansible to connect as. If your playbooks do not name one, set remote_user in the management server’s Ansible configuration file.

Password-less SSH and sudo

Playbooks run without a terminal, so the user Ansible connects as needs a public key on every managed server, with the matching private key on the management server. Configure the key in one of two ways: include it in the image or template the servers are built from, or run the built-in SSH Public Key action, a shared remote script that adds a public key to a Linux server. That action is disabled by default, so enable and attach it where you want it to run, such as a blueprint’s build item.

Ansible Tower module

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse Ansible Tower module allows admins to create API-based, Ansible-powered services to drive solutions from upstream automation tools or scripts.

OneFuse codeless, policy-based integrations can securely power other automation tools and services such as VMware Aria Automation, Terraform, and others via API.

Highlights

Provides control and standardization for resources on both public and private cloud (on-prem) environments.
OneFuse enables least-privilege access wherein each policy serves as an API-based service, restricted to the specific use cases defined in the policy, without exposing the full Tower API or over-allocating permissions to users or upstream automation tools.
Each policy defines the automation use case, organization, inventory, specific provisioning and deprovisioning job templates, and overrides.
In addition to all of this, it offers the added flexibility of allowing the requester to influence the assignments dynamically via templated fields.

Setup overview

In OneFuse, select Ansible Tower from Home, or select Modules > Ansible Tower from the left navigation menu.
Create an Ansible Tower Policy.
Enter Lifecycle Job Templates.
Manage Inventory and Inventory Groups.
Run Ansible Tower Playbooks on Inventory Groups through the OneFuse API or an Upstream Provider.

This module requires the Ansible Tower License in order to execute a Policy to run playbooks on inventories. Ansible Tower Policies, Endpoints, and Module Credentials can be created without a license.

Appliance security

Mon, 01 Jan 0001 00:00:00 +0000

CMP is a highly sensitive piece of infrastructure because it often houses credentials with elevated privileges across multiple cloud environments. The appliance can be configured to meet different hardening guidelines depending on your regulatory environment. If you have specific hardening needs, contact Support.

Encryption

CMP encrypts the secrets file with AES in CBC mode. The key is derived with Argon2.

TLS and end-to-end transport encryption

Avoid unencrypted protocols during deployment when establishing connections to external providers, for example, resource handlers and configuration managers.

Aria Automation policy

Mon, 01 Jan 0001 00:00:00 +0000

Setup overview

Create an Aria Automation Module Credential.
Create a VMware Aria Automation Endpoint. If applicable, configure VMware Aria Automation proxy support.
Create a VMware Aria Automation Policy.
Execute the Aria Automation Policy to create managed vRA Deployments.

The user setting up the Aria Automation Policy must have the credentials to log in to the Aria Automation instance.

Create an Aria Automation Policy

Prerequisite

Create a Module Credential and Endpoint for the selected technology.

Authenticate with an IAM role

Mon, 01 Jan 0001 00:00:00 +0000

Access keys have to be rotated and tracked, which gets tedious across many accounts. With the IAM role option, the keys live in one place: an AWS account profile stored under Connection Info. Each handler then names the role Cloud Management Platform (CMP) should assume.

Create the AWS account profile

The profile holds the access key and secret key CMP uses to assume the role. Create it before the handler, because the add dialog offers only profiles that already exist.

Back up Cloud Management Platform

Mon, 01 Jan 0001 00:00:00 +0000

The backup process consists of two steps:

Backing up the CMP database
Backing up the CMP files

Complete both steps to ensure a full backup of your environment.

These steps cover a single-node deployment, where the web server, job engine, and database all run on one appliance. If your database or shared storage runs on separate hosts, contact CloudBolt Support before backing up.

Service impact

The web server and job engine are stopped while the CMP files are backed up. Perform this process during a scheduled maintenance window.

Blueprint ordering permissions

Mon, 01 Jan 0001 00:00:00 +0000

A user can order a blueprint if they are in a group assigned to it as a deploy group, and their role in that group includes the required ordering permission: order.submit by default, or a permission configured in the blueprint’s Deployment Permissions field.

Group-based access

A user can order a blueprint if:

The user is a member of a group assigned to the blueprint as a deploy group.
The user has a role in that group that includes the order.submit permission.

Add group permissions on blueprints

Go to Catalog and open a blueprint to edit.
Go to the Groups tab and select Edit.
Choose the groups that can Deploy or Manage and deploy, and decide whether to enable Any group can deploy.
Select Save changes.

The “Any group can deploy” permission

To edit the “Any group can deploy” checkbox, you must have the blueprint.any_group_can_deploy permission. On new installations this permission is not included in any role by default, so an administrator must add it to a role. (On instances upgraded from an earlier release, it is granted to any role that already had blueprint.manage.) Assign it with caution: selecting the checkbox allows any group to order the blueprint.

Branded portals

Mon, 01 Jan 0001 00:00:00 +0000

See Theme configurations for designing color schemes that can be used across portals.

(opens full-size image in a new tab)

How CMP chooses a portal

Each request is matched against the Domain/IP of every portal. If none match, the default portal is used. One portal must always be the default, and the default cannot be deleted.

The portal’s Name replaces references to CloudBolt anywhere a non-admin can see them, and its images replace the ones in the header, the loading indicator, and the splash screen.

Build configuration

Mon, 01 Jan 0001 00:00:00 +0000

Server tiers

Server tiers deploy one or more servers of a particular role. The OS build and other primary attributes, such as the hostname template, are typically set by the admin; end users choose the rest at the time of order, within the options and constraints defined for the target environment.

These items can be enabled for one or multiple environments, each with its own parameter options. The environment configuration form lets blueprint managers predefine certain values, so the order form does not prompt the user for them.

Check infrastructure health with CIT

Mon, 01 Jan 0001 00:00:00 +0000

A resource handler is the starting point for provisioning a server and for running remote scripts through a platform’s own channel, so its connection is worth checking on a schedule rather than when an order fails. This example uses Cloud Management Platform (CMP) Continuous Infrastructure Testing to do that. For CIT itself, see Continuous Infrastructure Testing (CIT).

Prerequisites

You are a super admin in CMP.
A resource handler is already configured.
You have its resource handler ID.

Create the test

Go to Admin > Continuous Infrastructure Testing.
Select Add > New Action Test.
Select CloudBolt Plug-in > + Add a New CloudBolt Plug-in.
Enter a name, then scroll to the bottom of the form.
For File Location, select Enter code later.
Select Create.

Add the code

Find the new test in the Tests list and select its name.
Under Actions, select the action name to open the plugin for editing.
Replace the default code with the following, then save.

from common.methods import set_progress
from resourcehandlers.models import ResourceHandler
from utilities.logger import ThreadLogger

logger = ThreadLogger(__name__)


def run(*args, **kwargs):
    rh = ResourceHandler.objects.get(id=int("{{ resource_handler }}"))
    rh = rh.cast()
    if rh.can_verify_connection:
        set_progress(f"Verifying connection to '{rh}'.")
        rh.verify_connection()
        set_progress(f"Successfully verified connection to '{rh}'.")

The plugin reads a resource handler ID from an action input, casts the handler to its concrete type, and calls verify_connection() on it if that handler supports connection checks.

Configure AWS accounts

Mon, 01 Jan 0001 00:00:00 +0000

Preparing your AWS environment for CloudBolt Platform integration requires IAM roles and an S3 bucket. This page describes how to use a CloudBolt-provided AWS CloudFormation template to create them.

The template creates the following:

Cross-account IAM roles: Least-privilege IAM roles enabling cost report access. The FOCUS role can also create cost report exports on CloudBolt’s behalf (but not delete them).
Permissions for the cost report exports: The template grants CloudBolt the permissions needed to create the FinOps Open Cost and Usage Specification (FOCUS) 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports. When a connection is established, CloudBolt creates any that do not exist.
S3 bucket: Created when CreateS3Bucket=true (default), with policies for report storage. Set CreateS3Bucket=false to use an existing bucket.

Prerequisites

Before you begin, ensure the following:

Connect AWS

Mon, 01 Jan 0001 00:00:00 +0000

This guide explains how to configure AWS connections in the CloudBolt Platform to support billing functions.

You can deploy the required AWS resources as part of this connection, or connect a stack you already deployed separately (see Configure AWS accounts).

Each AWS management (billing) account requires its own connection. A single connection covers the member accounts in that organization.

Prerequisites

A CloudBolt Platform user with the Operations or Admin role. Refer to Manage roles.
The AWS account prerequisites described in Configure AWS accounts.

Connect a new AWS account

Use this option if you haven’t deployed the CloudBolt CloudFormation template. This flow opens CloudFormation in a new browser tab using your current AWS Console session, so make sure you’re signed in to the AWS Console for the account you’re connecting before you start.

Connections

Mon, 01 Jan 0001 00:00:00 +0000

The Connections page lets you manage the cloud accounts from which the CloudBolt Platform ingests cost and resource data. Connections are grouped by provider, with at-a-glance health status, account coverage, and testing, editing, and disconnect actions for each one.

Access the Connections page

Log in to the CloudBolt Platform.
In the sidebar, select Settings.
Select Connections.

Connections overview

Each connection is a compact row that expands in place. Select the chevron or connection name to show its identity details, the time of the last health check, and the full list of health checks.

Content Library

Mon, 01 Jan 0001 00:00:00 +0000

The Content Library is a catalog of content that CloudBolt builds and maintains. Importing an item copies it into your instance, where you can modify it to suit your requirements. CloudBolt updates the published content periodically, and the Library is refreshed on a schedule to pull the latest updates.

Import content

The steps are the same, regardless of content type.

In CMP, select Library in the main menu.

(opens full-size image in a new tab)
Select the download icon on the item you want to import.

(opens full-size image in a new tab)
Review the details, then select Import.

Create a user

Mon, 01 Jan 0001 00:00:00 +0000

Administrators, and users with the Manage Group Memberships permission in at least one group, can create users. You can create users directly in CMP, as described below, or sync users from an external directory via LDAP or SSO. For how users, groups, and roles fit together, see Users.

Create a user manually

Go to Admin > Users.
Select Create a new User.

(opens full-size image in a new tab)
Complete the Create a User form.
Select Create.

Create multi-channel alerts

Mon, 01 Jan 0001 00:00:00 +0000

Quick setup

Create alert channels in Admin > Multi-Channel Alerts.
Add one or more categories to each channel.
Set each channel’s destination.

For the full, type-specific steps, see Configure Slack to use multi-channel alerts and Set up Microsoft Teams to use multi-channel alerts.

Example: route alerts by category

A channel receives an alert only when the alert’s category exactly matches one of the channel’s categories. This example routes two custom categories so that both go to Slack while bad-news alerts also go to email.

Dashboard

Mon, 01 Jan 0001 00:00:00 +0000

The Dashboard provides teams with comprehensive visibility into cloud spend. Constructed on real-time data pipelines, the Dashboard delivers:

Holistic Cost Visibility: Aggregation of actual and forecasted spend across multiple cloud providers, segmented by service and environment.
Trend Analysis & Forecasting: Interactive visualizations depicting historical spending patterns, with embedded models projecting end-of-period costs to inform budget planning.
Customizable Controls: Flexible filters, time-range selectors, and account-level credentials that ensure stakeholders view data tailored to their permissions.

Access the dashboard

Log in to the CloudBolt Platform. The Dashboard displays upon login.
To go to the Dashboard from elsewhere, select the Dashboard icon in the sidebar.

Dashboard overview

(opens full-size image in a new tab)

Deploy a virtual appliance

Mon, 01 Jan 0001 00:00:00 +0000

Deploy from OVA

Download the OVA

Cloud Management Platform Releases

Go to the Releases page and select the latest release.
Download the Installer, Upgrader, or OVA as required.

Deploy the OVA

See Deploying an OVA to VMware vSphere and Deploying OVA via Citrix XenCenter.

Configure the appliance

Core configuration

Connect to the VM using your Virtualization Manager (for example, VMware vSphere or Citrix XenServer).
Log in to the VM console. The default values for username and password are ‘root/cloudbolt’.
Configure the VM’s network settings:

Skip this step if using CMP in a DHCP environment.
- Set the fully qualified domain name (FQDN):
  - Press ENTER to set the FQDN.
  - Press ENTER to accept.
- Set the IP address:
  - Use the arrow keys to go to IP Address and press ENTER.
  - Confirm the IP address.
  - Press ENTER to accept.
- Repeat for subnet mask, gateway, primary DNS, secondary DNS, and SELinux mode (default: permissive).

Disable OpenSSH on Windows servers

Mon, 01 Jan 0001 00:00:00 +0000

Currently, SSH is the only supported connection method in OneFuse. Trying to uninstall OpenSSH while connected using it is problematic. This method uses WinRM to connect to the target server to uninstall OpenSSH.

This article assumes you have a bastion/jump server configured with OpenSSH, and that your Windows templates already have OpenSSH installed. This has only been tested on Windows 2016 and 2019, but may work on other versions of Windows with modification.

DNS module best practices

Mon, 01 Jan 0001 00:00:00 +0000

The CloudBolt OneFuse integration platform offers a DNS Module that can be leveraged to provide enterprise grade DNS registration for creating host, A, and PTR records with support for Infoblox, BlueCat, Men & Mice, and Microsoft DNS services with more to come.

The OneFuse DNS module allows for both pre and post validation of DNS records to ensure names are unique before they are created and resolvable after creation.

Resources

For additional information regarding OneFuse DNS, refer to the following documentation:

Email templates

Mon, 01 Jan 0001 00:00:00 +0000

Templates are listed by name and slug on the Templates tab of Admin > Email Settings.

Edit a template

On the Templates tab, select the pencil icon in the template’s row. Each template has the following fields:

Field	Description
Subject	The subject line, rendered with the context the sender passes in.
From address	A sending address, written as `Full Name <email@address>`. Leave empty to use the default from Email Settings.
CC Addresses, BCC Addresses	Comma-separated addresses copied on every email from this template.
Body	The HTML body, rendered with the context the sender passes in. Omit `<html>` and `<body>` tags, as these are supplied by the wrapper described below.
Text body	The plain-text body. If left empty, CMP strips the tags from the HTML body and uses the result.

For example, to drop the rate from the Order Complete email, find this block in the Body field:

Event Broker Subscriptions

Mon, 01 Jan 0001 00:00:00 +0000

The following Event Broker Subscriptions (EBS) are created during OneFuse Configuration.

Event Broker Subscription states

The list below represents the vRA Event State Names, in order of execution, for OneFuse Modules that may require an EBS trigger.

BuildingPreEarly
BuildingPreLate
ProvisionedPreEarly
ProvisionedPreLate

Resource: Machine Life Cycle Extensibility

MachineRequested

Subscription name	EBS priority	OneFuse module	EBS name
PRE	1000	Property Toolkit	`OneFuse_PropertyToolkit_Requested`
PRE	1150	Naming	`OneFuse_Provision_Naming`

BuildingPre

Subscription state	EBS priority	OneFuse module	EBS name
Early	10	Scripting	`OneFuse_Provision_Scripting_BuildingPreEarly`
Early	15	Ansible Tower	`OneFuse_Provision_AnsibleTower_BuildingPreEarly`
Early	25	Pluggable Module	`OneFuse_Provision_PluggableModule_BuildingPreEarly`
Early	1000	Property Toolkit	`OneFuse_PropertyToolkit_Building`
Early	1200	IPAM	`OneFuse_Provision_IPAM`
Early	1300	DNS	`OneFuse_Provision_DNS`
Early	1500	Microsoft Active Directory	`OneFuse_Provision_AD`
Late	2000	Scripting	`OneFuse_Provision_Scripting_BuildingPreLate`
Late	2005	Ansible Tower	`OneFuse_Provision_AnsibleTower_BuildingPreLate`
Late	2015	Pluggable Module	`OneFuse_Provision_PluggableModule_BuildingPreLate`

ProvisionedPre

Subscription state	EBS priority	OneFuse module	EBS name
Early	10	Scripting	`OneFuse_Provision_Scripting_ProvisionedPreEarly`
Early	15	Ansible Tower	`OneFuse_Provision_AnsibleTower_ProvisionedPreEarly`
Early	25	Pluggable Module	`OneFuse_Provision_PluggableModule_ProvisionedPreEarly`
Early	1000	Property Toolkit	`OneFuse_PropertyToolkit_Provisioned`
Early	1500	Microsoft Active Directory	`OneFuse_Move_OU_AD`
Early	1600	ServiceNow CMDB	`OneFuse_Provision_ServiceNow_CMDB`
Late	2000	Scripting	`OneFuse_Provision_Scripting_ProvisionedPreLate`
Late	2005	Ansible Tower	`OneFuse_Provision_AnsibleTower_ProvisionedPreLate`
Late	2015	Pluggable Module	`OneFuse_Provision_PluggableModule_ProvisionedPreEarly`

Reconfigure VM

EBS priority	OneFuse module	EBS name
1100	ServiceNow CMDB	`OneFuse_Update_ServiceNow_CMDB`

MachineDisposingPost

EBS priority	OneFuse module	EBS name
10	Scripting	`OneFuse_De-Provision_Scripting`
15	Ansible Tower	`OneFuse_De-Provision_AnsibleTower`
25	Pluggable Module	`OneFuse_De-Provision_PluggableModule`
1100	ServiceNow CMDB	`OneFuse_De-Provision_ServiceNow_CMDB`
1200	Microsoft Active Directory	`OneFuse_De-Provision_AD`
1300	DNS	`OneFuse_De-Provision_DNS`
1400	IPAM	`OneFuse_De-Provision_IPAM`
1500	Naming	`OneFuse_De-Provision_Naming`

Configure EBS timeouts

EBS Timeouts allow the user to set a time limit per EBS for communication between vRealize Automation and vRealize Orchestrator.

Getting started

Mon, 01 Jan 0001 00:00:00 +0000

Easily integrate CloudBolt OneFuse with vRealize Automation (compatible with 7.6, 8.1+ and Cloud) to quickly automate and integrate into your business provisioning lifecycle.

The CloudBolt OneFuse integration platform offers integrations to services like Naming, IPAM, DNS, Microsoft Active Directory, Scripting, Ansible Tower and more.

Upstream Providers like VMware vRealize Automation, Terraform, CloudBolt CMP, Ansible, ServiceNow and others are able to consume the same OneFuse integrations combined with organizational business logic for a standardized approach to automation across the enterprise.

GitHub App authentication

Mon, 01 Jan 0001 00:00:00 +0000

A GitHub source code repository connection authenticates with either a Personal Access Token (PAT) or a GitHub App. Both methods support reading (auto-import) and pushing, work with GitHub Cloud and self-hosted GitHub Enterprise Server, and are selected per connection. The same repository can therefore authenticate differently in different Cloud Management Platform (CMP) environments.

Personal Access Token	GitHub App
A personal identity. The connection stores a read token, and each user pushes with their own token.	A non-personal, organization-owned identity that keeps working when people change teams or leave.
Best for development environments, where users author content and push it under their own GitHub identity.	Best for staging, QA, and production, as it refreshes promoted content without relying on an individual’s token.

In a typical promotion workflow, developers connect with PATs and push blueprints, actions, and other content to the repository. Each higher-level environment connects to the same repository with a GitHub App and refreshes the promoted content.

Help us help you

Mon, 01 Jan 0001 00:00:00 +0000

What to include

Focus on describing the symptoms and the situation rather than what you think the cause is, and be as specific as you can.

Error messages and logs: Include the full text of any error. For a failed job, attach the job log from the job’s details page. From the Admin page, you can also view the application log, download all CloudBolt logs, or download the web server logs. For UI issues, check the browser’s JavaScript console and send any errors you find.
Your configuration: The more you share with us, the more likely we are to replicate the issue, which is often the first step in troubleshooting. Note the resource handler, the template OS, the page you were on, whether you’re behind a proxy, and the context in which an action runs. Tell us if you’re using a custom resource type: “Deploying a blueprint that creates a custom resource type called ‘Storage’” is easier to troubleshoot than “deploying storage.”
Cloud Management Platform version: Tell us which version you’re running, and note if you use a distributed HA installation or keep the database on a separate server.
Timing: When did you first notice the issue, and when did it last work, if ever? Knowing whether something used to work or is new can be very helpful.
Frequency: Does this happen every time, or only sometimes? How often it occurs can offer clues.
Expected vs. actual behavior: Describe both what you expected and what actually happened, in as much detail as possible. “I expect parameter x on the order form for group y and environment z, but it’s missing” gives us more to go on than “order form broken.”
Your goal: Especially for questions and requests for enhancement (RFEs), tell us what you’re trying to accomplish. It’s hard to answer deep questions about actions without knowing where, how, and why they’re used.
Screenshots: A screenshot helps clarify where an issue occurs and what you were doing when it happened.

Ticket guidelines

One issue per ticket: Include only one issue or request per ticket so we can track and resolve each one effectively.
Flag requests for enhancement: If you’re submitting an RFE, let us know. A sense of urgency or a needed-by date helps us prioritize.

Escalation

Start with support. For urgent issues or RFEs, escalate to your account representative, who will work with our product managers to schedule a resolution promptly.

Hostname specification

Mon, 01 Jan 0001 00:00:00 +0000

There are four main ways to set a server’s hostname:

Manual entry: the user enters a hostname when ordering a server. This is the default.
Resource pool: a pool of hostnames associated with the environment.
Hostname template: a template that generates hostnames dynamically, covered here.
Orchestration action: a pre-create resource orchestration action runs code to determine the hostname. See Plugins.

Using hostname templates

The Hostname Template parameter specifies how hostnames are generated for new servers. Instead of a static hostname pool, a hostname template dynamically generates hostnames from order attributes, such as a group code, an environment code, a location code, and a user-provided purpose (for example, “web”).

Import and export utilities

Mon, 01 Jan 0001 00:00:00 +0000

There are two utilities:

cb_import: Import files and directories to CMP instances
cb_export: Archive and compress files and directories into a single .tar.gz file

Access utilities

On a CMP instance, you can access the import and export utility scripts from the following location:

/opt/cloudbolt/manage.py
/opt/cloudbolt/manage.py cb_export
/opt/cloudbolt/manage.py cb_import

Export utility

By default, cb_export includes the following directories:

VARDIR/opt/cloudbolt, where VARDIR is defined in Django settings
MEDIA_ROOT and STATIC_TESTS_DIR, where each is defined in Django settings

Specific files and directories can be included or excluded as required. Refer to Options for more details.

Import and manage existing networks

Mon, 01 Jan 0001 00:00:00 +0000

CMP imports networks defined in your virtualization platform or cloud account; it does not create them.

Import networks

Networks are imported from the resource handler that provides them.

Go to Admin > Resource Handlers and open the handler.
Select the Networks tab and select Import Networks.
Select the networks you want and confirm.

CMP lists only networks it has not already imported, so run the import again to pick up new ones.

Install OneFuse from OVA

Mon, 01 Jan 0001 00:00:00 +0000

Download the latest OneFuse OVA

OneFuse is distributed as a CloudBolt OVA file, which is an open standard for packaging VM images for easy installation.

Access CloudBolt’s Download Article for CMP/OneFuse 2023.5.

The article will always contain the latest Appliance link.

Log in with your CloudBolt Connect account.
Download CloudBolt OVA.

Requirements

Obtain and download the OneFuse license key.
- Purchase Key: Reach out to your CloudBolt Account Manager or our Customer Success team
Optionally, obtain SSL Certificate(s) for OneFuse.
Ensure your environment meets the following base requirements:
- A Virtualization Manager
  - VMware vSphere 6.0+
  - Citrix XenServer 6+
- Virtual Capacity for the Virtual Machine (VM)
  - 2 CPUs minimum
  - 8GB memory minimum
  - 50GB storage minimum
  - The initial VM will use 3GB if Thin Provisioned or 50GB if Thick Provisioned (recommended).

Deploy the OneFuse VM from OVA

Log in to your virtualization manager (for example VMware vSphere, Citrix XenServer).
Deploy the OVA as a Virtual Machine (VM).
- Resources: the VMware vSphere documentation on deploying an OVA, or Import VMs from OVA via Citrix XenCenter
Power on the newly created OneFuse VM.

Configure the OneFuse VM

OneFuse needs a few configuration items before you can access the web portal to continue your setup.

IP address management for Nutanix

Mon, 01 Jan 0001 00:00:00 +0000

Imported networks and their addressing schema

When you import a network on the Nutanix handler’s Networks tab, CMP sets its Addressing Schema from Nutanix: DHCP only if Nutanix runs DHCP on the network; otherwise, Static only. You can change it on the network, where the third option, User defined, is also available. See Networks.

The import fills in the network’s gateway but not its netmask. For a network where CMP assigns addresses, enter the Netmask and DNS settings on the network before provisioning.

IP ranges

Mon, 01 Jan 0001 00:00:00 +0000

An IP range is an alternative to static addressing, DHCP, or asking the requester to supply an address. CMP tracks which addresses in the range are free, and which are in use, so each is issued only once. The range is held in an adjustable resource pool.

A network with an IP range overrides a configured addressing scheme.

Add an IP range

Go to Admin > Networks and select the network’s name.
Select the IP Pool tab and select Add Range of IPs.
Enter a Starting IP and an Ending IP. CMP adds the starting IP and every address after it up to the ending IP, except addresses ending in .0, .1, or .255. Add those from the pool’s Values tab if you need them.
Select Add.

When the network records a gateway and a netmask, CMP fills both fields with the first and last usable addresses, omitting the network, gateway, and broadcast addresses. Accept those or narrow them.

IPAM module best practices

Mon, 01 Jan 0001 00:00:00 +0000

The CloudBolt OneFuse integration platform offers an IPAM module that can be leveraged to provide enterprise grade IP address assignment automation to CloudBolt CMP, vRealize Automation, Terraform, and other platforms. It allows for easy, flexible, consistent integration to Infoblox, BlueCat, and Men & Mice IPAM providers with more to come.

The OneFuse IPAM module takes IPAM integration a step further by validating every IP address before it is assigned. This ensures you won’t have conflicts from IP addresses that were assigned for use without being reserved in the IPAM system.

Job

Mon, 01 Jan 0001 00:00:00 +0000

(opens full-size image in a new tab)

Job status

Jobs progress through the following statuses when a Policy is executed:

Status	Description
Initialized	All jobs are created with the Initialized status
In Progress	The Job Engine picks up Initialized jobs and spawns a thread; status updates to In Progress

When a job completes, depending on the results, the job status is set to:

Job engine troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

Work from the status to the appliance, then to the logs. Most of what follows also produces the information a support engineer will ask for, so keep notes as you go.

Start with the job’s status

Note the job number, status, and URL of the job that made you notice the problem, then find its status below. For what each status means, see Job engine.

Status	What to check
`PENDING`	Whether the job is scheduled for a future time, which is normal. Otherwise, confirm that a worker is running and check whether anything is preventing the job engine from starting.
`QUEUED`	Whether the worker that claimed the job is still alive, and whether it is out of free threads. A worker with no free threads records that in its log. If the worker has died, the job stays QUEUED, because nothing reclaims it. Cancel it and order the work again.
`RUNNING`	The job’s own log, for its last step and any error. The job may still be working normally. If its worker has died, the job engine cancels the job on its next start.
`PAUSED`, `STEP`, `NEXT`, `RETURN`	The job is in debug mode and waiting for someone to drive it, holding a thread until it ends. An administrator can resume or cancel it from the job’s detail page.
`CANCELED`	The job’s log. If the worker died, it says the process running the job is no longer active. A user cancellation and a timeout both log `Canceling this job`, so check the job engine log to tell those two apart. Then run a small job to check the health of the job engine.
`SUCCESS`, `WARNING`, `FAILURE`	The job engine is working, so troubleshoot the job itself: its log, the action or plugin it ran, and the resource it was working on.

After checking the status, consider the following: which other jobs are affected, and which job ran most recently? Has anything run since? If some jobs are progressing and others are not, compare their types and owners: a worker may be restricted to specific job types, which can make the excluded types appear stuck while everything else runs.

Key concepts

Mon, 01 Jan 0001 00:00:00 +0000

Core concepts

Concept	Description
Resource handlers	A resource handler is a connection to a cloud platform or virtualization technology, such as AWS, Azure, GCP, or VMware. Each resource handler provides CMP with visibility and control over resources on that platform.
Environments	An environment is a logical grouping of resources within a resource handler, such as an AWS region or a VMware cluster. Environments define which VM images, networks, and configuration options are available when users place orders.
Servers	A server is CMP’s record of a compute resource, either a virtual machine or a physical server. Servers can be provisioned through CMP or discovered automatically by scanning a connected resource handler. Each server belongs to one environment and one group, and can be managed, tracked, and acted on throughout its lifecycle.
Groups	Groups organize users and facilitate access to environments, blueprints, and resources. Roles and quotas are applied at the group level to control what members can see, use, and request.
Catalog	The catalog is the self-service portal where users browse and order blueprints. Administrators can control which blueprints appear in the catalog.
Blueprints	A blueprint defines a repeatable, orderable service. Blueprints include build steps, management actions, and teardown logic, and are ordered by users through the catalog.
Orchestration	Orchestration allows administrators to automate actions at defined trigger points, such as during provisioning, on a schedule, or in response to an event. Actions can run plugins, remote scripts, webhooks, or integrate with external systems.
Networks	Networks define the subnets and VLANs available to servers in CMP, derived from your resource handlers. They can be assigned to environments to control network options during provisioning.

External integrations

CMP integrates with a range of infrastructure technologies for provisioning, orchestration, and self-service operations.

MAAS parameters

Mon, 01 Jan 0001 00:00:00 +0000

CMP creates these parameters when a MAAS resource handler is saved. Orders also use the standard CPU, memory, disk size, and network parameters; how each one affects the machine MAAS chooses is covered in MAAS server selection.

Environment parameters

These parameters appear on each MAAS environment’s MAAS Parameters tab. CMP imports their options from MAAS when the environment is created. To refresh one parameter’s options, select the import icon in its row. Import parameters from refreshes all of them at once, replacing any options you have edited.

Make your first request

Mon, 01 Jan 0001 00:00:00 +0000

These examples use curl, but the requests are the same regardless of the client. To browse the full list of endpoints, use the API console at /api-docs/v3/cmp/.

Get a token

Exchange your Cloud Management Platform (CMP) credentials for a token:

curl -X POST -H "Content-Type: application/json" \
  -d '{"username":"<username>","password":"<password>"}' \
  "https://<cmp-ip-or-hostname>/api/v3/cmp/apiToken/"

The response returns two tokens. token is the short-lived access token used in the requests below; refreshToken is the longer-lived one you exchange for a new access token when it expires. Keep the access token and your CMP address in shell variables:

Manage connections

Mon, 01 Jan 0001 00:00:00 +0000

To add a connection, visit Connect cloud accounts.

View connections

To view connections:

Go to Settings > Connections.
Connections are grouped by cloud provider. Each provider section (AWS, Azure, GCP) has a header with the provider logo and name, a search box, and an Add Connection button.

Connection rows

Each connection appears as a single row:

Item	Description
Name	Connection name, provided at creation time.
Status	Connection health badge: Healthy, Failing, Pending, or Not yet checked.
Accounts	The number of cloud accounts covered by the connection, for example, 167 accounts. Select the count to view per-account status.
Actions	Test Connection, Manage, and a ⋯ (more actions) menu containing Disconnect. AWS connections also offer Re-Sync.

Use the search box in a provider’s section header to filter that provider’s connections by name or ID.

Connection details and health checks

Rows are collapsed by default. Select the chevron on a row to expand the connection in place. The expanded region shows:

Manage network virtualization

Mon, 01 Jan 0001 00:00:00 +0000

These are the steps from creating an NSX-T connection to using it in a blueprint. Before you start, make sure at least one vCenter resource handler exists. Then work through the sections below in order, because each depends on the last.

Map a resource handler

NSX-T keeps a list of its connected compute managers. Refreshing the mappings requests that list from NSX-T, and Cloud Management Platform (CMP) displays the vCenter entries. The NSX-T integration supports only vCenter resource handlers, so you need at least one before this step produces any output.

Manage organizations

Mon, 01 Jan 0001 00:00:00 +0000

The CloudBolt Platform organizes access into a hierarchy of organizations, each with its own users, roles, and data access boundaries. Use sub-organizations to reflect your internal structure or, for managed service providers and resellers, the individual customers you manage.

When you sign up, CloudBolt automatically creates an organization for your company, and you’re granted the Admin role as the first user so you can add teammates and assign roles.

Prerequisites

Viewing and managing organizations requires access to a CloudBolt Platform user account with the Admin role.

Organization context

The CloudBolt Platform allows you to navigate between organizations of which you are a member. Each organization represents a separate working environment, or context, with its own data and users.

Manage recurring jobs

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) ships with a set of built-in recurring jobs. Any that you or another administrator create appear alongside them.

View recurring jobs

Go to Admin > Recurring Jobs.

(opens full-size image in a new tab)

The Next Run column shows when each job runs next, or Disabled if the job is switched off. The toggle in the Actions column enables or disables a job.
Select a job name to open its details, including its execution history.

(opens full-size image in a new tab)

MCP server tools

Mon, 01 Jan 0001 00:00:00 +0000

The CMP MCP server exposes a set of built-in tools covering servers, resources, groups, environments, jobs, orders, catalog operations, power schedules, and UI links.

Listing the available tools

List the tools a CMP server currently publishes using the management command:

./manage.py mcp_inspect

Safety profiles

All tools operate within the authenticated user’s permission scope. Each tool is tagged with a safety profile:

read_only: The tool only reads data and cannot make changes. Multiple read-only tools can be called in parallel to gather information.
write: The tool can change the state of CMP and/or your cloud resources, and requires the write scope (see Authentication).

Identity

Tool	Safety	Parameters	Description
`fetch_identity`	`read_only`	None	Return the authenticated user’s profile: username, email, and group memberships.

Servers

Tool	Safety	Parameters	Description
`fetch_server_list`	`read_only`	`hostname` (optional): exact hostname match `hostname_contains` (optional): servers whose hostname contains this string; ignored if `hostname` is set `hostname_startswith` (optional): servers whose hostname starts with this string; ignored if `hostname` or `hostname_contains` is set `group_name` (optional): exact name of the group the server belongs to `power_status` (optional): `on` for powered-on servers, `off` for powered-off servers `owned_by_me` (optional): when `True`, return only servers owned by the requesting user `page` (optional; defaults to `1`) `page_size` (optional; defaults to `25`)	List all active servers visible to the current user.
`fetch_server_details`	`read_only`	`server_id`	Return full details for a specific server: IP, OS, CPU/RAM, status, and provider metadata.
`fetch_server_action_parameter_options`	`read_only`	`action_id`: action global ID (for example, “SVA-abc12345”) `parameter_name`: name of the parameter from the `fetch_server_actions` schema `server_ids`: list of server global IDs the action will run on `current_values`: dictionary of provided parameter values; required when fetching options for a parameter that depends on another	Return the available options for a specific server action parameter.
`fetch_server_actions`	`read_only`	`server_id`	Return the list of server actions available to the current user for a given server, along with each action’s parameter schema.
`run_server_action`	`write`	`server_ids`: list of server global IDs (for example, “SVR-abc12345”) `action_id`: action global ID returned by `fetch_server_actions` (for example, “SVA-abc12345”) `parameters`: dictionary of parameter values keyed by the parameter name from the `fetch_server_actions` schema	Run a server action on one or more servers.

Groups

Tool	Safety	Parameters	Description
`fetch_groups`	`read_only`	None	List all groups accessible to the user.
`fetch_group_details`	`read_only`	`group_id`	Return full details for a specific group, including members and assigned environments.

Environments

Tool	Safety	Parameters	Description
`fetch_environment_list`	`read_only`	None	List all cloud environments the user can access (for example, AWS regions, Azure subscriptions, vSphere clusters).
`fetch_environment_details`	`read_only`	`environment_id`	Return full details for a specific environment: provider type, connection status, and available networks.

Resources

Tool	Safety	Parameters	Description
`fetch_resource_types`	`read_only`	None	List all registered resource types and their global IDs. Call this first when filtering by type.
`fetch_resources`	`read_only`	`name` (optional): exact resource name `name_contains` (optional): resources whose name contains this string; ignored if `name` is set `name_startswith` (optional): resources whose name starts with this string; ignored if `name` or `name_contains` is set `group_name` (optional): exact name of the group the resource belongs to `owned_by_me` (optional): when `True`, returns only resources owned by the requesting user `resource_type_name` (optional): exact name of the resource type (for example, “S3 Bucket”) `page` (optional; defaults to `1`) `page_size` (optional; defaults to `25`)	List resources, optionally filtered by type.
`fetch_resource_details`	`read_only`	`resource_id`	Return full details for a specific resource.
`fetch_resource_actions`	`read_only`	`resource_id`	Return the list of actions for the given resource available to the current user, along with each action’s parameter schema.
`fetch_resource_action_parameter_options`	`read_only`	`action_id`: action global ID (for example, “RSA-abc12345”) `parameter_name`: name of the parameter from the `fetch_resource_actions` schema `resource_ids`: list of resource global IDs the action will run on `current_values`: dictionary of provided parameter values; required when fetching options for a parameter that depends on another	Return available options for a specific resource action parameter.
`run_resource_action`	`write`	`resource_ids`: list of resource global IDs (for example, “RSC-abc12345”) `action_id`: action global ID returned by `fetch_resource_actions` (for example, “RSA-abc12345”) `parameters`: dictionary of parameter values keyed by the parameter name from the `fetch_resource_actions` schema	Run a resource action on one or more resources.

Jobs

Tool	Safety	Parameters	Description
`fetch_running_jobs`	`read_only`	None	List all jobs in a RUNNING state for the authenticated user. Use this to monitor async operations.
`fetch_job`	`read_only`	`job_id`: job global ID (for example, “JOB-abc12345”)	Return the current status and details for a specific job.

Orders

Actions that require approval create an order. Use these tools to find orders, check their status, and act on orders awaiting approval.

Minimize technical debt with orchestration actions

Mon, 01 Jan 0001 00:00:00 +0000

Why technical debt accumulates

Technical debt is the trail of digital breadcrumbs left behind as infrastructure is decommissioned. When a server reaches the end of its lifecycle, it is deleted. But the other dependencies that supported it, most commonly firewall rules, often remain. Cloud Management Platform (CMP) provides orchestration actions to clean them up.

Prerequisites

Access to and understanding of orchestration actions.
Understanding of the provisioning job.

Use the delete trigger points

For every provision action, there is a delete counterpart. While provisioning, CMP stores data from provisioning actions that later trigger the counterpart action, removing technical debt.

Minimum required permissions in vCenter/VMware

Mon, 01 Jan 0001 00:00:00 +0000

Where a vSphere administrator wants to follow the principle of least privilege, create a vCenter user and assign it a role containing only these privileges.

Datastore, required for provisioning

Datastore.AllocateSpace
Datastore.Browse
Datastore.Config
Datastore.FileManagement
Datastore.UpdateVirtualMachineFiles
Datastore.UpdateVirtualMachineMetadata

Folder, required for provisioning

Folder.Create
Folder.Delete
Folder.Move
Folder.Rename

Network, required for provisioning

Network.Assign

Resource, required for provisioning

Resource.ApplyRecommendation
Resource.AssignVMToPool
Resource.QueryVMotion

vApp, required for provisioning and managing virtual machines

VApp.ApplicationConfig
VApp.AssignResourcePool
VApp.AssignVApp
VApp.AssignVM
VApp.Clone
VApp.Create
VApp.Delete
VApp.Export
VApp.ExtractOvfEnvironment
VApp.Import
VApp.InstanceConfig
VApp.ManagedByConfig
VApp.Move
VApp.PowerOff
VApp.PowerOn
VApp.Rename
VApp.ResourceConfig
VApp.Suspend
VApp.Unregister

Virtual machine configuration, required for provisioning and management

VirtualMachine.Config.AddExistingDisk
VirtualMachine.Config.AddNewDisk
VirtualMachine.Config.AddRemoveDevice
VirtualMachine.Config.AdvancedConfig
VirtualMachine.Config.Annotation
VirtualMachine.Config.ChangeTracking
VirtualMachine.Config.CPUCount
VirtualMachine.Config.DiskExtend
VirtualMachine.Config.DiskLease
VirtualMachine.Config.EditDevice
VirtualMachine.Config.HostUSBDevice
VirtualMachine.Config.ManagedBy
VirtualMachine.Config.Memory
VirtualMachine.Config.MksControl
VirtualMachine.Config.QueryFTCompatibility
VirtualMachine.Config.QueryUnownedFiles
VirtualMachine.Config.RawDevice
VirtualMachine.Config.ReloadFromPath
VirtualMachine.Config.RemoveDisk
VirtualMachine.Config.Rename
VirtualMachine.Config.ResetGuestInfo
VirtualMachine.Config.Resource
VirtualMachine.Config.Settings
VirtualMachine.Config.SwapPlacement
VirtualMachine.Config.Unlock
VirtualMachine.Config.UpgradeVirtualHardware

Guest operations, required for interacting with a virtual machine

VirtualMachine.GuestOperations.Execute
VirtualMachine.GuestOperations.Modify
VirtualMachine.GuestOperations.Query

Virtual machine interaction, required for power and console operations

VirtualMachine.Interact.ConsoleInteract
VirtualMachine.Interact.DeviceConnection
VirtualMachine.Interact.PowerOff
VirtualMachine.Interact.PowerOn
VirtualMachine.Interact.Reset
VirtualMachine.Interact.SetCDMedia
VirtualMachine.Interact.SetFloppyMedia

Inventory, required for creating and managing virtual machines

VirtualMachine.Inventory.Create
VirtualMachine.Inventory.CreateFromExisting
VirtualMachine.Inventory.Delete
VirtualMachine.Inventory.Move
VirtualMachine.Inventory.Register
VirtualMachine.Inventory.Unregister

Provisioning, required for deployment and customization

VirtualMachine.Provisioning.Clone
VirtualMachine.Provisioning.CloneTemplate
VirtualMachine.Provisioning.CreateTemplateFromVM
VirtualMachine.Provisioning.Customize
VirtualMachine.Provisioning.DeployTemplate
VirtualMachine.Provisioning.DiskRandomAccess
VirtualMachine.Provisioning.DiskRandomRead
VirtualMachine.Provisioning.GetVmFiles
VirtualMachine.Provisioning.MarkAsTemplate
VirtualMachine.Provisioning.MarkAsVM
VirtualMachine.Provisioning.ModifyCustSpecs
VirtualMachine.Provisioning.PromoteDisks
VirtualMachine.Provisioning.PutVmFiles
VirtualMachine.Provisioning.ReadCustSpecs

Snapshot management

VirtualMachine.State.CreateSnapshot
VirtualMachine.State.RemoveSnapshot
VirtualMachine.State.RenameSnapshot
VirtualMachine.State.RevertToSnapshot

VMware vCenter: create the resource handler this account is used by.
Snapshots: what the snapshot privileges above enable.

Module credentials

Mon, 01 Jan 0001 00:00:00 +0000

Module Credentials are encrypted and reusable across OneFuse Module Endpoints of the same Endpoint Type.

A Module Credential is a prerequisite to creating Module endpoints and OneFuse Policies.

Workspace role	Function(s)
Admin or Member	Create, update, view and delete Module Credentials
Viewer	View Module Credentials

Modules list

The following modules utilize Module Credentials:

Access Module Credentials

Log in to the OneFuse UI.
In the Workspace, select Module Credentials from the left navigation menu.

This area will display all active Module Credentials by Endpoint Type.

Naming module best practices

Mon, 01 Jan 0001 00:00:00 +0000

The CloudBolt OneFuse integration platform offers a Naming Module that allows users to craft Naming Policies for just about anything that requires a name. These Policies can be used for naming virtual machines, physical machines, deployments, AWS VPCs, Azure, GCP, or anything else you want to name in a standardized way.

Following these best practices will allow you to build your Naming Policies on a solid foundation offering repeatable, standardized, and compliant naming across the CloudBolt CMP, VMware Aria Automation, Terraform, and other tools.

Networking

Mon, 01 Jan 0001 00:00:00 +0000

The available networks depend on the group and environment selected on the order form.

Choose which networks are available

Control which networks a group can use on its Networks tab. You need permission to manage the group’s networks.

Go to Groups and select a group to open its details.
Select the Networks tab. Each row is a network associated with the group, and each column is a NIC. Use the NIC columns to show selector to set how many NIC columns appear (1 to 10; four by default).
In the cell where a network and a NIC intersect, use the toggle to make that network available on that NIC.

Environments work the same way: go to Admin > Environments, select an environment, and open its Networks tab. In some environments, such as AWS and Azure, the tab also has an import button (Import Subnets, or Import VPC Subnets in an AWS environment) that brings in subnets before you enable them.

OneFuse UI

Mon, 01 Jan 0001 00:00:00 +0000

OneFuse UI is the primary mode for managing OneFuse Policies, managing Property Sets, viewing Managed Objects, Jobs and more.

Access the OneFuse UI

Access the OneFuse UI to easily manage OneFuse Policies, view Managed Objects and Jobs, and more.

Open a web browser (for example, Google Chrome).
Type in OneFuse VM’s IP address or Fully Qualified Domain Name (FQDN) in the URL
- For example, https://my-onefuse-instance-name.domain.com
Log in with your credentials.

Workspace layout

When a user logs in, the user will see the following layout for the Workspace.

Option return formats

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) accepts several return shapes from a plugin that generates parameter options. The return must be a list or a dictionary.

List of simple values

The most common return from a generated parameter options action is a list of simple scalar values: strings, integers, decimals, etc. Each value is used as the stored value and the label shown to the user.

