vRealize Automation Orchestrator is the core service that enables the integration between Cisco ACI and vRA. The components of Orchestrator are:

• Control Center—for managing plug-ins and enabling logs.

• Client—for designing, debugging, and running vRO workflows and actions.

• Inventory View—for browsing through the APIC objects.

vRealize Automation Cloud Assembly connects public and private cloud providers so that you can deploy machines, applications, and services that you create for the resources. The main purpose of Cloud Assembly is to design, develop and deploy cloud templates.

The components of Cloud Assembly are:

• Infrastructure— for provisioning and maintaining various compute and cloud resources.

• Custom Resources—are building blocks for designing a ACI cloud template. Drag and drop the custom resources on the canvas to design a custom cloud template.

• Cloud Template—for automating the deployment of ACI resources using the custom resources, canvas and YAML editor.

Cloud Assembly relays the deployment information to the Orchestrator, which is responsible to run the corresponding/respective workflows. Cloud Assembly can not directly communicate with the APICs; communication to APIC is only via the Orchestrator.

vRA acts as a single pane for automating and deploying applications on cloud and on premises environments. Cisco ACI vRealize 8 plug-in enables faster deployment of applications with networking services. This consumption model allows users to deploy single and multi-tier application workloads in a single click with pre-defined, as well as customizable compute and network policies.

Here is a list of mandatory prerequisites before integrating vRA 8.x with Cisco ACI:

• Install vRealize Automation Release 8.x. See VMware vRealize 8.x documentation.

• Set up the vRealize Appliance. See VMware vRealize 8.x documentation.

• Download and unzip the Cisco ACI vRealize 8 plug-in package.

• Install Python 3.8 and requests and pyYaml libraries.

• For role based control access for APIC, an APIC user must be created with a valid security domain and access privileges.

Note	For details about Cisco ACI integration with vRA 7.x, see the Cisco ACI with VMware vRealize chapter in the Virtualization Guide on the Cisco APIC Document support page.

A project is an abstraction of the compute resources. A set of users gain access to the underlying services and resources through Projects. A project can roughly be compared to an AWS account or a subscription in Azure.

An APIC account is treated as a networking resource for a vRA Project. A vRA project can be connected to an APIC account using the provided Orchestrator workflows. One APIC account can be reused by multiple projects, similar to using the same compute resources for deploying various applications on cloud or an on-prem datacenter. However, multiple APIC accounts can not be linked to one project.

As part of ACI-integration with vRA, this release supports pairing up vRA project with a ACI fabric managed by an APIC-cluster. As part of the plug-in design, the APIC accounts are auto-selected implicitly based on the vRA Project to APIC association. Therefore, when the ACI cloud templates are deployed within a project, the ACI resources are created on the connected APIC. This provides stronger access control and isolation among tenants.

The vRO service administrator has to setup APIC connections with the vRA projects accordingly. APIC accounts can be added with administrator and tenant users.

Note	Tenant user must have write permissions to be able to deploy resources on the respective APIC.

In the example:

Project 1: ACI_Site_1 creates a tenant “coke” on APIC Account, APIC_1, by deploying the Cloud Template, Create an ACI Tenant.

Project 2: ACI_Site_2 creates a tenant “pepsi” on APIC Account, APIC_2, by deploying the Cloud Template with the project. You do not need to provide the APIC account while deploying ACI Cloud Templates as long as the APIC account is added to the Project.

You can create an APIC Account with non admin users. Ensure that a user account with required security domains and roles is created in APIC. Also make sure that the user has the appropriate access rights.

APIC offers the following access rights:

• readPriv: User with readPriv can only retrieve information about the APIC objects.

• writePriv: Users can create APIC objects in the assigned security domain.

vRealize Automation 8.x creates a default organization. The user installing the vRA suite is assigned the Organization Owner role. The Organization Owner can create new users and assign them roles. Roles define the set of tasks that a particular user can perform.

The roles offered in vRealize Automation can be classified into three categories:

• Organizational

• Service

• Project

Roles	Responsibilities
Organization	Has administrator level permissions. Can create and manage other users.
Service	Service administrator: Read and write access to the entire user interface and API resources for a service. Can perform all tasks. Service User: Can be assigned a project role by the service admin. Can create and deploy resources.
Project	Project administrator: Provision infrastructure, add and manage users for a project. Project Member: Design and deploy cloud templates within a project.

Each service, namely Cloud Assembly and Service Broker can have their own set of service administrators, users and viewers. For more information on user management, see VMware vRealize 8.x documentation.

