Essential Automation
Production-grade open-source repositories from real VMware customer engagements.
Each repository represents a workstream from a real customer engagement — sanitized of all customer-identifying detail, published under GPL-3.0, and ready for adaptation in other environments. Read the customer success story for each to understand the full context, then clone the repository to use the code.
Platform Migration
Aria Automation → VCF Automation 9.1 Migrator
Capture an Aria Automation 8.18 environment as one reviewable YAML document and rebuild it on VCF Automation 9.1 — including onto fabric that doesn’t match. Four lifecycle commands (export, dry-run import, verify, purge) plus read-only assessment of what a rebuild can’t carry. Python 3.8+, GPL-3.0, 104 tests.
Aria Automation Modernization
BlueCat IPAM Provider for Aria Automation
Production-ready third-party IPAM provider integrating BlueCat Address Manager with VMware Aria Automation. ABX-based with five Python actions: ValidateEndpoint, GetIPRanges, AllocateIP, DeallocateIP, UpdateRecord. Federation-aware via Strategy-4 prefix-stripping for Global Manager segments. Format-preserving package builds matching the reference Infoblox implementation. DNS host record + PTR creation via BlueCat’s quickDeploy.
License: GPL-3.0 | Language: Python | Requires: Aria Automation 8.x+, BlueCat Address Manager (Proteus)
Aria Network Automation Toolkit
Multi-tool Python toolkit for managing Aria Automation infrastructure as code. aria_mapping.py handles flavors, images, storage, capability tags, segment tags, and DNS via configuration-as-code. mapper.py provides multi-profile NSX network management with CIDR-based BlueCat IPAM matching and dynamic VCF sub-account discovery. cleanup_profiles.py performs Federation-aware cleanup of ghost and duplicate network entries. Reduced one customer’s TX network profile from 2,500+ stale references to 155 clean workload networks.
License: GPL-3.0 | Language: Python | Requires: Aria Automation 8.x+, NSX Federation, BlueCat (recommended)
Unified VM Deployment Blueprint
One Cloud Assembly blueprint serving Windows, Linux, and Oracle VM provisioning. Twenty-six dynamic inputs with comprehensive validation. Hybrid network resource declaration (Cloud.vSphere.Network for VLAN-backed segments, Cloud.NSX.Network for overlay) for federated VCF environments. Service Broker custom form with $dynamicEnum live dropdown integration. Conditional second-NIC pattern via count: 0. Empty-string-default safety mechanism preventing accidental misdeployments. Eight major versions of production iteration (v5.5.1 → v8.8.3).
License: GPL-3.0 | Language: YAML + JSON | Requires: Aria Automation 8.x+, Service Broker custom forms
vRO Actions for Aria Automation
Three production JavaScript actions in the com.essential.aria vRealize Orchestrator module solving capabilities Aria doesn’t provide natively. getNetworkSegmentsAll powers dynamic Service Broker dropdowns from live NSX data. getNetworkProfileTag routes deployment requests to the correct network profile based on segment and datacenter selection. addDataDisksOnDeploy is the post-provision disk attach event subscription that bypasses Aria’s storage validator while waiting for VMware Tools confirmation.
License: GPL-3.0 | Language: JavaScript (vRO) | Requires: vRO 8.x, Aria Automation 8.x+
Ansible Windows Post-Deploy Library
Ten production Ansible roles replacing legacy inline-PowerShell post-deploy workflows. Built around the desired-state dispatcher pattern: every role checks current state before changing it, making the playbook safely re-runnable against any VM at any time. Roles cover timezone, KMS activation, Windows hardening, RDP, fleet agents, build info registry, AD groups, DNS validation, WinRM HTTPS, and domain join. Includes enable_winrm_handler.py ABX bridge that pushes ConfigureRemotingForAnsible.ps1 via VMware Tools Guest Operations before Ansible connects.