List of two-tuples

If you want the stored value to differ from the label shown on the form, return a list of two-tuples. Each tuple must have exactly two elements: the first is the value stored for the parameter, and the second is the human-readable label for the option.

Order blueprints

Mon, 01 Jan 0001 00:00:00 +0000

Order form

Once a blueprint is set up, users order it by opening the Catalog and selecting the blueprint.

If the blueprint has all choices predefined, the user only needs to select Submit. Blueprint items can be set to appear only when needed, so users don’t see them at order time when everything is predefined. Otherwise, the order form prompts for choices such as group, environment, and hardware and software options.

Parameter options

Mon, 01 Jan 0001 00:00:00 +0000

A parameter can be limited to a fixed set of options at the group, environment, blueprint, or parameter level. Its options can also be generated at runtime by an orchestration action. When more than one of these applies to the same parameter, Cloud Management Platform (CMP) resolves them in a set order, described below.

How option order is determined

A blueprint’s options win outright. If the blueprint defines options for the parameter, that is the list the requestor sees. See Blueprint-level parameters.
If the blueprint defines none, the list is the union of the options on the group and the options on the environment.
Generated options are used as they come back, unless the blueprint, group, or environment also define options. In that case, the result is the intersection of the generated list and those options. To bypass that filtering, see Option return formats.
If none of the above yields any options, CMP falls back to the global options set on the parameter. If none of those apply, the requestor gets a free-form entry field, still subject to any constraints.

Two behaviors follow from this:

Permissions

Mon, 01 Jan 0001 00:00:00 +0000

Permissions are assigned to group and special roles. Each role is assigned default permissions, which you can add to or remove from group and special roles. This is a separate set of permissions from those associated with admin roles.

View permissions

Select Admin > Permissions.
Use the search box or page arrows to find specific permissions.

Use permissions

See Groups, roles, and permissions for details on how permissions are used.

Permissions

Orders

Name	Label	Description
order.approve	Approve Orders	Allows the user to approve and deny orders.
order.view	View Orders	Grants the user view-only permission for orders.
order.submit	Submit Orders	Allows the user to order servers and blueprints.
order.change_attributes	Change Order Attributes	Change the order name.
order.choose_recipient	Choose Recipient for Orders	Allows the user to choose a recipient other than themselves to own the servers or resources created by an order.

Servers

Name	Label	Description
server.view	View Servers	Grants the user view-only permission for servers.
server.manage_snapshots	Manage Snapshots	Create, delete, and restore from server snapshots.
server.manage_nics	Manage NICs	Add and remove NICs on servers.
server.console	Console	Open a console session to a server.
server.remote_terminal	Remote Terminal	SSH/RDP access to servers from the CMP UI.
server.manage_applications	Manage Apps	Install and uninstall configuration manager applications on servers.
server.change_attributes	Change Attributes	Change the environment, group, OS Family, and OS Build associations for servers.
server.manage_labels	Manage Labels	Add and remove labels on servers.
server.manage_parameters	Manage Server Parameters	Add, remove, and modify parameters (Custom Fields) on servers.
server.delete	Delete Server	Allows the user to delete servers.
server.manage_credentials	Manage Server Credentials	Allows the user to view and manage the credentials used to run remote actions on servers.
server.view_handler_specific_details	View Handler-Specific Details	Allows the user to see resource handler-specific details for servers, such as the VMware cluster or AWS region.
server.all_actions	Run All Server Actions	Allows the user to run any server action available on the server.
server.view_power_schedule	View Server’s Power Schedule	Allows the user to view the schedule for recurring power control on the server.
server.manage_power_schedule	Manage Server’s Power Schedule	Allows the user to edit the schedule for recurring power control on the server.
server.add_disks	Add Disks	Allows the user to add disks to a server.
server.remove_disks	Remove Disks	Allows the user to remove disks from a server.
server.resize_disks	Resize Disks	Allows the user to resize disks on a server.
server.resize	Resize VM	Change the type (size) of a virtual machine.
server.define_remote_script	Define Remote Script	Allows the user to choose servers when creating a remote script action.

Resources

Name	Label	Description
resource.view	View Resources	Allows the user to view resources.
resource.change_attributes	Change Resource Attributes	Change attributes for resources.
resource.manage_parameters	Manage Resource Parameters	Add, remove, and modify parameters (Custom Fields) on resources.
resource.all_actions	Run All Resource Actions	Allows the user to run any resource action available on the resource.
resource.view_power_schedule	View Resource’s Power Schedule	Allows the user to view the schedule for recurring power control on the resource.
resource.manage_power_schedule	Manage Resource’s Power Schedule	Allows the user to edit the schedule for recurring power control on the resource.
resource.manage_labels	Manage Labels	Add and remove labels on resources.

Groups

Name	Label	Description
group.view	View Group Details	Allows the user to view a group’s details.
group.change_attributes	Change Group Attributes	Allows the user to change a group’s attributes.
group.delete	Delete Group	Allows the user to delete groups.
group.create_subgroup	Create Subgroup	Allows the user to create a subgroup within an existing group.
group.manage_members	Manage Group Memberships	Allows the user to manage group memberships.
group.manage_networks	Manage Group Networks	Allows the user to manage group networks.
group.manage_parameters	Manage Group Parameters	Allows the user to manage group parameters.
group.manage_subgroup_quotas	Manage Subgroup Quotas	Allows the user to manage quotas for subgroups of a group.
group.manage_members_view_unassigned_users	Manage Group Memberships - View Unassigned Users	Allows the user to view and add users to groups they manage that do not currently have a group assigned (such as new users). Requires the group.manage_members permission.
group.edit_parameter_values	Change Value Of Parameters	Allows the user to change the values of existing parameters.

Blueprints

Name	Label	Description
blueprint.manage	Manage Blueprints	Allows the user to perform most management actions on blueprints the group can manage, such as setting the resource type, allowing additional groups to manage or deploy it, and adding build items. Exceptions handled by other permissions include configuring the blueprint so any group can deploy (blueprint.any_group_can_deploy) and creating a new parameter from the blueprint (blueprint.create_parameters).
blueprint.any_group_can_deploy	Configure Blueprints So Any Group Can Deploy	Allows the user to modify a blueprint’s settings so it is available for deployment by all groups on the instance, current and future. This permission can have a broad impact; we recommend limiting it to Resource Admin or a similar role.
blueprint.create_parameters	Create Blueprint Parameters	Allows the user to create blueprint parameters only.
user.create_parameters	Create User Parameters	Allows the user to create user parameters only.
environment.create_parameters	Create Environment Parameters	Allows the user to create environment parameters only.

Jobs

Name	Label	Description
job.view	View Jobs	Allows the user to view jobs.
job.view_logs	View Job Logs	Allows the user to view and download job logs.
job.cancel	Cancel Jobs	Allows the user to cancel in-progress jobs.
job.rerun	Re-run Jobs	Allows the user to re-run failed jobs.

Data protection

Name	Label	Description
dataprotection.manage_parameter_dataprotection_plan	Manage Data Protection Plan	Allows the user to manage servers’ data protection plans.
dataprotection.restore_from_snapshot	Restore Data Protection Snapshots	Allows the user to restore a host from a data protection snapshot.

OneFuse

Name	Label	Description
module.view	View Modules	Allows the user to view modules.
policy.list	List Policies	Allows the user to list OneFuse policies.
policy.manage	Manage Policies	Allows the user to create, edit, and delete OneFuse policies.
policy.execute	Execute Policies	Allows the user to run OneFuse policies.

Product support lifecycle

Mon, 01 Jan 0001 00:00:00 +0000

Starting v9.4.7, refer to Releases for the list of supported versions.

OneFuse v1.4.2 and older

Version	General Availability	Deprecation Date	End of General Support
1.4.2	February 3, 2022	February 3, 2023	May 3, 2023
1.4.1	October 22, 2021	Upgrade to 1.4.2	Upgrade to 1.4.2
1.4	September 21, 2021	Upgrade to 1.4.2	Upgrade to 1.4.2
1.3	June 3, 2021	June 3, 2022	September 3, 2022
1.2	February 2, 2021	February 2, 2022	May 2, 2022
1.1	October 27, 2020	October 27, 2021	January 27, 2022
1.0.1	August 25, 2020	August 25, 2021	November 25, 2021
1.0	July 15, 2020	July 15, 2021	October 15, 2021

Definitions

General Availability: the date the version is released and support starts.

Provisioning

Mon, 01 Jan 0001 00:00:00 +0000

Built-in parameters are added to each Azure environment when CMP imports its region, and appear on the environment’s Azure Parameters tab. Create optional parameters where you need them: on a group, an environment, or a server.

Authentication and passwords

Azure requires credentials for every new server. The Authentication parameter selects the method: a password, or an SSH key on Linux.

Azure Password must be 8 to 123 characters with a number, an uppercase letter, a lowercase letter, a special character, and no spaces. Windows servers always need one, and there is no default.
Azure Key pair name selects an existing Azure SSH public key to install on the server. You connect with the matching private key. Linux only.

Azure does not accept root, admin, or Administrator as a username. If an order carries one of those, or no username, CMP uses the server owner’s CMP username instead and notes the change in the job log.

Release 2026.3

Mon, 01 Jan 0001 00:00:00 +0000

Refreshed interface and guided onboarding

Release 2026.3 introduces a redesigned Cloud Management Platform (CMP) interface and a new onboarding experience, including a free-tier license so you can get started right away. If you maintain custom templates, UI extensions, or JavaScript written for Bootstrap 3, review the Bootstrap 5 migration guide before upgrading.

Latest release 2026.3.104

Availability: 21 Oct 2026

Enhancements

Custom forms now show the Rate and Cost Preview when ordering a blueprint and when editing an order. They follow the Show “Rates” when ordering and Show “Cost Preview” on Order forms settings. (CMP-4378)

Bug fixes

Fixed an issue introduced in 2026.3.101 where selecting Save in the parameter options dialog did not save the options or close the dialog. (CMP-4543)

Release 2026.3.101

Availability: 20 Oct 2026

Release notes

Mon, 01 Jan 0001 00:00:00 +0000

Refer to OneFuse release notes for additional information.

v 1.50.2

Released June 23, 2025:

Terraform OneFuse Provider v1.50.2 for OneFuse

New features and bugs:

Excluded the empty records parameter for DNS reservation

v 1.50.1

Released October 23, 2024:

Terraform OneFuse Provider v1.50.1 for OneFuse

New features:

Terraform Import feature for OneFuse Modules.

Enhancements and bug fixes:

Added the fix to output the dns_search_suffix in IPAM module.

v 1.40.0

Released September 21, 2021:

Release notes

Mon, 01 Jan 0001 00:00:00 +0000

Refer to OneFuse release notes for additional information.

v1.4.0

Released September 30, 2021:

Introducing OneFuse XUI for consuming OneFuse integrations in CloudBolt CMP 9.3+.

New features

Allows easy consumption of the following OneFuse Modules within CloudBolt CMP (minimum version required: v9.3):
- Ansible Tower
- DNS
- IPAM
- Microsoft Active Directory
- Naming
- Pluggable
- Scripting
- ServiceNow CMDB
Templating and Property Toolkit features:
- Create properties/parameters via OneFuse_CreateProperties
- Get properties from a OneFuse Property Set by name OneFuse_SPS
Utilizes the OneFuse Python Module

Release notes

Mon, 01 Jan 0001 00:00:00 +0000

Refer to OneFuse release notes for additional information.

v1.4.0

Released September 21, 2021

Introducing the OneFuse Python module for consuming OneFuse integrations and using them with any Python platform (for example, Ansible).

New features

Allows easy consumption of the following OneFuse modules within Python:
- Ansible Tower
- DNS
- IPAM
- Microsoft Active Directory
- Naming
- Pluggable
- Scripting
- ServiceNow CMDB
- vRealize Automation
Templating and Property Toolkit features:
- Render a template
- Get Property Toolkit properties from template properties dict:
  - Also get properties that have a key prefixed with OneFuse_SPS_
  - Also get properties that have a key prefixed with OneFuse_CreateProperties_
- Get properties from a OneFuse property set by name
Common utilities that can be used by any Python platform (for example, Ansible):
- OneFuse instance: get version and instance ID
- OneFuse jobs: get jobs return, and wait for a job completion
- Requests: perform an API request, get a OneFuse managed object, get a OneFuse policy by name, deprovision a OneFuse managed object
- Tracking ID: create a unique tracking ID, add the tracking ID to request headers, get the tracking ID from a OneFuse managed object

Release notes

Mon, 01 Jan 0001 00:00:00 +0000

Refer to OneFuse release notes for additional information.

v1.4.0

Released September 21, 2021

Introducing OneFuse Ansible Module for consuming OneFuse integrations with Ansible Core and Ansible Tower!

New features

Utilizes OneFuse Python Module
Allows easy consumption of the following OneFuse modules within Ansible Module:
- Ansible Tower
- DNS
- IPAM
- Microsoft Active Directory
- Naming
- Pluggable
- Scripting
- ServiceNow CMDB
- vRealize Automation

Release notes

Mon, 01 Jan 0001 00:00:00 +0000

Refer to OneFuse release notes for additional information.

v2023.0.0

OneFuse for VMware vRealize Automation Package v2023.0.0, released February 2023.

New features

Add Additional AD Computer Account object capabilities Build 19639095
Added CMP Migration Endpoint Build 19639095
Added additional information to vmProperties stack Build 19639095
Added retry logic to REST request action, in case it fails with StatusCode != 2xx Build 19639095
Updated the resource status (expire) in ServiceNow depending on the deployment status Build 19639095

Enhancements

Made sure that all vRA8 provisioning workflows log “Custom Properties” returned to vRA8, for better insight into what is added to each VM Build 19639095

Bug fixes

Small bugfix to fix typo in error/log message related to retry logic in REST request action Build 19639095
Do not execute ServiceNow Update workflow for ‘Deployment’ resourceType Build 19639095

Required GCP permissions

Mon, 01 Jan 0001 00:00:00 +0000

The credential finds your projects and resources and creates CMP’s service account when you import a project, so it needs permission to create service accounts and modify project IAM policies. Create the credential as described in Create credentials in Google Cloud, then grant it the roles below on each CMP-managed project.

How CMP uses each identity

Identity	What CMP uses it for
Your credential: the service account key you add to the handler, or, with an OAuth client ID, the Google account you authorize with.	Listing projects and verifying the handler’s connection; creating CMP’s service account and its key when you import a project; syncing servers, networks, images, and disk types; applying labels; reading utilization; and provisioning onto Shared VPC subnets or from another project’s images.
CMP’s service account: `cb-service-account-<handler ID>`, created in each imported project.	All other provisioning, power actions, disk changes, deleting servers and their firewall rules, resetting Windows passwords, and verifying a project’s connection.

When CMP imports a project, it grants its service account the Compute Admin and Service Account User roles in that project. Servers provisioned by this account run as the project’s Compute Engine default service account, so that account must exist and be enabled.

Resource handler model

Mon, 01 Jan 0001 00:00:00 +0000

Every resource handler is an instance of resourcehandlers.models.ResourceHandler. Each supported technology subclasses it: a vCenter connection is a VsphereResourceHandler and an AWS connection is an AWSHandler. The base model uses HasSubModelsMixin, meaning that a query against ResourceHandler returns base instances. Call cast() on one to get the subclass, with the fields and methods specific to that technology.

(opens full-size image in a new tab)

Resource types (XaaS)

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) ships with one resource type: Service. Defining more allows the Catalog to offer items beyond servers. A blueprint names the type it deploys, and every resource it creates is listed and managed under that type. CMP calls this feature XaaS, or anything as a service.

(opens full-size image in a new tab)

Manage resource types

Go to Admin > Resource Types (XaaS). The page lists every resource type, and the Quantity column shows how many of that type you have access to. Select a type to see them.

Sample payloads

Mon, 01 Jan 0001 00:00:00 +0000

F5 BIG-IP

To learn more about this OneFuse Pluggable Module, refer to F5 BIG-IP.

Replace the value of f5Endpoint in the samples below with the name of the Connection info created for the F5 Endpoint.

F5 sample 1: Using OneFuse modules

Sample payload below uses OneFuse Modules: Naming, IPAM, and DNS.

Policy parameters:

Sample payload for Policy Parameters for consuming this Module Policy via VMware vRealize Automation.

{% set vip_name = resource.onefuse_naming.vip.name | default("none", true) %}
{% set vip_ip = resource.onefuse_ipam.vip.ipAddress | default("none", true) %}
{% set dns_zone = "example.com" %}
{% set vip_dns_fqdn = resource.onefuse_dns.vip.records[0].name | default("none", true) %}
{% set tenant_name = "tenant_" + vip_name %}
{% set app_name = "application_" + vip_name %}
{% set pool_name = "pool_" + vip_name %}
{% set service_name = "service_" + vip_name %}

{
  "provisioningPayload": {
    "deploymentItems": {
      "plugin-bdi-54mjrf9h": {
        "parameters": {
          "resource_name": "{{vip_name}}",
          "skip_as3_install_check": false,
          "provisioning_as3_method": "POST",
          "provisioning_as3_path": "/mgmt/shared/appsvcs/declare?show=expanded",
          "provisioning_as3_data": {
            "class": "AS3",
            "action": "deploy",
            "persist": true,
            "declaration": {
              "class": "ADC",
              "schemaVersion": "3.0.0",
              "label": "{{vip_dns_fqdn}}",
              "remark": "Simple HTTP application with RR pool",
              "{{tenant_name}}": {
                "class": "Tenant",
                "{{app_name}}": {
                  "class": "Application",
                  "{{service_name}}": {
                    "class": "Service_HTTP",
                    "virtualAddresses": [
                      "{{vip_ip}}"
                    ],
                    "pool": "{{pool_name}}"
                  },
                  "{{pool_name}}": {
                    "class": "Pool",
                    "monitors": [
                      "http"
                    ],
                    "members": [
                      {
                        "servicePort": 80,
                        "serverAddresses": [
                          {% for key in members %}"{{ key.ip_address }}"{{ ", " if not loop.last else "" }}{% endfor %}
                        ]
                      }
                    ]
                  }
                }
              }
            }
          },
          "deprovisioning_as3_method": "DELETE",
          "deprovisioning_as3_path": "/mgmt/shared/appsvcs/declare/{{tenant_name}}",
          "deprovisioning_as3_data": "",
          "f5_endpoint": "F5_BIGIP_14",
          "onefuse_naming": [
            {
              "label": "vip",
              "endpoint": "onefuse",
              "policy": "vip_naming",
              "template_properties_override": {
                "text": "test2"
              }
            },
            {
              "label": "pool",
              "endpoint": "onefuse",
              "policy": "pool_naming",
              "template_properties_override": {}
            }
          ],
          "onefuse_ipam": [
            {
              "label": "vip",
              "endpoint": "onefuse",
              "policy": "F5_VIP",
              "template_properties_override": {},
              "hostname": "{{vip_name}}"
            }
          ],
          "onefuse_dns": [
            {
              "label": "vip",
              "endpoint": "onefuse",
              "policy": "F5_VIP",
              "template_properties_override": {
                "text": "test2"
              },
              "name": "{{vip_name}}",
              "value": "{{vip_ip}}",
              "zones": [
                "{{dns_zone}}"
              ]
            }
          ],
          "onefuse_property_sets": [
            {
              "label": "machine_naming_properties",
              "property_set_name": "template_portland_prod_windows_web",
              "template_properties_override": {
                "text": "test"
              }
            }
          ],
          "additive_key": "{{inputProperties.deploymentId | required("missing inputProperties.deploymentId")}}-{{OneFuse_Suffix | required("missing OneFuse_Suffix")}}",
          "additive_resource_name": "(member {{OneFuse_VmNic0.target}})",
          "additive_data": {
            "members": {
                "hostname": "{{OneFuse_VmNic0.target | required("missing OneFuse_VmNic0.target")}}",
                "ip_address": "{{OneFuse_VmNic0.ipAddress | required("missing OneFuse_VmNic0.ipAddress")}}"
            }
          },
          "f5_outputs": {
            "app_name": "{{app_name}}",
            "vip_name": "{{vip_name}}",
            "tenant_name": "{{tenant_name}}",
            "pool_name": "{{pool_name}}",
            "service_name": "{{service_name}}",
            "member_ips": "{{as3_results.declaration[tenant_name][app_name][pool_name].members.0.serverAddresses | default ([]) | tojson}}"
           }
        }
      }
    }
  }
}

The following snippet from the sample payload above can be modified to have the correct properties for the machine hostname/IP address.

SCVMM template preparation

Mon, 01 Jan 0001 00:00:00 +0000

CMP reads a new guest’s hostname and IP address back through Hyper-V KVP, which is part of Integration Services, and applies the hostname, address, and user data through guest customization: cloud-init on Linux, Sysprep and unattend.xml on Windows. The steps below make both mechanisms work.

This topic covers template and fabric preparation. For resource handler setup and provisioning behavior, see SCVMM.

Prepare a Linux template

Perform these steps inside the running Linux VM before you generalize and seal it.

Security information and event management (SIEM)

Mon, 01 Jan 0001 00:00:00 +0000

SIEM providers collect application logs so you can aggregate, visualize, and analyze events in real time. CMP can help configure the forwarding agents offered by SIEM providers, which ship logs back to the parent indexing server. Two integrations are supported:

Splunk: a CMP-managed SIEM provider. Install and configure the Splunk Universal Forwarder from the CMP UI.
Elastic: a manual integration. Install and configure Filebeat on your CMP server to ship logs to Elasticsearch.

Splunk

The Splunk SIEM provider manages the relationship between a Splunk Universal Forwarder and the remote Splunk server. From the CMP UI, you can install the Splunk Universal Forwarder and configure its essential settings.

Server blueprints

Mon, 01 Jan 0001 00:00:00 +0000

This topic walks through a minimal configuration of one server tier on a blueprint’s Build tab and one group on its Groups tab. For the full set of build items and options, see Build configuration.

Before you start

You need permission to create blueprints, at least one OS Build, and one environment, which in turn requires a configured resource handler.

Create the blueprint

On the Catalog page, select Create Blueprint, enter a name, then select Save.

Server views

Mon, 01 Jan 0001 00:00:00 +0000

List view

The server list shows all servers for which a user has view permissions, as determined by their group and role memberships. You can filter the list by various facets (select Show Filters) or search it using the table’s search field. If labels are set on any servers, selecting a label filters the table on that label.

Column headers also have a menu to sort and filter that column. Depending on the column, you can pick from a list of values (such as Status, Environment, or Labels), search text in Hostname or Owner, or choose dates in Added. Active filters show as chips above the table. Remove a chip to clear that filter, or select Clear all when more than one is active.

ServiceNow

Mon, 01 Jan 0001 00:00:00 +0000

ServiceNow is a platform for creating and managing digital workflows. CMP’s ServiceNow integration lets you route CMP orders through the ServiceNow request management process.

To send server configuration data to the ServiceNow CMDB, use the ITSM integration. This page covers the Service Catalog (request management) workflow.

Request management and the Service Catalog

The ServiceNow Service Catalog starts the request management process. When it is enabled, submitting an order in CMP sends the request to ServiceNow instead of ordering immediately:

ServiceNow CMDB policy

Mon, 01 Jan 0001 00:00:00 +0000

Setup overview

To use the ServiceNow CMDB module:

Create a ServiceNow CMDB Module Credential.
Create a ServiceNow Endpoint. If applicable, configure ServiceNow proxy support.
Create a ServiceNow CMDB Policy and define ServiceNow IRE Templates.
Provision with ServiceNow CMDB.

The user setting up the ServiceNow Policy must have the credentials to log in to the ServiceNow instance.

Create a ServiceNow CMDB policy

Prerequisite

Create a Module Credential and Endpoint for the selected technology.

In OneFuse, select ServiceNow CMDB from Home. Or, select Modules > ServiceNow CMDB from the left navigation menu.
Select Create, and fill out the ServiceNow CMDB Policy form under the General tab.
Select Next, and enter a provisioning template for the ServiceNow Identification and Reconciliation Engine (IRE).

Update a ServiceNow CMDB policy

Update the ServiceNow CMDB Policy to change the name, description, Endpoint, and IRE templates.

Set up and install the ServiceNow Connector

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

A ServiceNow instance. See Supported Versions for compatibility information.
A ServiceNow MID Server set up, installed, and configured. A ServiceNow user with the role mid_server must exist:
1. Go to User Administration > Users.
2. Create or edit a user.
  
  If creating a new user, save the user first before assigning roles.
3. Select Roles > Edit.
4. Add mid_server to the Roles List.
5. Select Save.
Verify that the MID Server has been successfully configured, that the MID Server service is started and running, and that the MID Server is validated with a status of Up in ServiceNow.
Access the CloudBolt Download Article for CMP/OneFuse 2023.5.

The article always contains the latest OneFuse ServiceNow Connector download link.
1. Log in with your CloudBolt Connect account.
2. Download the OneFuse ServiceNow Connector XML.

Set up high availability in AWS

Mon, 01 Jan 0001 00:00:00 +0000

Create EC2 instances

Consider creating a key pair (in .ppk format) and a security group before creating instances.

Create a primary instance

Log in to the AWS console and go to EC2.
Select Launch instance.
Search for and select the CloudBolt Cloud Management Platform AMI from the AWS Marketplace.
Select Subscribe on instance launch or Subscribe now.
Provide a name for the instance.
Select an instance type.
Select a key pair or create a new one using the .ppk private key file format.
Under Network settings, select Edit, and choose a subnet and availability zone.
Select a security group or choose to create a new one.
Configure any other details as required, then select Launch instance.

Create a secondary instance

Create a second EC2 instance using the same steps as the primary instance, with the following considerations:

Set up SSO and SAML

Mon, 01 Jan 0001 00:00:00 +0000

Add the SSO provider in CMP

Go to Admin > Single Sign-On (SSO).
Select Add.
Select the IdP type. The type only affects how the IdP appears in the CMP UI and some initial option defaults; any IdP type can be configured to work as any other.
Complete the SAML settings as needed. The selected Signing Algorithm must match the IdP.
Select Create.

(opens full-size image in a new tab)
Select Download Metadata XML to download the metadata file. You need it when configuring your IdP for single sign-on.
Configure the identity provider (see Configure the identity provider) and obtain its metadata.
In CMP, go to Admin > Single Sign-On (SSO), select the IdP, select Upload IdP XML, and upload the IdP metadata.

Shared management

Mon, 01 Jan 0001 00:00:00 +0000

When adopting CMP, operations may keep working directly in vCenter or a cloud console while users order through CMP.

Two management models

CloudBolt exclusive

Operations teams have little or no access to change the services CMP provisions: every change goes through CMP. Only the changes a blueprint offers are possible; any configuration a team needs must be available as a resource action or a plugin on the blueprint’s Build tab. This suits production and tightly change-managed environments.

Structure of a plugin

Mon, 01 Jan 0001 00:00:00 +0000

A plugin module must contain a function called run(). The Cloud Management Platform (CMP) job engine calls that function at particular points during a job’s execution.

What run() receives

The function is passed a Job object and a set of keyword arguments that simplify access to the CMP objects the plugin is likely to need. Every keyword argument below is passed to any plugin’s run method, but its value is None when the object it refers to does not apply in that context.

Summary Report

Mon, 01 Jan 0001 00:00:00 +0000

Summary reports live in the reports library alongside your other reports and have a Summary type badge. See Saved Reports.

Create a summary report

Go to Saved Reports.
Open the New report dropdown and select New summary report.
In the dialog, set:
- Organization (required): Search for and select the organization to report on.
- Date Range: Dynamic (always the most recently completed month) or Static (pick a month).

The report name is derived automatically, for example, “Acme summary report - Last month.”

Super admin tasks

Mon, 01 Jan 0001 00:00:00 +0000

Users with the Super Admin role will be able to access the Super Admin menu option on the Top App Bar.

OneFuse UI for Super Admin

Quickly identify whether or not you are in the Super Admin UI by the color of the left navigation menu.

(opens full-size image in a new tab)

Supported platforms and execution methods

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) runs a remote script either over SSH or WinRM, which works on any platform, or through a platform-specific mechanism, which is available on a few. Some operating systems and platforms require setup first; see OS-specific requirements.

SSH and WinRM

The generic method works on a server of any resource technology. What it needs is a network route from the CMP appliance to the server and credentials that CMP can authenticate with. The platform the server runs on does not matter.

UI elements that support extensions

Mon, 01 Jan 0001 00:00:00 +0000

Every decorator takes a title and a description. The title is displayed on the element and defaults to the view function’s name. The description appears on the Extensions Management page, and defaults to the view’s docstring. Import the decorators from extensions.views, and give each view a template path that starts with the package folder name.

Dashboard cards

The Dashboard is built from cards. Use dashboard_extension to add your own.

from django.shortcuts import render

from extensions.views import dashboard_extension


@dashboard_extension(
    title="Network Topology",
    description="Current status of the network topology",
)
def network_topology_card(request):
    return render(
        request,
        "network_topology/templates/dashboard_card.html",
        {"data": get_network_topology_data()},
    )

Reports

report_extension adds a custom report. Reports can include tables and charts using the built-in Highcharts library.

Use cases for multi-tenancy

Mon, 01 Jan 0001 00:00:00 +0000

Bring your own data center

A global managed services provider (MSP) uses Cloud Management Platform (CMP) to provide automation and self-service to its external customers. The MSP offers its customers two options:

Use the MSP’s data centers, along with all their virtualization systems (resource handlers), environments, container orchestrators, configuration managers, and so on, which are set up in CMP as global objects accessible to all tenants.
Bring their own data centers and use the CMP UI to connect to systems within their own data centers, enabling self-service and automation for the resources they already have.

Option 2 is enabled by CMP’s multi-tenancy capabilities. Global administrators set up tenants in CMP, create an admin role with the appropriate admin management permissions (for example, resourcehandler.manage), and grant that role to users while adding them to the appropriate tenant.

VMware data collector configuration

Mon, 01 Jan 0001 00:00:00 +0000

The collector is deployed with CMP and does not require a CSMP license to run.

The collector can be configured in one of two ways:

If you are a CMP-licensed customer, then configuration can be done using the standard CMP Administration UI.
If you only have a CSMP license, deploy the CMP appliance in Collector mode and use management commands.

CMP also collects OpenStack inventory through an OpenStack Data Collector recurring job and an openstack sub-command. This page covers the VMware collector.

Migrate from vRA 7 to Aria Automation with OneFuse

Mon, 01 Jan 0001 00:00:00 +0000

Once migrated, OneFuse Managed Objects will exist and the user has the flexibility to

Destroy via API without deprovisioning

or
Destroy normally within the deployment in vRA8.2+/Cloud, which then calls OneFuse to destroy and deprovision the resource.

What is an upstream provider?

Mon, 01 Jan 0001 00:00:00 +0000

(opens full-size image in a new tab)

A OneFuse Upstream Provider is an automation/orchestration tool or service that benefits from the consumption of OneFuse Policies.

Examples include Cloud Management Platforms (CMP), infrastructure-as-code automation/orchestration/provisioning, configuration management and service management tools, and cloud and container platforms.

OneFuse provides centralized management, governance, and visibility across Upstream Providers.

OneFuse Ansible Module for Ansible Core/Tower
OneFuse XUI for CloudBolt CMP
OneFuse Python Module
OneFuse Terraform Provider
VMware vRealize Automation 7.6
VMware Aria Automation 8.1+/Cloud

Resources

SwaggerHub API guide: OneFuse
GitHub Repos:

Widgets

Mon, 01 Jan 0001 00:00:00 +0000

To choose which widgets appear and change their settings, see Customize the dashboard. Some widgets and actions require specific roles. See Permissions.

Actionable orders

Lists up to 10 orders that are pending approval or paused by flow control. Orders waiting for your approval are listed first, followed by your orders.

Each row has icon buttons for available actions, such as View, Approve, Deny, Remind, Cancel, and Resume. Select See all orders to open the Orders page.

Action types

Mon, 01 Jan 0001 00:00:00 +0000

The six action types

CloudBolt Plugin: Runs a Python module on the Cloud Management Platform (CMP) server, with access to internal APIs.
Remote Script: Runs a script on the target servers rather than on the CMP server.
Copy File: Copies a file to the target servers. This type is marked Beta in the user interface.
Webhook: Makes a call into an external, web-based API.
Email Hook: Sends an email.
External Flow: Runs a flow held in an external orchestrator.

Not every type is available everywhere

The types available when you create an action depend on where you create it. CloudBolt Plugin is always available. The others are offered conditionally:

Annotations specification

Mon, 01 Jan 0001 00:00:00 +0000

Annotations, also called server notes, can be set for new servers in three ways:

Manual entry: the user enters annotations when ordering a server. This is the default.
Parameter template: an admin sets the Annotation parameter to a parameter template that generates the annotation, covered below.
Orchestration action: a pre-create resource orchestration action runs code to determine the annotation.

Annotations are supported on many resource handlers, where they map to the platform’s native notes, description, or tag field. For example, VMware uses the native Notes field, and AWS applies an Annotation tag when the handler is set to add Name and Annotation tags to new servers (enable Add Name & Annotation tags to new servers in the handler’s Edit Settings; the Name and Annotation entries then appear on its Tags tab). Annotations sync back to the server after creation.

Ansible Automation Platform

Mon, 01 Jan 0001 00:00:00 +0000

Import projects, inventories, groups, job templates, and workflows from the platform, then pair an inventory or group with a job template to form a configuration. CMP applies a configuration by adding the server to the appropriate inventory or group and launching the job against it, either while the server is being provisioned or on demand.

Turn the connector on or off

A feature flag controls whether this connector can be added and is enabled by default. To hide it, run the following on the appliance:

Migrate from Aria Automation to Aria Automation with OneFuse

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse Migration Tools vRealize Orchestrator Package provides examples for the user to “create” OneFuse Managed Objects via Brownfield ingest from Aria Automation VMs and apply necessary OneFuse vRA Properties on these VMs (to enable future deprovisioning from Aria Automation+OneFuse).

Once migrated, OneFuse Managed Objects will exist and the user has the flexibility to do the following:

Destroy via API without deprovisioning.
Destroy normally within the deployment in Aria Automation/Cloud, which then calls OneFuse to destroy and deprovision the resource.

The following table depicts sample workflows for OneFuse Modules in the Migration Tools vRO Package:

Authenticate with Roles Anywhere

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) presents a client certificate to the Roles Anywhere API and receives temporary credentials in return, valid for one hour. CMP requests new credentials each time it connects. Nothing long-lived is stored in CMP, which suits a multi-tenant deployment where you want to share the resources in an account without sharing its keys.

What you set up first

Four things must exist in AWS before you add the handler, each of which produces a required value. Work through them in order.

Authentication

Mon, 01 Jan 0001 00:00:00 +0000

The API uses the same accounts and permissions as the rest of Cloud Management Platform (CMP): the roles and group permissions that apply in the web interface also apply to the API.

Prerequisites

An account you can log in to the web interface with. Every user has API access.

Get a bearer token

With curl

Replace cmp-ip-or-hostname, username, and password. Include domain only when logging in against a directory domain.

Authentication requirements

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) must be able to authenticate with the remote guest in order to interact with it. That is done with either a password or an SSH key, depending on the resource handler and OS involved.

Passwords

VMware relies on passwords for accessing VMs. Authentication with these servers requires a password and sometimes a username.

Credentials can be set in several places:

On the server’s details page. For a server that has already been provisioned, view or update its credentials here to match the VM’s actual configuration.
On the template. Set credentials before provisioning so they are applied to new servers built from it.
On the group, environment, or globally. Set the Password and, if needed, Username parameters at any of these levels.
On a remote script action. Credentials set here override any set on the server when that action runs.

These credentials are associated with the server during provisioning, so they are available for running remote scripts at provision time or later. The username must be provided explicitly unless it is ubuntu for Ubuntu servers, root for other *nix distributions, or Administrator for Windows.

Azure Load Balancer

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) creates and deletes the load balancer, and adds or removes servers from its backend pool as the tier scales up and down. Any other configuration is done in the Azure portal.

Prerequisites

An Azure resource handler with at least one region and one image imported.
An Azure environment with at least one OS build.

Add a load balancer to a blueprint

A load balancer is a build item on a blueprint, alongside the server tier it balances. These steps build the simplest case, one server tier plus one load balancer. To balance more than one tier, add a server tier build item for each.

BlueCat

Mon, 01 Jan 0001 00:00:00 +0000

The setup workflow is common to all IPAM integrations: connect, import the networks, map them to your resource handler networks, and then enable orchestration. See IP address management (IPAM) for those steps. This page covers what is specific to BlueCat.

Connection details

In Admin > IP Management, select Add, then choose BlueCat.

Field	Description
Name	A name for this connection.
IP address	The address or hostname of the BlueCat server.
Port	Defaults to 443.
Account username	An account authorized to run commands on the BlueCat server.
Password	The password for that account. It is stored securely. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the secret from a configured vault provider. See Use password vaults.

A server will not get an address

The domain comes from the DNS Domain value on the CMP network. When it is set, CMP registers the host as <hostname>.<domain> in BlueCat, so the domain must be one BlueCat knows. If the two do not agree, BlueCat refuses to register the host against the IP, and provisioning fails. If the network has no DNS Domain, CMP reserves the IP address without creating a host record.

BlueCat DNS

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse BlueCat DNS module enables organizations who utilize BlueCat for DNS hosting to have a fully automated method of controlling DNS records as the cloud environment dynamically scales, reducing the support burden and increasing the chances of successful ITaaS deployments.

License required

This Module requires the BlueCat DNS License in order to execute a BlueCat DNS Policy. BlueCat DNS Policies, Endpoints, and Module Credentials can be created without a license.

BlueCat IPAM

Mon, 01 Jan 0001 00:00:00 +0000

The BlueCat IPAM module enables organizations who utilize BlueCat for centralized IP address management to have a fully automated method of obtaining and releasing IP addresses as the cloud environment dynamically scales. IP subnets can now easily be shared between deployments and alongside existing tools and devices without fear of IP conflict.

License required

This Module requires the BlueCat IPAM License in order to execute a BlueCat IPAM Policy. BlueCat IPAM Policies, Endpoints, and Module Credentials can be created without a license.

Blueprint actions

Mon, 01 Jan 0001 00:00:00 +0000

A blueprint can include one or more server tiers. When you need to add custom logic to the deployment process, blueprint actions provide it. Manage them on the Build tab of a blueprint’s detail view. Remote Script and Copy File actions can be associated with all server tiers, or only specific ones. You can give an action a name and description that make sense for that blueprint, and provide default values for any action inputs.

Blueprint-level parameters

Mon, 01 Jan 0001 00:00:00 +0000

Blueprint managers can associate parameters with blueprints using the Parameters tab while managing the blueprint.

Parameters include both custom fields and preconfigurations. These parameters appear when ordering the blueprint, and the values entered are associated with each build item in the deployed resource, the deployed resource itself, or both, depending on the destination the manager selects.

For example, you can use this to set the same expiration date for all servers provisioned by the blueprint, or to mark the entire resource as being associated with a particular ticket number.

Blueprints as code

Mon, 01 Jan 0001 00:00:00 +0000

Once a blueprint is linked to a repository, you can push it, preview the changes, and later refresh the blueprint from the repository. You can also create a blueprint from one already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh a blueprint

Open the blueprint from the Catalog, then select its repository tab. The tab is named Repository until the blueprint is linked to a repository; then it is named GitHub or GitLab.

Brownfield ingest

Mon, 01 Jan 0001 00:00:00 +0000

SwaggerHub API: OneFuse for Brownfield Ingest

VMware Aria Automation: Migration tools with Brownfield Ingest

Features and highlights

Utilize OneFuse Brownfield Ingest APIs for scenarios where OneFuse is desired for management for previously integrated and provisioned resources.

POST Ingest
- Ability to create the Managed object via Ingest API without provisioning and associate it to an existing OneFuse Policy.
DELETE Ingest
- Ability to delete the Managed Object via Ingest API without running any deprovisioning scenarios (only deletes the Managed Object).
DELETE Deprovisioning
- Ability to delete the Managed Object created via Ingest API with deprovisioning using normal delete API for the Module.
The Job Metadata reflects everything created and deleted via API.
- When templateProperties are passed in, it is stored on the Job Metadata requestInfo.payload

Prerequisites

OneFuse Installed and Setup
OneFuse Configured
- Module credentials and/or Connection info
- Module endpoints
- Module Policies
Identify resources to ingest and be managed by OneFuse

Ingest managed objects

The following can be created and maintained by OneFuse as an ingested OneFuse Managed Object.

Catalog item policies

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Create a Module Credential using a ServiceNow user that has the role x_sovla_onefuse.admin.
Create a ServiceNow Endpoint. If applicable, configure ServiceNow proxy support.
OneFuse policies: when using the OneFuse Aria Automation Module, it is recommended that the Aria Automation 8 Policy executes successfully with the ServiceNow CMDB policy attached to the vRA Cloud Template.

Create a ServiceNow Catalog Item Policy

In OneFuse, select ServiceNow Connector from Home, or select Modules > ServiceNow Connector from the left navigation menu.
Find the ServiceNow Catalog Item Policies table.
Select Create.
Fill out the ServiceNow Catalog Item Policy form.

Update a ServiceNow Catalog Item Policy

Note the following limitations when updating a policy:

CloudFormation template parameters

Mon, 01 Jan 0001 00:00:00 +0000

This page details the AWS CloudFormation template parameters you can configure when deploying the template in your AWS environment.

Use this guide when configuring AWS accounts for CloudBolt Platform integration to determine the appropriate parameter settings for your environment.

S3 bucket configuration

Parameter	Description	Allowed values	Default value	Required
CreateS3Bucket	Create a new S3 bucket. To use an existing bucket, set to `false` and specify the bucket name in `S3BucketName`.	true, false	true	Yes
CreateS3BucketPolicy	Create an S3 bucket policy to control access to billing data. Set to `false` if a bucket with the correct policy exists.	true, false	true	Yes
S3BucketName	Name for new S3 bucket, or existing S3 bucket name.	Valid S3 bucket name	N/A	Conditional, not required when `TargetDeploymentType=MemberAccountOnly`

If you set CreateS3BucketPolicy=false, the existing bucket’s policy must grant bcm-data-exports.amazonaws.com the actions shown in S3 bucket policy. If it does not, the exports are created, but every run fails with “Data Exports no longer has permission to run this export.”

Complete initial setup

Mon, 01 Jan 0001 00:00:00 +0000

In this guide, you’ll:

Create your initial administrator account.
Choose your license. CMP includes a free tier, so you can start right away.
Use the Setup Wizard to connect a cloud and add content to your catalog.

Prerequisites

CMP is installed and reachable in a browser. If you haven’t installed yet, see Install Cloud Management Platform.
You have the URL (or IP address) of your CMP appliance.
If you have a purchased license, have your license key text or .bin license file ready. If you don’t have one, you can start on the free tier and add a paid license later. See Product license.

Create your administrator account and log in

The first time you open CMP in a browser, it takes you to the configuration page. You won’t see a login page until configuration is complete.

Configure Azure tenants

Mon, 01 Jan 0001 00:00:00 +0000

Before connecting your Azure tenant to CloudBolt Platform, ensure that your billing account type is supported and that your Azure administrator has the required permissions for onboarding.

CloudBolt does not request any additional permissions. Any elevated permissions granted to your Azure administrator may be removed once onboarding completes.

To learn more about the resources CloudBolt creates during onboarding, refer to Connect Azure.

Time estimate

This process takes approximately 10–15 minutes. If you choose to include 12 months of historical cost data (recommended), the background data import runs for an additional 15–60 minutes.

Configure network build items on blueprints

Mon, 01 Jan 0001 00:00:00 +0000

With a network build item, the blueprint carries the network alongside the servers, and both are created when someone orders it.

Before you start

Connect an NSX-T manager and map it to a vCenter resource handler. See Network virtualization and Manage network virtualization.
Give the blueprint a resource type. A blueprint with a resource type of None cannot carry a network build item.
Add at least one server build item.

The Network button appears on the Build tab only once an NSX-T mapping has a resource handler attached. If you cannot see it, check the mapping.

Configure Slack to use multi-channel alerts

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Create or identify a Slack channel for alerts.
Ensure you can access your Slack workspace in a browser.

Create a Slack app

Log in to https://api.slack.com/apps.
Select Create New App > From scratch.
Provide an App Name and select your workspace.
Select Create App.

(opens full-size image in a new tab)
Under Features, select OAuth & Permissions.
Under Scopes > User Token Scopes, select Add an OAuth Scope.
Select chat:write.

(opens full-size image in a new tab)

Configure the identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Choose your identity provider

Typically, you send your CMP service provider’s metadata to the IdP. Select your identity provider below for its setup steps:

(opens full-size image in a new tab)

Required fields

Include the following on your IdP configuration. The IdP can extract some or all of these from the CMP service provider’s metadata:

Connect Azure

Mon, 01 Jan 0001 00:00:00 +0000

The process is automated: you authorize CloudBolt and select the subscriptions to include, and CloudBolt handles the rest.

Before you begin

Ensure you have completed the steps in Configure Azure tenants.

There are three stages to the onboarding process:

Authorize: Sign in to your Azure tenant and grant CloudBolt read-only consent
Configure: Select which subscriptions and billing scope to include
Provision: CloudBolt creates the required Azure resources and begins importing your cost data

The active part of this process takes approximately 10 minutes, after which time historical data import, if enabled, continues in the background.

Connection Info

Mon, 01 Jan 0001 00:00:00 +0000

A Connection Info object holds the details needed to reach an external system: an IP address or hostname, a port, a protocol, and credentials such as a username and password, an SSH key, or authentication headers. Cloud Management Platform (CMP) stores the password securely, so any action can use the connection without the credentials appearing in code. There is a standard form, one for Git connections, and another for AWS account profiles.