Each custom resource and catalog item are implemented as a workflow in the vRealize Orchestrator. When a cloud template containing an ACI custom resource is deployed, the corresponding Orchestrator workflow is executed in the backend.

The following APIC configuration workflows are provided to the user:

Workflow	Description
Add APIC Account	Creates the APIC account with user credentials and self-signed certificate.
Add vRA Projects to an APIC Account	Links projects to existing APIC accounts.
Set Default APIC Account	Updates the default APIC account.
Display vRA projects in an APIC Account	Lists all the vRA project(s) and APIC associations.
Update APIC Account	Updates an existing APIC account in case of connection failure.
Delete APIC Account	Deletes the APIC account, and also unlinks the projects.
Delete projects in an APIC Account	Deletes vRA Projects from an APIC account. Delete projects before deleting an APIC account.

Navigate to Orchestrator > Administration > Inventory. Use the Inventory View, to ensure that the Orchestrator is connected to an APIC.

A set of cloud templates are provided as a reference. Use these cloud templates to create a chained, automated deployment.

Table 1. Custom Resources

Custom Resource	APIC Resource	Description
ACI: Tenant	Tenant	Creates a tenant.
ACI: VRF	VRF (L3 Context)	Creates Layer 3 context (VRF) in a tenant.
ACI: Bridge Domain	Bridge Domain	Adds a bridge domain in a tenant.
ACI: Application Profile	Application Profile	Adds an application profile in a tenant.
ACI: EPG	Application EPG	Creates an Application EPG. You can add a VMM domain association. Ensure that you have created a valid VMM domain on the APIC before using this workflow.
ACI: Security Filter	Filter with rule entry list	Creates a Security Policy Filter. You can add or remove access list rules associated with a Security Policy Filter. The access list rules are of the format <source-port, destination-port, protocol, ethertype>. Note  The source and destination Ports are not allowed for arp, icmp, icmpv6 rules. Ports are valid only for tcp and udp protocols. The access list rules are deployed and enforced in ACI fabric and they are stateless in nature.
ACI: Contract	Contract (Policy)	Creates the security policy/contract between tenant networks. For example: APIC contracts between consumer EPG and provider EPG.

Table 2. Cloud Templates

Cloud Template	APIC Object
Create Tenant	Tenant
Create VRF	VRF (L3 Context)
Create Application Profile	Application Profile
Create Tenant and Application Profile	Tenant and Application Profile
Create Bridge Domain	Bridge Domain
Create Application EPG	Application EPG
Deploy ACI network resources	Tenant, VRF, Application Profile, BD, EPG
Create Security Filter	Filter with rule entry list
Create Contract	Contract (Policy)
Create Contract and Security Filter	Filter and Contract
Deploy EPGs, Contract and Security Filter	Provider, Consumer EPGs, Filter and Contract

The following CRUD (Create, Read, Update, Delete) operations can be performed on APIC objects.

Note	The Update operation can not be performed on all objects.

CRD operations on Tenant

• Parameters—Name, aaaDomain

CRD operations on Application Profile

• Parameters—Name, Tenant Name

CRD operations on VRF

• Parameters—Name, Tenant Name

CRUD operations on Bridge Domain

• Parameters— Name, Tenant name, VRF name, Subnets

• Option to set scope of the subnet. It is set to private by default. Use the Update operation to modify subnets and their scopes.

CRUD operations on EPGs

• Parameters—Name, Tenant name, Application Profile name, Bridge Domain, VMM Domains.

• VMM domain profiles can be attached to an EPG if it is already created on the APIC. They can be added/deleted as part of the update operation.

CRUD operations on Contracts

• Parameters—Name, Tenant name, Consumers, Providers, Filters.

• Default subject, default_vra_subj is created.

• Users cannot create subjects.

• Plug-in creates contracts only with a single subject.

• Consumer and provider contracts can be added to- applications EPGs and L3Out/ external EPGs. You have to provide the consumer and provider EPG DNs. An example is shown here:

  
  App EPG Dn : uni/tn-<tenant_name>/ap-<ap_name>/epg-<epg_name>
  External/L3 Out Dn: uni/tn-<tenant_name>/out<L3Out_name>/instP-<extEpg_name>
  	     	 

CRUD operations on Filters

• Parameters—Name, Rules.

• If you want to attach rule entries, create a valid rule entry list, using the values as indicated below (the available options are listed):

  • dstFormPort—Blank, Unspecified, 1-65535

  • dstToPort—Blank, Unspecified, 1-65535

  • protocol—icmp, icmpv6, tcp, udp, Blank

  • etherType—ip, arp

Note	You can use APIC objects in tenant common.