Bulk Inventory Security Groups Creation using vRA + vRO + NSX-T REST API

 

Objective

Enable automated bulk creation of NSX-T Security Groups and VM membership assignment by uploading a .csv file through vRA catalog request.

This solution leverages:

• vRA → For self-service catalog & request handling.

• vRO → Workflow logic, parsing CSV, and REST API communication.

• NSX-T REST API → To validate, create, and update Security Groups.

Input CSV Example

The CSV file contains the following columns:

SecurityGroupName,Criterion1,Criterion2

App-Frontend,VM.Name=web*,Tag=env:dev

App-Backend,VM.Name=app*,Tag=env:qa

DB-Servers,VM.Name=db*,Tag=env:prod

SecurityGroupName → Name of the NSX-T security group

Criterion1, Criterion2 → Membership conditions (VM names, Tags, IPs, etc.)

Workflow Logic

1. vRA Catalog Request

   • User uploads CSV file with GroupName,Criterion1,Criterion2.

   • vRA triggers a vRO workflow via Event Subscription or custom catalog item.

2. vRO Workflow Steps

   • Parse CSV file (using Properties or ResourceElement).

   • For each line:

     • Validate VM exists in NSX-T inventory via API.

     • Check if Security Group exists.

       • If yes → Add VM to the group with Criterion.

3. REST API Calls to NSX-T Manager

   • GET /api/v1/fabric/virtual-machines → Validate VM in NSX inventory.

   • GET /policy/api/v1/infra/domains/default/groups → Validate existing groups.

   • PATCH /policy/api/v1/infra/domains/default/groups/<groupName> → Create/Update group with VM membership criteria.

4. Update Status to vRA

• Return result summary:

• ✅ Groups created

• ✅ VMs added

• ❌ Any VM not found

Process Flow Diagram

Benefits

• Bulk Automation: No manual clicks in NSX-T Manager.
• Consistency: Security groups are created and updated following policy standards.
• Scalability: Handle large CSV input (hundreds of VMs/groups).
• Integration: Single-click request from vRA catalog.

Solution Approach

We’ll build a vRO workflow that:

1. Reads the CSV input file.
2. Iterates through each row.
3. Prepares a REST API JSON payload for the NSX-T Security Group.
4. Calls the NSX-T Policy API to create the Security Group with its criteria.
5. Logs the success/failure of each creation.

Demo