Cost Explorer

Mon, 01 Jan 0001 00:00:00 +0000

The Cost Explorer displays aggregated cost data across cloud providers, helping you understand where spending occurs and how it changes over time.

Cost Explorer automatically loads the latest preset report, a standardized view of your organization’s cloud provider cost data. From here, you can experiment with customizing the report.

The preset report is a starting point for cost analysis, and changes to it can’t be saved directly. You can create a custom report by selecting Save As after customizing the cost report criteria.

Create recurring jobs

Mon, 01 Jan 0001 00:00:00 +0000

Every route starts in the same place: Cloud Management Platform (CMP), at Admin > Recurring Jobs.

Ways to add a recurring job

Add from Job. Turn a job type that CMP already runs, such as a resource handler sync, into a scheduled job.
Add from Action. Schedule an action, either one that already exists on your instance or a new one you define as you go.
Add from Action in Repository. Create the job from an action held in a connected source code repository. CMP opens the new recurring job when it finishes.
Upload Recurring Job. Import a recurring job from a Zip file. Selecting replace existing overwrites any matching action already on the instance.

(opens full-size image in a new tab)

Custom forms

Mon, 01 Jan 0001 00:00:00 +0000

Drag inputs onto pages and panels in the Cloud Management Platform (CMP) form builder, add logic to show, hide, and validate them as the user types, and fill dropdowns from a REST endpoint when the form opens. A form is stored as JSON, which you can read and edit in the builder’s JSON editor. The builder is SurveyJS.

Build a custom form

When you edit a blueprint, a resource action, or a server action, the Custom Form tab holds the builder for that object.

Customize VMs during provisioning

Mon, 01 Jan 0001 00:00:00 +0000

Extending disks

CMP supports extending the primary disk at provision time for VMs of all OS family types on the VMware and GCP resource handlers. Other resource handlers, including AWS and Azure, do not currently support primary disk extension.

Extending Linux disks

To configure an environment to extend the primary disk on provisioning for Linux servers only:

Add the Extend Primary Disk During Provisioning parameter (extend_root_disk) to the environment and set its value to True.
Include the Disk Size parameter (disk_size) either in a preconfiguration or as a parameter on the group or environment. This value represents the final size, in GB, of the primary disk.

On Linux servers, CMP extends the disk but does not extend partitions to fill the new space. Because of this, CMP does not need to interact with the OS to extend the disk. Extending partitions is the administrator’s responsibility after the server is provisioned.

Permissions

Mon, 01 Jan 0001 00:00:00 +0000

If the CloudBolt Admin role is enabled, CloudBolt Admins have the same dashboard access as Super Admins, except for approving orders, the Blueprints and Recent Activity scope options, and See All History. See Global roles.

Most dashboard widgets are visible to all users, and the content within each widget is limited to what you have permission to see. A few widgets are restricted by role. Users without the required role don’t see these widgets in the Manage Displayed Widgets dialog.

Data protection plan parameters

Mon, 01 Jan 0001 00:00:00 +0000

Add the parameter where your servers are ordered, and Cloud Management Platform offers the imported plans.

The parameter can sit on an environment, a group, or a server. When added to an environment, every server ordered into it can then carry a plan. A blueprint can pin the plan to a value or leave it to be chosen at order time.

Add the parameter to an environment

Go to the environment.
Open the Parameters tab.
Select Add.
Locate and select Data Protection Plan.
Select Add in the dialog.

The parameter now applies to servers ordered into this environment.

Data retention policy

Mon, 01 Jan 0001 00:00:00 +0000

This Data Retention Policy document outlines the retention and deletion practices for data ingested into the CloudBolt Platform during the term of service. As part of our commitment to transparency, security, and compliance, this policy governs how data is retained, stored, and deleted. The retention of customer data, including performance telemetry data, is designed to balance operational needs with privacy and legal obligations. This document covers the retention period for different types of data, the data deletion process, and the client rights regarding data retention.

Deploy with installer

Mon, 01 Jan 0001 00:00:00 +0000

This is also the recommended way to deploy in Azure.

Prerequisites

A dedicated server running RHEL 8 or OL 8 that meets the Hardware guidelines. The installer removes any existing CMP data on the server.
Root access to the server.
The root user’s umask set to 022. Run umask to check it, and umask 022 to set it for the current session.
/usr/local/bin in the root user’s PATH. Run echo $PATH to check it.
firewalld running, if you use it.

Download Cloud Management Platform

Cloud Management Platform Releases

Embed in ServiceNow

Mon, 01 Jan 0001 00:00:00 +0000

Considerations

CMP must have an SSL certificate that your users’ browsers trust, as browsers do not let users accept a certificate warning inside a frame. Check for a locked padlock icon to the left of the CMP URL.
You need a ServiceNow account with an administrator role.
Users’ browsers must allow third-party cookies from CMP. Some browsers block them by default. See Users are asked to log in again.
If CMP uses SSO, CloudBolt recommends turning on Automatically Login to SSO in Miscellaneous Settings so users do not see the CMP login page. Some identity providers do not allow their login page to load in a frame. See The frame is blank.

Setup overview

Set up allowed embed URLs in CMP.
Choose the CMP URL to embed.
Set up the iframe in ServiceNow using one of these methods:
- UI page (recommended): Opens the full CMP interface from the ServiceNow navigator.
- Dashboard: Shows a CMP page as a dashboard widget. Requires Core UI dashboards.
- Homepage (legacy): Shows a CMP page on a homepage. Requires the UI16 interface.

Set up embed URLs in CMP

In CMP, go to Admin > Miscellaneous Settings.
On the Login tab, next to Settings, select Edit.
In Embed URLs / Frame Ancestors, enter the URL of your ServiceNow instance, such as https://yourcompany.service-now.com. To allow more than one instance, separate the URLs with spaces.

(opens full-size image in a new tab)
Select Save.
If you run multiple CMP appliances, SSH into each web server and run /opt/cloudbolt/manage.py generate_webserver_conf.

Environment model

Mon, 01 Jan 0001 00:00:00 +0000

An environment is an instance of infrastructure.models.Environment. It carries a single optional resource_handler, so one environment represents one slice of one cloud or data center.

(opens full-size image in a new tab)

What an environment links to

Some of these links live on the environment, others on the related object.

Related to	Where the link lives
Resource handler	`Environment.resource_handler`, a single foreign key.
Groups	On the group, as `Group.environments`, labeled Available Environments. An empty list means the group is not constrained to particular environments.
Servers	`Server.environment`, protected. An environment with servers cannot be deleted.
OS Builds	On the build, as `OSBuild.environments`, which sets where the build is offered. Read it back from an environment as `environment.os_builds`.
Networks	Networks are `ResourceNetwork` objects, sub-typed per technology. An environment links to them through the options of the NET-type parameters `sc_nic_0` through `sc_nic_9`. An option is offered only when the resource handler has it and the group or environment also allows it.
Parameters	`custom_fields` for the parameters that apply, and `custom_field_options` for their allowed values. The resource handler determines which technology parameters appear, so changing the handler clears their values.
Preconfigurations	`preconfigurations` for the preconfigurations offered in this environment, and `preconfiguration_options` for their allowed value sets.
Provision engine, container orchestrator	The optional foreign keys `provision_engine` and `container_orchestrator`, for environments that provision through something other than the resource handler.
Data center, resource pool	The optional foreign keys `data_center` and `resource_pool`, which describe where in the provider the environment sits.
Tenant	`tenant` scopes the environment in a multi-tenant deployment.
Quotas	`quota_set`, required. Every environment is created with an empty quota set.

Two fields override behavior set elsewhere:

Example prompts and workflows

Mon, 01 Jan 0001 00:00:00 +0000

The examples below illustrate how an AI agent interprets natural-language requests and maps them to MCP server tools. Single-tool examples show straightforward requests; the complex multi-tool workflows section shows how the agent chains several tools together to answer a single request.

For the full tool reference, see MCP server tools.

Identify yourself

“Who am I, according to CloudBolt?”
“What is my username and email in the platform?”
“Am I a super admin in CloudBolt?”

Export and import environments

Mon, 01 Jan 0001 00:00:00 +0000

An export includes the environment along with its parameters, limits, OS builds, and rates. On import, CMP reuses any existing matching objects and creates the rest. Exporting requires administrator access.

Export an environment

Go to Admin > Environments and select the environment’s name.
Select Export.
To encrypt the secrets this environment holds, enter a password of at least 12 characters. See Secrets in an exported environment.
Select Next.
Choose a format: sanitized, or instance-specific.

CMP downloads the zip file to your machine.

Export and upload blueprints

Mon, 01 Jan 0001 00:00:00 +0000

The CloudBolt Forge is a repository of sample CMP content. Exported blueprints are typically stored as zip files that contain JSON-formatted metadata about the blueprint, along with its related items and actions.

Exporting blueprints

You can export a blueprint from the Catalog page or by using the API. To export from the Catalog page:

In CMP, select Catalog.
Select the blueprint you wish to export.
Select Manage blueprint.
On the Overview tab, select Export.
You are prompted to enter an optional password for secret encryption. See Secrets stored in blueprints below. Decide whether or not you wish to provide a password (must be at least 12 characters long) and select Next.
Choose Export blueprint in sanitized format, or Export with instance-specific info from this CloudBolt. The sanitized version omits potentially sensitive information, or details that may not make sense when importing into a different instance, such as environments and groups.

Exported blueprint contents

Exports include all build and teardown blueprint items, any discovery configurations, all blueprint-specific resource actions, and all action scripts used by those actions.

Export reports and data

Mon, 01 Jan 0001 00:00:00 +0000

There are three ways to get information out of the platform:

Document exports: Render a report as a PDF, PowerPoint, or Excel file, formatted like the on-screen report and suited to sharing with stakeholders.
Data exports: Download the rows behind a table as CSV or JSON for your own analysis.
Scheduled email delivery: Send a report to recipients automatically on a recurring cadence. See Saved Reports.

Export a report

Open the report: a Cost Explorer report, or a saved Cost, Detail, Kubernetes, or Summary report.
Select the export icon in the report header.
Choose a format. The export renders server-side and downloads when ready.

Available export formats by report type:

Extensibility

Mon, 01 Jan 0001 00:00:00 +0000

This page is a map of the extension points, ordered by effort: import content someone has already written, assemble blueprints, attach actions, and then extend the interface.

Content Library

The Content Library is CloudBolt’s catalog of ready-made content you can download into your instance, including blueprints, actions, rules, recurring jobs, and UI extensions. Much of it is a complete solution you can use as-is, and the rest serves as a worked example. Start here before building anything from scratch.

Generate names

Mon, 01 Jan 0001 00:00:00 +0000

Create Naming Sequences, Validators, and Policies in the OneFuse UI. Naming Policies can be used instantly after creation.

Generate a name in four steps:

Gather and define the naming standard(s) that address your business needs.
Create a Naming Sequence.
Create a Naming Policy.
Call the Naming Policy via an Upstream Provider.

Create flexible and dynamic names

Extend the flexibility of your Naming Policy by applying a Sequence, Templating, and Validators.

Use a Sequence

A Naming Template without a sequence in a Naming Policy can result in a limited set of names.
Use Sequence(s) in Naming Policies to automatically create names in sequential order.
If consuming Naming Policies using Aria Automation 8, see how to use Custom Resources to influence deployment names.

Refer to Sequences to learn more.

Getting started

Mon, 01 Jan 0001 00:00:00 +0000

Easily integrate CloudBolt OneFuse with CloudBolt CMP to quickly automate and integrate into your business provisioning lifecycle of a CloudBolt Blueprint.

The CloudBolt OneFuse integration platform offers integrations to services like Naming, IPAM, DNS, Microsoft Active Directory, Scripting, Ansible Tower and more.

Upstream providers like VMware Aria Automation, Terraform, CloudBolt CMP, Ansible, ServiceNow and others are able to consume the same OneFuse integrations combined with organizational business logic for a standardized approach to automation across the enterprise.

Getting started

Mon, 01 Jan 0001 00:00:00 +0000

Easily integrate CloudBolt OneFuse with Python to quickly automate and integrate into your business provisioning lifecycle.

The CloudBolt OneFuse integration platform offers integrations to services like Naming, IPAM, DNS, Microsoft Active Directory, Scripting, Ansible Tower and more.

Upstream providers like Ansible, Terraform, VMware vRealize Automation, CloudBolt CMP, ServiceNow and others are able to consume the same OneFuse integrations combined with organizational business logic for a standardized approach to automation across the enterprise.

Getting started

Mon, 01 Jan 0001 00:00:00 +0000

Easily integrate CloudBolt OneFuse with Red Hat Ansible (compatible with Ansible Core or Tower) to quickly automate and integrate into your business provisioning lifecycle.

The CloudBolt OneFuse integration platform offers integrations to services like Naming, IPAM, DNS, Microsoft Active Directory, Scripting, Ansible Tower and more.

Global roles

Mon, 01 Jan 0001 00:00:00 +0000

A user can be granted one or more of these roles:

Super Admin
Devops Admin
Global Viewer

A fourth role, CloudBolt Admin, is available only when it is explicitly enabled. See CloudBolt Admin.

Manage global roles

Select Admin > Users.
Select the user’s email address to open their profile, where you can view their active global roles.
Select Manage profile.
Enable or disable global roles using the checkboxes.

Do not remove the Super Admin role from a user unless at least one other user is a Super Admin. Once a user is no longer a Super Admin, they cannot grant themselves or others that role.

Grant users access to OneFuse

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

License OneFuse

Add users to the OneFuse group

The Default workspace group and the workspace roles appear only after OneFuse is licensed and initialized.

Log in to CMP as an administrator who can manage users and groups.
Go to Admin > Groups.
Select the group named Default. Its breadcrumb shows Groups / Workspace: Default.
On the Users tab, select Add (+).
In the Add Users to Group Default form, under Roles to grant, assign exactly one workspace role:
- Workspace Admin
- Workspace Member
- Workspace Executor
- Workspace Viewer
Select the users for that role, then select Add Users.

Assign only one workspace role. If a user has any other role in this group, they may not be able to access OneFuse.

Hardware guidelines

Mon, 01 Jan 0001 00:00:00 +0000

Processing requirements depend on active workloads. Memory requirements depend on the total size of transactions and the objects being managed. The application itself has minimal storage requirements, but the underlying storage backend should have a relatively high-performance disk subsystem.

Deployment shapes

The two shapes below correspond to the two designs described in System architecture.

Single node is appropriate for most initial production deployments and for development and testing environments. It is one appliance running all CMP roles.
Distributed (HA) is for production environments with consistent, high workloads. This could be a large number of transactions, blueprints, managed VMs and objects, or a combination of the three. It splits the roles across three web servers and three job engines.

The CMP installer supports only the x86_64 architecture.

Install packages with Chocolatey

Mon, 01 Jan 0001 00:00:00 +0000

This article assumes that your Windows templates already have OpenSSH and Chocolatey installed. If using a bastion/jump server, the article assumes that OpenSSH, Chocolatey and WinRM are configured. This has only been tested on Windows 2016 and 2019, but may work on other versions of Windows with modification.

The code provided in this walkthrough is a sample only. It should be thoroughly reviewed and tested before use in your environment.

Installation and setup

Mon, 01 Jan 0001 00:00:00 +0000

New install requirements

Perform once for first initial install. Upgrading? Skip to Upgrade to the latest.

Review Getting started for prerequisites.
Create a local OneFuse service account for vRealize Automation
1. Log in to https://{MY-VRA-INSTANCE}/vcac
  - User: administrator and Domain: vsphere.local
2. Select the Tenant tab and select your tenant in the list to edit it.
3. Add a local user:
  1. Select the Local Users tab.
  2. Select New.
  3. Create the new user (recommended to use sov_admin as the username) and record the password somewhere secure.
  4. Select OK.
4. Add user to Tenant Administrators:
  1. Select the Administrators tab for the tenant.
  2. Add the user (for example, sov_admin) to the Tenant Administrators.
5. Create a vRA custom group:
  1. Select the Administration tab > Users and Groups > Custom Groups.
  2. Select New.
  3. Type in the Name field: sov_admins.
  4. In Add Roles to this Group: check the boxes next to Tenant Administrator and/or XaaS Architect.
  5. Select Next.
  6. Add the sov_admin service account user (or another desired service account user) to the members.
  7. Add any other administrative users or groups who should have permission to manage OneFuse content.
6. Log out of the base vRA instance.
Follow instructions below to:
1. Download the latest OneFuse vRealize Orchestrator Workflow Package
2. Import the OneFuse vRealize Orchestrator Workflow Package
3. Run the OneFuse Configuration Workflow

Upgrade to the latest

Follow instructions below to get the latest features for OneFuse + VMware’s vRealize Automation.

Limit recently viewed items

Mon, 01 Jan 0001 00:00:00 +0000

The limit is controlled by a setting rather than by anything on screen. To change it, add the setting to customer_settings.py, which overrides the shipped defaults in settings.py.

How the limit works

MAX_RECENTLY_VIEWED_ITEMS_TO_TRACK caps how many items CMP keeps in a user’s recently viewed list, counted separately for each kind of object it tracks. It defaults to 5.

The list is held most recent first. When a user opens an item and the list is already at the cap, the oldest entry drops off.

MAAS server selection

Mon, 01 Jan 0001 00:00:00 +0000

This is determined by the MaaS Virtual parameter. Physical allocation is the default; virtual machines are available only when MAAS has at least one VM host. Parameters are described in MAAS parameters.

How a physical machine is chosen

CMP sends MAAS the order’s requirements as minimums, and MAAS allocates a machine in the Ready state that meets all of them. The machine can exceed any requirement, and MAAS decides which of the qualifying machines to use.

Maintenance modes

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) supports two maintenance modes:

Admin-only: Only CMP admins can use the CMP UI and API
Full: No one can use the CMP UI and API, and jobs cannot run

Admin-only maintenance mode

When Admin-only mode is enabled, all non-admin CMP users are logged out, and a message displays on all pages. Jobs are uninterrupted.

Non-admins cannot log in while the mode is enabled, including through SSO. The login page tells them that only admins can log in.

Manage and organize the Catalog

Mon, 01 Jan 0001 00:00:00 +0000

A Catalog can hold many blueprints. Three choices keep it navigable: the categories you define, the order you put them in, and which filters you expose to end users.

Create and organize categories

Administrators manage the Catalog at Admin > Catalog Management. The page covers the display options that determine which filters end users see, as well as the category tree.

(opens full-size image in a new tab)

Manage OneFuse license

Mon, 01 Jan 0001 00:00:00 +0000

Update a license when a license key expires or when you obtain a new one.

A license key is applied during initial Setup and licensing.

Access licenses

Log in to the OneFuse UI.
- You must have the Super Admin role to perform these steps.
Go to the Licenses page:
1. If you are in the Workspace, select the wrench button on the Top App Bar.
2. Select Licenses from the left navigation menu.
3. Optionally, when OneFuse is unlicensed, you can select Add License from the Unlicensed banner.

Add a new license

Download and open the OneFuse license key you obtained.
Access Licenses.
Copy and paste the entire license key into the License field.
Select Add License.
OneFuse will be licensed with a valid key.

Add a new CMP license

Download and open the CloudBolt CMP license key you obtained.
- If you do not have a license key, contact your Account Manager or our Customer Success team.
Access Licenses.
Copy and paste the entire CloudBolt CMP license key into the License field.
Select Add License.
CloudBolt CMP will be licensed with a valid key.
The CloudBolt logo will appear on the right of the Top App Bar and you can select it to go to the CMP UI.

Update a license

If you do not have a license key, contact your Account Manager or our Customer Success team.

Manage users

Mon, 01 Jan 0001 00:00:00 +0000

To view the user list, change a user’s role, or remove a user, see User Management.

Prerequisites

Adding a user requires access to a CloudBolt Platform user account with the Owner permission.
Accepting an invitation requires access to the user’s email account.

Select an organization

To select a CloudBolt Platform organization:

Log in to the CloudBolt Platform as a user with the Owner permission. The address depends on where your organization’s tenant is hosted; see Sign in.
In the sidebar, select Switch Organization.
Choose the organization to make active.

For details, see Switch Organization.

MCP catalog operations

Mon, 01 Jan 0001 00:00:00 +0000

Catalog operations bring the Cloud Management Platform (CMP) catalog into any MCP-compatible AI agent. Users can find, order, reorder, and approve catalog items in natural language. The agent resolves the blueprint, group, environment, and required parameters, then submits the order.

How it works

When a user requests something from the catalog, the agent handles the entire process:

It finds the matching blueprint from the blueprints the user is permitted to order.
It determines where the order can go, such as the valid groups and environments, choosing automatically when there is only one option and asking when there are several.
It resolves the required parameters, refreshes dependent options, and applies the same show/hide rules as the UI order form.
It presents the complete order for confirmation before submission.
It returns an order ID and tracks the order to completion.

For multi-tier blueprints that require environment selection, the agent first resolves the environment, then loads only that environment’s parameters. This ensures quick responses regardless of how many environments a blueprint spans.

Microsoft Active Directory policy

Mon, 01 Jan 0001 00:00:00 +0000

Setup overview

Create a Microsoft Module Credential.
Create a Microsoft Endpoint.
Create a Microsoft Active Directory Policy.
Generate Active Directory computers from Microsoft Active Directory policy executions through the OneFuse API or an Upstream Provider.

The user setting up the Microsoft AD Policy must have credentials to log in to the Microsoft AD instance.

Create a Microsoft Active Directory policy

Before creating an Active Directory Policy, create a Module Credential and Endpoint for Microsoft Active Directory.

Module

Mon, 01 Jan 0001 00:00:00 +0000

Modules work individually or in any combination. A module is invoked when its Policy is executed and, upon successful completion, creates a Managed object.

Network address translation

Mon, 01 Jan 0001 00:00:00 +0000

Do this with a custom orchestration action. CMP ships with an example, Sample NAT IP Translation Action, at the Pre Server Refresh trigger point.

Enable the sample action

Go to Admin > Orchestration Actions.
In the tree on the left, expand Synchronize VMs from Resource Handlers and select Pre Server Refresh.
Set Sample NAT IP Translation Action to Enabled.

How the sample action works

The sample action uses the NAT Info field on CMP networks. Set NAT Info on the appropriate network to a string following the pattern 192.168.25.x. For any NIC associated with that network, the first three octets of the discovered IP address are replaced with the first three octets of the NAT Info pattern, and the original IP address is stored in the NIC’s private IP field.

Objects and permissions of multi-tenancy

Mon, 01 Jan 0001 00:00:00 +0000

Group and admin permissions

Group permissions govern which users can see and manage servers and resources, and deploy to specific environments. They keep that role when multi-tenancy is enabled.

Multi-tenancy adds finer-grained permissions to the Super Admin global role. This lets you grant users access to manage a subset of admin objects, but only within their tenant.

For a complete multi-tenancy setup, use both group permissions and admin permissions. See Admin roles.

Order on behalf of a recipient user

Mon, 01 Jan 0001 00:00:00 +0000

By default, the person who submits an order (the requestor) owns the servers and resources it creates. When the Recipient field is enabled on the order form, a permitted user can instead assign ownership to another user.

Enable the Recipient field

An admin controls when the Recipient field appears with the Miscellaneous Setting Show “Recipient” on Order forms (Admin > Miscellaneous Settings, Resource Management tab). It has three options:

When Allowed: the field appears for all permitted users.
Only Enabled Blueprints: the field appears only on blueprints that a blueprint manager has enabled it for. To enable it on a blueprint, select Edit on the blueprint’s Overview tab and turn on Show “Recipient” field on order form.
Never: the field is hidden, and the requestor is the sole recipient. This is the default.

Who can set and receive

Even when the setting allows it, the Recipient field appears only for users with the order.choose_recipient permission in the selected group. By default, no standard role includes this permission; only super admins have it. To let other users choose a recipient, add order.choose_recipient to a role and assign that role in the relevant group.

Package structure

Mon, 01 Jan 0001 00:00:00 +0000

The package layout tells Cloud Management Platform (CMP) where to find your views, templates, and static files.

Packages live in /var/opt/cloudbolt/proserv/xui/, one folder per extension, named after the extension’s Name. A single package can register several extensions at different points in the UI: a dashboard card, a report, and a detail view tab can all come from the same folder.

Files in a package

Path	What it holds
`__init__.py`	Required by Python, and where you set `ALLOWED_XUI_EXTENSIONS` to change which file types the package exports.
`views.py`	Django views. Each is registered as an extension by the decorator above it.
`urls.py`	Optional URLs for buttons, links, and dialogs that call back into your views.
`templates/`	Django templates your views render. Template paths start with the package folder name.
`static/`	CSS, JavaScript, and images that ship with the extension.

Creating a package from Admin > Manage UI Extensions writes __init__.py, views.py, and a stub function for each selected extension type. Add the rest as needed.

Product matrix compatibility

Mon, 01 Jan 0001 00:00:00 +0000

Modules

When each module was introduced in OneFuse:

Module	OneFuse Release	Vendor(s)
Ansible Tower	1.2	Ansible Tower
DNS	1.1	BlueCat, Infoblox, Men&Mice Micetro, Microsoft
IPAM	1.1, 1.3, 1.4	BlueCat (v1.1), Infoblox (v1.1), Men&Mice Micetro (v1.1), Microsoft (v1.4), SolarWinds (v1.3)
Microsoft AD	1.1	Microsoft
Naming	1.0	—
Pluggable Modules	1.4	—
Scripting	1.2	—
ServiceNow CMDB	1.3	ServiceNow
ServiceNow Connector	1.4 (formerly beta for v1.3)	ServiceNow
VMware Aria Automation	1.3	VMware Aria Automation

Vendors

Supported vendor versions for OneFuse module endpoints:

Product support lifecycle

Mon, 01 Jan 0001 00:00:00 +0000

HashiCorp’s product lifecycle with OneFuse Terraform Provider

OneFuse upstream provider support for HashiCorp Terraform is listed below:

Terraform Version	Terraform General Availability	OneFuse Terraform Provider Start Support	OneFuse Terraform Provider End Support
1.0.x	June 8, 2021	1.40.0, 1.50.1 [October 23, 2024]
0.15	April 14, 2021	1.30.0
0.14	December 2, 2020	v1.10.x
0.13	August 10, 2020	v1.10.x
0.12	May 22, 2019	v1.0.0	v1.10.0

Review Terraform’s Support Plan Details and their Terraform Blog for the latest announcements and updates.

Product support lifecycle

Mon, 01 Jan 0001 00:00:00 +0000

VMware’s product lifecycle

OneFuse upstream provider support for VMware’s vRealize/Aria Automation follows VMware’s Product Lifecycle.

VMware’s product	VMware general availability	VMware end of general support
Aria Automation 8.5	Aug 05, 2021	Aug 05, 2022
Aria Automation 8.4	Apr 15, 2021	Apr 15, 2022
Aria Automation 8.3	Feb 04, 2021	Feb 04, 2022
Aria Automation 8.2	Oct 20, 2020	Oct 17, 2021
Aria Automation 8.1	Apr 14, 2020	Oct 17, 2021
vRealize Automation 7.6	Apr 11, 2019	Sep 01, 2022

Review VMware’s Product Lifecycle Matrix for the latest announcements and updates.

Provision with VMware Aria Automation

Mon, 01 Jan 0001 00:00:00 +0000

Use the defined Cloud Template in the VMware Aria Automation OneFuse Policy to provision and deprovision vRA Deployments and their resources in your VMware Aria Automation instance.

License required

This module requires the Aria Automation License in order to execute a policy to provision or deprovision vRA Cloud Templates. vRA Policies, Endpoints, and Module Credentials can be created without a license.

Setup overview

Create an Aria Automation Policy.
Execute your Aria Automation Policy using the OneFuse API or an Upstream Provider:
1. Call the OneFuse vRA module from Terraform.
2. Call the OneFuse vRA module from Aria Automation 8.1+.

Highlights

Consume VMware Aria Automation Cloud Templates via API or a supported Upstream Provider.
Drive “Blueprints-as-a-Service” dynamically: specify the Cloud Template/Blueprint by name, version, input parameters, and which user will own the deployed resources.
Centralized visibility: view the active deployment representing the resource(s) and relevant data of each policy execution.

Next steps

Now that you have executed an Aria Automation Policy using the API or an Upstream Provider, track your deployments in OneFuse.

Release 2026.2

Mon, 01 Jan 0001 00:00:00 +0000

Django and Python upgrade

Release 2026.2.10 upgrades the platform to Django 5.2 and Python 3.12. Review the framework upgrade guide before applying this release.

Release 2026.2.110

Availability: 31 Jul 2026

New features

Hyper-V cloud-init support CMP-3409
- Hyper-V resource handlers now support cloud-init for customizing Linux guests during provisioning, alongside the existing Sysprep support for Windows guests.
GitHub App authentication for Source Code Repositories CMP-4026
- Source Code Repository connections can now authenticate using a GitHub App instead of a personal access token, covering both read/sync and push.
- App credentials are set at the connection level and are not tied to an individual GitHub account, so access survives personnel changes.
- Supports both GitHub Cloud and self-hosted GitHub Enterprise Server.
- Existing personal access token connections continue to work unchanged.

Enhancements

Scheduled server/resource actions can now be rescheduled directly from the UI. CMP-3948
OpenShift Virtualization resource handler now supports CPU and memory hardware rate calculation, using the same rates configuration as other resource handlers. CMP-4085
Sync resources job now runs as a parent job with individual child jobs per blueprint, so a discovery failure on one blueprint no longer prevents the remaining blueprints from syncing. CMP-4075

Bug fixes

Fixed a stored cross-site scripting (XSS) vulnerability in custom order forms. CMP-4138
Fixed an issue where Keeper custom fields did not resolve correctly for password values. CMP-3273
Fixed an issue where canceling a job marked its order as completed with errors instead of canceled. CMP-4083
Fixed an issue where the Continue button on a paused job, shown on the order details page, did not resume the job. CMP-3420
Fixed an issue where a blueprint with an optional numeric parameter with a generated option action could not be ordered. CMP-4135
Fixed an issue where Hyper-V Sysprep and unattend files written to the root of C:\ failed silently on Windows Server 2025. CMP-4131
Fixed an issue where running a server or resource action in bulk on multiple servers did not respect the action’s custom form. CMP-3951
Fixed an issue where exporting a blueprint’s parameters omitted global constraints, such as minimum, maximum, and regex values. CMP-3427
Fixed an issue where AWS Roles Anywhere authentication failed with an “Invalid signature” error on servers whose system clock was not set to UTC. CMP-4076
Fixed an issue where AWS tagging did not convert a blueprint parameter’s value to a string when the parameter allowed multiple values, causing tag updates to fail. CMP-4094

Release 2026.2.95

Availability: 17 July 2026

Resource attributes

Mon, 01 Jan 0001 00:00:00 +0000

Every parameter value a resource includes is on its Parameters tab. An attribute is one you have promoted to the Overview tab, beside the resource’s group, owner, and rate, making it immediately visible.

Show a parameter as an attribute

Attributes are chosen at the parameter level, not the resource level, so the setting applies everywhere that parameter is used.

Go to Admin > Parameters and open the parameter.
Enable Show as Attribute. The switch saves once set.

A resource displays attributes it has values for, ordered by label. The same setting governs servers, where the value appears on the server’s Details tab. Enable it for a parameter used by both only if it belongs on both.

Restart the job engine

Mon, 01 Jan 0001 00:00:00 +0000

Restart them manually when one is stuck, and enable the automatic restart for jobs that the timeout cannot cancel.

A worker runs for at least a minute. Once it has finished the jobs it started and has nothing active, it exits, and Supervisor starts a new one. This keeps a long-running plugin from leaking memory into later jobs. A worker process ID that changes throughout the day is evidence of this cycle.

Restore Cloud Management Platform from a backup

Mon, 01 Jan 0001 00:00:00 +0000

The restore process consists of two steps:

Restoring the CMP database
Restoring the CMP files

Complete both steps to ensure a full restore of your environment.

Service impact

The web server and job engine will be unavailable during the restore process.

Perform this process during a scheduled maintenance window.

Send email manually

Mon, 01 Jan 0001 00:00:00 +0000

There is one helper for the administrator and one for any list of recipients, and both render an email template.

Email the administrator

email_admin() writes to the CB Admin address on Email Settings. Provide a subject and a message:

from utilities.mail import email_admin

email_admin(context={'subject': 'Hello', 'message': 'My email message'})

To use a specific template, pass its slug. The context is rendered into the template’s Subject, Body, and Text body fields:

from utilities.mail import email_admin

email_admin(
    slug='order-complete',
    context={
        'subject': 'Your order is complete',
        'message': 'Success!',
        'order': order,
    },
)

Email anyone else

email() takes a list of recipients, allowing you to reach, for example, a group’s admins or a server owner:

Set up high availability in Azure

Mon, 01 Jan 0001 00:00:00 +0000

A high availability (HA) deployment of Cloud Management Platform (CMP) in Azure uses two or more VM nodes behind a Standard Azure Load Balancer, with a shared Azure Database for PostgreSQL flexible server and an Azure Files NFS share providing a common data layer across all nodes.

Create virtual machines

Deploy in the region closest to your physical infrastructure, or the region where the majority of your cloud infrastructure resides. Before creating virtual machines, ensure that Azure Database for PostgreSQL flexible server is available in your desired region.

Setup and license OneFuse

Mon, 01 Jan 0001 00:00:00 +0000

Access the OneFuse UI

Once OneFuse is installed from OVA and deployed, verify the VM is running. A web user interface (UI) will be available.

Open a web browser (for example, Google Chrome).
Type in the OneFuse VM’s IP address or Fully Qualified Domain Name (FQDN) in the URL.
- For example, https://my-onefuse-instance-name.domain.com
When accessing the OneFuse UI for the first time, you will be prompted to License OneFuse.

License OneFuse

If you do not have a license key, contact your Account Manager or our Customer Success team.

Special case plugins

Mon, 01 Jan 0001 00:00:00 +0000

Most plugins follow the shape described in Structure of a plugin. A few do not: they may run directly from the front-end appliance rather than inside a job, or they may have their own return types. Three are covered on this page; the rest are documented with the feature they belong to.

Order approval plugins: Replace the built-in approval workflow. Covered below.
Generate parameter options plugins: Decide a parameter’s options at run time. Covered below.
Auto-select environment plugins: Choose where a server tier is built. Covered below.
Order validation plugins: Run at the Blueprint Validation, Server Tier Validation, and Validate Order Recipient trigger points.
External user synchronization plugins: Run at the External Users Sync trigger point each time a directory user logs in.
Display condition plugins for server actions: Decide whether a server action’s button is shown.
Discovery plugins on blueprints: Onboard resources that were created outside Cloud Management Platform (CMP).

Order approval plugins

When an order approval plugin is enabled, it replaces Cloud Management Platform’s default behavior of emailing approvers when an order is submitted. Use one to integrate with a separate change management system, or to replace the standard approval workflow with something that fits your organization.

Static options

Mon, 01 Jan 0001 00:00:00 +0000

The values a requestor can choose from are configured on the blueprint, the group, and the environment they are ordering from. A parameter can also carry a list of its own, set on the parameter. These options are static and do not change at order time. To build a list at runtime instead, see Generated parameter options.

Where options are defined

On a group or an environment. Open the group or environment, then go to the Parameters tab.
On a blueprint. See Blueprint-level parameters.
On the parameter itself. Go to Admin > Parameters and open the parameter. Its list sits under Global Options, or under Static Options when the parameter is an action input.

Global options are not supported for password parameters. For those, use a global default or set options at the environment, group, or blueprint level instead.

Troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

System status

View the health of CMP services at Admin > System Status. This is a good first step when diagnosing unexpected behavior.

Provisioning issues and parameters

For what the VM Customization Timeout and Post Provisioning Delay parameters do, where you can set them, and which resource handlers use them, see Waiting for a server to be ready.

“Customization timeout” errors

If a provisioning job fails due to a customization timeout on the resource handler side or because the server is not fully customized (for example, the hostname is not set correctly), increase the VM Customization Timeout parameter.

Use case

Mon, 01 Jan 0001 00:00:00 +0000

Example: Yoyodyne, Inc.

Let’s look at the fictitious company “Yoyodyne” to see how it makes use of CMP’s core objects to manage their infrastructure.

When the yo-yo craze revitalized, Yoyodyne became a household name. Now they run a booming business selling yo-yos both online and off. Because their computing infrastructure became fragmented and complicated, they adopted CMP to streamline it and make it easier to use.

Yoyodyne develops their website at their Portland headquarters. They have a VMware vCenter with two clusters: one for development and another for production. Two teams are responsible for maintaining the website: a principal “Dev” team and another “QA” team. The QA team is responsible for testing and deploying the website to production, so they need access to both clusters, but the Dev team only needs access to the development cluster.

Use vCenter APIs

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) already manages the resources in a vCenter, but when you need something it does not expose, both vCenter APIs are reachable from a resource handler without setting up your own connection or credentials.

vSphere Web Services API

The vSphere Web Services API is stable, changes infrequently, and keeps backward compatibility with earlier versions. It is based on SOAP and XML, which makes it complex to call directly.

User Management

Mon, 01 Jan 0001 00:00:00 +0000

As your team changes, use this page to see who has access, invite new people, and adjust or revoke access as needed.

Access the User Management page

Log in to the CloudBolt Platform.
In the sidebar, select Settings.
Select User Management.

Managing users requires the Owner permission.

User Management overview

Key areas of the User Management page.

Section	Description
User table	A list of all users with columns for First Name, Last Name, Email, and Role, plus a delete action per row.
Roles	The role assigned to each user (Admin, Operations, Practitioner, or Stakeholder), which governs their access and permissions across the platform. For what each role can do, see Manage Roles.
Add User	A button to invite a new user and assign them a role.
Search	A search field to filter the user list by name or email.

Add a user

Select Add User.
In the dialog, enter the user’s Email.
Choose a Role. The role defaults to Stakeholder.
Confirm the dialog to add the user.

If the person does not have a CloudBolt account yet, CloudBolt automatically sends them an email invitation. Until they accept it and sign in, their row shows an Invited badge and their role cannot be changed. For the invitation-acceptance steps from the new user’s side, see Manage users.

User tasks

Mon, 01 Jan 0001 00:00:00 +0000

Update profile settings

Update your name, email, and password from the Profile Settings page.

Log in to the OneFuse UI.
Select your User Menu (the first letter of your username) on the Top App Bar.
Select Profile Settings.
Edit your name, email and/or change your password.
Select Update.

Change your password

Update your password after your first login or any time you need to change it.

Log in to the OneFuse UI.
Select your User Menu (the first letter of your username) on the Top App Bar.
Select Profile Settings.
Under Security, select Update Password.
Enter your new password.
Select Update.

Forgot your password? Contact your OneFuse Administrator to reset it.

XaaS blueprints

Mon, 01 Jan 0001 00:00:00 +0000

Anything-as-a-Service blueprints call an external API to provision, delete, and manage a service. Users order it from the Catalog the same way they order a server. You define what happens at each stage, while CMP handles the catalog, order form, approvals, and auditing.

Start by giving the service a custom resource type. This is what holds the deployment’s parameters and gives day-2 operations something to attach to.

Lifecycle

Develop these in order. Build is what makes the service orderable. Without teardown, deleting a resource in CMP leaves the real service running at the provider.

Action input parameters

Mon, 01 Jan 0001 00:00:00 +0000

CMP scans the actions you define to determine whether the action needs additional input in order to run. This process is covered in more detail in the documentation for each action type. CMP then prompts users for those inputs, or substitutes pre-designated default values where appropriate.

CMP does not create action inputs for template variables that start with the keyword server, such as {{ server.ip }}. For the full list of context keys, see Action context.

Advanced network support

Mon, 01 Jan 0001 00:00:00 +0000

This section covers the available features and how to configure them.

Load balancers

Blueprints can include load balancing to support easy scale up and down of their resulting resources.

CMP ships with load balancer support for AWS Elastic Load Balancing (ELB), F5 Big-IP, HAProxy, VMware NSX, and Microsoft Azure. Contact Support to request other technologies.

Create

To create a scalable blueprint with a load balancer, go to Catalog, add a blueprint, and add at least one server tier blueprint item and a load balancer blueprint item. The specific steps depend on the type of load balancer added.

Authenticate with ADFS

Mon, 01 Jan 0001 00:00:00 +0000

Use this where your organization already federates AWS access through ADFS and does not want to issue a key pair for Cloud Management Platform (CMP) to hold. CMP logs in to your ADFS server with the provided credentials, receives a SAML assertion, and exchanges it for temporary AWS credentials by assuming a SAML role.

Prerequisites

A SAML IAM role in AWS, and its role ARN. The role must appear in the ADFS assertion issued for the account you log in with.
An ADFS server with the AWS relying party trust configured and IdP-initiated sign-on enabled, since that is the page CMP posts the credentials to.
An Active Directory account with permission to log in there.

Create the handler

Go to Admin > Resource Handlers and select Add.
Select the Amazon Web Services tile.
Set Credentials Type to ADFS Credentials.

Complete the fields that appear:

Field	Description
Username	The Active Directory username or email address, such as `admin@example.com`.
Password	That account’s password.
ADFS Domain Name	The ADFS server’s domain, such as `adserver.example.com`.
SAML IAM Role ARN	The role CMP assumes, such as `arn:aws:iam::111111111111:role/YourADFSRole`.
ADFS Server SSL Verification	Leave enabled unless the ADFS server presents a certificate CMP cannot verify. Disabling it stops CMP from checking the certificate at login.

Select Continue, then complete the handler’s settings and select at least one region, as described under Add an AWS resource handler.

Auto scaling

Mon, 01 Jan 0001 00:00:00 +0000

Auto scaling is built from Cloud Management Platform (CMP) parts you can see and change: a rule that checks deployed resources on a schedule, plugins that read CPU load, and a parameter on each resource that sets the thresholds.

How it works

The Check Resources for Scaling Conditions rule reads each resource’s Auto-Scaling Config parameter, which sets the minimum and maximum CPU thresholds per tier. When a tier exceeds its maximum, CMP adds more servers to it and adds them to the load balancer; when it falls below its minimum, CMP deletes servers and takes them out of the rotation. A tier is also brought back inside its min_servers and max_servers bounds whatever the CPU is doing.

Budgets

Mon, 01 Jan 0001 00:00:00 +0000

Budgets let you define monthly spending targets and compare them against actual cloud spend. Budgets are hierarchical, so you can mirror your organization’s structure: individual budgets track specific slices of spend, while rollup budgets aggregate their children into combined totals. The Budgets page provides:

Hierarchy view: An expandable tree of budgets showing each budget’s type, currency, and current-month target.
Budget vs. actual: Per-budget performance charts comparing budgeted and actual spend, monthly or cumulative.
Variance tracking: Monthly variance figures, with month-to-date prorated targets for the in-progress month.

Budgets is enabled per tenant. The Budgets page is for viewing performance; budgets are created and edited under Settings > Budgets. See Manage budgets.

Built-in recurring jobs

Mon, 01 Jan 0001 00:00:00 +0000

CMP ships with a set of recurring jobs you can use as-is, customize, or disable. Several support core functionality, such as resource handler synchronization. Each job is listed below, and the ones you are most likely to configure are described in full further down the page.

The default settings below are for a newly installed instance. Check Admin > Recurring Jobs for the current state of your recurring jobs.

Certificate-based authentication

Mon, 01 Jan 0001 00:00:00 +0000

Configure PKI in the Cloud Management Platform (CMP) web interface

Turn on the Database Browser: add ENABLE_DB_BROWSER = True to /var/opt/cloudbolt/proserv/customer_settings.py, then run systemctl restart httpd.
Log in to CMP as an admin user.
Go to Admin > Database Browser. On that page, find the Utilities section and select Add in the PKIUtilities row.
Enter regex expressions that evaluate to the username, first, last, and email fields based on the Subject (or DN) field in the user certificates your company uses.
Optionally, determine which groups the new users should have requestor, approver, and other roles in.
Save the form.

Configure PKI in CMP’s server settings

Edit /var/opt/cloudbolt/proserv/customer_settings.py and append the following section:

Chef

Mon, 01 Jan 0001 00:00:00 +0000

Users select cookbooks and roles on the order form as applications, and CMP installs the Chef agent on the new server and applies those cookbooks and roles through Chef. The Chef tile appears in the Add dialog only where a Chef configuration manager already exists, so this page covers deployments that already run Chef.

What the integration does

Installs cookbooks and roles on servers as CMP applications.
Installs the Chef agent on each new server.
Discovers and synchronizes Chef nodes.

Prerequisites

CMP runs knife on the appliance to bootstrap agents, so Chef Workstation must be installed there with knife on the path. Follow the Chef Workstation install guide.

CloudFormation template outputs

Mon, 01 Jan 0001 00:00:00 +0000

A successful deployment produces the following outputs. The CloudBolt Platform reads these values automatically to complete the integration.

Each FOCUS and Cost Optimization export is named ${ResourceNamePrefix}-<ExportType>-${AWS::StackName}, so the CBPInputResourcePrefix and CBPInputStackName outputs together reconstruct every export prefix path the CloudBolt Platform needs.

Template outputs

Name	Description	Condition
CBPInputAccountId	Management account ID	All modes except `MemberAccountOnly`
CBPInputFocusBucket	S3 bucket name for FOCUS exports	All modes except `MemberAccountOnly`
CBPInputResourcePrefix	Resource name prefix value (`ResourceNamePrefix` parameter)	All modes except `MemberAccountOnly`
CBPInputStackName	Stack name (suffix on FOCUS and Cost Optimization export resource names)	All modes except `MemberAccountOnly`
MemberAccountActionsRoleArn	Actions role ARN in the member account (for confirming the deploy succeeded)	`MemberAccountOnly` (first deploy only)
ServiceManagedStackSetId	ID of the created StackSet	`OrganizationWide` or `SpecificOU`

Configure remote script method

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) runs remote scripts through a platform-specific mechanism where one exists, and over SSH or WinRM otherwise. You can change that choice globally, or for particular servers and environments.