License: GPL-3.0 | Language: Ansible (YAML) + Python (ABX) | Requires: Ansible 2.15+, Aria Automation 8.x+
Ansible Inventory Generators
Two Python inventory generators triggered via vRO workflows so operators never leave the Aria UI. The vSphere generator pulls VMs from vCenter with intelligent IP resolution preferring VMware Tools data, groups by OS, folder, and environment, and writes INI-format Ansible inventories. The HPE OneView generator supports OneView 6.6 (API 3800), 8.9 (API 6400), and 10.0 (API 7600) with auth variants for local and directory accounts. Each ships with vRO workflow JS and a signed .package file.
License: GPL-3.0 | Language: Python | Requires: vRO 8.x, vSphere or HPE OneView 6.6/8.9/10.0
ACI EPG Placement for Aria
Orchestrator actions that place a VM in a Cisco ACI EPG when the vendor plugin no longer covers the Aria release. Authenticate, list, verify the EPG, resolve the port group, and move the NIC. Endpoints are inputs. Nothing in the files is a site value.
License: GPL-3.0 | Language: JavaScript | Requires: Aria Automation Orchestrator, APIC API access, vCenter
Ansible Automation
The paved-path playbook bundle. 350 roles, ready-to-run Linux and Windows build playbooks, and a worked-example inventory. The Windows post-deploy roles and the dynamic inventory generators feed this repo.
License: GPL-3.0 | Language: Ansible | Requires: Ansible, an inventory copied from the example
Federal STIG Compliance
VMware vSphere 8.0 STIG Compliance Tooling
Production tooling for VMware vSphere 8.0 STIG compliance scanning at federal scale. Includes a Base64-based train-vmware password fix for vCenter passwords containing special characters, an enhanced PowerShell InSpec runner with -allhosts mode that scans entire clusters and produces per-host JSON + CKL artifacts, a Python CKL → CKLB converter that preserves mode flags, GUIDs, and target metadata for STIG Viewer 3.x, plus comprehensive scanning documentation and Photon OS 5.0 static-IP configuration guides.
License: GPL-3.0 | Language: Ruby + PowerShell + Python | Requires: VMware STIG Tools Appliance 5.x, vSphere 8.0 U2/U3, v2r3-stig content baseline
Infrastructure & Imaging
Custom ESXi ISO Builder for HPE Synergy
PowerCLI Image Builder tooling that combines a VMware base ESXi depot with an HPE Synergy AddOn depot into an installable custom ISO — so HPE Synergy compute modules booting from SAN can see their boot LUN at install time. Now the HPE-supported path forward following the deprecation of pre-built Synergy custom ISOs (SSP 2026.01.xx). Includes a parameterized build script, a VIB-merge validation script that catches silent partial merges, a BOM-free JSON spec writer, and post-install host validation. Documents the three gotchas that aren’t in the official docs: the UTF-8 BOM, relative-path resolution, and the partner acceptance level.
License: GPL-3.0 | Language: PowerShell + Shell | Requires: VMware PowerCLI (ImageBuilder), Python 3.7–3.12, VMware base + HPE Synergy AddOn depots (bring your own)
SPP ESXi VIB Extractor
The companion to the ISO builder. With HPE delivering ESXi drivers inside the Service Pack (SPP) rather than as standalone AddOn depots, the drivers you need are buried in a bundle that mixes every operating system together — and the SPP content list has no column grouping components by OS release. This tool scans an extracted SPP, finds the ESXi VIBs (including those wrapped inside HPE smart components), groups them by ESXi release into folders, and emits a manifest with the OS-release column the SPP report lacks. The grouped output feeds straight into the ISO builder. Validated against a real HPE Synergy AddOn depot and a VMware ESXi 9.0.2 base depot.