Choose the execution method

What happens by default depends on the platform:

VMware runs remote scripts through VMware Tools.
AWS, Azure, and Oracle Cloud Infrastructure can run scripts through their own channels, but do not by default; you must enable it.
Every other platform uses SSH or WinRM.

The Use Tech-Specific Script Execution parameter sets this per server or environment: True to use the platform’s own mechanism, False to use SSH for *nix and WinRM for Windows.

Connect GCP

Mon, 01 Jan 0001 00:00:00 +0000

Connect your Google Cloud Platform (GCP) environment to the CloudBolt Platform to enable cost analysis, resource inventory, and optimization recommendations across your GCP projects.

CloudBolt offers two connection methods:

OAuth connect (recommended): Sign in with Google to let CloudBolt automatically discover and provision resources.
Setup script (manual): Generate a Terraform or gcloud script to run in your own environment for full control.

Both methods create a Workload Identity Federation (WIF) credential that CloudBolt uses for ongoing, passwordless data collection.

Continuous Infrastructure Testing as code

Mon, 01 Jan 0001 00:00:00 +0000

A test that runs an action can be pushed to a repository and refreshed from it later, and you can add a test from an action already in a repository. Tests of other kinds have no repository tab. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh a test

Open the test from Admin > Continuous Infrastructure Testing, then select the Repository tab. Unlike other content types, this tab keeps the same name regardless of which provider the repository belongs to.

Conventions

Mon, 01 Jan 0001 00:00:00 +0000

These conventions apply across every endpoint. For the endpoint reference, use the API console built into CMP at /api-docs/v3/cmp/.

URLs and verbs

Paths follow a small number of patterns.

Path	What it addresses
`/{plural-noun}`	A collection of that type, such as `/api/v3/cmp/servers/`.
`/{plural-noun}/{id}`	A single item within a collection.
`/{single-noun}`	A singleton that exists without a collection. The current-user singleton is `/api/v3/cmp/user/`.
`/{plural-noun}/actions/{action}`	Functionality better expressed in RPC style than REST, such as `/resource-handlers/actions/sync-vms`.

Both collections and items are called resources. Collections are the more common of the two.

Deploy in AWS

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) starts on the free tier, which supports up to 100 resources. To manage more, apply a paid license. See Product license.

Log in to AWS.
Go to AWS Marketplace.
From the left-hand menu, select Discover products.
Search for CloudBolt.
Select CloudBolt Cloud Management Platform.
Select View purchase options.
Select Subscribe.
Select Accept Terms to subscribe and wait for the subscription process to complete.
Select View Subscription.
Select your subscription.
Select Launch new instance.
Select Launch from EC2 Console.
Select a Region. The default is US East (N. Virginia).
Select Launch from EC2 and proceed to the next section.

Configure the appliance

Provide a name and tags

Enter a name for the instance. CloudBolt recommends adding at least a Name tag to identify the instance.

Deployment trigger points

Mon, 01 Jan 0001 00:00:00 +0000

An action attached to a blueprint runs only for that blueprint. The same action attached to a trigger point runs for every order or every server provisioned, which is ideal for policy, naming, validation, and notifications. This topic covers the trigger points a deployment passes through and what each one receives.

Where the trigger points fall

Deploying a blueprint that contains a single server runs two jobs: a Deploy Blueprint job that processes the order and a Provision Server job that builds the server, each with its own trigger points. Actions can also be triggered on order status changes. See Orchestration actions for the full list of trigger points.

Development tips for plugins

Mon, 01 Jan 0001 00:00:00 +0000

Run remote scripts with connection info objects

Connection info objects let a plugin run scripts against systems that have no REST API. They are also the way to run commands remotely on Windows servers via WinRM or on Linux servers via SSH.

Windows servers

Create a connection info object and set its protocol to winrm.
In the CMP CLI (shell_plus), set the transport type. Supported types are ntlm, kerberos, credssp, and basic, depending on what the target requires.

from utilities.models import ConnectionInfo

connection_info = ConnectionInfo.objects.get(name='my_connection_info')
connection_info.transport = 'ntlm'
connection_info.save()

Linux servers

Create a connection info object and set its protocol to ssh.

Execute a script on the connection info host

This works for both Windows and Linux targets. The example shows every parameter execute_script accepts, with its default.

Extend session timeout

Mon, 01 Jan 0001 00:00:00 +0000

For security purposes, the default timeout of API Tokens in OneFuse is 5 minutes.

When an API call is invoked in OneFuse UI, the session automatically extends. However, when the user remains on a particular page in OneFuse UI, the default timeout setting may be too short (for example, when creating or updating OneFuse Policies, Property Sets, and so on). Follow the instructions below to extend the session timeout for OneFuse API Tokens.

F5 BIG-IP

Mon, 01 Jan 0001 00:00:00 +0000

Feature highlights

AS3-powered
Integrates with OneFuse Naming, IPAM, and DNS modules to provide services directly within AS3 declarations
Provisioning and deprovisioning scenarios:
- Create and destroy a new service (for example, a VIP) at once
- Create a new service (for example, a VIP) and add or remove members and nodes incrementally. As members and machines are deprovisioned, they are removed from the service, and the last member or machine out deletes the service. For example:
  - The first member or machine matching the Tracking ID or (unique) additive key and tagged with the Policy creates the service
  - Any additional members or machines get added to the service
Supports Day 2 operations
View F5 supported versions

Prerequisites

Learn about F5 BIG-IP.
- Visit the F5 Knowledge Center for BIG-IP.
Install and set up F5 BIG-IP.
Install and set up F5 AS3 on F5 BIG-IP.
Create a OneFuse Service Account in F5 BIG-IP.
Learn about F5 Application Services 3 Extension and Composing an AS3 Declaration.
If the OneFuse Appliance does not have an internet connection, follow the instructions in the section below.

OneFuse Appliance without internet connection

Perform the following only if the OneFuse Appliance does not have an internet connection.

Front-end assets and tools

Mon, 01 Jan 0001 00:00:00 +0000

Libraries you can use

These are loaded by default, so any template can call them:

Bootstrap, a CSS framework with Bootstrap Icons.
jQuery, for general-purpose scripting.
Highcharts, for charts.
D3, for data visualization beyond charting.
DataTables, for sortable, searchable, paginated tables.
Selectize.js, for type-ahead and multi-select fields.
Lodash, for collection and object helpers.

Extensions written for Bootstrap 3 need migrating. See Upgrading to Release 2026.3.

Ship your own CSS, JavaScript, and images

Keep an extension’s own files inside its package, so they travel with it when exported and imported. Place them in a static folder in the package directory, for example:

Getting started

Mon, 01 Jan 0001 00:00:00 +0000

Easily integrate CloudBolt OneFuse with HashiCorp Terraform (compatible with Terraform Open Source, Enterprise, or Cloud) to quickly automate and integrate into your business provisioning lifecycle.

The CloudBolt OneFuse integration platform offers integrations to services like Naming, IPAM, DNS, Microsoft Active Directory, Scripting, Ansible Tower and more.

Upstream providers like Terraform, VMware vRealize Automation, CloudBolt CMP, Ansible, ServiceNow and others are able to consume the same OneFuse integrations combined with organizational business logic for a standardized approach to automation across the enterprise.

Group and environment parameters

Mon, 01 Jan 0001 00:00:00 +0000

Groups and environments have the same Parameters tab, and parameters work the same way on both. In Cloud Management Platform (CMP), a parameter on a group applies to orders in that group and its subgroups. A parameter on an environment applies to orders that deploy there. When a blueprint sets options for a parameter, the form offers only those options. Otherwise, it offers the options from both the group and the environment. See How option order is determined.

Infoblox

Mon, 01 Jan 0001 00:00:00 +0000

Connection details

In Admin > IP Management, select Add, then choose Infoblox.

Field	Description
Name	A name for this connection.
IP address	The address or hostname of the Infoblox server.
Port	Defaults to 443.
Account username	An account authorized to run commands on the Infoblox server.
Password	The password for that account. It is stored securely. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the secret from a configured vault provider. See Use password vaults.

Network result limit

CMP imports every network from Infoblox, however many there are, by requesting them in pages through Infoblox WAPI v2.0.

Infoblox DNS

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse Infoblox DNS module enables organizations who utilize Infoblox for DNS hosting to have a fully automated method of controlling DNS records as the cloud environment dynamically scales, reducing the support burden and increasing the chances of successful ITaaS deployments.

License required

This Module requires the Infoblox DNS License in order to execute an Infoblox DNS Policy. Infoblox DNS Policies, Endpoints, and Module Credentials can be created without a license.

Infoblox IPAM

Mon, 01 Jan 0001 00:00:00 +0000

The Infoblox IPAM module enables organizations who utilize Infoblox for centralized IP address management to have a fully automated method of obtaining and releasing IP addresses as the cloud environment dynamically scales. IP subnets can now easily be shared between deployments and alongside existing tools and devices without fear of IP conflict.

License required

This Module requires the Infoblox IPAM License in order to execute an Infoblox IPAM Policy. Infoblox IPAM Policies, Endpoints, and Module Credentials can be created without a license.

Least permissions

Mon, 01 Jan 0001 00:00:00 +0000

Ansible Tower

For OneFuse Ansible Tower Modules.

Create or determine the Service Account for the OneFuse Ansible Tower Module.
Log in to Ansible Tower as an Administrator.
Go to Access > Users.

Add the Service Account via either Local Users or LDAP User Account (do not use Social, Azure AD, or Kerberos). If the desired Service Account already exists, edit the user.

Under the Details section for the user, verify the following:

Setting Selection

User Type Normal User
Select Save.

Setting	Selection
User Type	Normal User

Under the Permissions tab for the Service Account, perform the following:

Resource	Selection	Role
Organizations	Select all Organizations OneFuse will integrate with	Member
For granular permissions instead of at an Organizational level, set below:
Projects	Select all Projects OneFuse will integrate with	Use
Job Templates	Select all Job Templates OneFuse will integrate with	Execute
Inventories	Select all Inventories OneFuse will integrate with	Inventory Admin

Save the user.

Log in via SSO

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Complete Set up SSO and SAML.

Log in from the CMP UI

How you are prompted to log in depends on the Automatically Login to SSO setting:

Setting	Description
Enabled	You are taken directly to the SSO provider’s login page when you access CMP. If Force Authentication is enabled on the SSO provider in CMP, you must log in to the SSO provider manually.
Disabled	The default. In the CMP UI, select the Log In with <SSO provider name> button.

In both cases, CMP sends a Security Assertion Markup Language (SAML) request identifying the user to the IdP: automatically when the setting is enabled, or when you select Log In with… when it is disabled.

Manage roles

Mon, 01 Jan 0001 00:00:00 +0000

The CloudBolt Platform provides a role-based access control (RBAC) model to manage user privileges within each organization. Roles determine available components and actions, enabling fine-grained control across cloud cost, operations, and user management workflows. Users can have different roles in different organizations, but only one role per organization.

Permissions

Roles in the CloudBolt Platform consist of permissions that define the allowed actions. Permissions are granted at three hierarchical levels:

Level	Description
Owner	Full access: create, read, update, and delete resources.
Editor	Read and update access: cannot create or delete resources.
Viewer	Read-only access to resources.

Permissions are not assigned directly to users. Users receive permissions through assigned roles.

Managed object

Mon, 01 Jan 0001 00:00:00 +0000

A managed object is created from a Module’s Policy. It:

Enables Day 2 operations for the associated module.
Is destroyed when the policy is executed for release/destroy.

(opens full-size image in a new tab)

Managed object details

Field	Description
Created Date	Timestamp when the managed object was created
Source	API or Upstream Provider
Source IP Address	IP address of the source
Requester	Username of who created the managed object
Policy Name	Name of the policy that executed the managed object
Job ID	Job ID associated with the managed object

MCP custom tools

Mon, 01 Jan 0001 00:00:00 +0000

Extend the built-in MCP tool set in Cloud Management Platform (CMP) with organization-specific tools.

Two ways to expose a tool

MCP Tool Actions: purpose-built agent tools authored directly in CMP
Existing server and resource actions: can be promoted to agent tools

Both are permission-aware, so agents only see and run what the authenticated user is entitled to.

After creating or modifying a custom tool, reconnect to the MCP server so the agent picks up the updated tool list.

Naming components

Mon, 01 Jan 0001 00:00:00 +0000

The following components are needed to generate names.

(opens full-size image in a new tab)

Sequences

A Sequence allows for a continuous or connected series of numbers to be used when generating a name.

Sequence types

Decimal

Base10 numeral system. Increments a sequence 0 to 9.

The most commonly used Sequence Type.

{# Example Decimal Sequence with:
   Reuse Sequence Values: false
   Maximum Length: 2
   Padding Character: 0
   Initial Value: 1
   No Unique Key
#}

=> 01, 02, 03, 04, 05, 06, 07, 08, 09, 10, 11 ... 99

Consume odd or even sequenced custom names by passing the following OneFuse naming properties from the upstream provider:

Network connectivity

Mon, 01 Jan 0001 00:00:00 +0000

The preconfigured application uses the following ports and services on a single appliance. Ensure that connectivity requirements are in place for internal network communication with the CMP appliance.

The appliance makes outbound network connections as required by your configured resource handlers and any other integrations. These are specific to each resource handler and are not detailed in the tables below.

Ports

Inbound

TCP port	Protocol	Usage
22	SSH	Appliance management. Not required for end users
80	HTTP	HTTP to HTTPS redirect, optional HTTP access
443	HTTPS	Web UI and APIs. Also carries the RDP/SSH terminal and console sessions, which are proxied through the web server as WebSocket connections
5900-6900	VNC	Port range the appliance uses to give browsers access to VM consoles. Required only for consoles that are not proxied over HTTPS. Configurable through the `LOW_CONSOLE_PORT` and `HIGH_CONSOLE_PORT` settings

The Guacamole services that support the RDP/SSH terminal, guacd and guacg, listen on the loopback interface only and sit behind the web server. They do not need firewall rules. If you relocate guacd to a secondary server, allow traffic between the nodes on the port you configure for it.

Organizations

Mon, 01 Jan 0001 00:00:00 +0000

Sub-organizations can mirror your internal business units, or, for managed service providers and resellers, the customers you manage. Browse and create organizations in a hierarchy, then configure each one:

Scope rules: Define which cloud resources belong to each sub-organization by filtering on billing dimensions.
Billing configuration: Attach billing rulesets that control how costs are re-rated for an organization.

Access the Organizations page

Log in to the CloudBolt Platform.
In the sidebar, select Settings.
Select Organizations.

Viewing the page requires organization-admin visibility. The Create Organization button and scope-rule editing additionally require the Owner permission.

OS build model

Mon, 01 Jan 0001 00:00:00 +0000

An OS build is an instance of externalcontent.models.OSBuild. It lets a user pick Windows Server 2022 without knowing that it means one AMI in AWS and a different template in vCenter.

(opens full-size image in a new tab)

Mapping a build to provider images

Each pairing of an OS build with a technology that can provide it is an OSBuildAttribute, whose template_name field holds the provider’s identifier for the image or template. They have the global ID prefix IMG.

Product license

Mon, 01 Jan 0001 00:00:00 +0000

Licensing options

CMP’s product license sets how many resources you can provision and when your license expires. CMP offers two options:

Free tier. Applied automatically when you install CMP. It is full-featured, supports up to 100 resources, and is valid for up to one year. No action is required to start using this license.
Paid license. Obtain a license from your account manager to provision more resources and extend your license period. Apply it as described in Apply a license.

If your license expires: CMP locks the appliance and directs administrators to the Product License page. Apply a current license to restore access; your configuration and data are preserved.

Rates

Mon, 01 Jan 0001 00:00:00 +0000

Rates can be assigned to hardware, operating systems, applications, blueprint items, and other parameters. Provisioned servers and resources carry their associated rates, which CMP aggregates and reports in several ways, showing spend by servers, groups, environments, and individual users.

How rates are used

Rates are useful for internal showback and chargeback, so you can show or charge groups for what they used in a given period. Report on them using one of the graphical reports in Reports, or by running the export_server_info command on the appliance. See Command line utilities.

Release 2026.1

Mon, 01 Jan 0001 00:00:00 +0000

We are preparing to upgrade Django and Python in an upcoming release.

Release 2026.1.73

Availability: 14 April 2026

New features

Custom Forms for Actions: Custom forms can now be generated for Resource and Server actions. CMP-3339
VMware Resource Handler — Vault Secret Support: VMware Resource Handlers can now be created and updated with password vault credentials via the API. CMP-3482
Blueprint Deployment Permissions: Administrators can now assign one or more deployment permissions to a blueprint; any user with a matching permission in a deploy group can order it, eliminating the need for separate functional groups. Existing blueprints default to the previous order.submit behavior. CMP-3387
Oracle Linux Virtualization Manager — CPU Topology: OLVM now supports CPU topology configuration via the following parameters: olvm_cores, olvm_sockets, olvm_threads, olvm_cpu_type, and olvm_cpu_cnt. CMP-3567

Enhancements

Vault API—Common Framework Support: Vault API now supports common extensions and validator functions. CMP-3476
Terraform Operations — Source Code Repository Support: Terraform Operations now support a Source Code Repository as a source option. CMP-3534
Custom Forms — Field Description Tooltips: Custom forms now support displaying field descriptions as tooltips. Set the custom field description display mode to Infotip to access this enhancement. CMP-3261
XUI Tab Extensions — Override Built-in Tabs: Tab extensions using the @tab_extension decorator can now replace a built-in tab on a detail view rather than appending. Use the replaces parameter to specify the tab to replace. CMP-3592
Resources Menu — Filter by User’s Resource Types: The Resources menu can now be configured to show only resource types the current user has resources for. Use the show_resource_type_for_profile flag in misc_settings.py to enable this behavior. CMP-3515
Azure Local — Operation Status Sleep Timer: Now supports setting AZURE_LOCAL_OPERATION_STATUS_SLEEP_TIMER = 45 in customer_settings.py. This introduces a 45-second delay to work around a Microsoft API issue where resource creation data isn’t immediately available. CMP-3577

Bug fixes

Fixed an issue where the custom form failed to render when editing an order. CMP-3541
Fixed an issue where the Hyper-V Resource Handler could fail to provision servers correctly. CMP-3576
Fixed an issue where custom forms ignored the Only Show Group Types on Order Form setting. CMP-3561
Fixed an issue in multi-worker deployments where concurrent Job Engine processes could pick up and execute the same job more than once. CMP-3564
Fixed an issue where API requests to retrieve preconfigurations failed with a 500 error when any preconfiguration used Object data as a custom field value. CMP-3586

Release 2026.1.58

Availability: 27 March 2026

Request a catalog item

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Create a ServiceNow Catalog Item Policy.
A ServiceNow Admin has configured the associated ServiceNow Catalog Item for their ServiceNow end-users.

Execute OneFuse ServiceNow Connector via ServiceNow

Log in to ServiceNow.
Find the Service Catalog created via the OneFuse ServiceNow Catalog Item Policy.
Select the Service Catalog to request it.
Fill out the Service Catalog Inputs, if any.
Select Order Now.
Select the Request Number to track the status.
Once the request succeeds, track the deployment in ServiceNow.

The Service Catalog will request the ServiceNow Flow: Execute OneFuse Connector Policy Wrapper, which calls Subflow: Execute OneFuse Connector Policy.

The flow will mark the request as Closed Complete if it was successful and Closed Incomplete if it failed.

Resize VMs

Mon, 01 Jan 0001 00:00:00 +0000

Resizing is a server action named Resize VM, which Cloud Management Platform (CMP) enables by default. It runs against Azure and AWS servers.

Which sizes are offered

An Azure VM size, such as Standard_D2s_v3, sets the CPUs, memory, and disk types available to a server. Not every size can be resized to any other size, and what is possible depends on where the VM is deployed. See Microsoft’s documentation on sizes for Azure virtual machines.

Restore from snapshots

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) lists those snapshots on the server and can ask your backup system to restore one.

CMP does not hold the snapshots or perform the restore. It reads the snapshot list from your backup system and passes your request back to it.

Prerequisites

The server has a Data Protection Plan value.
You are an administrator or hold the Restore Data Protection Snapshots permission. Without it, the tab lists snapshots but shows no Actions column.

Restore a server from a snapshot

The restore begins as soon as you select the restore icon. For most technologies, it replaces the running server.

Run or exclude specific job types

Mon, 01 Jan 0001 00:00:00 +0000

This is controlled by environment variables CBJE_INCLUDE_JOB_TYPES and CBJE_EXCLUDE_JOB_TYPES. Each accepts a comma-separated list of job types, using the type names in the table below.

Set the variables

Variable	Effect
`CBJE_INCLUDE_JOB_TYPES`	The job engine runs only jobs of the listed types.
`CBJE_EXCLUDE_JOB_TYPES`	The job engine runs everything except jobs of the listed types.

Jobs of an excluded type stay PENDING until another job engine claims them. If no other job engine runs them, they never run.

Search, sort, and filter the Catalog

Mon, 01 Jan 0001 00:00:00 +0000

The controls sit in a strip above the blueprint cards:

The search box matches blueprint names and descriptions.
The Sort by list changes the order in which the cards appear.
The Filters button shows and hides the filters pane beside the cards.

(opens full-size image in a new tab)

Search

Enter a term in the search box to narrow the Catalog. Search matches only the blueprint name and description. It does not match categories, resource types, or parameter values — use the filters pane for those.

Send email automatically

Mon, 01 Jan 0001 00:00:00 +0000

Each one is rendered from a built-in, customizable email template.

Orders

When an order needs approval, CMP emails the approvers for that order’s group. See Users.
Send Reminder on the order sends approvers another request.
When an order is finished, CMP emails the requester with the result. This is controlled by the Email on order completion setting in Email Settings, enabled by default.
When an order that names a recipient finishes successfully, that recipient is emailed.

Rules and actions

Several built-in rules send email as their action. You can see the pattern in the Then behavior of the Notify admins when a newer version of CloudBolt is available rule, and copy it in your own rules.

ServiceNow Approval extension

Mon, 01 Jan 0001 00:00:00 +0000

The extension adds a ServiceNow Approval admin page to CMP, where you store the connection to your ServiceNow instance and map orders to the ServiceNow workflows that approve them. Orders are sent to ServiceNow as they are submitted, and a recurring job returns the decisions.

Before you start

Import the ServiceNow Approval extension from the Content Library and restart the Apache HTTP Server. See UI extensions for the import steps.
Create the approval workflow in ServiceNow. It must exist before you can add a workflow configuration.

How an approval flows

A user places an order in CMP.
CMP raises a matching request in ServiceNow.
An approver acts on the request in ServiceNow.
The next run of the recurring job reads the decision and applies it to the CMP order.
When the order finishes, CMP closes the ServiceNow request.

The job runs every 30 minutes. To pick up a decision without waiting, run ServiceNow Change Order Status from Admin > Recurring Jobs.

Set up Microsoft Teams to use multi-channel alerts

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Set up or identify the Microsoft Teams channel for Cloud Management Platform (CMP) alerts.
Log in to the Microsoft Teams application.

Quick setup

Create a new workflow in Microsoft Teams on the desired team.
Copy the URL from the workflow.
Create a Microsoft Teams alert channel in CMP.
Enter the URL copied from the workflow.

Create a workflow in Microsoft Teams

In your Microsoft Teams application, select the channel you want to receive alerts. You can also create a new team and channel for the alerts.
On the channel, select the ellipsis menu […].
In the search field, type Workflows, or select + Apps and type Workflows in the search bar. The search results are displayed.

(opens full-size image in a new tab)
Find the required workflow and select its Add button.
Select the template Post to a channel when a webhook request is received.
Enter the flow name, for example “Cloudbolt Alert”. Select Next.

(opens full-size image in a new tab)
Select the Microsoft Teams team and channel as required.

(opens full-size image in a new tab)
Select Create a Flow.
Your workflow is created. You can run it by making a POST request to the displayed URL.

(opens full-size image in a new tab)

Copy the URL. You use this URL in the multi-channel alert channel in CMP.
Select Done. The flow name is displayed in the workflow home dashboard:

(opens full-size image in a new tab)
Select the created flow name, for example “Cloudbolt Alert”, then select the edit icon (upper left) to update the workflow.
On the edit page, you may see two steps. The first contains the workflow URL you use in CMP. Do not remove the first step; it is required. The second step is the action to take for this workflow.
Remove the action by selecting the ellipsis (…) and selecting Delete.

(opens full-size image in a new tab)
Select New steps > Standard > Microsoft Teams > Post a message in a chat or channel.

(opens full-size image in a new tab)
Fill out the form as follows:
- Post as: user
- Post in: Channel
- Team: the team you created or selected in step 1. Example: support-alerts
- Channel: the channel from step 1 you want to receive alerts. Example: General
- Message: select Body from dynamic content
- Subject: a subject for your alert
(opens full-size image in a new tab)
Select Save.
Use the URL you copied in step 9 in CMP.
You can also see the alert status in Teams. Go to Workflow > Home > flow name, then scroll down.

Set up multi-tenancy

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

A Super Admin account, plus two users you can log in as who are not Super Admins (for testing).

Set up tenants

Log in to CMP as a Super Admin.
Create a CNAME alias for each tenant, pointing to the CMP server and named for the tenant. (External to CMP.)
Create a group role with the blueprint permissions your tenant admins need, plus order.view and job.view_logs so tenant-specific admin roles can view orders and jobs within their tenant to troubleshoot and monitor.
Create a branded portal for each tenant.
Create a user to administer each tenant.
Create a top-level group for each tenant. The group can have the same name as the tenant.
Add each tenant’s admin user to its group, with the appropriate roles. If you are not sure which roles to assign, add the user to all roles on the group.
Go to Admin > Roles and create at least one admin role with the admin permissions you want to assign to your tenant users. See Admin roles.
Select Admin > Multi-tenancy, add a tenant, and add the users to the tenant with the appropriate admin roles. Use the branded portal.

(opens full-size image in a new tab)
Add the tenant admin to the tenant’s admin role.
Add a resource handler named for the tenant. This is needed if you want the top-level folder in vCenter to match the tenant name or group; otherwise, you can use a global resource handler for all tenants.
Configure the network for the tenant. This is only needed if you want a separate IPAM or IP pool for the tenant’s machines; otherwise, use the global networks configured on the main CMP instance.
Finish setting up an environment for each tenant.
Create a blueprint for each environment. You can also use a global blueprint with different environments. Configure the build step environments as well.

Shell Plus

Mon, 01 Jan 0001 00:00:00 +0000

Shell Plus is a Django management command, so it loads CMP’s models and settings before handing you an IPython prompt. Run a line of code and see the result immediately. Use it to find out what an object holds and work out the queries a plugin will make.

Shell Plus has read-write access to the CMP database and, through it, your cloud infrastructure. Talk to CloudBolt Support before using it in production.

T-shirt sizing for VMs

Mon, 01 Jan 0001 00:00:00 +0000

Use preconfigurations to bundle a group of options into a single choice on the order form. This lets you offer a friendly, technology-agnostic set of sizes (such as small, medium, and large) that align with your corporate standards for server ordering.

Different resource handlers use different size parameter names: AWS uses instance_type, Azure uses node_size, GCP uses gcp_node_size, and vCenter uses cpu_cnt, mem_size, and disk_size. The vCenter parameters are built in. The AWS, Azure, and GCP parameters are created when the matching resource handler is configured, so they appear in a preconfiguration’s Custom fields list only after that handler exists.

Tracking ServiceNow deployments

Mon, 01 Jan 0001 00:00:00 +0000

Track ServiceNow Deployments in OneFuse, including the Configuration Item (CI) name and class name in ServiceNow.

View ServiceNow deployments

In OneFuse, select ServiceNow CMDB under Modules, or select Modules > ServiceNow CMDB from the left navigation menu.
Scroll down to Deployments. See Managed object for more information.

The OneFuse ServiceNow CMDB Deployments reflect the history of CI modifications.

If an existing CI is renamed, the Deployment view will show the previous runs as the original CI name, since the result is captured at a point in time. CIs may be renamed or consolidated in future runs by the ServiceNow Reconciliation Engine.

Tracking VMware Aria Automation deployments

Mon, 01 Jan 0001 00:00:00 +0000

Track VMware Aria Automation Deployments in OneFuse, including the information of the Resource(s).

View VMware Aria deployments

In OneFuse, select VMware Aria Automation under Modules, or select Modules > VMware Aria Automation from the left navigation menu.
Scroll down to Deployments. See Managed object for more information.

VMware Aria Deployment details

In the VMware Aria Deployments section, select the Details caret to view the Deployment response from VMware Aria Automation.

(opens full-size image in a new tab)

Upgrade with high availability

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Web server and job engine processes must be stopped before upgrading.

Web server instances

Perform the following on each web server instance.

Stop web server processes.
```
systemctl stop httpd
```

Job engine instances

Perform the following on each job engine instance.

Check for active job engine jobs.

# Navigate to /opt/cloudbolt/
cd /opt/cloudbolt/

# Start shell_plus
./manage.py shell_plus

# List active jobs
Job.objects.filter(status__in=Job.ACTIVE_STATUSES)

Cancel active job engine jobs.

Job.objects.filter(status__in=Job.ACTIVE_STATUSES).update(status="CANCELED")

Stop job engine processes.
```
supervisorctl stop jobengine:*
```

Execute PowerShell scripts using a bastion host

Mon, 01 Jan 0001 00:00:00 +0000

This method allows for connection over PowerShell/WinRM to a target server. This is to support execution of scripts on Provisioned nodes that do not have SSH running.

Currently, the Scripting module only supports the use of OpenSSH connection types on Windows servers. This will require WinSSH to the Bastion host from the OneFuse appliance (TCP 22) to copy and execute the desired PowerShell script. Then, utilize WinRM (TCP 5985, 5986) to the Provisioned Node.

Use Windows Sysprep with resource handlers

Mon, 01 Jan 0001 00:00:00 +0000

Microsoft Windows System Preparation (Sysprep) prepares a Windows installation for imaging by removing system-specific data, allowing it to be deployed on other machines.

Sysprep can be used independently or with an Answer file (also known as an unattend file or unattend.xml). The Answer file instructs Sysprep how to configure the operating system during the next boot.

When using Sysprep with an Answer file that includes CMP resource handlers, note that the XML Answer file adheres to a strict schema. Sysprep fails if the Answer file contains malformed XML, misplaced values, or incorrectly structured elements.

User permission and attribute synchronization

Mon, 01 Jan 0001 00:00:00 +0000

How it works

When an external user (one authenticated against an external source) logs in, CMP runs every action enabled for the External Users Sync trigger point. These actions fetch the user’s permissions and attributes from an external system such as Active Directory, then add or remove the user from the appropriate groups and roles. This runs synchronously: the user cannot use the UI until it completes.

Use the User Permission Sync From LDAP action

CMP includes a sync action, enabled by default, that grants a user roles based on their LDAP OU and group membership. For each LDAP utility you create, map its OUs and groups to the equivalent groups and roles.

Migrate from vRA 7 to CMP with OneFuse

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse Migration Tools vRealize Orchestrator Package provides examples for the user to “create” OneFuse Managed Objects via Brownfield ingest from vRealize Automation 7x VMs and apply necessary OneFuse Properties on CloudBolt’s VMs (to enable future deprovisioning from CMP+OneFuse). Once migrated, OneFuse Managed Objects will exist and the user has the option to flexibility to 1) destroy via API without deprovisioning or 2) destroy normally within the deployment in CloudBolt CMP, which then calls OneFuse to destroy and deprovision the resource.

Workspace admin tasks

Mon, 01 Jan 0001 00:00:00 +0000

Users with the Workspace Admin role can access the Workspace Admin menu from the left navigation menu.

Once a Super Admin has created local users, the Workspace Admin must add them to the Workspace before they can access it.

(opens full-size image in a new tab)

Manage workspace users

Access the Workspace User Management dashboard

Log in to the OneFuse UI.
If you are in the Super Admin UI and have the Workspace Admin role, select Return to Workspace on the Top App Bar.
Select Workspace Admin > User Management from the left navigation menu.

Add a workspace user

Add a new user to access the OneFuse Workspace.

Access control

Mon, 01 Jan 0001 00:00:00 +0000

Pass a delegate class to the extension’s decorator using the delegate argument. Its should_display method runs each time the page is built, returning True to show the extension and False to hide it. An extension with no delegate is displayed.

Extension types that accept a delegate

Subclass the delegate class that matches the extension type, and import it from extensions.views.

Extension type	Decorator	Delegate class to subclass
Report	`report_extension`	`ReportExtensionDelegate`
Detail view tab	`tab_extension`	`TabExtensionDelegate`
Custom order form	`custom_form_extension`	`CustomFormExtensionDelegate`

dashboard_extension also accepts a delegate argument, but Cloud Management Platform does not check it, so a dashboard card is shown to every user. Admin pages and the microfrontend types do not accept a delegate. An admin page needs none, since only CloudBolt admins and global viewers can view one.

Action retries

Mon, 01 Jan 0001 00:00:00 +0000

Every base action has a max retries value: the maximum number of times to retry the action if it fails. Whenever the action runs and returns an unsuccessful status or raises an exception, Cloud Management Platform (CMP) retries it up to that number of times. This is useful for actions that interact with a flaky external system.

(opens full-size image in a new tab)

Admin roles

Mon, 01 Jan 0001 00:00:00 +0000

Combine admin roles with group, special, and global roles to give users exactly the administrative capabilities they need, such as a slice of what a Super Admin can do.

Example: to let a user manage resource handlers but nothing else an administrator can do, create an admin role with only the Manage Resource Handlers permission.

With multi-tenancy, admin roles control the management permissions users have within their tenant. For users who are not part of a tenant, their admin roles apply everywhere: across all tenants and to global objects.

AI Spend

Mon, 01 Jan 0001 00:00:00 +0000

The AI Spend page provides teams with dedicated visibility into the cost and consumption of generative AI and large language model (LLM) workloads across their connected cloud accounts, covering spend trends, token economics, cost attribution, and anomaly detection in one place.

AI Spend is enabled per tenant. AI usage is currently detected in AWS billing data: Anthropic and other marketplace LLMs, native Amazon Bedrock, and AWS AI and machine-learning services such as SageMaker.

API Keys

Mon, 01 Jan 0001 00:00:00 +0000

Each API key is an OAuth2 service account that authenticates using the client credentials flow.

API keys are scoped to read-only reporting access (reporting:viewer). The scope is fixed and cannot be changed when creating a key.

Only users with the Owner role can view the API Keys page and manage keys.

Access the API Keys page

Log in to the CloudBolt Platform.
In the sidebar, select Settings.
Select API Keys.

API Keys overview

Key areas of the API Keys page:

Migrate from Aria Automation to CMP with OneFuse

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse Migration Tools vRealize Orchestrator Package provides examples for the user to “create” OneFuse Managed Objects via Brownfield ingest from Aria Automation VMs and apply necessary OneFuse Properties on CloudBolt’s VMs (to enable future deprovisioning from CMP+OneFuse).

Once migrated, OneFuse Managed Objects will exist and the user has the option to flexibility to

Destroy via API without deprovisioning

Destroy normally within the deployment in CloudBolt CMP, which then calls OneFuse to destroy and deprovision the resource.

The Migration Tools vRO Package contains sample workflows that can be used out-of-the-box or copied then modified to fulfill requirements. Check back here for updates to the Migration Tools vRO Package.

Authenticate with IAM Auto Discovery

Mon, 01 Jan 0001 00:00:00 +0000

CMP reads temporary credentials for the role from the EC2 instance metadata service, so nothing is stored in CMP, and nothing needs to be rotated. This suits AWS security guidance that favors roles over long-lived keys.

Prerequisites

CMP installed on an AWS EC2 instance. This option works only there, because the credentials come from that instance’s metadata.
An IAM role attached to that same EC2 instance, carrying the permissions listed under AWS permissions.

Create the IAM role in AWS

In the IAM console, select Roles, then Create role.
Select AWS service as the trusted entity type and EC2 as the use case, then select Next.
Attach a policy granting the permissions under AWS permissions, or select Create policy and paste them in as JSON.
Name the role and create it. You need its exact name in CMP.

Attach the role to the EC2 instance running CMP

In the AWS console, go to EC2 > Instances and open the instance CMP is installed on.
Go to Actions > Security > Modify IAM role.
Select the role you created and save.

The role must be on the instance CMP itself runs on, not on the instances CMP provisions.

Azure Backup

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) imports those policies as protection plans and enables backup on a server under the policy you choose.

CMP reaches Azure Backup through an existing Azure resource handler and uses its credentials, so what that resource handler can do in your subscription is what Azure Backup can do.

Prerequisites

An Azure resource handler configured in CMP.
A Recovery Services vault in that subscription, holding at least one backup policy for Azure virtual machines.
The resource handler’s account has permission to enable backup on a VM. See Microsoft’s Azure VM backup FAQ.

Set up the vault and policy in Azure

CMP only reads the vault and its policies, so create both in Azure first.

Azure Local

Mon, 01 Jan 0001 00:00:00 +0000

Azure Local runs Azure services on hardware in your own data center while keeping Azure management and APIs. CMP provisions and manages virtual machines, disks, and network interfaces on its clusters. Azure Local is disabled by default, so enable it before it appears in the technology picker: see Enable a resource handler.

Before you begin

Azure Local uses the same Microsoft Entra ID application and subscription setup as an Azure resource handler. Register the application, give it a role on the subscription, and note its credentials, as described in Configure the Azure portal.

CloudBolt Content Navigator

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) stores content in git using ID-based directory names like BP-50pq8bqg/. The CloudBolt Content Navigator extension reads the metadata files in your local repo and shows content by name in the VS Code sidebar, so you can find and sync items without cross-referencing the CMP UI.

Installation

Install the extension from the Visual Studio Code Marketplace.

Open Visual Studio Code.
Open the Extensions view by selecting the Extensions icon in the Activity Bar on the side, or by pressing Ctrl+Shift+X (Cmd+Shift+X on macOS).
In the search box, type CloudBolt Content Navigator.
Locate the extension in the results and select Install.
Once installed, reload VS Code if prompted.

After installation, the CloudBolt Content Navigator view appears in the VS Code sidebar when you open a folder containing a CMP content repository.

Command line utilities

Mon, 01 Jan 0001 00:00:00 +0000

These are Django management commands, run through manage.py on the appliance. Every command accepts --help, which prints its usage and its full list of options.

Run a command

Connect to the appliance over SSH and switch to the root user.
```
sudo su -
```
The - gives you a root login shell with the environment manage.py expects.

Run the command by its full path.

/opt/cloudbolt/manage.py sync_vms_from_rh --help

Synchronize servers from a resource handler

/opt/cloudbolt/manage.py sync_vms_from_rh

Queues a Sync VMs job and prints the job ID and the path to the job’s log file. The job creates a server record for each VM it finds that CMP does not have, updates the power status and hardware of the records it already holds, and marks a record historical when its VM is no longer in the resource handler.

Connection info

Mon, 01 Jan 0001 00:00:00 +0000

Connection Info are encrypted and reusable across OneFuse Pluggable Modules.

A Connection Info is a prerequisite to OneFuse Pluggable Modules.

Workspace role	Function(s)
Admin or Member	Create, update, view and delete Connection Info
Viewer	View Connection Info

Modules list

The following modules utilize Connection Info:

F5 BIG-IP

Access Connection Info

Log in to the OneFuse UI.
In the Workspace, select Connection Info from the left navigation menu.

This area will display all active Connection Info.

Deploy multiple images from one blueprint

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

A general understanding of OS builds and blueprints.
A blueprint you wish to use.

Deploying multiple images on one blueprint

In CMP, create an OS build and add the desired images to it.
Go to the blueprint.
On the Build tab, add a server tier to the blueprint. Choose the OS build you configured in step 1.
On the Edit Blueprint Item form, leave the Allowable OS Families field empty.
Select Save.
Select the caret to expand the server tier build item. Under Enabled Environments, turn on the switch.

Result: When this blueprint is used in an order, CMP displays all valid environments for the selected OS build from which to deploy a server.

Explore features

Mon, 01 Jan 0001 00:00:00 +0000

Free tier limits: On the free tier you can manage up to 100 resources. See Product license for more information.

Global search

Use global search to quickly find objects and navigate the CMP UI. The Admin page has its own search, scoped to admin content.

Platform configuration

Review and adjust your instance settings in Admin > Miscellaneous Settings.

Time zone

Time zone is set on the appliance, not in the CMP UI.

Flow control actions as code

Mon, 01 Jan 0001 00:00:00 +0000

Once a flow control action is linked to a repository, you can push it, preview the changes, and later refresh the action from the repository. You can also create an action from one already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh a flow control action

Open the action from Admin > Flow Control Actions, then select its repository tab. The tab is named Repository until the action is linked to a repository; then it is named GitHub or GitLab.

IAM roles

Mon, 01 Jan 0001 00:00:00 +0000

If you choose to deploy the AWS CloudFormation template to configure AWS accounts for CloudBolt Platform integration, two least-privilege IAM roles are created in your environment:

CloudBoltFocusCrossAccountRole: A management account role that allows CloudBolt to access your billing data.
CloudBoltActionsCrossAccountRole: Target account roles used to discover resources.

The Terraform module creates the same two roles, with the same names and permissions, in the management account.

CloudBoltFocusCrossAccountRole

Purpose: Used by CloudBolt for cost visibility and analysis, and to create the cost report exports on your behalf.
Permissions: AWS ReadOnlyAccess, plus Cost Explorer, Budgets, and S3 billing-data access. To create and read the cost report exports, it also has bcm-data-exports:GetExport, ListExports, and CreateExport; cur:PutReportDefinition (required by AWS for export creation); and cost-optimization-hub:GetRecommendation / ListRecommendations.

The role has no permission to delete exports and cannot change your account’s Cost Optimization Hub or Compute Optimizer enrollment. CloudBolt reports missing prerequisites rather than remediating them.

Internationalization

Mon, 01 Jan 0001 00:00:00 +0000

CMP ships with English only. Translating it consists of generating message files from the strings marked in the product, translating those files, compiling them, and then telling CMP which language to serve. This is carried out on the appliance, and the files are stored in the proserv directory where they will not be overwritten during an upgrade.

Generate the message files

Run these commands on the appliance. Replace fr with your target language code from the ISO 639-1 list.

LDAP authentication

Mon, 01 Jan 0001 00:00:00 +0000

Add LDAP utility

Set up a connection to your LDAP utility.

Go to Admin > LDAP Authentication Settings.
Select Add.

Complete the Add LDAP Utility form:

Field	Notes
IP Address	IP address or FQDN of AD/LDAP server.
Port	Port to connect to the AD/LDAP server. Defaults are 389 (LDAP) and 636 (LDAPS).
Protocol	Select ldap or ldaps. To use ldaps, LDAPS must be enabled on the directory server. See the OpenLDAP or Active Directory documentation.
LDAP Version	Select Version 2 or Version 3. Contact your directory admin for guidance.
Account	The service account in AD/LDAP that can search for users and, if applicable, join servers to the domain. For Active Directory, use the form `username@domain`.
Password	The password used to authenticate the service account. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the secret from a configured vault provider. See Use password vaults.

Select Save.

Manage computer objects

Mon, 01 Jan 0001 00:00:00 +0000

Microsoft Active Directory computer objects

Microsoft Active Directory computer accounts can be registered and unregistered through policy executions. Search based on the Managed Object Computer Name, see computer account details, view the connected policy, and view job details.

Create at least one Microsoft Active Directory policy.
Locate the Managed Active Directory Computers datatable and select Refresh.

Create a computer object

Workspace Admin and Workspace Member roles can use the OneFuse API to register a Computer Name with Microsoft AD.

Men&Mice Micetro DNS

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse DNS module for Men&Mice enables organizations who utilize Men&Mice Micetro to manage BIND, Microsoft, or cloud-based providers for DNS hosting to have a fully automated method of controlling DNS records as the cloud environment dynamically scales, reducing the support burden and increasing the chances of successful ITaaS deployments.

License required

This Module requires the Men&Mice Micetro DNS License in order to execute a Men&Mice Micetro DNS Policy. Men&Mice Micetro DNS Policies, Endpoints, and Module Credentials can be created without a license.

Men&Mice Micetro IPAM

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse Men&Mice Micetro IPAM module enables organizations who utilize Men&Mice Micetro for centralized IP address management to have a fully automated method of obtaining and releasing IP addresses as the cloud environment dynamically scales. IP subnets can now easily be shared between deployments and alongside existing tools and devices without fear of IP conflict.

License required

This Module requires the Men&Mice Micetro IPAM License in order to execute a Men&Mice Micetro IPAM Policy. Men&Mice Micetro IPAM Policies, Endpoints, and Module Credentials can be created without a license.

Microsoft Entra identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Complete Set up SSO and SAML and Configure the identity provider.
Capture the IdP XML metadata.
Create the branded portal for this SSO provider.

Configure Microsoft Entra as the IdP

Log in to the Azure portal.
Go to Enterprise Applications.

(opens full-size image in a new tab)
Select + New Application, then search for and select Microsoft Entra SAML Toolkit.

(opens full-size image in a new tab)

The create dialog appears.

(opens full-size image in a new tab)
Enter a name for the CMP application and select Create. The application is added to your enterprise applications.
Select Microsoft Entra SAML Toolkit, then select Set up single sign-on to start configuring it for CMP.

(opens full-size image in a new tab)
On the single sign-on page, select SAML.

(opens full-size image in a new tab)
In the Basic SAML Configuration section, set Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Logout URL to point to your CMP instance.

(opens full-size image in a new tab)
Alternatively, select Upload metadata file and upload the metadata file you downloaded in step 6 of Set up SSO and SAML. The Basic SAML settings are then configured automatically from your metadata XML.

(opens full-size image in a new tab)
Ensure the Sign on URL is set.
Select Save.
When prompted to test the connection, select No, I’ll test later.
Under SAML Certificates, select Download for Federation Metadata XML.

(opens full-size image in a new tab)
Save the metadata XML. You need it in Set up SSO and SAML.
Select Edit on the SAML settings section and ensure the Signing Algorithm matches the one you set in the SAML settings in Set up SSO and SAML.

(opens full-size image in a new tab)

Modify or add disks

Mon, 01 Jan 0001 00:00:00 +0000

Which of the two applies depends on the server’s existing disks. Servers built with managed disks take a Storage type on each new disk; servers built against a storage account take an Azure Storage Account instead, and Cloud Management Platform (CMP) creates one if not specified.

Add a disk

Open the server and select the Disks tab.
Select Add.
Enter a Disk Size (GB) and set OS Disk Host Caching.
Set Storage type or Azure Storage Account, whichever the dialog offers.
Submit the dialog.

Add appears only on an active server in an assigned environment, on a technology that supports adding disks, and only for users with permission to add disks.

Orders and jobs

Mon, 01 Jan 0001 00:00:00 +0000

An orders.models.Order holds one or more OrderItem records, one per requested item. When the order is approved, Cloud Management Platform creates a jobs.models.Job for each top-level item, and those jobs can create sub-jobs.

(opens full-size image in a new tab)

Order lifecycle

An order’s state is the Order.status field. It starts at CART, and only an order still in the cart can be submitted.

phpIPAM

Mon, 01 Jan 0001 00:00:00 +0000

Create an API key first

phpIPAM authenticates CMP with an application API key, so create one before you start. In phpIPAM, log in as an administrator and create an API key, setting the App Security to SSL with User token. You will enter that key’s app ID in CMP.

Plugin examples

Mon, 01 Jan 0001 00:00:00 +0000

CMP hosts a Content Library of example plugins, which you can import from most pages where actions are created, such as Server Actions and Orchestration Actions. The source for those plugins lives in a public GitHub repository.

Add a progress message

Use this at the Pre-Create Resource trigger point in a Provision Server job. It writes the server’s IP address to the job progress and log, then waits 60 seconds so the message is easy to notice.

Policy

Mon, 01 Jan 0001 00:00:00 +0000

(opens full-size image in a new tab)

A policy belongs to a Module. It:

Replaces custom code.
Is consumed through multiple tools, CMPs, scripts, or independent service requests.
Acts as a broker for IT integrations and extensibility.
Controls module-specific features.
Creates and destroys module-specific Managed Objects.

Produce output from Scripting policies

Mon, 01 Jan 0001 00:00:00 +0000

A managed object for OneFuse Scripting Policy can include “output” under the section “provisioningDetails” or “deprovisioningDetails”.

Prerequisites

The script being executed must produce valid JSON strings to STDOUT. This output is then captured by the Scripting Module and used to populate the “output” fields.

How it works

Each JSON string written towards STDOUT will result in an escaped JSON string in the array called “output” under “provisioningDetails” or “deprovisioningDetails”. The structure and key/value names of the JSON string depend on your requirement. The Scripting Module requires that the string must be a valid JSON string. This functionality is valid for both BASH scripts and PowerShell scripts.

Puppet Enterprise

Mon, 01 Jan 0001 00:00:00 +0000

CMP installs the Puppet agent on each new server, has its certificate signed, and adds the server to the node groups it was ordered with. The Puppet Enterprise tile appears in the Add dialog only where a Puppet Enterprise configuration manager already exists, so this page covers deployments that already run Puppet Enterprise.

What the integration does

Installs the Puppet agent on a new server and signs its certificate.
Sets the server’s node groups during provisioning.
Imports node groups from Puppet Enterprise so they can be offered as applications.
Synchronizes servers and retrieves node facts.
Removes a node from Puppet Enterprise and cleans its certificate when a server is decommissioned.

The Version setting in the configuration manager determines which built-in actions CMP uses and also changes what the manager offers. With 3.X, CMP shows the certificate name, adds a Reports tab, and allows applications to be installed and uninstalled on servers through Puppet Enterprise. With 2015+, none of those are offered, and you configure the API and SSH endpoints described below.

Recurring jobs with secrets

Mon, 01 Jan 0001 00:00:00 +0000

A recurring job created from an action can hold secrets: values of action inputs whose type is password or encrypted text. When you export that job from Cloud Management Platform (CMP), you can encrypt those values with a password you choose. Importing the job prompts for the same password, which decrypts the secrets.

Why use a password

Setting your own password lets you move an exported job between CMP instances without exposing its secrets.

Release 2025.1

Mon, 01 Jan 0001 00:00:00 +0000

Customers using a proxy

The HTTP_PROXY and HTTPS_PROXY environment variables must be set to an outgoing proxy before running the upgrader.

CloudBolt now designates os_build as a proprietary parameter.

Customers on Release 2025.1.298 or newer do not need to take any action.

Customers upgrading from Release 2025.1.276 or older must check for an existing os_build Custom Field and, if present, rename it to avoid an upgrade conflict. For instructions, refer to the CloudBolt Knowledge Base article on renaming custom field parameters.

Resource expiration

Mon, 01 Jan 0001 00:00:00 +0000

Nothing expires on its own. Setting the date marks the resource; the Expire Resources rule is what finds it afterward and acts on it, and both the rule and its action are disabled by default. Servers expire through their own mechanism, described in Server expiration.

Set an expiration date

Provide a value for the Expiration Date parameter. There are two ways to do it:

At order time, by adding Expiration Date to the blueprint as a blueprint-level parameter, with its destination set to the resource, so the person ordering can pick a date.
On an existing resource, from its Parameters tab.

Act on expired resources

The Expire Resources rule pairs a condition that finds expired resources with an action that acts on them. Both halves are disabled by default, so enable the rule and its action before relying on it. See Rules for how rules are enabled and run, including the recurring job they depend on, which is also disabled on a new instance.

Resource pools

Mon, 01 Jan 0001 00:00:00 +0000

Instead of generating a hostname or letting a parameter be filled in on the order form, you can prepare the values in advance and let CMP allocate them. A pool is attached to one or more environments, and each server built into those environments claims one set of values from it. A set is claimed by a single server, so the same value is never handed out twice.

Add a resource pool

Go to Admin > Resource Pools.
Select Add a resource pool.
Fill in the fields, then select Create.

The Scope column reads Local for any pool you create here, meaning it applies across the environments you attach it to.

Roles and permissions

Mon, 01 Jan 0001 00:00:00 +0000

Every user has one of four roles: Admin, Operations, Practitioner, or Stakeholder. Roles are assigned when a user is invited and can be changed later from User Management. For a description of what each role means, see Manage roles.

Most pages in the platform are open to any authenticated member of your organization, regardless of role. A smaller set of administrative pages require a specific permission level on top of your role.

Rules

Mon, 01 Jan 0001 00:00:00 +0000

A rule lets Cloud Management Platform (CMP) administrators check the state of the environment and act on what they find. Use rules to enforce policy with corrective actions, respond to changes as they happen, or run health checks and tell the right people what needs attention.

How a rule works

A rule is a logical statement in two parts:

Condition (the “if”). One action that tests something and reports whether it found anything.
Actions (the “then”). One or more actions that run when the condition is met.

Both parts are CMP actions of type CloudBolt Plug-in. The condition is written a little differently from other plugins; see Write a condition plugin.

Set up Kubernetes cost allocation

Mon, 01 Jan 0001 00:00:00 +0000

How Kubernetes cost allocation works

Your cloud provider bills you for the nodes, disks, and network traffic behind a cluster, without specifying which namespace or workload used that capacity. CloudBolt combines two sources of data to close that gap:

Cloud billing data: A FOCUS cost and usage export from each cloud provider, which tells CloudBolt what your cluster infrastructure costs.
Cluster usage metrics: CPU, memory, and network metrics collected in-cluster by the StormForge Agent, showing CloudBolt how capacity was consumed by each namespace, workload, pod, and container.

CloudBolt joins the two and attributes infrastructure cost down to the workload level, including idle and overhead capacity. The result is shown in the Kubernetes Report and the Kubernetes cost allocation dataset in Cost Explorer.

SSL root certificates

Mon, 01 Jan 0001 00:00:00 +0000

(opens full-size image in a new tab)

For Cloud Management Platform (CMP) to verify TLS/SSL connections whose certificate is issued by a private certificate authority, add that private CA to CMP’s built-in list of trusted SSL root certificates.

CMP ships with the certifi (Mozilla-curated) bundle of trusted certificate authorities, so connections to public cloud services should not require adding SSL root certificates.

Tracking ServiceNow Connector deployments

Mon, 01 Jan 0001 00:00:00 +0000

Track deployments created by ServiceNow Connector Policy executions. While executing, you can track progress in the Jobs log.

View deployments in OneFuse

Log in to the OneFuse UI.
Select Modules > ServiceNow Connector from the left navigation menu.
Scroll down to ServiceNow Connector Deployments. Each deployment shows:
- Created Date
- Source
- Source IP
- Requester
- Policy
- Child Policy
- Managed Object
- Link to Job
- Link to Job Tracking ID
- Select Details to view:
  - OneFuse Policy Type
  - Link to Deployment CI in ServiceNow
  - OneFuse Managed Object HREF

(opens full-size image in a new tab)

Troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

Job logs

View Job Logs to identify any issues.

Log in to the OneFuse UI.
Select Jobs from the left navigation menu.
Find the job of interest from the datatable and select the eye icon to view it.
Find the Job Logs section and view logs.

In future releases, we will enable Log mode and Log exports.

Support

CloudBolt’s Customer Success team is here to help with OneFuse.

Create a support ticket

Go to https://support.cloudbolt.io/.
Select New Support Ticket.
Select OneFuse as the request type.
Fill out the form with as many details as possible.
Select Submit.

Email Customer Success

Send an email to support@cloudbolt.io.

Upgrade OneFuse

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Read the Release notes.
Back up your OneFuse instance by cloning the VM or taking a snapshot.

Upgrade OneFuse

There are two methods to upgrade OneFuse:

Option 1: Command Line
Option 2: Yum Repository

Option 1: Upgrade via the command line

OneFuse upgraders are distributed as .tgz archives.

The upgrader is designed to save customizations you have made and not lose information, but be sure to review the Release Notes for any changes that may affect your OneFuse instance.

Upgrading to Release 2026.2

Mon, 01 Jan 0001 00:00:00 +0000

This page covers what changed in Release 2026.2.10, how to prepare your environment, known compatibility risks, and how to resolve common post-upgrade errors.

What is this upgrade?

CloudBolt upgraded the underlying framework and runtime of the Cloud Management Platform (CMP) to Django 5.2 and Python 3.12, and updated Django REST Framework (DRF) from 3.11.2 to 3.15.2. These upgrades move CMP to the latest long-term support (LTS) versions of these technologies.

Use RBAC and portals with multi-tenancy

Mon, 01 Jan 0001 00:00:00 +0000

Multi-tenancy allows a single CMP instance to serve multiple organizations while keeping each organization’s data and resources private. Administrators set global policies, automations, blueprints, and actions, and report on usage across all customers, while each tenant gets a tailored hybrid cloud experience.

Multi-tenancy is especially useful for large companies with different lines of business that should not see each other’s servers, blueprints, and environments.

It also suits managed service providers (MSPs) that provide cloud services to external customers, ensuring that customers (internal or external) can access only the resources they are permitted to and cannot interfere with each other’s operations.

Use SSL with an external PostgreSQL database

Mon, 01 Jan 0001 00:00:00 +0000

This procedure applies to a distributed deployment in which the database runs outside the appliance. Every web server and job engine node needs outbound access to the database on TCP 5432. See Network connectivity.

The paths and commands below use PostgreSQL 14. If your database server runs another version, such as PostgreSQL 18, replace 14 with your version number.

PostgreSQL database configuration

Perform the following on the PostgreSQL server.

Add the following to the PostgreSQL data directory: /var/lib/pgsql/14/data
- Server SSL certificate: server.crt
- Private key: server.key

Update the SSL configuration to enable SSL:

Edit /var/lib/pgsql/14/data/postgresql.conf:
1. Uncomment ssl and set the value to on
If the filename for the server SSL certificate is not server.crt, or the private key is not server.key, do the following:
1. Uncomment ssl_cert_file and set the value to the server SSL certificate filename
2. Uncomment ssl_key_file and set the value to the private key filename

Example /var/lib/pgsql/14/data/postgresql.conf

# - SSL -

ssl = on
#ssl_ca_file = ''
#ssl_cert_file = 'server.crt'
#ssl_crl_file = ''
#ssl_crl_dir = ''
#ssl_key_file = 'server.key'
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
#ssl_prefer_server_ciphers = on
#ssl_ecdh_curve = 'prime256v1'
#ssl_min_protocol_version = 'TLSv1.2'
#ssl_max_protocol_version = ''
#ssl_dh_params_file = ''
#ssl_passphrase_command = ''
#ssl_passphrase_command_supports_reload = off

Update the allowed hosts to use SSL by adding hostssl entries for your IP addresses or IP ranges:

Edit /var/lib/pgsql/14/data/pg_hba.conf:

Example /var/lib/pgsql/14/data/pg_hba.conf

# TYPE  DATABASE        USER            ADDRESS                 METHOD

# "local" is for Unix domain socket connections only
local   all             all                                     peer
# IPv4 local connections:
host    all             all             127.0.0.1/32            scram-sha-256
# IPv6 local connections:
host    all             all             ::1/128                 scram-sha-256
# Allow replication connections from localhost, by a user with the
# replication privilege.
local   replication     all                                     peer
host    replication     all             127.0.0.1/32            scram-sha-256
host    replication     all             ::1/128                 scram-sha-256
hostssl all             all             192.168.56.0/24         scram-sha-256

Restart the database
```
systemctl restart postgresql-14
```

Verify SSL is configured properly by connecting to the database using the psql command below:

#Replace value for password in the psql command below

psql "dbname=cloudbolt host=db.cloudbolt.vm user=cb_dba password=yourdbpassword sslmode=require"

Example expected return after running the psql command above

# Example of successful psql command return
psql (14.2)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.

cloudbolt=>

Write remote scripts

Mon, 01 Jan 0001 00:00:00 +0000

A remote script can be written in any scripting language, as long as that language is installed on the target server and allowed to run there. On Windows, the execution policy must permit the script. On *nix, the script must begin with a shebang line.

Shebang lines

A bash script starts with one of these:

#!/bin/bash

or the more portable form, which resolves bash through env:

#!/usr/bin/env bash

The portable form requires the interpreter to be on the PATH of the target server.

AWS tech-specific script execution

Mon, 01 Jan 0001 00:00:00 +0000

Tech-specific script execution lets Cloud Management Platform (CMP) run remote scripts on an EC2 instance it cannot reach directly over SSH or WinRM. CMP instead uses the AWS Systems Manager (SSM) Run Command feature, which delivers the script to the instance and reports the result back.

Prerequisites

Set these up in AWS before configuring anything in CMP.

Instances must have the SSM Agent installed. See Images with the SSM Agent pre-installed.
Linux instances need port 443 reachable, or a correctly configured VPC endpoint for SSM.
Windows instances need port 3389 open. The default launch-wizard security groups do not work. Use an instance type of t2.small or larger for acceptable performance, and allow a few minutes longer than Linux for SSM to finish installing: an instance can report Running before SSM is ready. The instance system log in AWS helps here.
If the deployment has no internet access over port 443, configure VPC endpoints. See the AWS guidance on creating VPC endpoints.

Roles and policies

Roles are what SSM support in CMP rests on. Create an IAM role in AWS for SSM, for example EnablesEC2ToAccessSystemsManagerRole. CMP uses it to enable SSM on supported operating systems. See Supported operating systems in the AWS documentation.

Azure Stack

Mon, 01 Jan 0001 00:00:00 +0000

Azure Stack is a legacy technology and does not appear in the technology picker. You cannot create a new Azure Stack resource handler. Existing handlers continue to work, and you can still edit their credentials and settings.

Credentials for an existing handler

To review or update the connection, open the handler from Admin > Resource Handlers and select Edit Credentials.

Field	Description
Subscription ID	The ID of the subscription this handler manages.
Application ID	The ID of the Active Directory application the handler authenticates as. Azure calls this the Client ID.
Authentication Key	The private key created for that application. Azure displays the value only once, when it is generated. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the key from a configured vault provider.
Directory ID	The directory the application belongs to. Azure calls this the Tenant ID.
Auth Type	How the handler authenticates: Service Principal or Active Directory. Service Principal is the default.
Metadata Endpoint	The Azure Stack endpoint the handler connects to. This field is what distinguishes an Azure Stack handler from an Azure one.

Azure: the current handler for new connections to Azure subscriptions.
Azure Local: run Azure services on hardware in your own data center.
Use password vaults: storing the authentication key in HashiCorp Vault, CyberArk, Keeper, AWS Secrets Manager, or Azure Key Vault.
Legacy technologies: QEMU-KVM and XenServer, which are also closed to new handlers.

Billing Rulesets

Mon, 01 Jan 0001 00:00:00 +0000

Billing Rulesets allow you to define rules to adjust cloud costs before presenting them to your customers.

Rules can optionally include filters to target specific services, regions, or resources. Each ruleset is scoped to one cloud provider (or all providers) and assigned to one or more customers.

Rulesets are applied by the data pipeline, not on demand: changes take effect on the next pipeline run. Adjusted costs appear as the Rerated Cost metric in cost views and are the basis of Summary Reports.

Commvault backup and recovery

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) imports those groups, so the choice on an order form is which VM group the new server should join. How Commvault identifies a machine determines what a restore produces.

Prerequisites

A resource handler in CMP for a platform Commvault supports.
In Commvault: storage, a hypervisor, a server backup plan, and at least one VM group with that plan assigned to it. See Commvault’s documentation for how to set these up.

Configure your resource handler to identify servers by fully qualified domain name rather than by IP address, since Commvault tracks machines by their hostnames.

Cost and security considerations

Mon, 01 Jan 0001 00:00:00 +0000

This page details AWS account configuration considerations for IAM roles, data protection, and cost to provide the highest level of security while minimizing overhead and costs.

IAM roles

Least privilege principles applied to all policies
Roles are only assumable by specified CloudBolt Platform accounts

Data protection

S3 server-side encryption (SSE-S3) with AES-256 is enabled by default on S3 buckets
S3 Block Public Access is enabled by default on S3 buckets
S3 Versioning is enabled on S3 buckets
The S3 bucket policy grants access to the bcm-data-exports.amazonaws.com service for the management account only

Cost

No additional AWS cost:
- FOCUS Data Exports
- Cost Optimization Recommendations Exports
- CloudFormation StackSets
- IAM Roles and Policies
Standard costs apply:
- S3 Storage: For the cost report data stored in the S3 bucket
- Data Transfer: If reports are generated in a different region than your resources

Create a parent-child resource handler for AWS

Mon, 01 Jan 0001 00:00:00 +0000

A child handler carries no credentials of its own. It uses the parent’s and assumes a cross-account IAM role that exists in the member account under the same name. CMP can create that role across the member accounts for you, then import the accounts as handlers.

Prerequisites

The work happens on the Organization Accounts tab of the parent handler. That tab appears only where all of the following are true:

Deprecated versions

Mon, 01 Jan 0001 00:00:00 +0000

Upgrades from a deprecated version to the latest version will no longer be tested on the deprecation date. Upgrades are still supported, but may take multiple steps.

Deprecated versions support matrix

Release	GA	Deprecation	End of support
2025.1.300	15 Oct 2025	15 Oct 2026	15 Apr 2027
2025.1.298	10 Oct 2025	10 Oct 2026	10 Apr 2027
2025.1.276	23 Sep 2025	23 Sep 2026	23 Mar 2027
2025.1.260	3 Sep 2025	3 Sep 2026	3 Mar 2027
2025.1.246	14 Aug 2025	14 Aug 2026	14 Feb 2027
2025.1.235	1 Aug 2025	1 Aug 2026	1 Feb 2027
2025.1.206	16 July 2025	16 July 2026	16 Jan 2027
2025.1.187	18 June 2025	18 June 2026	18 Dec 2026
2025.1.171	06 June 2025	06 June 2026	06 Dec 2026
2025.1.156	23 May 2025	23 May 2026	23 Nov 2026
2025.1.146	09 May 2025	09 May 2026	09 Nov 2026
2025.1.134	30 Apr 2025	30 Apr 2026	30 Oct 2026

Export and import actions

Mon, 01 Jan 0001 00:00:00 +0000

Actions can be exported as files so they can be reused across Cloud Management Platform (CMP) instances or shared in the CloudBolt Forge, a repository of sample CMP resources. An exported action is a zip file containing JSON-formatted metadata about the action, along with any scripts it uses.

Exporting

When exporting, choose between a sanitized and an instance-specific version of the action. The formats are the same, but the sanitized version omits potentially sensitive information such as script credentials, environments, and groups. Sanitized versions are suitable for sharing on the CloudBolt Forge or for moving actions between instances that do not have the same groups and environments.

Flow control orchestration

Mon, 01 Jan 0001 00:00:00 +0000

Use flow control to prevent orders from starting or pause orders when known issues or scheduled downtime affect certain ecosystem integrations.

Enabling flow control

Go to Admin > Flow Control Actions.
Select Add, then select Create New.
In the Create Flow Control dialog, fill in the required fields (Label and Control Type) and any top-level filters, then select Save.

Top-level filters

Filter	Description
Groups	Select one or more groups to allow or pause orders with the group.
Blueprints	Select one or more blueprints to allow or pause orders for them.
Environments	Select one or more environments to allow or pause orders that have any items with any of the selected environments.
Resource Technologies	Select one or more resource technologies to allow or pause orders that have any items with any of the selected resource technologies.
Resource Handlers	Select one or more resource handlers to allow or pause orders that have any items with any of the selected resource handlers.

Once saved, a new flow control action is created with minimal action code to apply the top-level filters. The new action is created in the disabled state.

Import images

Mon, 01 Jan 0001 00:00:00 +0000

Import images from the handler’s Images tab, which lists each imported region and the images already available in it. Import the regions you need on the Regions tab first: an image can only be imported into a region Cloud Management Platform (CMP) knows about.

Import public images

Azure publishes a large number of images, so CMP imports them in two steps. The Fetch and Cache Available Azure Images rule caches Azure’s offering, and Import Images on the Images tab picks from that cache. Until the rule has run at least once, the import dialog has nothing to show.

Inbound webhooks as code

Mon, 01 Jan 0001 00:00:00 +0000

Once an inbound webhook is linked to a repository, you can push it, preview the changes, and later refresh the webhook from the repository. You can also create a webhook from one already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh an inbound webhook

Open the webhook from Admin > Inbound Web Hooks, then select its repository tab. The tab is named Repository until the webhook is linked to a repository; then it is named GitHub or GitLab.

Microsoft DNS

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse Microsoft DNS module enables organizations who utilize Microsoft for DNS hosting to have a fully automated method of controlling DNS records as the cloud environment dynamically scales, reducing the support burden and increasing the chances of successful ITaaS deployments.

License required

This Module requires the Microsoft DNS License in order to execute a Microsoft DNS Policy. Microsoft DNS Policies, Endpoints, and Module Credentials can be created without a license.

Microsoft IPAM

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse Microsoft IPAM module enables organizations who utilize Microsoft for centralized IP address management to have a fully automated method of obtaining and releasing IP addresses as the cloud environment dynamically scales. IP subnets can now easily be shared between deployments and alongside existing tools and devices without fear of IP conflict.

License required

This Module requires the Microsoft IPAM License in order to execute a Microsoft IPAM Policy. Microsoft IPAM Policies, Endpoints, and Module Credentials can be created without a license.

Office 365 identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Office 365 uses the same setup as Microsoft Entra (formerly Azure AD). The screenshots here are from the Microsoft Entra SSO interface.

Before you begin

Complete Set up SSO and SAML and Configure the identity provider.
Capture the IdP XML metadata.
Create at least one branded portal for this SSO provider.

Configure Office 365

In Office 365, configure an enterprise application linked to SSO for CMP.

In Office 365, manage the enterprise application.
In the Manage menu, select Single sign-on. Set Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Logout URL to point to your CMP instance.

(opens full-size image in a new tab)

OS builds

Mon, 01 Jan 0001 00:00:00 +0000

One OS build can gather the equivalent template or image from several resource handlers, so an order form can offer a choice of operating system rather than a list of platform-specific template names. The build also controls which environments offer it. Cloud Management Platform (CMP) uses the build to decide what to deploy from, and users never see the underlying template names.

Add an OS build

Managing OS builds needs the osbuild.manage permission.

Override or hide built-in tabs

Mon, 01 Jan 0001 00:00:00 +0000

By default, tab extensions are appended to the end of the tab list on a detail view. With the replaces parameter, you can instead target a specific built-in tab by its slug, and either replace it with your extension tab or hide it entirely.

This feature applies to the following detail views:

User profiles
Groups
Environments
Servers
Resource handlers
Resources
Blueprints

The examples on this page are using the Scheduled Snapshots UI extension.

Password policies and admin password reset

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) enforces password requirements, history, and expiration through settings you configure in customer_settings.py.

Password policy settings

Configure these settings in customer_settings.py:

PASSWORD_HISTSIZE: The number of previous passwords a user cannot reuse. The default is 10.
AUTH_PASSWORD_VALIDATORS: Password requirements such as length and complexity. By default, Cloud Management Platform requires at least 9 characters and a mix of character types. See the Django password validation documentation.
PASSWORD_EXPIRATION_HOURS: The number of hours after which a password expires, and the user must set a new one. The default is 0, which disables expiration.
PASSWORD_RESET_TIMEOUT: How long, in days, a password reset token stays valid. The default is 86400.
EMAIL_VERIFICATION_TIMEOUT_DAYS: The number of days a user has to use an email verification link before it expires. The default is 1.

Reset the administrator password

If you are locked out or need to reset an administrator’s password, use Django’s built-in changepassword command. SSH into your CMP instance and run:

Plugin parameterization

Mon, 01 Jan 0001 00:00:00 +0000

When you upload a plugin file or point at one by URL, CMP scans its contents for template variables such as {{ variable }} and creates an action input for each one it finds. See Action input parameters for more on generated inputs, and Action context for the objects available in each context.

CMP prompts users for those inputs and renders them into the action before it runs. Input values are escaped so they cannot execute arbitrary code while still rendering as expected.

Puppet Open Source

Mon, 01 Jan 0001 00:00:00 +0000

CMP becomes the master’s external node classifier: the master asks CMP which classes belong to a node and forwards each agent’s run report to CMP, which then shows a server’s facts and its latest report. The Puppet Open Source tile appears in the Add dialog only where a Puppet Open Source configuration manager already exists, so this page covers deployments that already run Puppet.

What the integration does

Installs and removes Puppet classes on servers as CMP applications.
Signs the agent certificate and removes the node when a server is decommissioned.
Imports classes, synchronizes servers, and records Puppet run reports.

CMP does not install the Puppet agent for open-source Puppet, so the agent must be in your images or installed by a remote script. With the 4.4+ version setting, node facts are not retrieved.

Reference architecture

Mon, 01 Jan 0001 00:00:00 +0000

OneFuse and CloudBolt CMP are deployed together on the same CloudBolt appliance. Refer to the CloudBolt CMP documentation for appliance architecture details:

CloudBolt appliance reference architecture: overall appliance design
Appliance security: security hardening guidance
Hardware guidelines: CPU, memory, and storage sizing recommendations
Network connectivity: required network ports and connectivity
SSL with External PostgreSQL: configuring SSL when using an external database

Resource Inventory

Mon, 01 Jan 0001 00:00:00 +0000

The Resource Inventory provides a unified view of the cloud resources deployed across your accounts and regions, with a page per cloud: AWS Resource Inventory and Azure Resource Inventory. GCP resource inventory is coming soon.

Access the Resource Inventory page

Log in to the CloudBolt Platform.
In the sidebar, select Resource Inventory to expand it, then choose AWS or Azure.

All resources view

Each cloud’s page displays all discovered resources in a searchable, filterable table.

Resource names

Mon, 01 Jan 0001 00:00:00 +0000

If a blueprint manager does not configure this template, the resource name defaults to the blueprint name followed by a unique number. To set one, select Edit while managing the blueprint and fill in the Resource Name Template field.

The template uses the Django template format and the same uniquification scheme used elsewhere in Cloud Management Platform, such as parameter templates. The available context includes:

the blueprint itself, with all its attributes
the requestor (the order owner)
blueprint-level parameters whose destination includes the resource
the group selected for the order

For example, to name the resource after the group and the value entered for a blueprint-level parameter (with a resource destination) named ticket_number, enter:

SELinux

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Take a VM snapshot of your CMP host before making any operating system changes.

Enabling SELinux

Log in to your CMP host and run the following command: getenforce. If this reports that SELinux is disabled, run the following command, then reboot the host:

sed -i "s/SELINUX=.*$/SELINUX=permissive/g" /etc/selinux/config

This will tell the host to run in permissive SELinux mode upon reboot.

Permissive SELinux

To set SELinux back to Permissive mode, run the following commands on the host:

Server expiration

Mon, 01 Jan 0001 00:00:00 +0000

A server or resource is marked for expiration using the Expiration Date parameter.

Server expiration is a recurring job (Admin > Recurring Jobs > Expire Servers). By default, the job runs each day at midnight.

The job runs the Expire Servers action, which spawns a job and executes any enabled Expire actions.

How expiration works

To indicate that a server should expire on a particular date, it must have an Expiration Date value. This can be provided during provisioning, as described in Order Form Customization, or added to a server via the Parameters tab.

SolarWinds IPAM

Mon, 01 Jan 0001 00:00:00 +0000

Connection details

In Admin > IP Management, select Add, then choose SolarWinds.

Field	Description
Name	A name for this connection.
IP address	The address or hostname of the SolarWinds server.
Port	Defaults to 17778, the SolarWinds Information Service port, rather than the 443 the other integrations use.
Protocol	HTTP or HTTPS. Defaults to HTTPS.
Account username	An account authorized to run commands on the SolarWinds server.
Password	The password for that account. It is stored securely. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the secret from a configured vault provider. See Use password vaults.

IP address management (IPAM): The setup workflow shared by every IPAM integration.
Import and manage existing networks: The resource handler networks a SolarWinds network maps to.

SSL certificates

Mon, 01 Jan 0001 00:00:00 +0000

To log in to the CMP appliance for the first time, you must accept the self-signed certificate. To let your browser verify the certificate afterward, configure CMP with a certificate trusted by your clients.

CMP requires a certificate issued by either a public or a private CA. Ensure all your client and user devices trust this CA.

Additional resource: How to force HSTS in CloudBolt Server

Install a signed certificate

If you already have a signed certificate and key in PEM (Base64-encoded) format, update the certificate on the CMP appliance via SSH/SCP. Otherwise, first generate a CSR.

Terraform Provider for CloudBolt

Mon, 01 Jan 0001 00:00:00 +0000

CloudBolt publishes it in HashiCorp’s public registry as CloudBoltSoftware/cloudbolt. The provider documentation covers all resources and data sources it offers, as well as the settings that point it to your CMP instance.

Terraform operations: The reverse direction. A blueprint build item that runs a Terraform source from inside CMP and tracks the result as a resource.
REST API: The API the provider calls and the user account it authenticates as.

Tracking ID

Mon, 01 Jan 0001 00:00:00 +0000

A tracking ID groups executions of OneFuse Modules. It is:

Set on the OneFuse API request headers using the key Tracking-Id:

Request header key Value

Tracking-Id <tracking_id>
Generated automatically if none is provided: OneFuse generates a unique one and associates it with the resulting Managed Objects. Reference it using the field key jobTrackingId.
Used to associate multiple Jobs together.
Accepted as an optional parameter by most methods in upstream provider integrations.

For example, when deploying a VM using OneFuse Naming, IPAM, and DNS modules, pass the tracking ID returned from the first policy execution (Naming) to the subsequent modules (DNS and IPAM). This links all policy runs, jobs, and managed objects together under a single tracking ID.

Trigger points

Mon, 01 Jan 0001 00:00:00 +0000

The following trigger points are created during OneFuse XUI initial setup.

Trigger point states

The list below represents the trigger point state names for Provision Server, in order of execution, for OneFuse modules that may require an execution string trigger.

HostnameOverwrite
PreCreateResource
PreApplication
PostProvision

HostnameOverwrite

Job / Process	Trigger point name	OneFuse module	Run sequence	Plugin action name
Provision Server	Generated Hostname Overwrite	Property Toolkit	1000	OneFuse - Property Toolkit
Provision Server	Generated Hostname Overwrite	Scripting	1005	OneFuse - Provision Scripting
Provision Server	Generated Hostname Overwrite	Ansible Tower	1010	OneFuse - Provision Ansible Tower
Provision Server	Generated Hostname Overwrite	Pluggable Modules	1015	OneFuse - Provision Pluggable Module
Provision Server	Generated Hostname Overwrite	Naming	1150	OneFuse - Provision Naming

PreCreateResource

Job / Process	Trigger point name	OneFuse module	Run sequence	Plugin action name
Provision Server	Pre-Create Resource	Property Toolkit	1000	OneFuse - Property Toolkit
Provision Server	Pre-Create Resource	Scripting	1005	OneFuse - Provision Scripting
Provision Server	Pre-Create Resource	Ansible Tower	1010	OneFuse - Provision Ansible Tower
Provision Server	Pre-Create Resource	Pluggable Modules	1015	OneFuse - Provision Pluggable Module
Provision Server	Pre-Create Resource	IPAM	1200	OneFuse - Provision IPAM
Provision Server	Pre-Create Resource	DNS	1300	OneFuse - Provision DNS
Provision Server	Pre-Create Resource	Microsoft Active Directory	1500	OneFuse - Provision AD

PreApplication

Job / Process	Trigger point name	OneFuse module	Run sequence	Plugin action name
Provision Server	Pre-Application Installation	Property Toolkit	1000	OneFuse - Property Toolkit
Provision Server	Pre-Application Installation	Scripting	1005	OneFuse - Provision Scripting
Provision Server	Pre-Application Installation	Ansible Tower	1010	OneFuse - Provision Ansible Tower
Provision Server	Pre-Application Installation	Pluggable Modules	1015	OneFuse - Provision Pluggable Module

PostProvision

Job / Process	Trigger point name	OneFuse module	Run sequence	Plugin action name
Provision Server	Post-Provision	Property Toolkit	1000	OneFuse - Property Toolkit
Provision Server	Post-Provision	Microsoft Active Directory	1005	OneFuse - Join AD Domain; OneFuse - Join AD Domain - Azure
Provision Server	Post-Provision	Scripting	1005	OneFuse - Provision Scripting
Provision Server	Post-Provision	Ansible Tower	1010	OneFuse - Provision Ansible Tower
Provision Server	Post-Provision	Pluggable Modules	1015	OneFuse - Provision Pluggable Module
Provision Server	Post-Provision	Microsoft Active Directory	1500	OneFuse - Move OU - AD
Provision Server	Post-Provision	ServiceNow CMDB	1600	OneFuse - Provision ServiceNow CMDB

PostServerModification

Job / Process	Trigger point name	OneFuse module	Run sequence	Plugin action name
Server Modification	Post-Server Modification	ServiceNow CMDB	1600	OneFuse - Update ServiceNow CMDB

PostDelete

Job / Process	Trigger point name	OneFuse module	Run sequence	Plugin action name
Delete Server	Post-Delete	Scripting	10	OneFuse - De-Provision Scripting
Delete Server	Post-Delete	Ansible Tower	15	OneFuse - De-Provision Ansible Tower
Delete Server	Post-Delete	Pluggable Modules	20	OneFuse - De-Provision Pluggable Module
Delete Server	Post-Delete	ServiceNow CMDB	1100	OneFuse - De-Provision ServiceNow CMDB
Delete Server	Post-Delete	Microsoft Active Directory	1200	OneFuse - De-Provision AD
Delete Server	Post-Delete	DNS	1300	OneFuse - De-Provision DNS
Delete Server	Post-Delete	IPAM	1400	OneFuse - De-Provision IPAM
Delete Server	Post-Delete	Naming	1500	OneFuse - De-Provision Naming

Upgrade to PostgreSQL 18

Mon, 01 Jan 0001 00:00:00 +0000

PostgreSQL 14 reaches end of life in November 2026 and will no longer receive security or bug fixes. PostgreSQL 18 is supported until November 2030.

The upgrade is optional and separate. Upgrading CMP does not upgrade the database. CMP continues to work on PostgreSQL 14 until you upgrade.
New installations use PostgreSQL 18. No action is required for a new CMP installation.
The upgrade requires downtime. CMP is unavailable while the database is upgraded, so schedule the upgrade in a maintenance window.

Upgrade scripts

The scripts are included in CMP 2026.3.97 and later, in the top level of the unpacked installer and upgrader. Run each script from that directory. The PostgreSQL 18 packages are included in the upgrader, so the scripts work on servers without internet access and on database servers without CMP installed.

What's new

Mon, 01 Jan 0001 00:00:00 +0000

September 2026

Connect AWS with Terraform

Beta, enabled on request. Organizations that cannot use CloudFormation can configure the AWS management account with a CloudBolt-provided Terraform module, downloaded from the AWS connection form, and connect it with Connect Terraform Deployment. The option is off by default; contact CloudBolt Support to enable it for your organization. The module covers the management account only, so the CloudFormation StackSet remains the recommended path. See AWS onboarding with Terraform.

AWS GovCloud (US) and AWS China

Mon, 01 Jan 0001 00:00:00 +0000

Both connect to their own AWS partition rather than the commercial one, and both are limited to that partition’s regions. Cloud Management Platform (CMP) creates one environment for each VPC in each region you import, exactly as it does for Amazon Web Services. Anything not described here, including the permissions AWS needs to grant and the AWS parameters on each environment, is on the AWS page.

What differs from a commercial AWS handler

Credentials always consist of an access key and a secret key. Neither technology offers the Credentials Type choice, so IAM Role, Roles Anywhere, ADFS, and IAM Auto Discovery are not available. You can still name an IAM Role ARN for CMP to assume.
GovCloud needs a second, commercial credential pair for billing. A GovCloud account does not maintain its own billing data; an associated commercial account does, and CMP reads the cost and usage reports using that account’s keys.
AWS China has no billing. The Billing and Reserved Instances tabs are not offered.

Set up an AWS GovCloud (US) handler

Before you start, collect four credentials: the Access Key ID and Secret Access Key for the GovCloud account, and the Commercial Access Key ID and Commercial Account Secret Access Key for the commercial account that holds the billing bucket. For billing, you also need an S3 bucket in that commercial account configured to receive cost and usage reports. See AWS Cost and Usage Reports.

AWS onboarding with Terraform

Mon, 01 Jan 0001 00:00:00 +0000

Beta, enabled on request

Terraform onboarding is off by default. CloudBolt recommends the CloudFormation StackSet deployment described in Configure AWS accounts, because it also covers member accounts. To use Terraform, contact CloudBolt Support to enable it for your organization; the Connect Terraform Deployment option then appears on the AWS connection form.

The CloudBolt Terraform module creates, in the management (payer) account, what the ManagementAccountOnly deployment of the CloudFormation template creates: an S3 bucket for the cost report exports, the CloudBolt OIDC identity provider, and the CloudBoltFocusCrossAccountRole and CloudBoltActionsCrossAccountRole IAM roles. CloudBolt then creates the FOCUS 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports itself once the connection is established.

Azure tech-specific script execution

Mon, 01 Jan 0001 00:00:00 +0000

Tech-specific script execution lets Cloud Management Platform (CMP) run remote scripts on an Azure VM it cannot reach directly over SSH or WinRM. CMP uses the Azure Run Command feature, so Azure delivers the script to the VM and reports the result back.

Prerequisites

An Azure resource handler with an environment.
An Azure account with the VMs you intend to run scripts on.

Azure imposes its own limits on what Run Command can do. See the Microsoft documentation for running PowerShell scripts on a Windows VM and shell scripts on a Linux VM, particularly the listed restrictions.

Azure VM OS Guest Patching

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) reads the VM’s current mode from Azure and offers only the modes that the VM can move to. Refer to Microsoft’s documentation on Automatic Guest Patching for more information.

Enable OS Guest Patching

The action is not installed with CMP. Import it from the Content Library first.

In the main menu, select Library, then filter Content Type to Server Actions.
Locate the OS Guest Patching server action, then select the Download icon and choose Import.
Go to an Azure server. OS Guest Patching appears with the server’s other actions, above the tabs. If the server has more than six actions, the rest are under More.
Select OS Guest Patching.
Select a New Patch Mode. Available modes depend on the Azure VM OS image and VM settings.
Select Change Mode.

Patch modes

Mode	Who applies patches
`AutomaticByPlatform`	Azure.
`AutomaticByOS`	The operating system.
`Manual`	The user.
`ImageDefault`	Determined by the OS image’s settings.

New Patch Mode never offers the current mode, and offered modes depend on the operating system. For Windows they also depend on whether the VM has automatic updates enabled, which Azure sets when the VM is created and cannot be changed afterwards.

Container orchestrators

Mon, 01 Jan 0001 00:00:00 +0000

Two technologies are supported: Kubernetes and OpenShift. A hosted service such as Google Kubernetes Engine or Azure Kubernetes Service is added as a Kubernetes orchestrator. Once a cluster is connected, a blueprint can include a container object, and CMP deploys it to the cluster and manages it alongside the rest of the resource.

Add a container orchestrator

Managing container orchestrators needs the containerorchestrator.manage permission.

Go to Admin > Container Orchestrators.
Select Add, then choose a technology.
Fill in the connection details, then select Save.

Connection details

Field	Description
Name	The name under which the orchestrator is listed.
Protocol, IP address, Port	How CMP reaches the cluster’s API.
Account username, Password	An account authorized to run commands on the cluster. OpenShift labels the username field Username and requires both.
Environments	The environments in which this orchestrator is available.

The rest of the form depends on the technology:

Custom Metrics

Mon, 01 Jan 0001 00:00:00 +0000

A custom metric is a reusable, named value computed from your existing cost fields and variables with a formula. Once defined, the metric becomes a new column that billing rulesets can use, for example, a discounted cost, a marked-up rate, or a value blended from several fields.

The Custom Metrics page is a shared library for these definitions: edit a metric once here, and every ruleset that references it picks up the change on the next pipeline run. The page provides:

Discovery/sync configuration

Mon, 01 Jan 0001 00:00:00 +0000

This is especially useful for bringing brownfield environments under management. The main component of the discovery/sync logic is the Discovery plugin. You can also choose whether an existing resource associated with the blueprint is automatically marked Historical if the Discovery plugin does not find it when it runs. The Sync Resources recurring job must be enabled for this.

Because only Super Admins can create or edit plugins, a blueprint manager who is not a Super Admin can only select an existing shared plugin to set as the Discovery plugin.

External orchestrators

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) supports two technologies: HP Operations Orchestration (HPOO) and vCenter/vRealize Orchestrator. Inputs defined on a flow appear on the order form.

External Orchestrators is disabled by default and does not appear under Admin. Contact CloudBolt to enable it on your instance.

Add an orchestrator

Go to Admin > External Orchestrators.
Select Add.
Choose the technology you are connecting to.
Fill in the connection details, then select Continue.
Give the orchestrator a Name and the folder or library path CMP should discover flows from, then select Done.

Connection details

Field	Description
Scheme	Protocol used to connect to the orchestration engine.
Host	IP address or hostname of the orchestrator.
Port	Port used to connect to it. The field is prefilled with the default port for the technology you chose.
Account	Username that runs the flows.
Password	Password for that account.

Name and flow location

Field	Description
Name	The name this orchestrator is shown under in CMP.
Base folder for discoverable flows	The folder CMP imports flows from. It must contain the workflows themselves; subfolders are not searched. Some technologies label this field as a library path.

Edit an orchestrator

The External Orchestrators page lists each connection with its Name, Technology, Username, and IP Address. Select a name to open it. From there you can:

File copy actions

Mon, 01 Jan 0001 00:00:00 +0000

A file copy action sends a text or binary file to the servers in context, which is useful for both servers being provisioned and existing ones. File copy actions can be used in blueprints, as server actions, and as orchestration actions. The action type appears as Copy File and is marked as Beta in the user interface.

File copy action fields

In addition to the fields common to all actions, a file copy action has the following:

High availability

Mon, 01 Jan 0001 00:00:00 +0000

OneFuse and CloudBolt CMP are deployed together on the same CloudBolt appliance. Refer to the CloudBolt CMP documentation for high-availability configuration:

Set up high availability
Upgrade with high availability

Miscellaneous settings

Mon, 01 Jan 0001 00:00:00 +0000

The Admin > Miscellaneous Settings page is divided into five tabs, and a search box above them filters across all tabs. Within a tab, toggles save once changed. Other settings are read-only until you select Edit, which opens a dialog that saves on submission.

Sessions, single sign-on, embedded mode, and legal notices.