License: GPL-3.0 | Language: Python (standard library only) + PowerShell wrapper | Requires: Python 3.7–3.12, an extracted HPE SPP (bring your own)
ESXi Host Prep for VCF Commissioning
Three shell scripts, one hosts.yaml. esx_ready.sh 1.20 upgrades standalone hosts to the target build, downward too with update_mode: install, and brings each one to the seven things VCF 9.1 commissioning checks, waits out the reboots and resumes after Ctrl-C. It leaves the old vSAN cluster, breaks up the old disk groups by their cache device and only then clears the disks; moves vmk0 off a distributed switch a vCenter left behind with --restore-vswitch; and carries a 104-check self-test that runs the host-side script against stubbed esxcli, partedUtil and vdq, with order assertions for the bugs that only show in sequence. esx_prep.sh does the seven checks on hosts already on the build; esx_push.sh stages a bundle and upgrades. Plan is the default. A host already in a cluster, managed by a vCenter or waiting on a reboot is left alone, and disk wipes need an explicit flag. The day it went from 1.12 to 1.20 is its own story.
License: GPL-3.0 | Language: POSIX shell (esx_prep.sh: bash) | Requires: standalone ESXi hosts and root over SSH; runs from a jump box or from one of the hosts
VCF 9.1 Operations
NSX DFW, Global Manager to Global Manager
Export a distributed firewall from one NSX Global Manager, plan the move, and stage every policy disabled. Apply does not write without –commit. An API 200 is not proof the rule is realized. TLS verification stays on.
License: GPL-3.0 | Language: Python | Requires: Python 3.9+, requests, NSX Global Manager
Avi Blue to Green
Converge virtual services from a source controller onto each new site’s own cloud, VRF, SE group, and VIP network. GSLB is part of the same run. Dry run unless –commit. Nothing is written back to the source. A flipped application is frozen.
License: GPL-3.0 | Language: Python | Requires: Avi controller API access. Run the offline self-test before the first converge.
The GSLB build order is Avi GSLB Across Two Sites, and the controllers, the licensing and the supported design under NSX Federation are in Avi 32.1.3 Under NSX Federation.
Regional Harbor Recovery
Temporary grants, the finalizer clear for a stuck depot resolution entry, and the rollback. A region teardown can leave regional Harbor mid-removal. Retrying the uninstall does not free the name. Delete the grants when the reconcile finishes.
License: GPL-3.0 | Language: YAML | Requires: kubectl against the Supervisor. Do not leave the temporary role in place.
TKG Guest Cluster Certificates, Back in Date
Bring a VKS / TKG guest cluster’s control plane certificates back into date from the Supervisor. Every control plane node is read first and placed in one of four states, ready, restart, renew, problem, and only what that state needs is done. Nodes go in series, so a cluster with no quorum is carried back rather than restored; the API server’s SANs are compared across the renewal and a node whose SANs changed is never restarted; the etcd member list and certmgr come afterwards. --all for every cluster, plan by default, a self-test of the decision logic, and a read-only check of the Spherelet certificates on the ESXi hosts.
License: GPL-3.0 | Language: POSIX shell | Requires: a Supervisor control plane node with kubectl and the cluster’s SSH secret; certmgr from Broadcom KB 323453 for the certificates kubeadm does not cover
VCF Domain Target Release
Show or clear a domain target release on SDDC Manager. The screen can say the domain is already on the target while isCustomizedBom is still true. clear prints the payload and does not write without –commit. The token comes from the environment.
License: GPL-3.0 | Language: Python | Requires: SDDC Manager API, a bearer token you already have
Harbor Air-Gap Kit
One transfer folder and one inventory for a standalone Harbor the Supervisor can pull from. Three settings name where the Harbor files, the certificate, and the container engine come from. The example inventory is filled as registry01.example.coach.
License: GPL-3.0 | Language: Ansible | Requires: RHEL 9 with Podman, ansible-core 2.14 or later, and a transfer built on a connected workstation
Notes on the files in this kit: the second run of install_harbor, why absent is not the idempotency test, the certificate task that must not print the key, and how I add a role.
Already on ansible-automation? harbor-registry-overlay is the same registry build as drop-in roles for it.
NSX Certificate Replacement
Replace expired NSX Manager API certificates after the assessment says that is the failed phase. Plan by default. With –commit, apply a new certificate on each manager node and then the cluster VIP. Delete a failed edge deployment only when you name it. CSR export and CA-signed import are included when a self-signed certificate is not acceptable.