Setting	Default	Description
Automatically Login to SSO	Disabled	Redirects users to the configured SSO provider for login instead of showing the CMP login form.
Display Legal Notice on every Login	Enabled	Shows the Legal Notice Text after every login. Disable it to show the notice to each user only once.
Require New Users to Self-Assign Passwords	Disabled	Sends a password-reset email to each newly created user so they can set their own password, rather than an admin assigning one. See Create a user.
Enforce Single Sessions for Users	Disabled	Logs a user out of their first session when they log in from a second browser or location.
Require User Email Verification	Enabled	Sends a verification email automatically whenever a user’s email address changes.
Disable Edit Email By User	Disabled	Prevents users from changing their own email address in Manage profile.
Show ResourceType for Profile	Disabled	Limits the resource types a user sees to those with at least one resource visible to that user.
Embedded Mode	Disabled	Allows CMP to render inside an iframe without the navigation bar. Set Embed URLs / Frame Ancestors and Allowed Global Roles in Embedded Mode to finish the configuration. See Embed in ServiceNow.
Hide ‘Domain’ dropdown	Disabled	Removes the Domain dropdown from the login page. Domain users then log in with `username@domain` in the Username field.

Setting	Default	Description
Allowed Global Roles in Embedded Mode	Super Admin	The global roles that reach CMP directly while Embedded Mode is enabled: Super Admin, Devops Admin, or Global Viewer. Everyone else is redirected to the same page with `?frame=true` appended. Super Admin must always be included. See Global roles.
Embed URLs / Frame Ancestors	Empty	A space-separated list of the parent sites allowed to embed CMP in an iframe. It sets the frame-ancestors directive in the appliance’s Content-Security-Policy. Entries can mix formats: `example.com`, `*.example.com`, or a full URL with a port and path.
Legal Notice Text	Empty	Text shown to users at login. They must select Agree to continue; Disagree logs them out. Leave the field blank to turn the notice off.
Default Redirect (restart Web Server)	/dashboard/	Where CMP sends a user who navigates to the site root or selects the logo in the navigation bar. Other common values are `/catalog/` and `/servers/`. Restart the web server for a change to take effect.

UI

Branding, navigation links, security messaging, and inactivity timeouts.

Okta identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Complete Set up SSO and SAML and Configure the identity provider.
Capture the IdP XML metadata.
Create at least one branded portal for this SSO provider.
Have an Okta administrator account that can create an application and add users.
Have an Okta organization.

Add the Okta SSO provider in CMP

Log in to CMP as an administrator.
Select Admin > Single Sign-On (SSO).
Select Add > Okta.
Complete the SAML settings form.

You need the Single Sign-On URL and Metadata URL / Entity ID for the Okta application.

Orchestration actions as code

Mon, 01 Jan 0001 00:00:00 +0000

Once an orchestration action is linked to a repository, you can push it, preview the changes, and later refresh the action from the repository. You can also create an action from one already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh an orchestration action

Open the action from Admin > Orchestration Actions, then select its repository tab. The tab is named Repository until the action is linked to a repository; then it is named GitHub or GitLab.

Preconfigurations

Mon, 01 Jan 0001 00:00:00 +0000

A user selects a single named option that applies a combination of settings.

Create a preconfiguration

Go to Admin > Preconfigurations.
Select New preconfiguration.
Enter a Label and Name for the preconfiguration.
Select Include OS build, Include applications, or both, to offer those options as part of the preconfiguration.
From the Custom fields list, select the parameters to include, such as CPUs, Mem Size, and Disk Size. You can select more than one.
Select Create.

(opens full-size image in a new tab)

Reports

Mon, 01 Jan 0001 00:00:00 +0000

Select Reports in the navigation bar to open the Reports page. Results are scoped to the groups and environments you have permission to see.

Who can see the Reports page

The Reports link appears in the navigation bar for:

Super Admins.
Users with the Global Viewer global role.
Everyone else, when the Show “Reports” in navigation bar for all Users setting is enabled in the UI tab of Admin > Miscellaneous Settings. This setting is disabled by default.

Users who do not qualify cannot reach report URLs directly.

Resources for writing plugins

Mon, 01 Jan 0001 00:00:00 +0000

Interact with the data model

Cloud Management Platform (CMP) has an interactive shell, allowing you to try a query before putting it in a plugin. Open an SSH session to the CMP appliance, switch to the root user, then start the shell_plus management command. It opens an interactive Python shell with all of the models already imported. From there you can work with them directly:

# Reboot the server with hostname "devtest0032"
server = Server.objects.get(hostname="devtest0032")
server.reboot()

# Re-assign all of David's servers to Lisa
lisa = UserProfile.objects.get(user__username='lisa')
Server.objects.filter(owner__user__username='david').update(owner=lisa)

# Get OS build attributes whose template name matches "ubuntu_16_sqaqe03_green".
# This filter is case insensitive, so it can return several results when
# template names differ only by capitalization.
rh = ResourceHandler.objects.get(id=11)
rh.os_build_attributes.filter(template_name__iexact='ubuntu_16_sqaqe03_green')

The internal API can be destructive, both to CMP and to the servers it manages. Do plugin development on a non-production instance that manages only development servers.

Shared modules

Mon, 01 Jan 0001 00:00:00 +0000

A shared module is a Python file that CMP stores on the appliance and makes available to all plugins, and to other shared modules. Shared modules live at Admin > Shared Modules, and only CloudBolt admins can manage them. Typical candidates are generated parameter options reused across blueprints and a class that handles connecting to an external API.

Create a shared module

Go to Admin > Shared Modules.
Select Add > Create New. The same menu offers Create from Repository, which pulls the module from a source code repository, and Upload Shared Module for an exported one.

(opens full-size image in a new tab)
Provide a Label and Module Name. The module name becomes the Python file name and the name you import, so use a valid Python identifier such as generated_options.
Select Upload a script file now, or Fetch from URL and provide a file or URL, or select Enter code later.
Select Save.

(opens full-size image in a new tab)

SolarWinds IPAM

Mon, 01 Jan 0001 00:00:00 +0000

The OneFuse SolarWinds IPAM module enables organizations who utilize SolarWinds for centralized IP address management to fully automate obtaining and releasing IP addresses as the cloud environment dynamically scales. IP subnets can now easily be shared between deployments and alongside existing tools and devices without fear of IP conflict.

License required

This Module requires the SolarWinds IPAM License in order to execute a SolarWinds IPAM Policy. SolarWinds IPAM Policies, Endpoints, and Module Credentials can be created without a license.

SSH keys

Mon, 01 Jan 0001 00:00:00 +0000

CMP needs the private key material for the key pair a server accepts before it can open an SSH session to that server, whether to provision it, run a remote script, or connect to it later.

Keys from a resource handler

Several clouds create and hold key pairs, and a server built there accepts the pair it was created with. These resource handlers have an SSH Keys tab listing the key pairs CMP found in the provider:

Tag Analysis

Mon, 01 Jan 0001 00:00:00 +0000

Rather than simply considering tagged vs. untagged resources, Tag Analysis shows the cost impact of tagging gaps, helping you to prioritize remediation where it matters most.

Cloud resource tags are essential for cost allocation, governance, and operational management. Tag Analysis answers key questions:

How much of my cloud spend is untagged? See the total cost exposure from missing tags.
Which tag keys have the best (and worst) coverage? Identify gaps in your tagging strategy.
Where should I focus remediation? Prioritize by cost impact, not resource count.
Are we improving over time? Compare coverage across time periods.

Tag Analysis works across all connected cloud providers (AWS, Azure, and GCP) and uses your FOCUS billing data as the primary data source, ensuring all taggable spend is accounted for.

Templating

Mon, 01 Jan 0001 00:00:00 +0000

To learn more, refer to the Templating guide and Property Toolkit features.

Example

When requesting a VM, the requester chooses a value for the Environment field. Using templating, you can use the variable Environment and apply further logic to create a dynamic result.

{# Environment variable has two options on the request: "Development" and "Production" #}

{# Requester selects "Development" for Request 1 #}
{# We will print the variable Environment below #}

{{ Environment }}

=> "Development"

{# Requester selects "Production" for Request 2 #}
{# We will print the variable Environment below #}

{{ Environment }}

=> "Production"

{# Requester selects "Production" for Request 3 #}
{# You can further manipulate the variable using Filters #}
{#
  We will print the variable Environment below with the "first" and "lower" filters
  - The "first" Filter will get the first letter of the variable
  - The "lower" Filter will lowercase the result of the variable after the previous filter is applied
#}

{{ Environment | first | lower }}

=> "p"

Templating in policies

Policies allow for templating where it matters to achieve sophisticated use cases quickly without lines of custom code. When a policy is executed from an upstream provider, script or self-service API call, the user can pass in properties to drive the desired configuration output.

Upgrading to Release 2026.3

Mon, 01 Jan 0001 00:00:00 +0000

Release 2026.3.51 moves the Cloud Management Platform (CMP) interface from Bootstrap 3 to Bootstrap 5. Bootstrap 3 is no longer supported, and no compatibility layer is provided. This page covers what changed and how to migrate custom templates, UI extensions, and JavaScript.

Who this affects

This page applies to you if you maintain any of the following:

Custom Django templates in /var/opt/cloudbolt/proserv/ that extend base.html or any CMP template
UI extensions (XUIs) you wrote yourself, or modified after installing
Custom JavaScript that calls c2.* functions

CloudBolt UI extensions

CloudBolt UI extensions have been updated for Bootstrap 5 and republished in the Content Library. If an updated version is not listed yet, refresh the Library listing.

Veeam UI extension

Mon, 01 Jan 0001 00:00:00 +0000

Each server then gains a Veeam tab for backups and restores to AWS or Azure.

Veeam has its own admin page and server tab, and it does not use the Data Protection Plan parameter or the Data Protection tab.

Prerequisites

A running Veeam Backup Enterprise Manager that CMP can reach. CMP talks to its REST API, which listens on port 9399 by default.
An Enterprise Manager account, with its username and password.
CMP administrator access for both the Library and the extension’s admin page.

Install the extension

In the main menu, select Library.
Type Veeam in the search field, or browse to UI Extensions.
Select Veeam, then select Import.

CMP takes you to the Extensions Management page, which you can reach later from Admin > Manage UI Extensions.

API personal access token

Mon, 01 Jan 0001 00:00:00 +0000

This is useful when you implement SSO and your users cannot authenticate with a username and password.

Create a personal API access token

On your user profile page, select Create API Token.

(opens full-size image in a new tab)
In the dialog, select the number of days for token expiration and select Create.

(opens full-size image in a new tab)
The API access token is created. Use the icons to the right of the masked token to copy, regenerate, or delete it.

(opens full-size image in a new tab)

Backup and restore

Mon, 01 Jan 0001 00:00:00 +0000

Back up the OneFuse appliance

The steps below assume a single OVA instance. If you use an HA setup, adapt these steps to restore the necessary files and database to the appropriate locations.

Any backup tool or strategy of the Enterprise can be used for the OneFuse appliance.

The critical data needed from the appliance are as follows:

Create a backup of the cloudbolt database:

PostgreSQL:

# Execute the following command on the appliance
# Replace '/tmp/' with the desired directory

export PGPASSWORD=${postgresql_pass}
pg_dump -h localhost -p 5432 -U cb_dba -w --clean -F t -f /tmp/cloudbolt.tar cloudbolt

# The database will get backed up to the /tmp folder as file name: cloudbolt.tar

Create a backup of the following directories:

Path	Location (for non-monolithic installs)
`/var/opt/cloudbolt`	All nodes
`/var/log/cloudbolt/jobs`	All nodes running Job Engine role
`/var/www/html/cloudbolt/static`	All nodes running Web Server role

Commitments

Mon, 01 Jan 0001 00:00:00 +0000

Track what you’ve purchased, how well those commitments are being used, how much you’re saving, and where money is being wasted.

Commitments has a page per cloud: Commitments (AWS) and Azure Commitments, each with five tabs: Dashboard, Inventory, Savings, Waste, and Performance. Most views offer a Time Range selector (1, 3, 6, or 12 months) and, where relevant, a Billing Account filter that scopes data to one payer account.

Key terms: Utilization is the share of purchased commitment capacity actually consumed. Coverage is the share of eligible spend covered by commitments. Waste is commitment capacity paid for but unused. Net Savings = gross savings (list cost minus effective cost) minus waste.

Cost Allocation

Mon, 01 Jan 0001 00:00:00 +0000

Cost-allocation rules distribute shared costs, such as support charges or shared infrastructure, across the workloads that consume them, without changing the underlying billing records. The Cost Allocation page hosts the Custom Distribution Rules that define this behavior. It provides:

Distribution rules: Create rules that take a pool of shared cost and spread it to the right consumers.
Allocation strategies: Split costs equally, proportionally by spend, or proportionally by usage.
Filters: Define which cost rows are allocated and which workloads receive them.
Ordering: Control the sequence in which rules execute.

This page covers non-Kubernetes costs. Kubernetes cost allocation is handled in the Kubernetes Report.

Hyper-V

Mon, 01 Jan 0001 00:00:00 +0000

CMP discovers the virtual machines already on the instance, provisions new ones, customizes Windows and Linux guests, manages their disks and networks, and runs scripts against them.

Supported versions

Windows Server 2025
Windows Server 2022
Windows Server 2019
Windows Server 2016

Before you begin

What CMP connects to depends on whether the instance is standalone or clustered.

Standalone instances

Use an IP address or DNS name that the CMP appliance can resolve.
Firewall rules must allow WinRM, typically on port 5985 or 5986.

Clustered instances

Use the cluster’s IP address or hostname, not that of an individual node.
If you use a hostname or an alias, configure DNS or hostname resolution on the CMP appliance.
The WinRM protocol and transport you choose must be enabled on every cluster node.

Certificates for SSL Verification

SSL Verification works only when each cluster node has a valid certificate. Run winrm get winrm/config/Service on a node: the CertificateThumbprint property shows whether a certificate is configured.

Import AMIs

Mon, 01 Jan 0001 00:00:00 +0000

CMP first syncs the AMIs available in AWS into its own list; then you pick from that list. Everything happens on the AMIs tab of an AWS resource handler.

Sync AMIs from AWS

Until AMIs have been synced, the import dialogs report that no AMIs are available.

Go to Admin > Resource Handlers and open the AWS handler.
Go to the AMIs tab and select Sync AMIs.
Under AMIs Type, select Private AMIs or Public AMIs.
Select the Regions to sync. Only regions already imported for this handler are listed.
For public AMIs, leave Sync Whitelist AMIs selected unless you need the full list. AWS publishes a large number of public AMIs, and syncing them all takes 15 minutes or more per region.
Select Sync AMIs. CMP starts a job; open it to follow progress.

(opens full-size image in a new tab)

Markdown support

Mon, 01 Jan 0001 00:00:00 +0000

Supported syntax

Cloud Management Platform supports the following Markdown syntax:

Name	Syntax	What it looks like
Headers	`# Header 1` `## Header 2` `### Header 3`	(opens full-size image in a new tab)
Bold text	`bold text`	bold text
Italicized text	`Italicized text`	Italicized text
Link	`[Link Title](https://www.example.com)`	Link Title
Inline code snippets	`Code`	`Code`
Code blocks	``` `{` `"FirstName":"John",` `"lastname":"Smith",` `"age":25` `}` ```	(opens full-size image in a new tab)
Ordered lists	`1. First Item` `2. Second Item` `3. Third Item`	1. First Item 2. Second Item 3. Third Item
Unordered lists	`- First Item` `- Second Item` `- Third Item`	- First Item - Second Item - Third Item
Horizontal rule	`---`	(A thin horizontal line across the full width of the description)

Unsupported Markdown

Cloud Management Platform does not interpret any other Markdown, including but not limited to:

Notifications

Mon, 01 Jan 0001 00:00:00 +0000

OneFuse Pluggable Module: Notifications

Pluggable Module Name is Notifications

Feature highlights

Send flexible email notifications
Notification email subject, body, and addresses can consist of a mix of static text and dynamic content such as properties and/or custom logic
SMTP servers are defined independently of notifications
SMTP configurations, message content, and recipients can leverage property sets for ease of management of dynamic content

Prerequisites

Create a OneFuse Service Account for the SMTP server(s) used for Notifications.
If the OneFuse Appliance does not have an internet connection, follow the instructions in the section below.

OneFuse Appliance without internet connection

Perform the following only if the OneFuse Appliance does not have an internet connection.

OCI tech-specific script execution

Mon, 01 Jan 0001 00:00:00 +0000

In Cloud Management Platform (CMP), this is an alternative to SSH, controlled by a server parameter. When enabled, ad hoc scripts are executed by the Oracle Cloud Agent running on the instance rather than over an SSH connection.

This method provides additional security; however, due to the Oracle Cloud Agent’s polling interval, it is slower than SSH.

How it works

The Oracle Cloud Agent polls for queued commands approximately every 90 seconds. When CMP submits a script to run on an OCI server with tech-specific script execution enabled, the command is added to the Oracle Cloud Agent’s queue. The agent picks up the command on its next poll, executes the script, and returns the output.

OneLogin identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Complete Set up SSO and SAML and Configure the identity provider.
Capture the IdP XML metadata.
Create at least one branded portal for this SSO provider.
Have a OneLogin administrator account that can create applications and add users.
Have a OneLogin organization.

Add the OneLogin SSO provider in CMP

Log in to CMP as an administrator.
Select Admin > Single Sign-On (SSO).
Select Add > Generic SAML Provider.
Complete the SAML settings form.

You need the Single Sign-On URL and Metadata URL / Entity ID for the OneLogin application setup below.

Parameters list

Mon, 01 Jan 0001 00:00:00 +0000

The following parameters need to exist on the CloudBolt Blueprint to ensure the desired OneFuse Modules are called for the resource.

Learn more about parameters for Blueprints, Environments, and Groups.

Ansible Tower

Parameter Name Format Parameter Value Format

OneFuse_AnsibleTowerPolicy_<ExecutionString>_<CustomID>

- Replace <ExecutionString> with an appropriate Trigger Point state
- Replace <CustomID> with a unique, user-defined friendly label. <OneFuse Connection Info Name>:<Ansible Tower Policy Name>:<Ansible Tower Host>:<Ansible Tower Limit>

- (Optional) <Ansible Tower Host> is a specific Hostname (FQDN) or IP Address of the Host to add to the Ansible Tower Inventory.
- (Optional) <Ansible Tower Limit> is a valid Limit definition to pass to Ansible Tower. This can be a specific Hostname (FQDN) or IP Address or any valid Limit pattern. See Patterns: targeting hosts and groups.

It is recommended to insert a required filter for the <Ansible Tower Limit>. When left blank, it will execute an Ansible Tower Job on the entire Ansible Host Inventory. Refer to the example below.

Example parameter:

Recurring jobs as code

Mon, 01 Jan 0001 00:00:00 +0000

A recurring job that runs an action can be pushed to a repository and refreshed from it later, and you can add a recurring job from an action already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh a recurring job

Open the job from Admin > Recurring Jobs, then select its repository tab. The tab is named Repository until the job is linked to a repository; then it is named GitHub or GitLab.

Remote server access

Mon, 01 Jan 0001 00:00:00 +0000

CMP offers three ways to reach a server remotely, without leaving the browser:

Console: direct hypervisor console access, available on console-capable resource handlers.
Remote Desktop (RDP): graphical access to Windows servers.
SSH: terminal access to servers that support SSH.

When the requirements for a method are met, a Console, Remote Desktop, or SSH button appears on the server’s details page. Select a button to open the connection in a new browser tab.

Required Azure permissions

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) works entirely through Azure Resource Manager. Register the application as described in Configure the Azure portal, then assign it one of the roles below at subscription scope. A role scoped to individual resource groups cannot read what CMP needs from the subscription as a whole: existing servers to discover, available regions and virtual machine sizes, stored SSH public keys, and cost.

Contributor

Assign the built-in Contributor role to the application at subscription scope. It covers everything CMP does: creating and deleting virtual machines, disks, network interfaces, security groups, public IP addresses, storage accounts, availability sets, and resource groups; power actions; resizing; snapshots; load balancers; tagging; cost; and utilization metrics.

System status

Mon, 01 Jan 0001 00:00:00 +0000

Go to Admin > System Status. The page is limited to CB Admins and Super Admins.

(opens full-size image in a new tab)

Admin-only mode

Under CloudBolt Mode, Enable admin-only mode stops anyone who is not a CMP admin from logging in or using CMP until disabled. The button becomes Disable admin-only mode while enabled.

Jobs are unaffected, including scheduled and recurring ones. To stop those, use maintenance mode.

Upstream providers

Mon, 01 Jan 0001 00:00:00 +0000

To learn more, refer to What is an upstream provider?

Use Django ORM

Mon, 01 Jan 0001 00:00:00 +0000

CMP’s models are exposed through Django’s object-relational mapper. Rather than looking up table and field names for SQL statements, you express create, read, update, and delete operations as Python, which makes them straightforward to script from a plugin or the interactive shell.

Queries become Python

For example, this SQL statement:

SELECT * FROM infrastructure_server;

becomes:

Server.objects.all()

Iterate results directly

Instead of loading a recordset from a database driver and stepping through it, you iterate the queryset with ordinary Python constructs.

Azure resource handler for multiple cloud subscriptions

Mon, 01 Jan 0001 00:00:00 +0000

Create one Azure resource handler as described in Azure, then import the rest. Cloud Management Platform (CMP) reads the subscriptions the application can access and creates a handler for each one you select, reusing that handler’s credentials.

Create a custom role in Azure

Contributor on each subscription covers everything CMP does; see Required Azure permissions. To grant less than that, create a custom role with the permissions CMP uses and assign it.

IBM Cloud

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) connects through the IBM Cloud classic infrastructure API. Import data centers into CMP, and each one becomes an environment that users can order into.

Before you begin

An IBM Cloud account on at least a Pay-as-you-go plan.
A classic infrastructure API key, and the account ID it belongs to. For how to create and find one, see Managing user API keys in the IBM Cloud documentation.
Outbound access to api.softlayer.com, or to api.service.usgov.softlayer.com for IBM Cloud for Government.

Add an IBM Cloud resource handler

Go to Admin > Resource Handlers, select Add, then select IBM Cloud under Public Cloud.
Enter the account ID in API Username.
Enter the key in API Key. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed; select Vault Managed to read the key from a configured vault provider. Select Continue.

(opens full-size image in a new tab)
Enter a name for the handler, choose the data centers to bring in under Import IBM Cloud datacenters, then select Done.

OS-specific requirements

Mon, 01 Jan 0001 00:00:00 +0000

These requirements apply to the generic execution method. A server that runs scripts through its platform’s own mechanism, such as a VMware server using VMware Tools, does not need them. See Configure remote script method.

*nix servers using SSH

Cloud Management Platform (CMP) copies the script to the server and runs it over SSH. For that to work:

The server’s IP address must be routable from the CMP appliance. In public cloud environments, this often means using a public IP address.
CMP must know the server’s IP address, usually because CMP provisioned it or the resource handler reports it.
TCP port 22 must be open. Test this by opening an SSH session from the CMP appliance to the server.
sshd must be installed and running on the server, with password authentication enabled in its configuration if you authenticate by password.
The package providing the scp client must be installed on the server: openssh-clients on CentOS and RHEL, openssh-client on Debian and Ubuntu, or the equivalent.

If scripts fail due to a permissions error, point CMP to a directory the connecting user owns, such as a path under that user’s home directory, instead of the default temporary directory. Change it in Admin > Miscellaneous Settings > Resource management tab > *nix Temporary Directory for Remote Scripts, and verify that the ownership and permissions on that directory are correct.

PingOne for Enterprise identity provider

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Create at least one branded portal for this SSO provider. Its URL determines the metadata and ACS URL.
Have an administrator account in PingOne for Enterprise that can create an application and add users.
Have a PingOne organization.

PingOne also offers a similar product, PingIdentity SSO. CMP can integrate with it as well, but this guide covers PingOne for Enterprise specifically.

Set up PingOne in CMP

In CMP, log in as an administrator.
Select Admin > Single Sign-On (SSO).
Select Add > Generic SAML Provider.
Complete the SAML settings form, selecting the branded portal for this provider.
Select Create.
Copy and store the Single Sign-On URL and Metadata URL / Entity ID, and select Download Metadata XML. You use these later during PingOne setup.

Create the PingOne application

Connect to the PingOne directory

Log in to the PingOne for Enterprise web interface.
In the top navigation menu, select Setup > Identity Repository > Connect to an Identity Repository.
1. For Connect to an Identity Repository, select PingOne Directory, then select Next.
2. After the directory is configured, select Next.
3. Make note of the Map Attributes; you use them later.
Select Finished.

Add the PingOne SAML application

In the top navigation menu, select Applications > Add Application > Search Application Catalog.
Search for “Ping”, then select the arrow next to Ping IDaaS Directory Provisioner > Setup.

(opens full-size image in a new tab)

Recommendations

Mon, 01 Jan 0001 00:00:00 +0000

The Recommendations page surfaces actionable opportunities to reduce your cloud spend, with a page per cloud: AWS recommendations come from AWS Cost Optimization Hub, and Azure recommendations come from Azure Advisor.

Each recommendation identifies a specific resource that could be optimized, shows the estimated monthly savings, and describes what action to take. Recommendations are informational: changes are made in your cloud provider, not from this page.

AWS savings figures are estimated on a before-discount (list price) basis. Azure monthly savings are derived from Advisor’s annual savings figure.

Resource actions

Mon, 01 Jan 0001 00:00:00 +0000

A resource action puts a button on the detail page of a deployed resource. When a user selects it, it runs an action of any of the six action types. Administrators create them in Cloud Management Platform (CMP) at Admin > Resource Actions.

What resource actions can do

A resource action can run scripts on all or a subset of the server tiers in the resource, call an integration, email users, or run code that reads and writes information to and from the resource via the CMP database. Browse the Content Library or the CloudBolt Forge to see examples.

Resource actions as code

Mon, 01 Jan 0001 00:00:00 +0000

Once a resource action is linked to a repository, you can push it, preview the changes, and later refresh the action from the repository. You can also create an action from one already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh a resource action

Open the action from Admin > Resource Actions, then select its repository tab. The tab is named Repository until the action is linked to a repository; then it is named GitHub or GitLab.

Snapshots

Mon, 01 Jan 0001 00:00:00 +0000

A snapshot records the state of a server’s disk (but not its virtual memory) at the moment it is taken. Snapshots are useful during development: if something goes wrong, you can revert the server to the saved state.

CMP can create and revert snapshots on the following server types:

VMware vCenter
Nutanix Acropolis
Microsoft Azure
Amazon Web Services (AWS)
OpenStack
SCVMM
Oracle Linux Virtualization Manager (OLVM)
H3C CAS
OpenShift Virtualization (create only)

CMP manages one snapshot per server at a time. You can also install the Scheduled Snapshots extension to take snapshots automatically and retain several. See Schedule snapshots.

Terraform operations

Mon, 01 Jan 0001 00:00:00 +0000

A Terraform Operation is a blueprint build item that points to a Terraform source, such as a zip file, a git repository, or a URL. When the blueprint is ordered, Cloud Management Platform (CMP) runs that source, stores the resulting state, and creates a resource representing what Terraform built. Values pass from CMP into Terraform through variable maps.

Add a Terraform Operation to a blueprint

Open Catalog and select the blueprint.
Open the Build tab.
Select Terraform Operation.

(opens full-size image in a new tab)
Complete the dialog and save.

Theme configurations

Mon, 01 Jan 0001 00:00:00 +0000

Themes live at Admin > Theme Configurations, where you can add a new theme or clone an existing one to start. Each portal has a Default Theme and can also have an Alternate Theme, and a single theme can serve multiple portals.

(opens full-size image in a new tab)

Theme settings

Open a theme and edit it to set its name and layout.

Use password vaults

Mon, 01 Jan 0001 00:00:00 +0000

The following solutions are supported:

🔐 AWS Secrets Manager
🔐 Azure Key Vault
🔐 CyberArk
🔐 HashiCorp Vault
🔐 Keeper

This guide details the HashiCorp Vault integration. AWS Secrets Manager, Azure Key Vault, CyberArk, and Keeper follow a similar workflow: enable the feature flag, add the provider under Admin > Password Vaults, then reference stored secrets from a supported password field.

When the vault feature is enabled, password and secret fields offer Locally Stored or Vault Managed. These fields appear on resource handlers, connection info, IPAM, ITSM, data protection, network virtualization, LDAP, and source code repositories.

Virtual Tags

Mon, 01 Jan 0001 00:00:00 +0000

A virtual tag applies tag key/value pairs to cost rows that match conditions you define. Virtual tags enrich your cost data without changing the underlying records and without re-tagging resources in the cloud provider. They apply tenant-wide. The page provides:

Tag mappings: Rules that pair one or more tags with the match conditions that select cost rows.
Sub-rules: Nested mappings that refine a parent mapping for finer-grained control.
Tenant-wide scope: Mappings apply across the tenant to standardize tagging in reports.
Enrichment: Fill gaps where native provider tags are missing or inconsistent.

Access the Virtual Tags page

Log in to the CloudBolt Platform.
In the sidebar, select Settings.
Select Virtual Tags.
If this is your first time here, select Create Virtual Tag Ruleset. The mappings list appears once it’s created.

Virtual Tags overview

Section	Description
Search	Filter the list by tag key or value (Search by tag key or value…).
Mappings list	Your virtual-tag mappings, with a count of how many are defined. Mappings can nest: use Add sub-rule to create child mappings under a parent.
Add Virtual Tag	Opens the dialog to create a new mapping.

Add a virtual tag

Select Add Virtual Tag.
In the Tags section, add one or more Tag Key / Tag Value pairs to apply. Keys autocomplete from existing keys; duplicate keys at the same level are rejected.
In the Match Conditions section, add the conditions that select which cost rows receive the tags.
Save the mapping.

Each match condition is a Field, an operator, and a Value. Available operators are Equals, Not Equals, In, Not In, Greater Than or Equal, Less Than or Equal, Contains, Not Contains, and Regex. With several conditions, choose Match all or Match any. For Equals/In-style operators, values autocomplete from actual billing values.

Workspace

Mon, 01 Jan 0001 00:00:00 +0000

Workspaces keep users and policies in one centralized space. They grow with your team and provide role-based access control (RBAC), giving users a clear division to automate responsibly.

Workspace: default

OneFuse creates a single default Workspace during initial setup. Support for additional workspaces is planned for a future release.

Cache vault secrets

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) can store credentials and other sensitive values in an external secrets manager (a vault provider) instead of in the CMP database. When CMP needs one of these values, it resolves it by calling the provider’s API.

By default, every access to a vault-backed value calls the provider. Environments that read these values frequently can approach or exceed the provider’s rate or quota limits.

Secret caching lets an administrator cache a resolved secret for a configurable time-to-live (TTL). While a cached value is within its TTL, CMP serves it directly from the cache without calling the provider, reducing API traffic and speeding up resolution.

IPMI

Mon, 01 Jan 0001 00:00:00 +0000

The handler holds no connection details. Each server has its own IPMI address and credentials, which CMP uses to send power commands to that server’s BMC. CMP supports one IPMI resource handler per installation, so the IPMI tile is hidden once one exists.

Add an IPMI resource handler

Go to Admin > Resource Handlers, select Add, then select IPMI.
In the Add an IPMI Resource Handler dialog, enter a Name and, optionally, a Description.
Leave the remaining fields empty. Stop if server on applies only to builds that network-boot the server.
Select Done.

Create an environment

CMP does not create an environment for the IPMI resource handler. Create one so servers can be ordered:

Manage budgets

Mon, 01 Jan 0001 00:00:00 +0000

The Budgets settings page is where budgets are created, edited, and deleted. To view budget performance, use the Budgets page in the sidebar.

Budgets come in two kinds:

Budget: an individual budget with its own monthly targets and optional filters that narrow which costs count against it.
Rollup: a parent budget that aggregates its children. Rollups carry no targets or filters of their own; their numbers are the sums of their child budgets.

Access the Budgets settings page

Log in to the CloudBolt Platform.
In the sidebar, select Settings.
Select Budgets.

Create a budget

Select Create budget.
Enter a Name (required; budget names must be unique within the organization) and, optionally, a Description.
Set the Currency as a 3-letter ISO code (default USD).
To make this a parent that aggregates other budgets, turn on Rollup budget. Rollups skip the remaining steps: the Periods and Filters sections apply to individual budgets only.
Optionally choose a Parent rollup budget to place this budget in a hierarchy.
Add Periods to set the monthly target: each period is a Month and an Amount, and each amount applies from its month forward until the next period. You only need a new period when the target changes.
Add Filters to narrow which costs count against the budget: each filter is a Field, an Operator (EQUALS, NOT_EQUALS, CONTAINS, or NOT_CONTAINS), and a Value. With no filters, the budget applies to all costs in the organization.
Select Create.

Budget hierarchies can be up to 10 levels deep, and a budget’s parent must be a rollup budget.

Examples

Mon, 01 Jan 0001 00:00:00 +0000

Expire a user password

Expires the named user’s password, so that the user must set a new one at next login. Replace cbuser with the account you want to expire.

#!/bin/bash
passwd --expire cbuser

Join a Windows server to an OU

On a Windows server, this executes as PowerShell and joins the server to the given domain and organizational unit. Replace the domain, OU, and account values with your own.

Security

Mon, 01 Jan 0001 00:00:00 +0000

The Security section brings your cloud security and compliance posture into the CloudBolt Platform. Each configured cloud provider (AWS and Azure) gets its own Security & Compliance page with two tabs: Findings (the default) and Compliance. A shared Suppressions page covers both clouds. The Security section lets you:

Review findings: Browse, filter, and export security findings across your connected accounts and subscriptions, with severity and type breakdowns at a glance.
Track compliance: See per-framework compliance scores, a 30-day trend, and the controls that are failing.
Suppress findings: Mute individual findings that are accepted risks or false positives, and manage all active suppressions in one place.

Security & Compliance is enabled per tenant. If you see Security & Compliance isn’t enabled for your account, contact CloudBolt to enable it.

Server actions

Mon, 01 Jan 0001 00:00:00 +0000

A server action appears as a button on a server’s detail view and runs an action of any of the six action types. When a user runs one, Cloud Management Platform (CMP) prompts for any inputs the action needs and then creates a job to run it asynchronously. The job also serves as the audit trail of who ran what, against which server, and when. The equivalent for deployed resources is a resource action.

Server actions as code

Mon, 01 Jan 0001 00:00:00 +0000

Once a server action is linked to a repository, you can push it, preview the changes, and later refresh the action from the repository. You can also create an action from one already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh a server action

Open the action from Admin > Server Actions, then select its repository tab. The tab is named Repository until the action is linked to a repository; then it is named GitHub or GitLab.

SSO group mapping

Mon, 01 Jan 0001 00:00:00 +0000

Group mapping eliminates the need for a CMP administrator to manually configure roles and permissions after each SSO login.

Before you begin

Ensure that:

Your SSO IdP is configured.
CMP is connected to your SSO IdP.
Groups and users are configured in your SSO IdP.
You have a list of the SSO IdP group IDs.

Create a group mapping

Map a user group from your SSO IdP to CMP.

Log in to CMP as an administrator.
Go to Admin > Single Sign-On (SSO).

(opens full-size image in a new tab)
Select your SSO IdP.
Select the Mapping tab.
Select New SSO Mapping.

(opens full-size image in a new tab)
Provide the Group Identifier.

This must match the group ID from your SSO IdP.
Enter a Group Display Name.
Grant the global roles (Super Admin, Devops Admin, Global Viewer) as required.
Assign Admin Roles as required.
Select Save.

Using HTML in descriptions

Mon, 01 Jan 0001 00:00:00 +0000

Most description fields in Cloud Management Platform (CMP) accept simple HTML without any configuration. To display more advanced HTML, such as style tags or attributes, you have to override one or more settings in customer_settings.py.

CMP sanitizes user-supplied HTML with the Python library bleach, using its clean method. Four settings control what survives sanitizing. Three of them map directly to keyword arguments of bleach.clean; the fourth configures bleach’s CSS sanitizer.

Import a setting before changing part of it. customer_settings.py is loaded as a module of its own, so a line that edits an entry of a setting the file has not imported raises an error and CMP does not start. Replacing a setting outright needs no import.

Ansible Tower

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Ansible Tower.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: ansible_tower

present

Run Provisioning Job Template(s) configured on the OneFuse Ansible Tower Policy.

Sample Play

- name: OneFuse Ansible Tower - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
  tasks:
  - name: Run Ansible Tower Provisioning Job Template(s)
    onefuse:
      module: ansible_tower
      state: present
      policy_name: '{{ policy_name }}'
      limit: ''
      hosts: ''
      template_properties: {}
      tracking_id: '{{ tracking_id  | default(omit) }}'
    delegate_to: localhost
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Ansible Tower Outputs to workflow"
    set_stats:
        data:
         onefuse_ansible_tower: '{{ onefuse_ansible_tower }}'
         tracking_id: '{{ tracking_id }}'

Parameter references

The following defines the function of each Ansible Tower specific Task Parameters for onefuse.

Best practices

Mon, 01 Jan 0001 00:00:00 +0000

The CloudBolt OneFuse Platform leverages the Jinja2 templating language to allow our customers to define logic around how a module is to be consumed inside of a OneFuse Policy. These templates can be extremely powerful and can define very granularly exactly how OneFuse Policies should be consumed by an Upstream Provider.

However, the OneFuse Platform was designed to simplify your automation journey, so these best practices will help to better define how to mitigate complexity when building OneFuse Policies.

Environment selection orchestration

Mon, 01 Jan 0001 00:00:00 +0000

A server tier in a blueprint can hand the choice of target Environment, OS Build, and additional Parameters to a plugin that runs at order time. Set this on the tier’s Environment Selection Orchestration attribute. Cloud Management Platform (CMP) then calls your plugin and provisions accordingly.

Set it on a server tier

Go to Catalog.
Edit a blueprint that has a server tier.
Open the Build tab.
Expand the server tier.
Under Environment Selection Orchestration, add a plugin.
Create a plugin, or select an existing one that implements determine_deployment_environment_and_parameters.
Select Save.

The function receives the order’s context and returns the environment to use. It can use any logic to determine the appropriate environment.

Event Broker subscriptions

Mon, 01 Jan 0001 00:00:00 +0000

The following Event Broker Subscriptions (EBS) are created during OneFuse Configuration.

Event Broker Subscription states

The list below represents the vRA Event State Names, in order of execution, for OneFuse Modules that may require an EBS trigger.

ComputeAllocationPreEarly
ComputeAllocationPreLate
NetworkConfigureEarly
NetworkConfigureLate
ComputeProvisionPreEarly
ComputeProvisionPreLate
ComputeProvisionPostEarly
ComputeProvisionPostLate

Resource: Lifecycle Extensibility

ComputeAllocationPre

Subscription State	EBS Priority	OneFuse Module	EBS Name
Early	10	Scripting	`OneFuse_Provision_Scripting_ComputeAllocationPreEarly`
Early	15	Ansible Tower	`OneFuse_Provision_AnsibleTower_ComputeAllocationPreEarly`
Early	20	vRealize Automation	`OneFuse_Provision_vRA_ComputeAllocationPreEarly`
Early	25	Pluggable Module	`OneFuse_Provision_PluggableModule_ComputeAllocationPreEarly`
Early	1000	Property Toolkit / VM Tagging	`OneFuse_PropertyToolkit_ComputeAllocate`
Early	1150	Naming	`OneFuse_Provision_Naming`
Late	2000	Scripting	`OneFuse_Provision_Scripting_ComputeAllocationPreLate`
Late	2005	Ansible Tower	`OneFuse_Provision_AnsibleTower_ComputeAllocationPreLate`
Late	2010	vRealize Automation	`OneFuse_Provision_vRA_ComputeAllocationPreLate`
Late	2015	Pluggable Module	`OneFuse_Provision_PluggableModule_ComputeAllocationPreLate`

NetworkConfigure

Subscription State	EBS Priority	OneFuse Module	EBS Name
Early	10	Scripting	`OneFuse_Provision_Scripting_NetworkConfigureEarly`
Early	15	Ansible Tower	`OneFuse_Provision_AnsibleTower_NetworkConfigureEarly`
Early	20	vRealize Automation	`OneFuse_Provision_vRA_NetworkConfigureEarly`
Early	25	Pluggable Module	`OneFuse_Provision_PluggableModule_NetworkConfigureEarly`
Early	1000	Property Toolkit / VM Tagging	`OneFuse_PropertyToolkit_NetworkConfigure`
Early	1200	IPAM	`OneFuse_Provision_IPAM`
Late	2000	Scripting	`OneFuse_Provision_Scripting_NetworkConfigureLate`
Late	2005	Ansible Tower	`OneFuse_Provision_AnsibleTower_NetworkConfigureLate`
Late	2010	vRealize Automation	`OneFuse_Provision_vRA_NetworkConfigureLate`
Late	2015	Pluggable Module	`OneFuse_Provision_PluggableModule_NetworkConfigureLate`

ComputeProvisionPre

Subscription State	EBS Priority	OneFuse Module	EBS Name
Early	5	-	`OneFuse_EBS_Prep`
Early	10	Scripting	`OneFuse_Provision_Scripting_ComputeProvisionPreEarly`
Early	15	Ansible Tower	`OneFuse_Provision_AnsibleTower_ComputeProvisionPreEarly`
Early	20	vRealize Automation	`OneFuse_Provision_vRA_ComputeProvisionPreEarly`
Early	25	Pluggable Module	`OneFuse_Provision_PluggableModule_ComputeProvisionPreEarly`
Early	1000	Property Toolkit / VM Tagging	`OneFuse_PropertyToolkit_ComputeProvision`
Early	1300	DNS	`OneFuse_Provision_DNS`
Early	1500	Microsoft Active Directory	`OneFuse_Provision_AD`
Late	2000	Scripting	`OneFuse_Provision_Scripting_ComputeProvisionPreLate`
Late	2005	Ansible Tower	`OneFuse_Provision_AnsibleTower_ComputeProvisionPreLate`
Late	2010	vRealize Automation	`OneFuse_Provision_vRA_ComputeProvisionPreLate`
Late	2015	Pluggable Module	`OneFuse_Provision_PluggableModule_ComputeProvisionPreLate`

ComputeProvisionPost

Subscription State	EBS Priority	OneFuse Module	EBS Name
Early	10	Scripting	`OneFuse_Provision_Scripting_ComputeProvisionPostEarly`
Early	15	Ansible Tower	`OneFuse_Provision_AnsibleTower_ComputeProvisionPostEarly`
Early	20	vRealize Automation	`OneFuse_Provision_vRA_ComputeProvisionPostEarly`
Early	25	Pluggable Module	`OneFuse_Provision_PluggableModule_ComputeProvisionPostEarly`
Early	1000	Property Toolkit / VM Tagging	`OneFuse_PropertyToolkit_ComputePostProvision`
Early	1500	Microsoft Active Directory	`OneFuse_Move_OU_AD`
Early	1600	ServiceNow CMDB	`OneFuse_Provision_ServiceNow_CMDB`
Late	2000	Scripting	`OneFuse_Provision_Scripting_ComputeProvisionPostLate`
Late	2005	Ansible Tower	`OneFuse_Provision_AnsibleTower_ComputeProvisionPostLate`
Late	2010	vRealize Automation	`OneFuse_Provision_vRA_ComputeProvisionPostLate`
Late	2015	Pluggable Module	`OneFuse_Provision_PluggableModule_ComputeProvisionPostLate`

DeploymentResourceActionPost

EBS Priority	OneFuse Module	EBS Name
1100	ServiceNow CMDB	`OneFuse_Update_ServiceNow_CMDB`

ComputePreRemoval

EBS Priority	OneFuse Module	EBS Name
10	Scripting	`OneFuse_De-Provision_Scripting`
15	Ansible Tower	`OneFuse_De-Provision_AnsibleTower`
20	vRealize Automation	`OneFuse_De-Provision_vRA`
25	Pluggable Module	`OneFuse_De-Provision_PluggableModule`

ComputePostRemoval

EBS Priority	OneFuse Module	EBS Name
1100	ServiceNow CMDB	`OneFuse_De-Provision_ServiceNow_CMDB`
1200	Microsoft Active Directory	`OneFuse_De-Provision_AD`
1300	DNS	`OneFuse_De-Provision_DNS`
1400	IPAM	`OneFuse_De-Provision_IPAM`
1500	Naming	`OneFuse_De-Provision_Naming`

Configure EBS timeouts

EBS Timeouts allow the user to set a time limit per EBS for communication between Aria Automation and vRealize Orchestrator.

Getting started

Mon, 01 Jan 0001 00:00:00 +0000

Easily integrate CloudBolt OneFuse with vRealize/Aria Automation (compatible with 7.6, 8.1+ and Cloud) to quickly automate and integrate into your business provisioning lifecycle.

The CloudBolt OneFuse integration platform offers integrations to services like Naming, IPAM, DNS, Microsoft Active Directory, Scripting, Ansible Tower and more.

Kubernetes Report

Mon, 01 Jan 0001 00:00:00 +0000

Kubernetes Report displays aggregated and granular cost data for your clusters, namespaces, workloads, and labels, allowing you to:

View cost trends over time.
Filter and refine data groupings.
Drill down to resource-level cost details.
Analyze CPU, memory, and shared costs across environments.

Kubernetes cost allocation is based on effective cost (after discounts), or on list cost for tenants configured to view undiscounted costs only. See How costs are allocated for how idle and overhead capacity is handled.

MFA management

Mon, 01 Jan 0001 00:00:00 +0000

MFA adds an additional layer of authentication using time-based one-time passwords (TOTP), typically via an authenticator app.

Prerequisites

SSH access to the Cloud Management Platform (CMP) appliance with sudo/root privileges
A TOTP-based authenticator app (for example, Microsoft Authenticator or Google Authenticator)

Enable multi-factor authentication (MFA)

Modify customer_settings.py
- SSH into the CMP appliance.
- Open the settings file /var/opt/cloudbolt/proserv/customer_settings.py.
- Add the following lines to enable MFA:
```
from settings import FEATURE_REGISTRY

FEATURE_REGISTRY["authentication::mfa"] = True
```
Reset the feature list and restart the HTTP service
- Run the following command to apply changes:
```
/opt/cloudbolt/manage.py features --reset && systemctl restart httpd
```
Verify that MFA is active
- Check the features list:
```
/opt/cloudbolt/manage.py features --list
```

Properties list

Mon, 01 Jan 0001 00:00:00 +0000

The following vRA Properties need to exist on the vRA Blueprint to ensure the desired OneFuse Modules are called for the Deployment.

General use

Purpose: relate OneFuse Policy executions from different OneFuse Modules together with a Tracking ID

Property	Value format
`OneFuse_Tracking_Id`	A GUID (globally unique identifier) that links OneFuse Policy Executions and the resulting Managed Objects together for a given resource on a deployment. The first OneFuse Module Policy execution will populate this vRA property and it will be passed into other OneFuse Modules automatically. Learn more about OneFuse Tracking ID.

When a Tracking ID is not provided, a Tracking ID gets generated for the Policy execution.

RDP/SSH troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

See Remote server access for setup and requirements.

Cloud Management Platform (CMP) runs the remote terminal through two Guacamole services on the CMP server: the Guacamole daemon (guacd) and the Guacamole websocket service (guacg).

Remote connections cannot be established

Confirm the RDP/SSH requirements are met.
Check the CMP logs for error messages.
On the CMP server, confirm that the guacd and guacg services are running: systemctl status guacd guacg.
From the CMP server, confirm you can reach the target server’s port: telnet SERVER_IP 22 for SSH or telnet SERVER_IP 3389 for RDP. If telnet is not installed, use nc -vz SERVER_IP 22.
Check your browser’s JavaScript console for errors, warnings, or other diagnostic information.
Review /var/log/cloudbolt/guacd.log and /var/log/cloudbolt/guacg.log for error messages.

If none of these steps identify the problem, contact Support with your CMP logs and a screenshot of your browser showing the JavaScript console open and any errors.

Scheduling actions

Mon, 01 Jan 0001 00:00:00 +0000

Scheduling is off by default. Enable it on the action, and users then get a choice of running now or later each time they launch it.

Enable scheduling

Go to Admin > Server Actions or Admin > Resource Actions.

(opens full-size image in a new tab)
Select an action.
Select the Edit button.
Clear Synchronous Action if selected, and select Allow scheduling. Synchronous actions run inline and cannot be deferred.

(opens full-size image in a new tab)
Select Save.

Shared modules as code

Mon, 01 Jan 0001 00:00:00 +0000

Once a shared module is linked to a repository, you can push it, preview the changes, and later refresh the module from the repository. You can also create a module from one already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh a shared module

Open the module from Admin > Shared Modules, then select its repository tab. The tab is named Repository until the module is linked to a repository; then it is named GitHub or GitLab.

SSO orchestration actions

Mon, 01 Jan 0001 00:00:00 +0000

In Cloud Management Platform (CMP), SSO orchestration actions control how users, groups, roles, and directory associations are handled when a user logs in through single sign-on (SSO).

You can use:

SSO User Update
External Users Sync
A combination of both

The default SSO User Update action provides basic behavior, such as associating users with an LDAP domain and updating standard user fields. For advanced requirements, such as group mapping or attribute synchronization, you can customize this action or use the External Users Sync action.

Templating and Property Toolkit

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse feature, refer to Templating guide and Property Toolkit features.

Introduction

The OneFuse Property Toolkit (PTK) is the Swiss army knife of the OneFuse Platform.

PTK can be used to simplify configurations, define business logic as configuration, build simple logic or tackle the most complex problems. At face value, the PTK is meta-data that can be called upon offering simple name value pairs that can be used as a reference for decision making. In its most powerful form, it can contain logic, decision trees, platform abstractions, and much more.

Templating and Property Toolkit

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse feature, refer to Templating guide and Property Toolkit features.

Introduction

The OneFuse Property Toolkit (PTK) is the Swiss army knife of the OneFuse Platform.

Templating and Property Toolkit

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse feature, refer to Templating guide and Property Toolkit features.

Introduction

The OneFuse Property Toolkit (PTK) is the Swiss army knife of the OneFuse Platform.

Email hooks

Mon, 01 Jan 0001 00:00:00 +0000

An email hook is an action type, so it can be attached anywhere other actions can. Its subject and body are templates, which lets a single hook produce a message tailored to the job that fired it.

Email hook fields

In addition to the fields common to all actions, such as name and description, an email hook has the following. None of them are required.

Field	Description
Subject	The subject line of the email.
Body	The body of the email.
From Address	The address the email is sent from. If it is empty, CMP uses Email default from address from Admin > Email Settings.
Send to Users	Choose from all users in your instance, including those imported from LDAP. The email goes to the address shown on each user’s detail page.
Send to Address	A comma-separated list of recipient addresses. It accepts templated addresses, such as `{{ server.owner.user.email }}`.
Send to Job Owner	When selected, the email goes to the owner of the job the hook is attached to. The job details page shows each job’s owner.

The Subject, From Address, and Body fields can all be templated using parameter templates.

Integration with other systems

Mon, 01 Jan 0001 00:00:00 +0000

Local authentication for SSO users

By default, users created through SSO login are not assigned a local password. These users are always required to log in through SSO and cannot use local authentication.

To let these users log in with a local CMP password, an admin assigns a password to the user in CMP.

Portals

Portals created through the branded portals feature can be associated with a single SSO provider.

MetalSoft

Mon, 01 Jan 0001 00:00:00 +0000

Each imported MetalSoft data center becomes a CMP environment. For each order, CMP deploys one server of the chosen type into an existing or new MetalSoft infrastructure. MetalSoft provisions physical servers only.

Before you begin

A MetalSoft user for CMP, with its email address and API key.
Network access from CMP to the MetalSoft API.

Add a MetalSoft resource handler

Go to Admin > Resource Handlers, select Add, then select MetalSoft.
Complete the credentials fields described below, then select Continue. CMP checks the connection, including that the API User Email belongs to the API key.
Enter a Name, and optionally a Description and VM Names to Ignore, then select Done.
On the handler’s Overview tab, select Verify Connection at any time to check the connection.

Field	Description
IP address	The host name or IP address of the MetalSoft controller.
Protocol	Usually https. The dialog opens with http; change it.
Port	The MetalSoft API port. The dialog opens with `443`.
API User Email	The email address of the MetalSoft user for CMP.
API Key	That user’s API key. The API key includes the user ID before the colon; enter it in full. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the secret from a configured vault provider. See Use password vaults.
Admin API Connection Info	Optional. A Connection Info record holding a MetalSoft administrator’s email address and API key. Only records tagged `metalsoft` are listed.
SSL Verification	Whether CMP verifies the MetalSoft controller’s SSL certificate.

Import data centers

A new handler has no environments until you import a data center. CMP creates one environment for each selected data center, named after the handler and the data center, for example (MetalSoft) ab-br-c1.

Schedule power on/off

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) can power servers off for set periods of the day, which saves cost and consumption on servers that, for example, do not need to run overnight. Set a schedule on a single server, or on a resource so that its servers are scheduled together.

Before you start

Power schedules are handled by two built-in recurring jobs: Auto-power control servers and Auto-power control resources. Both are disabled by default, so setting a schedule has no effect until you enable the corresponding job. See Built-in recurring jobs.

ServiceNow REST Client

Mon, 01 Jan 0001 00:00:00 +0000

Pluggable Module Name is ServiceNow REST Client

Feature highlights

Create flexible ServiceNow REST Client calls with OneFuse.
JSON Data can consist of a mix of static text and dynamic content such as properties and/or custom logic.

Prerequisites

Create a OneFuse Service Account for the ServiceNow instances used for ServiceNow REST Client.
Create ServiceNow Scripted REST APIs.
If the OneFuse Appliance does not have an internet connection, follow the instructions in the section below.

OneFuse Appliance without internet connection

Perform the following only if the OneFuse Appliance does not have an internet connection.

UI extensions as code

Mon, 01 Jan 0001 00:00:00 +0000

Once a UI extension is linked to a repository, you can push it, preview the changes, and later refresh the extension from the repository. You can also add an extension package from one already in a repository. This requires a repository linked to Cloud Management Platform (CMP) and repository credentials on your profile so commits are attributed to you. See Integrate a remote source code repository.

Push and refresh a UI extension

Go to Admin > Manage UI Extensions, open the extension, and select the Repository tab. Unlike other content types, this tab keeps the same name regardless of which provider the repository belongs to.

Anomalies

Mon, 01 Jan 0001 00:00:00 +0000

Using predictive cost forecasting and statistical models, CloudBolt identifies cost outliers that may indicate issues such as misconfigurations, unplanned consumption, billing discrepancies, or security events.

By default, the page shows detected events from the past month.

Anomaly detection

CloudBolt determines anomalies using a combination of predictive forecasting and threshold-based evaluation. An anomaly is recorded when both of the following conditions are met:

The billed cost for a given day exceeds the forecasted upper bound for that day.
The billed cost also exceeds a minimum threshold of $10.

When these criteria are satisfied, CloudBolt classifies the event as an anomaly and displays it in the Anomalies interface. This approach helps minimize false positives while ensuring that cost irregularities are quickly brought to your attention.

Outbound webhooks

Mon, 01 Jan 0001 00:00:00 +0000

An outbound webhook is an action of the Webhook type. It integrates CMP with external systems that expose a web-based API, typically REST. Use one to post a message to a channel whenever a particular blueprint is deployed, create an entry in a CMDB when a new server is built, or enable and disable monitoring when a user selects a button on the server details page.

To let an external system call CMP instead, see Inbound webhooks.

Inbound webhooks

Mon, 01 Jan 0001 00:00:00 +0000

An inbound webhook adds a URL to the CMP API that runs a plugin you write. It also offers a simpler authentication option, which makes CMP easier to call from external systems.

To have CMP call an external API instead, see Outbound webhooks.

Why use inbound webhooks

You may want another system to call into the CMP API to fetch information or perform an action: a chatbot that reports how many VMs and public cloud accounts CMP manages, for example, or one that kicks off provisioning of a development environment when someone asks for it.

OpenShift Virtualization

Mon, 01 Jan 0001 00:00:00 +0000

Each imported OpenShift namespace becomes a CMP environment. CMP builds servers from OpenShift Virtualization templates and persistent volume claims (PVCs).

Before you begin

OpenShift Virtualization is disabled by default. If its tile is missing from the technology picker, enable the resource handler.
The cluster’s base domain and network access from CMP to its API, which listens on port 6443 by default.
A service account token that can list namespaces, or the username and password of an OpenShift account.

Add an OpenShift Virtualization resource handler

Go to Admin > Resource Handlers, select Add, then select OpenShift Virtualization under Private Cloud.
Complete the credentials fields described below, then select Continue. CMP checks the connection at this point.

(opens full-size image in a new tab)
Enter a Name, complete any of the optional settings described below, then select Done.

Switch Organization

Mon, 01 Jan 0001 00:00:00 +0000

Organizations can mirror your internal business units or, for managed service providers and resellers, the customers you manage. Switching updates the dashboards, reports, and settings you see to reflect the selected organization.

The Switch Organization control appears in the sidebar only if you belong to more than one organization. Organizations and their hierarchy are managed on the Organizations page.

Switch your active organization

Log in to the CloudBolt Platform.
In the sidebar, select Switch Organization.
Choose the organization you want to make active.

The switcher shows the organizations you can access as a flat list. The active organization is marked with a Current badge. With seven or more organizations, a search box appears above the list to filter it.

External flows

Mon, 01 Jan 0001 00:00:00 +0000

An external flow is an action type that invokes an external orchestrator. Once a flow is mapped to an action, it can be used anywhere an action can be used: at an orchestration trigger point, as part of a blueprint deployment, or from a server’s details page.

Set up an external flow

Configure an external orchestrator and import one or more of its flows.
Create actions in CMP that map to those flows.

The External Flow action type is offered only when the external orchestrators feature is active and at least one orchestration engine is configured. If you do not see it when creating an action, check both.

OpenStack

Mon, 01 Jan 0001 00:00:00 +0000

Each imported OpenStack project becomes a CMP environment.

Before you begin

An OpenStack account CMP can authenticate as, and network access from CMP to the Identity service, which listens on port 5000 by default.
The account’s domain name and a project ID. In the OpenStack dashboard, find them under Identity > Domains and Identity > Projects.

Add an OpenStack resource handler

Go to Admin > Resource Handlers, select Add, then select OpenStack under Private Cloud.
Complete the credentials fields described below, then select Continue. CMP checks the connection at this point.
Enter a Name, and optionally a Description, VM Names to Ignore, and VM Tags to Include, then select Done.

Field	Description
Protocol	HTTP or HTTPS, as served by the Identity service. The dialog opens with HTTP.
Domain	Required. The Identity domain the account belongs to, for example `default`.
Project ID	Required. The ID of a project the account can access. CMP authenticates against this project.
IP address	The host name or IP address of the Identity service.
Port	The Identity service port. Defaults to `5000`.
Account username	The OpenStack account CMP authenticates as.
Password	The password for that account. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the secret from a configured vault provider. See Use password vaults.
SSL Verification	Whether CMP verifies the Identity service’s SSL certificate.

Import projects

A new handler has no environments until you import a project.

Account

Mon, 01 Jan 0001 00:00:00 +0000

The account menu opens when you select the Account button at the bottom of the sidebar. It shows who you’re signed in as and gives you access to personal and session-level options.

Log in to the CloudBolt Platform.
At the bottom of the sidebar, select Account.

Options available in the account menu.

Option	Description
Signed-in details	The email address you are signed in with and the name of your current customer.
Switch Customer	Opens a dialog to change the active customer. Appears only when you belong to more than one customer.
Color mode	Toggle the interface appearance between System Default, Light Mode, and Dark Mode.
Log out	End your current session and return to the login screen.

Switch Customer vs. Switch Organization

Switch Customer changes your active customer. To change organizations within that customer, use Switch Organization.

Oracle Cloud Infrastructure

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) authenticates to OCI with an API signing key rather than a password, so set the key up in Oracle Cloud before adding the handler. Oracle Linux images also disable password-based authentication, so plan to use SSH keys to access provisioned servers.

Before you begin

Collect the following from Oracle Cloud. The credentials dialog needs all of it, so keep it to hand:

The region to connect to.
Your user OCID and tenancy OCID, and the compartment OCID if you want the handler scoped to one compartment and its sub-compartments.
An API signing key in PEM format, its fingerprint, and its passphrase if set. Manage an OCI server with SSH keys below generates a key pair you can use for this.

Add an OCI resource handler

Go to Admin > Resource Handlers, select Add, then select Oracle Cloud Infrastructure, under Public Cloud.
Fill in the credentials dialog and select Continue.
Enter a name and an optional description, then select Done.

Field	Description
Region	Required. The OCI region this handler connects to.
User OCID	Required. The OCID of the user the API signing key belongs to.
Certificate Fingerprint	Required. The fingerprint OCI shows after you upload the public key.
Key File	Required. Paste the private key in PEM format.
Passphrase	The passphrase protecting the private key. Leave it empty if the key has none.
Tenancy OCID	Required. The OCID of your tenancy.
Compartment OCID	Optional. Scopes the handler to this compartment and its sub-compartments: environments offer only those compartments, and VM, image, and network discovery follow them. If empty, CMP uses the tenancy.

OCI parameters

The following parameters are imported and may appear on the order form:

Templating and Property Toolkit

Mon, 01 Jan 0001 00:00:00 +0000

To learn more, refer to Templating guide and Property Toolkit features.

Introduction

The OneFuse Property Toolkit (PTK) is the Swiss army knife of the OneFuse Platform.

Oracle Linux Virtualization Manager

Mon, 01 Jan 0001 00:00:00 +0000

Each imported OLVM cluster becomes a CMP environment, and CMP imports the cluster’s networks into it.

Before you begin

Oracle Linux Virtualization Manager is disabled by default. If its tile is missing from the technology picker, enable the resource handler.
An OLVM account CMP can authenticate as, and HTTPS access from CMP to the OLVM engine.
CMP verifies the engine’s certificate when SSL verification is enabled under Admin > SSL Root Certificates. If the engine’s certificate is issued by a private certificate authority, add the OLVM engine CA certificate on that page before you create the handler.

Add an OLVM resource handler

Go to Admin > Resource Handlers, select Add, then select Oracle Linux Virtualization Manager under Private Cloud.
Enter the IP address, Port, Account username, and Password, then select Continue. CMP checks the connection at this point.

(opens full-size image in a new tab)
Enter a Name, and optionally a Description and VM Names to Ignore, then select Done.

Outscale

Mon, 01 Jan 0001 00:00:00 +0000

Outscale does not appear in the technology picker until enabled. If you cannot find the tile, see Enable a resource handler.

Adding the handler creates a Cloud Management Platform (CMP) environment and imports the Outscale parameters. A handler covers one region, and each region has its own access key pair. Add a separate handler for each region you use.

Before you begin

Collect the following from Outscale:

The Region to connect to. Outscale region names follow the AWS pattern, such as us-east-2. See Outscale’s regions and endpoints reference for the full list.
The Access Key and Access Key Secret for that region.

Add an Outscale resource handler

Go to Admin > Resource Handlers, select Add, then select Outscale under Public Cloud.
Enter the Region, Access Key, and Access Key Secret, then select Continue.
Enter a name and an optional description, then select Done.

CMP opens the new handler. Before ordering, work through its tabs to complete configuration.

Proxmox Virtual Environment

Mon, 01 Jan 0001 00:00:00 +0000

Each imported Proxmox node becomes a CMP environment. CMP builds a server by cloning a Proxmox VM template, then sets its CPUs, memory, and disk size.

Before you begin

Proxmox Virtual Environment is disabled by default. If its tile is missing from the technology picker, enable the resource handler.
A Proxmox account that logs in with a username and password, in the Linux PAM or Proxmox VE realm. The account must not require two-factor authentication.
Network access from CMP to the Proxmox API, which listens on HTTPS port 8006 by default.

Add a Proxmox resource handler

Go to Admin > Resource Handlers, select Add, then select Proxmox Virtual Environment.
Complete the credentials fields described below, then select Continue. CMP checks the connection before moving on.

(opens full-size image in a new tab)
Enter a Name, and optionally a Description and VM Names to Ignore, then select Done.

QEMU-KVM

Mon, 01 Jan 0001 00:00:00 +0000

QEMU-KVM is a legacy technology and does not appear in the technology picker. You cannot create a new QEMU-KVM resource handler. Existing handlers continue to work, and you can still edit their credentials and settings.

Credentials for an existing handler

To review or update the connection, open the handler from Admin > Resource Handlers and select Edit Credentials.

Field	Description
IP address	The IP address of the KVM host.
SSH Port	CMP connects to the host on the standard SSH port, `22`.
Username	The SSH account CMP logs in with. It must be able to run `virsh` and `virt-clone`, and needs read access to the host’s libvirt domain configuration files.
Password	The password for that account. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the secret from a configured vault provider. See Use password vaults.

Templates

CMP treats a libvirt domain as a template when its name matches the handler’s Template name pattern, a regular expression that defaults to -tmpl. With the default, centos7-tmpl is a template. Every other domain is synced as a server. To change the pattern, open the handler’s Overview tab and select Edit Settings.

Ansible Tower

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Ansible Tower.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file
Run terraform commands to deploy a OneFuse Ansible Tower Deployment and run Provision Job Template(s):
1. terraform init
2. terraform plan
3. terraform apply
Run terraform command to destroy OneFuse Ansible Tower Deployment and run Deprovision Job Template(s), if any:
- terraform destroy

Create variables.tf

Add the following in the variables.tf file. Update the values as needed.

Ansible Tower

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Ansible Tower.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Install OneFuse XUI per CloudBolt CMP.
Review an overview on OneFuse Modules with CloudBolt CMP.
Create a new Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module. Resource: Blueprints.

Configure the Blueprint

Know the name of the OneFuse Connection Info created via OneFuse XUI initial setup.
Determine which OneFuse Ansible Tower Policies to run for this Blueprint.
Determine when to run each OneFuse Ansible Tower Policy for the deployment provisioning lifecycle with CMP’s Trigger Points.
Update the Blueprint to add in necessary parameters to invoke OneFuse Ansible Tower Policies.
Deploy the Blueprint to provision a deployment and run Provision Job Template(s).
Destroy the Deployment to run Deprovision Job Template(s), if any.

Update the Blueprint

Log in to CloudBolt CMP.
If not already on the Catalog page, select Catalog from the main menu.
Search and find the desired CloudBolt Blueprint.
Edit the Blueprint by selecting the gear icon on the bottom-right of the Catalog Item.

Add in necessary parameters

The following Parameters need to exist on the Blueprint.

Ansible Tower

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Ansible Tower.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Run provisioning job template(s) configured on the OneFuse Ansible Tower Policy for a resource.

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_ansible_tower('<policy_name>', <template_properties>, '<hosts>', '<limit>', '<tracking_id>')

Parameter references

The following defines the function of each Ansible Tower specific parameter.

Parameter name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution.

OneFuse Python Module Tracking ID methods:

Ansible Tower

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Ansible Tower.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per vRA Tenant.
Review the OneFuse Modules overview for vRealize Automation 7.6.
Create a new vRA Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
- Resource: Designing Machine Blueprints

Configure the Blueprint

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Ansible Tower Policies to run for this Blueprint.
Determine when to run each OneFuse Ansible Tower Policy for the deployment provisioning lifecycle with vRA’s EBS'.
Update the Blueprint to add in necessary vRA Properties to invoke OneFuse Ansible Tower Policies.
Deploy the Blueprint to provision a vRA Deployment and run Provision Job Template(s).
Destroy the vRA Deployment to run Deprovision Job Template(s), if any.

Update the Blueprint

Log in to the vRA Tenant
Select the Design tab from the top menu bar
Select the Blueprints tab from the left menu
Edit the Blueprint and perform the below:

Add in necessary vRA Properties

The following vRA Properties need to be added to the Blueprint’s Properties > Custom Properties section under the Resource(s) of interest.

DNS

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to DNS.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: dns

present

Sample Play

- name: OneFuse DNS - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
    name: <REPLACEME_with_hostname>        #{{ onefuse_name.name }}
    ip_address: <REPLACEME_with_ipAddress> #{{ onefuse_ipam.ipAddress }}
    zones: <REPLACEME_with_zones>          #{{ onefuse_ipam.dnsSuffix }}
  tasks:
  - name: Register DNS Record(s)
    onefuse:
      module: dns
      state: present
      policy_name: '{{ policy_name }}'
      name: '{{ name }}'
      value: '{{ ip_address }}'
      zones: '{{ zones }}'
      template_properties: '{}'
      tracking_id: '{{ tracking_id | default(omit) }}'
    delegate_to: localhost
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Pass DNS Outputs to workflow"
    set_stats:
        data:
         onefuse_dns: '{{ onefuse_dns }}'
         tracking_id: '{{ tracking_id }}'

Parameter references

The following defines the function of each DNS specific task parameters for onefuse.

Installation and setup

Mon, 01 Jan 0001 00:00:00 +0000

New install requirements

Perform once for first initial install. Upgrading? Skip to Upgrade to the latest.

Review Getting started for prerequisites.
Create a OneFuse service account for vRealize Automation 8x with least permissions
1. Log in to https://{MY-VRA-INSTANCE}/csp/gateway/portal/#/consumer/usermgmt/ad-groups/assign-roles
2. Select the Enterprise Groups tab.
3. Select Assign Roles.
4. Search and select the AD group containing the service account to be used for the OneFuse integration.
5. Designate the group at minimum: Organizational Member.
6. Select the [+ Add Service Access] button twice.
7. Assign the following VMware Service Roles to the user:
  - Orchestrator with roles Orchestrator Administrator
  - Cloud Assembly with roles Cloud Assembly Administrator
  - *To learn more, visit vRealize Orchestrator Roles and Groups.
If using vRA Cloud, generate the vRA Cloud API Token with least permissions:
1. Log in to vRA Cloud Assembly.
2. Select your name in the top-right menu > select My Account (under User Settings).
3. Select the API Tokens tab.
4. Select Generate a New API Token.
5. In the Generate a New API Token form:
  1. Enter the token name and define the token TTL.
  2. For Define Scopes, two roles are required:
    1. The role Organization Member is required:
      1. In the Organization Roles column on the right, scroll down and expand All Organization Roles.
      2. Check the checkbox for Organization Member.
    2. The role Cloud Assembly Administrator is required:
      1. In the Service Roles column on the right, scroll down and expand VMware Cloud Assembly.
      2. Check the checkbox for Cloud Assembly Administrator.
  3. Select Generate.
6. Save the API Token to be used later during Run the OneFuse Configuration Workflow.
Follow instructions below to:

Upgrade to the latest

Follow instructions below to get the latest features for OneFuse + VMware’s vRealize Automation.

Properties list

Mon, 01 Jan 0001 00:00:00 +0000

The following vRA Properties need to exist on the vRA Cloud Template to ensure the desired OneFuse Modules are called for the Deployment.

General use

Purpose: relate OneFuse Policy executions from different OneFuse Modules together with a Tracking ID

Property	Value format
`OneFuse_Tracking_Id`	A GUID (globally unique identifier) that links OneFuse Policy Executions and the resulting Managed Objects together for a given resource on a deployment. The first OneFuse Module Policy execution will populate this vRA property and it will be passed into other OneFuse Modules automatically. Learn more about OneFuse Tracking ID.

When a Tracking ID is not provided, a Tracking ID gets generated for the Policy execution.

Property Sets

Mon, 01 Jan 0001 00:00:00 +0000

Property Sets are typically grouped in one of two main functional areas:

Property Sets for modeling OneFuse Policies
- Used for Template Previews in the OneFuse platform while building Policies with the Active Property Set.
  - Ability to validate the result of a Policy while building it, giving the user real-time feedback on exactly how the Policy will behave with a certain set of inputs.
Property Sets for Property Toolkit features
- Properties get applied to the resource being provisioned as configuration. Each property in these Property Sets is used to drive the outcomes of the resource that we are building.
- Some properties may be used to name the resource, determine the number of CPUs, or place a virtual machine in a particular cluster. Almost any aspect of the provisioned resource is capable of being influenced by these Property Sets.
- Template both key:value of the property
- Call other Property Sets within the parent Property Set

Managing Property Sets

Workspace Role needed to manage Property Sets: Admin or Member.

VMware Cloud Director

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Director is not installed by default and is not controlled by a feature flag. Run the script in Enable the vCloud Director resource handler to display the tile in the picker, where it is listed under its former name, vCloud Director.

Cloud Director groups resources into organizations, and each organization into virtual data centers. Cloud Management Platform (CMP) creates one environment for each organization and virtual data center pair you import, and provisions into it.

XenServer

Mon, 01 Jan 0001 00:00:00 +0000

XenServer is a legacy technology and does not appear in the technology picker. You cannot create a new XenServer resource handler. Existing handlers continue to work, and you can still edit their credentials and settings.

Credentials for an existing handler

To review or update the connection, open the handler from Admin > Resource Handlers and select Edit Credentials. CMP checks the connection when you save, and Verify Connection on the Overview tab checks it on demand.

DNS

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to DNS.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file
Run terraform commands to register DNS Record(s):
1. terraform init
2. terraform plan
3. terraform apply
Run terraform command to release the DNS Record(s):
- terraform destroy

Create variables.tf

Add the following in the variables.tf file. Update the values as needed.

It is a best practice to separate configurations into identifiable files, refer to Best practices for OneFuse modules.

The sample below shows all configurations in one variables.tf file for simplicity.

DNS

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to DNS.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Install OneFuse XUI per CloudBolt CMP.
Review an overview on OneFuse Modules with CloudBolt CMP.
Create a new Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module. Resource: Blueprints.

Configure the Blueprint

Know the name of the OneFuse Connection Info created via OneFuse XUI initial setup.
Determine which OneFuse DNS Policies to run for this Blueprint.
Update the Blueprint to add in necessary parameters to invoke OneFuse DNS Policies.
Deploy the Blueprint to provision a deployment and register DNS record(s).
Destroy the Deployment to unregister the DNS record(s) for the destroyed resource(s).

Update the Blueprint

Log in to CloudBolt CMP.
If not already on the Catalog page, select Catalog from the main menu.
Search and find the desired CloudBolt Blueprint.
Edit the Blueprint by selecting the gear icon on the bottom-right of the Catalog Item.

Add in necessary Parameters

The following Parameters need exist on the Blueprint.

DNS

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to DNS.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_dns('<policy_name>', <template_properties>, '<name>', '<value>', '["<zones>"]', '<tracking_id>')

Parameter references

The following defines the function of each DNS specific Parameters.

Parameter Name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution. See Tracking ID methods below.

Tracking ID methods

Method Name	Notes
`create_tracking_id()`	Generate a unique Tracking ID to link OneFuse Policy Executions and the resulting Managed Objects together.
`get_tracking_id_from_mo('<Path to OneFuse Managed Object>')`	Get the Tracking ID from a OneFuse Managed Object.
`add_tracking_id_to_headers('<Tracking ID>')`	Add Tracking ID into request headers. When making custom requests to OneFuse instead of using OneFuse Python Module methods provided.

Learn more about OneFuse Tracking ID.

DNS

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to DNS.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per vRA Tenant.
Review the OneFuse Modules overview for vRealize Automation 7.6.
Create a new vRA Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
- Resource: Designing Machine Blueprints

Configure the Blueprint

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse DNS Policies to run for this Blueprint.
Update the Blueprint to add in the necessary vRA Properties to invoke a OneFuse DNS Policy.
Deploy the Blueprint to provision a vRA Deployment and register DNS Record(s).
Destroy the vRA Deployment to remove the DNS Record(s) for the destroyed resource(s).

Update the Blueprint

Log in to the vRA Tenant
Select the Design tab from the top menu bar
Select the Blueprints tab from the left menu
Edit the Blueprint and perform the below:

Add in necessary vRA Property

The following vRA Property needs to be added Blueprint’s Properties > Custom Properties section under the Resource(s) of interest.

IPAM

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to IPAM.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: ipam

present

Reserve IP Addresses for a resource.

Sample Play

- name: OneFuse IPAM - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
    name: <REPLACEME_with_hostname> #{{ onefuse_name.name }}
  tasks:
  - name: Reserve IP Address
    onefuse:
      module: ipam
      state: present
      policy_name: '{{ policy_name }}'
      name: '{{ name }}'
      template_properties: {}
      tracking_id: '{{ tracking_id | default(omit) }}'
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Pass IPAM Outputs to workflow"
    set_stats:
        data:
         onefuse_ipam: '{{ onefuse_ipam }}'
         tracking_id: '{{ tracking_id }}'

Parameter references

The following defines the function of each IPAM specific Task Parameters for onefuse.

OneFuse custom resources

Mon, 01 Jan 0001 00:00:00 +0000

To learn more, refer to VMware Docs: Custom Resources.

VMware Aria Automation version	OneFuse version
8.2+	1.2+

Introduction

Aria Automation 8.2+ allows you to create Custom Resources that can be treated as drag-and-drop elements directly onto a Cloud Template canvas.

For each of the OneFuse modules, you now have the capability to drag-and-drop any of the OneFuse modules directly onto the vRA Cloud Template canvas.

In addition, every OneFuse Custom Resource is capable of leveraging the Property Toolkit to consume integrations and drive dynamic outcomes in a standardized way.

Quick reference

Mon, 01 Jan 0001 00:00:00 +0000

`_all_properties`

This is a Custom filter created for OneFuse to output all the Properties from the Deployment at Run Time.

The primary use-case for this is to access all the Properties when using the Scripting Module to utilize meta data within the OS scripts or to populate Ansible Host Variables which can be used for playbook executions.

Output rendered templateProperties with: _all_properties during Policy execution calls and/or Templating API.

Example

{#
  Example templateProperties stack:

  {
    "foo": "hello",
    "bar": "world"
  }
#}

{# Example 1 #}

{{ _all_properties }}


{# Example 2 #}

{% for key, value in _all_properties.items() %}
  Key: {{key}}
  Value: {{value}}
{% endfor %}


{# Example 3#}

{%for key in _all_properties %}
  {{key}}
{%endfor%}

{# Example 4 #}

{{ _all_properties.foo }}

Will not account for variables set after invocation, for example setting new variables using {%set foo = "bar" %}.

Expressions

Mon, 01 Jan 0001 00:00:00 +0000

Expressions get replaced with values when a template is rendered.

Expressions appear inside {{ ... }} tags.

Literals

The simplest form of expressions.

Boolean

true is always true and false is always false.

true
false

Dict

A dict in Python is a structure that combines keys and values.

Keys must be unique and always have exactly one value.

{
  "foo": "Hello World"
}

Integers

Integers are whole numbers without a decimal part.

IPAM

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to IPAM.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file
Run terraform commands to reserve an IP Address:
1. terraform init
2. terraform plan
3. terraform apply
Run terraform command to release the IP Address:
- terraform destroy

Create variables.tf

Add the following in the variables.tf file. Update the values as needed.

It is a best practice to separate configurations into identifiable files, refer to Best practices for OneFuse modules.

The sample below shows all configurations in one variables.tf file for simplicity.

IPAM

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to IPAM.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Install OneFuse XUI per CloudBolt CMP.
Review an overview on OneFuse Modules with CloudBolt CMP.
Create a new Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module. Resource: Blueprints.

Configure the Blueprint

Verify Networks in CMP have certain fields set with values:

Find and verify the following fields are set with values for all networks that OneFuse will provide IP Addresses for.

For these networks, it cannot be assigned to another native CMP IPAM integration nor have an active IP Pool.

Field Name	Notes
Name	The Network name specified here must match the OneFuse IPAM Policy Network Name.
Gateway	This field is required to have a value.
Netmask	This field is required to have a value.
Dns1	This field is optional. If there is a value defined, the OneFuse IPAM Policy will override this value with the one defined on the OneFuse IPAM Policy.
Dns2	This field is optional. If there is a value defined, the OneFuse IPAM Policy will override this value with the one defined on the OneFuse IPAM Policy.
DNS Domain	This field is optional. If there is a value defined, the OneFuse IPAM Policy will override this value with the one defined on the OneFuse IPAM Policy.
Addressing schema	This field needs to be set to: DHCP only and is required for OneFuse Driven Networks.
Poweron stage	This field needs to be set to: On VM Creation.

Know the name of the OneFuse Connection Info created via OneFuse XUI initial setup.
Determine which OneFuse IPAM Policies to run for this Blueprint.
Update the Blueprint to add in necessary parameters to invoke OneFuse IPAM Policies.
Deploy the Blueprint to provision a deployment and reserve IP Address(es).
Destroy the Deployment to remove the IP Address(es) for the destroyed resource(s).

IPAM

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to IPAM.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Reserve IP Addresses for a resource.

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_ipam('<policy_name>', <template_properties>, '<hostname>', '<tracking_id>')

Parameter references

The following defines the function of each IPAM specific parameter.

Parameter Name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution.

OneFuse Python Module Tracking ID methods:

IPAM

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to IPAM.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per vRA Tenant.
Review the OneFuse Modules overview for vRealize Automation 7.6.
Create a new vRA Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
- Resource: Designing Machine Blueprints

Configure the Blueprint

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse IPAM Policies to run for this Blueprint.
Update the Blueprint to add in the necessary vRA Properties to invoke a OneFuse IPAM Policy.
Deploy the Blueprint to provision a vRA Deployment and reserve IP Address(es).
Destroy the vRA Deployment to remove the IP Address(es) for the destroyed resource(s).

Update the Blueprint

Log in to the vRA Tenant
Select the Design tab from the top menu bar
Select the Blueprints tab from the left menu
Edit the Blueprint and perform the below:

Add in necessary vRA property

The following vRA Property needs to be added to the Blueprint’s Properties > Custom Properties section under the Resource(s) of interest.

IPAM network selection support

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse Module, refer to IPAM.

Introduction

This feature allows you to derive the inputs for the OneFuse IPAM policy from a Network in vRA8. This simplifies implementation of IPAM in OneFuse, allowing you to defer to the Constraints in vRA8 to determine the network to be used for the IPAM reservation instead of mirroring that business logic within OneFuse templating or Static Property Sets.

Using this setup enables vRA Selected Network Mode for OneFuse IPAM.

Microsoft Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Microsoft Active Directory.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: ad

present

Sample Play

- name: OneFuse Microsoft Active Directory - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
    name: <REPLACEME_with_ComputerAccountName> #{{ onefuse_name.name }}
  tasks:
  - name: Create Computer Account in Active Directory
    onefuse:
     module: ad
     state: present
     policy_name: '{{ policy_name }}'
     name: '{{ name }}'
     template_properties: {}
     tracking_id: '{{ tracking_id  | default(omit) }}'
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Pass Microsoft AD Outputs to workflow"
    set_stats:
        data:
         onefuse_ad: '{{ onefuse_ad }}'
         tracking_id: '{{ tracking_id }}'

Parameter References

The following defines the function of each Microsoft Active Directory specific Task Parameters for onefuse.

Templating and Property Toolkit

Mon, 01 Jan 0001 00:00:00 +0000

To learn more, refer to the Templating guide and Property Toolkit features.

Introduction

The OneFuse Property Toolkit (PTK) is the Swiss army knife of the OneFuse Platform.

Control structures

Mon, 01 Jan 0001 00:00:00 +0000

A control structure refers to all those things that control the flow: conditionals, for-loops, as well as assignments.

Control structures appear inside {% ... %} tags.

For

Loop over each item in a sequence.

{# List users provided in a variable called 'users' #}
{% for user in users %}
  {{ user.username | e }}
{% else %}
  {# Optional else block if no iteration took place because sequence was empty or the filtering removed all items from the sequence. #}
  No users found.
{% endfor %}

{#
Unlike other for loops, you cannot break or continue in a loop. Instead, use filters
#}

{% for user in users if not user.hidden %}
  {{ user.username |e }}
{% endfor %}

Special variables

Access special variables inside a for-loop block.

Get OneFuse module policies and property sets

Mon, 01 Jan 0001 00:00:00 +0000

Available in vRA Upstream Provider version: 2022.0.0.16546453.

Steps

In Aria Automation’s Canvas Designer or Custom Form Designer, create an Input
Fill out the Input form accordingly, expand “More Options” and select Pairs: External Source
Select Select under “Add an existing action”
Search for “populateDropdownFromOneFusePolicies” and select the action desired, sorted or unsorted:
- populateDropdownFromOneFusePoliciesSorted
- populateDropdownFromOneFusePoliciesUnsorted

Fill out the Action Parameters accordingly:

Field	Notes
`moduleIdentifier`	Required. Enter the OneFuse Endpoint Name used when configuring Policies and other things in vRA.
`endpointName`	Required. Enter the desired Module or Property Set from the list below: `ansibleTowerPolicies`, `dnsPolicies`, `ipamPolicies`, `microsoftADPolicies`, `namingPolicies`, `propertySets`, `scriptingPolicies`, `servicenowCMDBPolicies`, `servicenowConnectorPolicies`, `vraPolicies`. For Pluggable modules: `BP-8cs4eqym` for Notifications, `BP-suqzqf7h` for F5 BIG-IP, `BP-ibg2rdbe` for ServiceNow REST Client.
`modulePoliciesSearchString`	Optional. Enter the search string (prefix) to filter the Policies (or PropertySets) from a specific Module.
`labelEqualsNameOrDescription`	Optional. Defaults to `description`. Enter `name` to control if the Label should be the Name of the Policy. Enter `description` to control if the Label should be the Description of the Policy.
`sortOnLabelOrValue`	(Only available for populateDropdownFromOneFusePoliciesSorted.) Optional. Defaults to `label`. Enter `label` to control if the sorting should be performed on the dropdown’s label. Enter `value` to control if the sorting should be performed on the dropdown’s value.
`sortOrderAscOrDesc`	(Only available for populateDropdownFromOneFusePoliciesSorted.) Optional. Defaults to `ASC`. Enter `ASC` to sort ascending order. Enter `DESC` to sort descending order.
`verboseLogging`	Boolean. Select `TRUE` to control if the logging in the vRO backend should be Verbose. Logs are only available in the logfiles in the filesystem of vRO.

Select Save
Select Save again to add the new Input.

Microsoft Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Microsoft Active Directory.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file
Run terraform commands to create a Computer Account in AD:
1. terraform init
2. terraform plan
3. terraform apply
Run terraform command to delete the Computer Account from AD:
- terraform destroy

Create variables.tf

Add the following in the variables.tf file. Update the values as needed.

Microsoft Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Microsoft Active Directory.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Install OneFuse XUI per CloudBolt CMP.
Review an overview on OneFuse Modules with CloudBolt CMP.
Create a new Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module. Resource: Blueprints.

Configure the Blueprint

Know the name of the OneFuse Connection Info created via OneFuse XUI initial setup.
Determine which OneFuse Microsoft Active Directory Policy to run for this Blueprint.
Update the Blueprint to add in necessary parameters to invoke a OneFuse Microsoft Active Directory Policy.
Deploy the Blueprint to provision a deployment and create a computer account in Microsoft Active Directory.
Destroy the Deployment to remove the computer account from Microsoft Active Directory.

Update the Blueprint

Log in to CloudBolt CMP.
If not already on the Catalog page, select Catalog from the main menu.
Search and find the desired CloudBolt Blueprint.
Edit the Blueprint by selecting the gear icon on the bottom-right of the Catalog Item.

Add in necessary Parameters

The following Parameters need exist on the Blueprint.

Microsoft Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Microsoft Active Directory.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_ad('<policy_name>', <template_properties>, '<name>', '<tracking_id>')

Parameter references

The following defines the function of each Microsoft Active Directory specific Parameters.

Parameter Name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution. (See OneFuse Python Module Tracking ID Methods below.)

OneFuse Python Module Tracking ID Methods:

Microsoft Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Microsoft Active Directory.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per vRA Tenant.
Review the OneFuse Modules overview for vRealize Automation 7.6.
Create a new vRA Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
- Resource: Designing Machine Blueprints

Configure the Blueprint

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Microsoft Active Directory Policy to run for this Blueprint.
Update the Blueprint to add in the necessary vRA Property to invoke a OneFuse Microsoft Active Directory Policy.
Deploy the Blueprint to provision a vRA Deployment and create a computer account in Microsoft Active Directory.
Destroy the vRA Deployment to remove the computer account from Microsoft Active Directory.

Update the Blueprint

Log in to the vRA Tenant
Select the Design tab from the top menu bar
Select the Blueprints tab from the left menu
Edit the Blueprint and perform the below:

Add in necessary vRA property

The following vRA Property needs to be added to the Blueprint’s Properties > Custom Properties section under the Resource(s) of interest.

Naming

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Naming.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: naming

present

Generate a name for a resource.

Sample Play

- name: OneFuse Naming - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
  tasks:
  - name: Generate unique name
    onefuse:
      module: naming
      state: present
      policy_name: '{{ policy_name }}'
      template_properties: {}
      tracking_id: '{{ tracking_id  | default(omit) }}'
    delegate_to: localhost
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Set Stats"
    set_stats:
        data:
          onefuse_name: '{{ onefuse_name }}'
          tracking_id: '{{ tracking_id }}'

Parameter references

The following defines the function of each Naming specific Task Parameters for onefuse.

Ansible Tower

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Ansible Tower.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per Cloud Assembly Organization per Installation and setup.
Review an overview on OneFuse modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration (see Installation and setup).
Determine which OneFuse Ansible Tower Policies to run for this Cloud Template.
Determine when to run each OneFuse Ansible Tower Policy for the deployment provisioning lifecycle with vRA’s EBS.
Update the Cloud Template to add in necessary vRA Properties and/or add in the Custom Resource to invoke OneFuse Ansible Tower Policies.
Deploy the Cloud Template to provision a vRA Deployment and run Provision Job Template(s).
Destroy the vRA Deployment to run Deprovision Job Template(s), if any.

Update the Cloud Template

Log in to vRA > Cloud Assembly.
Select the Design tab from the top menu bar.
Select the Cloud Templates tab from the left menu.
Edit the Cloud Template and perform the steps below.

Option 1: add in necessary vRA properties

The following vRA Properties need to be added to the Cloud Template’s Code section under the Resource(s) of interest.

Naming

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Naming.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file

Run terraform commands to generate a Name:

terraform init
terraform plan
terraform apply

Example apply output:

$ terraform init

Initializing the backend...

Initializing provider plugins...

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

$ terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.


------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # onefuse_naming.my_name will be created
  + resource "onefuse_naming" "my_name" {
      + custom_name_id      = (known after apply)
      + dns_suffix          = "company.com"
      + id                  = (known after apply)
      + name                = (known after apply)
      + naming_policy_id    = "2"
      + template_properties = {
          + "Application" = "Web Servers"
          + "env"         = "prod"
          + "location"    = "atl"
          + "os"          = "linux"
          + "suffix"      = "company.com"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

------------------------------------------------------------------------

Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.