License: GPL-3.0 | Language: Python | Requires: openssl, NSX Manager API access, NSX_PASSWORD or a prompt
fleetparity: NSX Federation Blue to Green
Move live workloads from one NSX Federation to another, one subnet at a time, over a temporary Layer 2 bridge. VMs keep their addresses and move by cross-vCenter vMotion; the default gateway moves per subnet, and the bridge comes off afterwards. Plan by default. --commit --expect writes only a reviewed plan, Blue is read again after every commit, production addresses are pinged across every change, and every step has a tested way back. Mock managers, mock vCenters and five end-to-end flows are included.
License: GPL-3.0 | Language: Python | Requires: Python 3, OpenSSH 8.4 or later, and one jump host that reaches both Global Managers, the Local Managers, the vCenters and the leaf switches (Cumulus Linux with NVUE)
vSphere 8 Clusters, Ready to Import
Build a vSphere 8 cluster outside VCF to the point VCF 9.1 imports it as a workload domain: DNS, host build, the appliance deploy or upgrade, cluster, hosts, NTP, distributed switch at a version ESXi 8 can join, vmkernels, management migration, vSAN, the vLCM image, SSH and the import prerequisites. Fourteen steps from one YAML file, each planned before --commit writes it, each read back afterwards. Since 1.1.0, host_release.py takes the hosts out of the vCenter they are in today first: evacuate, drain, disk groups out, out of the cluster, out of NSX, out of inventory, behind a capacity gate on the source vSAN and a refusal to release a host still carrying NSX. Since 1.2.0, a new cluster is born on a vLCM image seeded from a host, on a fresh vCenter too, and a cluster created without one has its image imported from a host already in it before image management is turned on, so the desired image is exactly what the hosts run and nothing is remediated.
License: GPL-3.0 | Language: Python | Requires: Python 3 and pyvmomi (the tool finds a Python that has it, or makes a virtualenv with bootstrap); the vcsa-deploy installer for the appliance steps
Stale NSX Off the Hosts
Survey and remove stale, unconfigured NSX VIBs from ESXi hosts, a cluster at a time: maintenance mode, del nsx, reboot, verify, one host at a time. VIBs are selected by version so vsipfwlib comes along, the esxio platform is swept from the software profile that vib list never shows, and removal is a self-correcting loop. Refuses any host that has real NSX configuration.
License: GPL-3.0 | Language: Python | Requires: Python 3, pyvmomi and paramiko; SSH enabled on the hosts
Overlay for Imported Clusters
Put working overlay onto clusters a VCF import left VLAN-only: the TEP pools, each cluster’s transport VLAN and pool, the overlay zone and uplink profile copied from a reference cluster that already works, host preparation and verification from the host up. The end state is one YAML file; there is no state file, and a run that failed halfway is finished by running it again. The TEP pool gateway is the one input it never guesses.
License: GPL-3.0 | Language: Python | Requires: Python 3 standard library; PyYAML optional; NSX Manager API access
How to Use These Repositories
- Read the customer success story first. Each repository links to its corresponding story. The story explains the problem, the discoveries, the patterns, and the lessons. The code makes more sense after the story.
- Always test in a non-production environment first. These tools work in production environments because they were built for production environments — but every environment is different. Validate before deploying.
- Review and customize for your specific environment. The code is sanitized of customer-identifying details, but customer-specific tags, naming conventions, and configurations are still present and need to be adjusted for your environment.
- Understand what each script does before running it. Especially the cleanup scripts. Several of these tools modify infrastructure state — read the README and run with –dry-run first.
- Back up your configuration before making changes. Aria Automation configuration export, NSX backup, BlueCat backup, vRO package export. The tools include backup capabilities; use them.
License
All repositories are published under GPL-3.0. You’re free to use, modify, and redistribute. We ask only that you maintain the license notice and contribute improvements back to the community where you can.
Get Help
Each repository has its own README with usage examples, configuration reference, and troubleshooting tables. Open an issue on GitHub for repository-specific questions. For broader guidance — modernization planning, architecture review, or custom integrations — reach out at noah@essential.coach.