$ terraform apply

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # onefuse_naming.my_name will be created
  + resource "onefuse_naming" "my_name" {
      + custom_name_id      = (known after apply)
      + dns_suffix          = "company.com"
      + id                  = (known after apply)
      + name                = (known after apply)
      + naming_policy_id    = "2"
      + template_properties = {
          + "Application" = "Web Servers"
          + "env"         = "prod"
          + "location"    = "atl"
          + "os"          = "linux"
          + "suffix"      = "company.com"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

onefuse_naming.my_name: Creating...
onefuse_naming.my_name: Creation complete after 1s [id=prodlinuxatl2.company.com]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

$ terraform show
# onefuse_naming.my_name:
resource "onefuse_naming" "my_name" {
    custom_name_id      = 31
    dns_suffix          = "company.com"
    id                  = "prodlinuxatl2.company.com"
    name                = "prodlinuxatl2"
    naming_policy_id    = "2"
    template_properties = {
        "Application" = "Web Servers"
        "env"         = "prod"
        "location"    = "atl"
        "os"          = "linux"
        "suffix"      = "company.com"
    }
}

Run terraform command to destroy a generated Name:

terraform destroy

Example destroy output:

$ terraform destroy
onefuse_naming.my_name: Refreshing state... [id=prodlinuxatl2.company.com]

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # onefuse_naming.my_name will be destroyed
  - resource "onefuse_naming" "my_name" {
      - custom_name_id      = 31 -> null
      - dns_suffix          = "company.com" -> null
      - id                  = "prodlinuxatl2.company.com" -> null
      - name                = "prodlinuxatl2" -> null
      - naming_policy_id    = "2" -> null
      - template_properties = {
          - "Application" = "Web Servers"
          - "env"         = "prod"
          - "location"    = "atl"
          - "os"          = "linux"
          - "suffix"      = "company.com"
        } -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

onefuse_naming.my_name: Destroying... [id=prodlinuxatl2.company.com]
onefuse_naming.my_name: Destruction complete after 0s

Destroy complete! Resources: 1 destroyed.
$ terraform show

$

Naming

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to the Naming configuration section.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Install OneFuse XUI per CloudBolt CMP.
Review an overview on OneFuse Modules with CloudBolt CMP.
Create a new Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module. Resource: Blueprints.

Configure the Blueprint

Know the name of the OneFuse Connection Info created via OneFuse XUI initial setup.
Determine which OneFuse Naming Policy to run for this Blueprint.
Update the Blueprint to add in necessary parameters to invoke a OneFuse Naming Policy.
Deploy the Blueprint to provision a deployment and generate a name.
Destroy the Deployment to destroy the name for resource(s).

Update the Blueprint

Log in to CloudBolt CMP.
If not already on the Catalog page, select Catalog from the main menu.
Search and find the desired CloudBolt Blueprint.
Edit the Blueprint by selecting the gear icon on the bottom-right of the Catalog Item.

Add in necessary parameters

The following parameters need to exist on the Blueprint.

Naming

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Naming.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Generate a name for a resource.

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_naming('<policy_name>', <template_properties>, '<tracking_id>')

Parameter references

The following defines the function of each Naming specific parameters.

Parameter Name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution. See the OneFuse Python Module Tracking ID methods below.

OneFuse Python Module Tracking ID methods:

Naming

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Naming.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per vRA Tenant.
Review the OneFuse Modules overview for vRealize Automation 7.6.
Create a new vRA Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
- Resource: Designing Machine Blueprints

Configure the Blueprint

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Naming Policy to run for this Blueprint.
Update the Blueprint to add in the necessary vRA Property to invoke a OneFuse Naming Policy.
Deploy the Blueprint to provision a vRA Deployment and generate a name.
Destroy the vRA Deployment to destroy the vRA Deployment and name.

Update the Blueprint

Log in to the vRA Tenant.
Select the Design tab from the top menu bar.
Select the Blueprints tab from the left menu.
Edit the Blueprint and perform the below.

Add in necessary vRA Property

The following vRA Property needs to be added to the Blueprint’s Properties > Custom Properties section under the Resource(s) of interest.

Pluggable modules

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Pluggable modules.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: pluggable

present

Run Provisioning scenarios configured on the OneFuse Pluggable Module Policy for a resource.

Sample play

- name: OneFuse Pluggable Module - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
  tasks:
  - name: Run Pluggable Module Provisioning scenario(s)
    onefuse:
      module: pluggable
      state: present
      policy_name: '{{ policy_name }}'
      template_properties: {}
      tracking_id: '{{ tracking_id  | default(omit) }}'
    delegate_to: localhost
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Pass Pluggable Module Outputs to workflow"
    set_stats:
        data:
         onefuse_pluggable_module: '{{ onefuse_pluggable }}'
         tracking_id: '{{ tracking_id }}'

Parameter references

The following defines the function of each Pluggable Module specific Task Parameters for onefuse.

Tests

Mon, 01 Jan 0001 00:00:00 +0000

Tests can be used to test a variable against a common expression.

To test a variable or expression, you add the is-operator or is not-operator plus the name of the test after the variable.

{{ 21 is divisibleby(3) }}

=> true

boolean

Test returns true if the object is a boolean value.

{{ true is boolean }}

=> true

defined

Test returns true if the variable is defined.

{{ foo is defined }}

Refer to the default filter.

DNS

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to DNS.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per Cloud Assembly Organization.
Review an overview on OneFuse modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse DNS Policies to run for this Cloud Template.
Update the Cloud Template to add in the necessary vRA Properties and/or add in the Custom Resource to invoke a OneFuse DNS Policy.
Deploy the Cloud Template to provision a vRA Deployment and register DNS Record(s).
Destroy the vRA Deployment to remove the DNS Record(s) for the destroyed resource(s).

Update the Cloud Template

Log in to vRA > Cloud Assembly
Select the Design tab from the top menu bar
Select the Cloud Templates tab from the left menu
Edit the Cloud Template and perform the below:

Option 1: Add in necessary vRA Property

The following vRA Property needs to be added to the Cloud Template’s Code section under the Resource(s) of interest.

Filters

Mon, 01 Jan 0001 00:00:00 +0000

Filters appear inside {{ ... }} tags and are separated from the variable by a pipe symbol (|). Filters may have optional arguments in parentheses.

Multiple filters can be chained; the output of one filter is applied to the next.

{# Example 1 #}
{% set foo = ["hello", "world"] %}
{{ foo | first | upper }}


{# Example 2 #}
{# You can also apply filters on a block of template data within the filter section #}

{% filter upper %}
hello world
{% endfilter %}

Result:

Pluggable modules

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Pluggable modules.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file
Run terraform commands to deploy a OneFuse Pluggable Module Deployment and run provisioning scenario(s):
1. terraform init
2. terraform plan
3. terraform apply
Run terraform command to destroy OneFuse Pluggable Module Deployment and run deprovision scenario(s), if any:
- terraform destroy

Create variables.tf

Add the following in the variables.tf file. Update the values as needed.

Pluggable modules

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse feature, refer to Pluggable modules.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Install OneFuse XUI per CloudBolt CMP.
Review an overview on OneFuse Modules with CloudBolt CMP.
Create a new Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module. Resource: Blueprints.

Configure the Blueprint

Know the name of the OneFuse Connection Info created via OneFuse XUI initial setup.
Determine which OneFuse Pluggable Module Policies to run for this Blueprint.
Determine when to run each OneFuse Pluggable Module Policy for the deployment provisioning lifecycle with CMP’s Trigger Points.
Update the Blueprint to add in necessary parameters to invoke OneFuse Pluggable Module Policies.
Deploy the Blueprint to provision a deployment and run provisioning scenarios for the Pluggable Module Policy.
Destroy the Deployment to run deprovision scenarios for the Pluggable Module Policy, if any.

Update the Blueprint

Log in to CloudBolt CMP.
If not already on the Catalog page, select Catalog from the main menu.
Search and find the desired CloudBolt Blueprint.
Edit the Blueprint by selecting the cog icon on the bottom-right of the Catalog Item.

Add in necessary Parameters

The following Parameters need to exist on the Blueprint.

Pluggable modules

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Pluggable modules.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Run provisioning scenarios configured on the OneFuse Pluggable Module Policy for a resource.

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_module('<policy_name>', <template_properties>, '<tracking_id>')

Parameter references

The following defines the function of each Pluggable Module specific parameters.

Parameter Name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution. See the tracking ID methods below.

OneFuse Python Module Tracking ID methods

Method Name	Notes
`create_tracking_id()`	Generate a unique Tracking ID to link OneFuse Policy Executions and the resulting Managed Objects together.
`get_tracking_id_from_mo('<Path to OneFuse Managed Object>')`	Get the Tracking ID from a OneFuse Managed Object.
`add_tracking_id_to_headers('<Tracking ID>')`	Add Tracking ID into request headers. When making custom requests to OneFuse instead of using OneFuse Python Module methods provided.

Learn more about OneFuse Tracking ID.

Pluggable modules

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse feature, refer to Pluggable modules.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per vRA Tenant.
Review the OneFuse Modules overview for vRealize Automation 7.6.
Create a new vRA Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
- Resource: Designing Machine Blueprints

Configure the Blueprint

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Pluggable Module Policies to run for this Blueprint.
Determine when to run each OneFuse Pluggable Module Policy for the deployment provisioning lifecycle with vRA’s EBS'.
Update the Blueprint to add in necessary vRA Properties to invoke OneFuse Pluggable Module Policies.
Deploy the Blueprint to provision a vRA Deployment and run provisioning scenarios for the Pluggable Module Policy.
Destroy the vRA Deployment to run deprovision for the Pluggable Module Policy, if any.

Update the Blueprint

Log in to the vRA Tenant
Select the Design tab from the top menu bar
Select the Blueprints tab from the left menu
Edit the Blueprint and perform the below:

Add in necessary vRA Properties

The following vRA Properties need to be added Blueprint’s Properties > Custom Properties section under the Resource(s) of interest.

Scripting

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Scripting.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: scripting

present

Run Provisioning Script(s) configured on the OneFuse Scripting Policy for a resource.

Sample Play

- name: OneFuse Scripting - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
  tasks:
  - name: Execute Provisioning Script
    onefuse:
      module: scripting
      state: present
      policy_name: '{{ policy_name }}'
      template_properties: {}
      tracking_id: '{{ tracking_id  | default(omit) }}'
    delegate_to: localhost
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Pass Script Outputs to workflow"
    set_stats:
        data:
          onefuse_script: '{{ onefuse_script }}'

Parameter references

The following defines the function of each Scripting specific Task Parameters for onefuse.

Scripting

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about the Scripting module in OneFuse, refer to Scripting.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file
Run terraform commands to deploy a OneFuse Scripting Deployment and run the Provision Script:
1. terraform init
2. terraform plan
3. terraform apply
Run terraform command to destroy the OneFuse Scripting Deployment and run the Deprovision Script:
- terraform destroy

Create variables.tf

Add the following in the variables.tf file. Update the values as needed.

Scripting

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Scripting.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Install OneFuse XUI per CloudBolt CMP.
Review an overview on OneFuse Modules with CloudBolt CMP.
Create a new Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module. Resource: Blueprints.

Configure the Blueprint

Know the name of the OneFuse Connection Info created via OneFuse XUI initial setup.
Determine which OneFuse Scripting Policies to run for this Blueprint.
Determine when to run each OneFuse Scripting Policy for the deployment provisioning lifecycle with CMP’s Trigger Points.
Update the Blueprint to add in necessary parameters to invoke OneFuse Scripting Policies.
Deploy the Blueprint to provision a deployment and run Provision Script(s).
Destroy the Deployment to run Deprovision Script(s), if any.

Update the Blueprint

Log in to CloudBolt CMP.
If not already on the Catalog page, select Catalog from the main menu.
Search and find the desired CloudBolt Blueprint.
Edit the Blueprint by selecting the gear icon on the bottom-right of the Catalog Item.

Add in necessary parameters

The following Parameters need to exist on the Blueprint.

Scripting

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Scripting.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Run Provisioning Script(s) configured on the OneFuse Scripting Policy for a resource.

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_scripting('<policy_name>', <template_properties>, '<tracking_id>')

Parameter references

The following defines the function of each Scripting specific Parameters.

Parameter Name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution. See the OneFuse Python Module Tracking ID Methods table below.

OneFuse Python Module Tracking ID Methods:

Scripting

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Scripting.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per vRA Tenant.
Review the OneFuse Modules overview for vRealize Automation 7.6.
Create a new vRA Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
- Resource: Designing Machine Blueprints

Configure the Blueprint

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Scripting Policies to run for this Blueprint.
Determine when to run each OneFuse Scripting Policy for the deployment provisioning lifecycle with vRA’s EBS'.
Update the Blueprint to add in necessary vRA Properties to invoke OneFuse Scripting Policies.
Deploy the Blueprint to provision a vRA Deployment and run Provision Script(s).
Destroy the vRA Deployment to run Deprovision Script(s), if any.

Update the Blueprint

Log in to the vRA Tenant
Select the Design tab from the top menu bar
Select the Blueprints tab from the left menu
Edit the Blueprint and perform the below:

Add in necessary vRA Properties

The following vRA Properties need to be added to the Blueprint’s Properties > Custom Properties section under the Resource(s) of interest.

ServiceNow CMDB

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to ServiceNow CMDB.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: cmdb

present

Run Provisioning IRE Template(s) configured on the OneFuse ServiceNow CMDB Policy for a resource.

Sample Play

- name: OneFuse ServiceNow CMDB - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
  tasks:
  - name: Create ServiceNow CMDB CI Record
    onefuse:
     module: cmdb
     state: present
     policy_name: '{{ policy_name }}'
     template_properties: {}
     tracking_id: '{{ tracking_id  | default(omit) }}'
    delegate_to: localhost
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Pass ServiceNow CMDB Outputs to workflow"
    set_stats:
        data:
         onefuse_cmdb: '{{ onefuse_cmdb }}'
         tracking_id: '{{ tracking_id }}'

Parameter references

The following defines the function of each ServiceNow CMDB specific Task Parameters for onefuse.

ServiceNow CMDB

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to ServiceNow CMDB.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per vRA Tenant.
Review the OneFuse Modules overview for vRealize Automation 7.6.
Create a new vRA Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
- Resource: Designing Machine Blueprints

Configure the Blueprint

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse ServiceNow CMDB Policies to run for this Blueprint.
Update the Blueprint to add in necessary vRA Properties to invoke OneFuse ServiceNow CMDB Policies.
Deploy the Blueprint to provision a vRA Deployment and create ServiceNow CMDB Configuration Item(s) and run the Provision IRE Template.
Performing specific Day2 actions on the vRA Deployment will update the ServiceNow CMDB CI(s) accordingly and run the Update IRE Template.
Destroy the vRA Deployment to update the ServiceNow CMDB CI(s) with the specified deprovision status and IRE Template.

Update the Blueprint

Log in to the vRA Tenant
Select the Design tab from the top menu bar
Select the Blueprints tab from the left menu
Edit the Blueprint and perform the below:

Add in necessary vRA Properties

The following vRA Properties need to be added to the Blueprint’s Properties > Custom Properties section under the Resource(s) of interest.

Microsoft Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Microsoft Active Directory.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per Cloud Assembly Organization.
Review an overview on OneFuse Modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Microsoft Active Directory Policy to run for this Cloud Template.
Update the Cloud Template to add in the necessary vRA Property and/or add in the Custom Resource to invoke a OneFuse Microsoft Active Directory Policy.
Deploy the Cloud Template to provision a vRA Deployment and create a computer account in Microsoft Active Directory.
Destroy the vRA Deployment to remove the computer account from Microsoft Active Directory.

Update the Cloud Template

Log in to vRA > Cloud Assembly
Select the Design tab from the top menu bar
Select the Cloud Templates tab from the left menu
Edit the Cloud Template and perform the below:

Option 1: Add in necessary vRA property

The following vRA Property needs to be added to the Cloud Template’s Code section under the Resource(s) of interest.

ServiceNow CMDB

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to ServiceNow CMDB.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file

Run terraform commands to create a ServiceNow CI:

terraform init
terraform plan
terraform apply

See example apply output:

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment will be created
  + resource "onefuse_servicenow_cmdb_deployment" "my_servicenow_cmdb_deployment" {
      + configuration_items_info = (known after apply)
      + id                       = (known after apply)
      + policy_id                = 72
      + template_properties      = {
          + "OneFuse_Suffix" = "company.com"
          + "cpuCount"       = "2"
          + "dnsSuffix"      = "company.com"
          + "fqdn"           = "myhost.company.com"
          + "hostname"       = "myhost"
          + "ipAddress"      = "10.10.2.7"
          + "memoryMB"       = "4"
          + "platformUuid"   = "634f89cd-bcf8-421b-bfa3-65f09557abca"
          + "powerState"     = "On"
          + "totalStorageGB" = "30"
        }
      + workspace_url            = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + servicenow-cmdb-response = (known after apply)

------------------------------------------------------------------------

Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.


An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment will be created
  + resource "onefuse_servicenow_cmdb_deployment" "my_servicenow_cmdb_deployment" {
      + configuration_items_info = (known after apply)
      + id                       = (known after apply)
      + policy_id                = 72
      + template_properties      = {
          + "OneFuse_Suffix" = "company.com"
          + "cpuCount"       = "2"
          + "dnsSuffix"      = "company.com"
          + "fqdn"           = "myhost.company.com"
          + "hostname"       = "myhost"
          + "ipAddress"      = "10.10.2.7"
          + "memoryMB"       = "4"
          + "platformUuid"   = "634f89cd-bcf8-421b-bfa3-65f09557abca"
          + "powerState"     = "On"
          + "totalStorageGB" = "30"
        }
      + workspace_url            = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + servicenow-cmdb-response = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Creating...
onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Still creating... [10s elapsed]
onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Creation complete after 14s [id=73]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

servicenow-cmdb-response = tolist([
  tomap({
    "ciClassName" = "cmdb_ci_linux_server"
    "ciName" = "myhost-company.com"
  }),
])

Modify values, then run terraform apply again to update the ServiceNow CI:

In our example below, the cpuCount was updated from 2 to 4.

See example apply output:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment will be updated in-place
  ~ resource "onefuse_servicenow_cmdb_deployment" "my_servicenow_cmdb_deployment" {
        id                       = "73"
      ~ template_properties      = {
          ~ "cpuCount"       = "2" -> "4"
            # (9 unchanged elements hidden)
        }
        # (3 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Modifying... [id=73]
onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Still modifying... [id=73, 10s elapsed]
onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Modifications complete after 13s [id=73]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Outputs:

servicenow-cmdb-response = tolist([
  tomap({
    "ciClassName" = "cmdb_ci_linux_server"
    "ciName" = "myhost-company.com"
  }),
])

Run terraform command to delete the ServiceNow CI:

terraform destroy

See example destroy output:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment will be destroyed
  - resource "onefuse_servicenow_cmdb_deployment" "my_servicenow_cmdb_deployment" {
      - configuration_items_info = [
          - {
              - "ciClassName" = "cmdb_ci_linux_server"
              - "ciName"      = "myhost-company.com"
            },
        ] -> null
      - id                       = "73" -> null
      - policy_id                = 72 -> null
      - template_properties      = {
          - "OneFuse_Suffix" = "company.com"
          - "cpuCount"       = "4"
          - "dnsSuffix"      = "company.com"
          - "fqdn"           = "myhost.company.com"
          - "hostname"       = "myhost"
          - "ipAddress"      = "10.10.2.7"
          - "memoryMB"       = "4"
          - "platformUuid"   = "634f89cd-bcf8-421b-bfa3-65f09557abca"
          - "powerState"     = "On"
          - "totalStorageGB" = "30"
        } -> null
      - workspace_url            = "/api/v3/onefuse/workspaces/2/" -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  - servicenow-cmdb-response = [
      - {
          - "ciClassName" = "cmdb_ci_linux_server"
          - "ciName"      = "myhost-company.com"
        },
    ] -> null

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Destroying... [id=73]
onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Still destroying... [id=73, 10s elapsed]
onefuse_servicenow_cmdb_deployment.my_servicenow_cmdb_deployment: Destruction complete after 12s

Destroy complete! Resources: 1 destroyed.

ServiceNow CMDB

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to ServiceNow CMDB.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Install OneFuse XUI per CloudBolt CMP.
Review an overview on OneFuse Modules with CloudBolt CMP.
Create a new Blueprint (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module. Resource: Blueprints.

Configure the Blueprint

Know the name of the OneFuse Connection Info created via OneFuse XUI initial setup.
Determine which OneFuse ServiceNow CMDB Policy to run for this Blueprint.
Update the Blueprint to add in necessary parameters to invoke a OneFuse ServiceNow CMDB Policy.
Deploy the Blueprint to provision a deployment and create ServiceNow CMDB Configuration Item(s) and run the Provision IRE Template.
Performing specific Day2 actions on the Resource will update the ServiceNow CMDB CI(s) accordingly and run the Update IRE Template.
Destroy the Deployment to update the ServiceNow CMDB CI(s) with the specified deprovision status and IRE Template.

Update the Blueprint

Log in to CloudBolt CMP.
If not already on the Catalog page, select Catalog from the main menu.
Search and find the desired CloudBolt Blueprint.
Edit the Blueprint by selecting the gear icon on the bottom-right of the Catalog Item.

Add in necessary Parameters

The following Parameters need to exist on the Blueprint.

ServiceNow CMDB

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to ServiceNow CMDB.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Run Provisioning IRE Template(s) configured on the OneFuse ServiceNow CMDB Policy for a resource.

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_cmdb('<policy_name>', <template_properties>, '<tracking_id>')

Parameter references

The following defines the function of each ServiceNow CMDB specific Parameters.

Parameter Name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution. See OneFuse Python Module Tracking ID Methods below.

OneFuse Python Module Tracking ID Methods:

VMware Aria Automation

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Aria Automation.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Ansible Module

Ansible OneFuse Module name

Ansible OneFuse Module name for this OneFuse Module is: vra

present

Deploy a VMware Aria Automation 8x/Cloud Cloud Template.

Sample Play

- name: OneFuse vRealize Automation - present
  hosts: localhost
  gather_facts: false
  vars:
    policy_name: <REPLACEME_with_OneFusePolicyName>
    deployment_name: <REPLACEME_with_deploymentName>
  tasks:
  - name: Deploy vRA Cloud Template
    onefuse:
     module: vra
     state: present
     policy_name: '{{ policy_name }}'
     deployment_name: '{{ deployment_name }}'
     template_properties: {}
     tracking_id: '{{ tracking_id  | default(omit) }}'
    register: output
  - name: Output Results
    debug:
      msg: '{{ output }}'
  - name: "Pass vRA Outputs to workflow"
    set_stats:
        data:
         onefuse_vra: '{{ onefuse_vra }}'
         tracking_id: '{{ tracking_id }}'

Parameter references

The following defines the function of each Aria Automation specific Task Parameters for onefuse.

Naming

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Naming.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per Cloud Assembly Organization.
Review an overview on OneFuse modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Naming Policy to run for this Cloud Template.
Update the Cloud Template to add in the necessary vRA Property and/or add in the Custom Resource to invoke a OneFuse Naming Policy.
Deploy the Cloud Template to provision a vRA Deployment and generate a name.
Destroy the vRA Deployment to destroy the vRA Deployment and name.

Update the Cloud Template

Log in to vRA > Cloud Assembly
Select the Design tab from the top menu bar
Select the Cloud Templates tab from the left menu
Edit the Cloud Template and perform the below:

Option 1: Add in necessary vRA property

The following vRA Property needs to be added to the Cloud Template’s Code section under the Resource(s) of interest.

Release notes

Mon, 01 Jan 0001 00:00:00 +0000

v2025.1.246

Released August 15, 2025:

OneFuse - BE: Added the fix to support AAP version 2.5 in OneFuse. CMP-3107
OneFuse - FE: Added an input field to collect the AAP version. CMP-3161
OneFuse - Added date and time properties to the ServiceNow pluggable module for provision, deprovision, and update operations. CMP-2367
OneFuse Terraform Provider - Excluded the empty ‘records’ parameter in DNSReservation. CMP-3104

See the Cloud Management Platform (CMP) 2025.1.246 release notes for further details.

VMware Aria Automation

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse Module, refer to Aria Automation.

Prerequisites

Configure the OneFuse Provider
Review an overview on OneFuse Modules with Terraform

Steps

Create variables.tf file
Create main.tf file

Run terraform commands to deploy a VMware Aria Automation Deployment:

terraform init
terraform plan
terraform apply

Example apply output:

Initializing the backend...

Initializing provider plugins...
- Reusing previous version of cloudboltsoftware/onefuse from the dependency lock file
- Using previously-installed cloudboltsoftware/onefuse v1.20.0

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # onefuse_vra_deployment.my_vra_deployment will be created
  + resource "onefuse_vra_deployment" "my_vra_deployment" {
      + blueprint_name      = (known after apply)
      + deployment_info     = (known after apply)
      + deployment_name     = "tf_vra_deployment"
      + id                  = (known after apply)
      + policy_id           = 1
      + project_name        = (known after apply)
      + template_properties = {
          + "Environment" = "Dev"
        }
      + workspace_url       = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + deployment_info = (known after apply)

------------------------------------------------------------------------

Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.


An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # onefuse_vra_deployment.my_vra_deployment will be created
  + resource "onefuse_vra_deployment" "my_vra_deployment" {
      + blueprint_name      = (known after apply)
      + deployment_info     = (known after apply)
      + deployment_name     = "tf_vra_deployment"
      + id                  = (known after apply)
      + policy_id           = 1
      + project_name        = (known after apply)
      + template_properties = {
          + "Environment" = "Dev"
        }
      + workspace_url       = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + deployment_info = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

onefuse_vra_deployment.my_vra_deployment: Creating...
onefuse_vra_deployment.my_vra_deployment: Still creating... [10s elapsed]
...
onefuse_vra_deployment.my_vra_deployment: Creation complete after 21m9s [id=1]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

deployment_info = "{\"blueprintId\":\"30adbde1-914b-48ae-80d5-38f67a0a76fd\",\"blueprintVersion\":\"1\",\"childResources\":[{\"createdAt\":\"2021-04-07T20:12:59.012526Z\",\"id\":\"89a59c4d-b64f-407f-a393-fe391c9023d5\",\"name\":\"Cloud_vSphere_Machine_1\",\"properties\":{\"account\":\"vcenter.company.com\",\"componentType\":\"Cloud.vSphere.Machine\",\"computeHostRef\":\"ResourcePool:resgroup-223319\",\"computeHostType\":\"ResourcePool\",\"coreCount\":\"1\",\"cpuCount\":1,\"datastoreName\":\"XtremIO\",\"endpointId\":\"0cf54d7c-f889-42b2-9596-275723a4442b\",\"endpointType\":\"vsphere\",\"flavorMappingName\":\"\",\"id\":\"/resources/compute/89a59c4d-b64f-407f-a393-fe391c9023d5\",\"imageRef\":\"MassTesting\",\"name\":\"Cloud_vSphere_Machine_1\",\"networks\":[{\"assignment\":\"dynamic\",\"deviceIndex\":0,\"id\":\"/resources/network-interfaces/184557fe-7a0f-4eff-94c4-87dd4e5df2f1\",\"mac_address\":\"00:50:56:a5:10:ac\",\"name\":\"dvs_102_10.10.2.0_24\",\"resourceName\":\"dvs_102_10.10.2.0_24\"}],\"osType\":\"LINUX\",\"powerState\":\"ON\",\"primaryMAC\":\"00:50:56:a5:10:ac\",\"project\":\"ae8d2e8e-ace6-4bf2-916a-bb10aa731d1b\",\"providerId\":\"5025e14b-38b7-8ea0-ce5b-580eb8bee60d\",\"provisionGB\":\"0\",\"region\":\"onefuse\",\"resourceDescLink\":\"/resources/compute-descriptions/efd6c152-6bab-4a78-af9f-079743f09cbb\",\"resourceId\":\"89a59c4d-b64f-407f-a393-fe391c9023d5\",\"resourceLink\":\"/resources/compute/89a59c4d-b64f-407f-a393-fe391c9023d5\",\"resourceName\":\"vrauserqa-976\",\"resourcePool\":\"/resources/pools/7248f32e8f9b5c75-7f703c5265a63d87\",\"softwareName\":\"Other (64-bit)\",\"storage\":{\"disks\":[{\"bootOrder\":1,\"capacityGb\":0,\"controllerKey\":\"1000\",\"controllerUnitNumber\":\"0\",\"diskPlacementRef\":\"StoragePod:group-p100\",\"encrypted\":false,\"independent\":\"false\",\"name\":\"vrauserqa-976-boot-disk\",\"persistent\":false,\"provisionGB\":\"0\",\"provisioningType\":\"thin\",\"type\":\"HDD\",\"vcUuid\":\"634f89cd-bcf8-421b-bfa3-65f09557abca\",\"vm\":\"VirtualMachine:vm-710951\"}]},\"totalMemoryMB\":1024,\"vcUuid\":\"634f89cd-bcf8-421b-bfa3-65f09557abca\",\"zone\":\"Cluster1 / ESX Agents\",\"zone_overlapping_migrated\":\"true\"},\"state\":\"OK\",\"type\":\"Cloud.vSphere.Machine\"}],\"createdAt\":\"2021-04-07T20:12:42.249541Z\",\"createdBy\":\"vrauser\",\"description\":\"\",\"id\":\"6162920c-d7df-4018-b843-0bb5e68873b7\",\"inputs\":{\"cpuCount\":1,\"totalMemoryMB\":1024},\"lastUpdatedAt\":\"2021-04-07T20:33:29.905193Z\",\"lastUpdatedBy\":\"vrauser\",\"name\":\"tf_vra_deployment\",\"orgId\":\"c1cb7d03-37ee-4fbe-a052-6d2c4af5a8a8\",\"ownedBy\":\"vrauser\",\"projectId\":\"ae8d2e8e-ace6-4bf2-916a-bb10aa731d1b\",\"status\":\"CREATE_SUCCESSFUL\"}"

Run terraform command to destroy Aria Automation Deployment:

terraform destroy

Example destroy output:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # onefuse_vra_deployment.my_vra_deployment will be destroyed
  - resource "onefuse_vra_deployment" "my_vra_deployment" {
      - blueprint_name      = "myblueprint" -> null
      - deployment_info     = jsonencode(
            {
              - blueprintId      = "30adbde1-914b-48ae-80d5-38f67a0a76fd"
              - blueprintVersion = "1"
              - childResources   = [
                  - {
                      - createdAt  = "2021-04-07T20:12:59.012526Z"
                      - id         = "89a59c4d-b64f-407f-a393-fe391c9023d5"
                      - name       = "Cloud_vSphere_Machine_1"
                      - properties = {
                          - account                   = "vcenter01.company.com"
                          - componentType             = "Cloud.vSphere.Machine"
                          - computeHostRef            = "ResourcePool:resgroup-223319"
                          - computeHostType           = "ResourcePool"
                          - coreCount                 = "1"
                          - cpuCount                  = 1
                          - datastoreName             = "XtremIO_5t_datastore3"
                          - endpointId                = "0cf54d7c-f889-42b2-9596-275723a4442b"
                          - endpointType              = "vsphere"
                          - flavorMappingName         = ""
                          - id                        = "/resources/compute/89a59c4d-b64f-407f-a393-fe391c9023d5"
                          - imageRef                  = "MassTesting"
                          - name                      = "Cloud_vSphere_Machine_1"
                          - networks                  = [
                              - {
                                  - assignment   = "dynamic"
                                  - deviceIndex  = 0
                                  - id           = "/resources/network-interfaces/184557fe-7a0f-4eff-94c4-87dd4e5df2f1"
                                  - mac_address  = "00:50:56:a5:10:ac"
                                  - name         = "dvs_102_10.10.2.0_24"
                                  - resourceName = "dvs_102_10.10.2.0_24"
                                },
                            ]
                          - osType                    = "LINUX"
                          - powerState                = "ON"
                          - primaryMAC                = "00:50:56:a5:10:ac"
                          - project                   = "ae8d2e8e-ace6-4bf2-916a-bb10aa731d1b"
                          - providerId                = "5025e14b-38b7-8ea0-ce5b-580eb8bee60d"
                          - provisionGB               = "0"
                          - region                    = "onefuse"
                          - resourceDescLink          = "/resources/compute-descriptions/efd6c152-6bab-4a78-af9f-079743f09cbb"
                          - resourceId                = "89a59c4d-b64f-407f-a393-fe391c9023d5"
                          - resourceLink              = "/resources/compute/89a59c4d-b64f-407f-a393-fe391c9023d5"
                          - resourceName              = "vrauserqa-976"
                          - resourcePool              = "/resources/pools/7248f32e8f9b5c75-7f703c5265a63d87"
                          - softwareName              = "Other (64-bit)"
                          - storage                   = {
                              - disks = [
                                  - {
                                      - bootOrder            = 1
                                      - capacityGb           = 0
                                      - controllerKey        = "1000"
                                      - controllerUnitNumber = "0"
                                      - diskPlacementRef     = "StoragePod:group-p100"
                                      - encrypted            = false
                                      - independent          = "false"
                                      - name                 = "vrauserqa-976-boot-disk"
                                      - persistent           = false
                                      - provisionGB          = "0"
                                      - provisioningType     = "thin"
                                      - type                 = "HDD"
                                      - vcUuid               = "634f89cd-bcf8-421b-bfa3-65f09557abca"
                                      - vm                   = "VirtualMachine:vm-710951"
                                    },
                                ]
                            }
                          - totalMemoryMB             = 1024
                          - vcUuid                    = "634f89cd-bcf8-421b-bfa3-65f09557abca"
                          - zone                      = "Cluster1 / ESX Agents"
                          - zone_overlapping_migrated = "true"
                        }
                      - state      = "OK"
                      - type       = "Cloud.vSphere.Machine"
                    },
                ]
              - createdAt        = "2021-04-07T20:12:42.249541Z"
              - createdBy        = "vrauser"
              - description      = ""
              - id               = "6162920c-d7df-4018-b843-0bb5e68873b7"
              - inputs           = {
                  - cpuCount      = 1
                  - totalMemoryMB = 1024
                }
              - lastUpdatedAt    = "2021-04-07T20:33:29.905193Z"
              - lastUpdatedBy    = "vrauser"
              - name             = "tf_vra_deployment"
              - orgId            = "c1cb7d03-37ee-4fbe-a052-6d2c4af5a8a8"
              - ownedBy          = "vrauser"
              - projectId        = "ae8d2e8e-ace6-4bf2-916a-bb10aa731d1b"
              - status           = "CREATE_SUCCESSFUL"
            }
        ) -> null
      - deployment_name     = "tf_vra_deployment" -> null
      - id                  = "1" -> null
      - policy_id           = 1 -> null
      - project_name        = "Quickstart Project 1" -> null
      - template_properties = {
          - "Environment" = "Dev"
        } -> null
      - workspace_url       = "/api/v3/onefuse/workspaces/2/" -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  - deployment_info = jsonencode(
        {
          - blueprintId      = "30adbde1-914b-48ae-80d5-38f67a0a76fd"
          - blueprintVersion = "1"
          - childResources   = [
              - {
                  - createdAt  = "2021-04-07T20:12:59.012526Z"
                  - id         = "89a59c4d-b64f-407f-a393-fe391c9023d5"
                  - name       = "Cloud_vSphere_Machine_1"
                  - properties = {
                      - account                   = "vcenter01.company.com"
                      - componentType             = "Cloud.vSphere.Machine"
                      - computeHostRef            = "ResourcePool:resgroup-223319"
                      - computeHostType           = "ResourcePool"
                      - coreCount                 = "1"
                      - cpuCount                  = 1
                      - datastoreName             = "XtremIO_datastore3"
                      - endpointId                = "0cf54d7c-f889-42b2-9596-275723a4442b"
                      - endpointType              = "vsphere"
                      - flavorMappingName         = ""
                      - id                        = "/resources/compute/89a59c4d-b64f-407f-a393-fe391c9023d5"
                      - imageRef                  = "MassTesting"
                      - name                      = "Cloud_vSphere_Machine_1"
                      - networks                  = [
                          - {
                              - assignment   = "dynamic"
                              - deviceIndex  = 0
                              - id           = "/resources/network-interfaces/184557fe-7a0f-4eff-94c4-87dd4e5df2f1"
                              - mac_address  = "00:50:56:a5:10:ac"
                              - name         = "dvs_102_10.10.2.0_24"
                              - resourceName = "dvs_102_10.10.2.0_24"
                            },
                        ]
                      - osType                    = "LINUX"
                      - powerState                = "ON"
                      - primaryMAC                = "00:50:56:a5:10:ac"
                      - project                   = "ae8d2e8e-ace6-4bf2-916a-bb10aa731d1b"
                      - providerId                = "5025e14b-38b7-8ea0-ce5b-580eb8bee60d"
                      - provisionGB               = "0"
                      - region                    = "onefuse"
                      - resourceDescLink          = "/resources/compute-descriptions/efd6c152-6bab-4a78-af9f-079743f09cbb"
                      - resourceId                = "89a59c4d-b64f-407f-a393-fe391c9023d5"
                      - resourceLink              = "/resources/compute/89a59c4d-b64f-407f-a393-fe391c9023d5"
                      - resourceName              = "vrauserqa-976"
                      - resourcePool              = "/resources/pools/7248f32e8f9b5c75-7f703c5265a63d87"
                      - softwareName              = "Other (64-bit)"
                      - storage                   = {
                          - disks = [
                              - {
                                  - bootOrder            = 1
                                  - capacityGb           = 0
                                  - controllerKey        = "1000"
                                  - controllerUnitNumber = "0"
                                  - diskPlacementRef     = "StoragePod:group-p100"
                                  - encrypted            = false
                                  - independent          = "false"
                                  - name                 = "vrauserqa-976-boot-disk"
                                  - persistent           = false
                                  - provisionGB          = "0"
                                  - provisioningType     = "thin"
                                  - type                 = "HDD"
                                  - vcUuid               = "634f89cd-bcf8-421b-bfa3-65f09557abca"
                                  - vm                   = "VirtualMachine:vm-710951"
                                },
                            ]
                        }
                      - totalMemoryMB             = 1024
                      - vcUuid                    = "634f89cd-bcf8-421b-bfa3-65f09557abca"
                      - zone                      = "Cluster1 / ESX Agents"
                      - zone_overlapping_migrated = "true"
                    }
                  - state      = "OK"
                  - type       = "Cloud.vSphere.Machine"
                },
            ]
          - createdAt        = "2021-04-07T20:12:42.249541Z"
          - createdBy        = "vrauser"
          - description      = ""
          - id               = "6162920c-d7df-4018-b843-0bb5e68873b7"
          - inputs           = {
              - cpuCount      = 1
              - totalMemoryMB = 1024
            }
          - lastUpdatedAt    = "2021-04-07T20:33:29.905193Z"
          - lastUpdatedBy    = "vrauser"
          - name             = "tf_vra_deployment"
          - orgId            = "c1cb7d03-37ee-4fbe-a052-6d2c4af5a8a8"
          - ownedBy          = "vrauser"
          - projectId        = "ae8d2e8e-ace6-4bf2-916a-bb10aa731d1b"
          - status           = "CREATE_SUCCESSFUL"
        }
    ) -> null

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

onefuse_vra_deployment.my_vra_deployment: Destroying... [id=1]
onefuse_vra_deployment.my_vra_deployment: Still destroying... [id=1, 10s elapsed]
onefuse_vra_deployment.my_vra_deployment: Still destroying... [id=1, 20s elapsed]
onefuse_vra_deployment.my_vra_deployment: Still destroying... [id=1, 30s elapsed]
onefuse_vra_deployment.my_vra_deployment: Still destroying... [id=1, 40s elapsed]
onefuse_vra_deployment.my_vra_deployment: Destruction complete after 43s

Destroy complete! Resources: 1 destroyed.

VMware Aria Automation

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Aria Automation.

Prerequisites

Configure OneFuse Manager
Review an overview on OneFuse Modules with OneFuse Python Module

Provision

Deploy a VMware Aria Automation 8x/Cloud Cloud Template.

Method

#Run the following in the Python Console
#Assumes OneFuse Manager is instantiated to 'ofm' variable

ofm.provision_vra('<policy_name>', <template_properties>, '<deployment_name>', '<tracking_id>')

Parameter references

The following defines the function of each Aria Automation specific Parameters.

Parameter Name	Required?	Notes
`policy_name`	Required	OneFuse Module Policy Name (string).
`template_properties`	Optional	Additional properties that are referenced within the Policy. Python dict format.
`tracking_id`	Optional	Tracking ID (string) to link multiple OneFuse Policy Executions and resulting OneFuse Managed Objects together. If none is passed, one gets generated by OneFuse for that specific Policy Execution. See tracking ID methods below.

OneFuse Python Module Tracking ID methods:

Pluggable modules

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse feature, refer to Pluggable modules.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per Cloud Assembly Organization.
Review an overview on OneFuse modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Pluggable Module Policies to run for this Cloud Template.
Determine when to run each OneFuse Pluggable Module Policy for the deployment provisioning lifecycle with vRA’s EBS'.
Update the Cloud Template to add in necessary vRA Properties and/or add in the Custom Resource to invoke OneFuse Pluggable Module Policies.
Deploy the Cloud Template to provision a vRA Deployment and run provisioning scenarios for the Pluggable Module Policy.
Destroy the vRA Deployment to run deprovision for the Pluggable Module Policy, if any.

Update the Cloud Template

Log in to vRA > Cloud Assembly
Select the Design tab from the top menu bar
Select the Cloud Templates tab from the left menu
Edit the Cloud Template and perform the below:

Option 1: add in necessary vRA properties

The following vRA Properties need to be added to the Cloud Template’s Code section under the Resource(s) of interest.

Scripting

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Scripting.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per Cloud Assembly Organization.
Review an overview on OneFuse Modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse Scripting Policies to run for this Cloud Template.
Determine when to run each OneFuse Scripting Policy for the deployment provisioning lifecycle with vRA’s EBS'.
Update the Cloud Template to add in necessary vRA Properties and/or add in the Custom Resource to invoke OneFuse Scripting Policies.
Deploy the Cloud Template to provision a vRA Deployment and run Provision Script(s).
Destroy the vRA Deployment to run Deprovision Script(s), if any.

Update the Cloud Template

Log in to vRA > Cloud Assembly
Select the Design tab from the top menu bar
Select the Cloud Templates tab from the left menu
Edit the Cloud Template and perform the below:

Option 1: add in necessary vRA properties

The following vRA Properties need to be added to the Cloud Template’s Code section under the Resource(s) of interest.

ServiceNow CMDB

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to ServiceNow CMDB.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per Cloud Assembly Organization.
Review an overview on OneFuse Modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse ServiceNow CMDB Policies to run for this Cloud Template.
Update the Cloud Template to add in necessary vRA Properties and/or add in the Custom Resource to invoke OneFuse ServiceNow CMDB Policies.
Deploy the Cloud Template to provision a vRA Deployment and create ServiceNow CMDB Configuration Item(s) and run the Provision IRE Template.
Performing specific Day2 actions on the vRA Deployment will update the ServiceNow CMDB CI(s) accordingly and run the Update IRE Template.
Destroy the vRA Deployment to update the ServiceNow CMDB CI(s) with the specified deprovision status and IRE Template.

Update the Cloud Template

Log in to vRA > Cloud Assembly
Select the Design tab from the top menu bar
Select the Cloud Templates tab from the left menu
Edit the Cloud Template and perform the below:

Option 1: add in necessary vRA properties

The following vRA Properties need to be added to the Cloud Template’s Code section under the Resource(s) of interest.

VM tagging

Mon, 01 Jan 0001 00:00:00 +0000

To learn more, refer to Templating and Property Toolkit.

Feature highlights

Attach one or more Standard Tags to the VM as it is provisioned.
Automate multiple scenarios of Standard Tag Names and values with OneFuse Template Engine.
Define one or more vRA custom properties that influence the creation of VM Tags.
Define a Standard Tag via JSON format of key:value pair.
Supports OneFuse Template Engine for both key:value pair.
Supports ordering sets/groupings of Standard Tags by alphabetizing after the Property Key prefix.

Prerequisites

Run OneFuse Configuration per Cloud Assembly Organization.
Review an overview on OneFuse modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which Standard Tag Categories and Tag Names are needed for this Cloud Template.
Update the Cloud Template to add in necessary vRA Properties to create Standard Tags.
Deploy the Cloud Template to provision a vRA Deployment and create and/or associate Tag(s).
Destroy the vRA Deployment to destroy the vRA Deployment and disassociate itself from Tag(s).

Update the Cloud Template

Log in to vRA > Cloud Assembly
Select the Design tab from the top menu bar
Select the Cloud Templates tab from the left menu
Edit the Cloud Template and perform the below:

Add in necessary vRA Properties

The following vRA Properties need to be added to the Cloud Template’s Code section under the Resource(s) of interest.

Aria Automation

Mon, 01 Jan 0001 00:00:00 +0000

To learn more about this OneFuse module, refer to Aria Automation.

Prerequisites

Configure OneFuse Property Set(s) and OneFuse Module Policies.
Run OneFuse Configuration per Cloud Assembly Organization.
Review an overview on OneFuse modules with Aria Automation 8.1+/Cloud.
Create a new Cloud Template (if none exist) or determine which existing Cloud Template(s) will utilize this OneFuse Module.
- Resource: Designing your vRealize Automation Cloud Assembly deployments

Steps

Know the name of the OneFuse Endpoint created via OneFuse Configuration.
Determine which OneFuse vRA Policies to run for this Cloud Template.
Determine when to run each OneFuse vRA Policy for the deployment provisioning lifecycle with vRA’s EBS'.
Update the Cloud Template to add in necessary vRA Properties and/or add in the Custom Resource to invoke OneFuse vRA Policies.
Deploy the Cloud Template to provision additional vRA Deployment(s).
Destroy the vRA Deployment to destroy the dynamically provisioned vRA Deployment(s).

Update the Cloud Template

Log in to vRA > Cloud Assembly
Select the Design tab from the top menu bar
Select the Cloud Templates tab from the left menu
Edit the Cloud Template and perform the below:

Option 1: add in necessary vRA properties

The following vRA Properties need to be added to the Cloud Template’s Code section under the Resource(s) of interest.