URI Format¶

URIs have this general form ([...] marks an optional part).

type://[username@]hostname[:port]/[[folder/...]datacenter/[folder/...][cluster/]server][?extraparameters]

The type:// is either esx:// or gsx:// or vpx:// since 0.8.3. The driver selects the default port depending on the type://. For esx:// and vpx:// the default HTTPS port is 443, for gsx:// it is 8333. If the port parameter is given, it overrides the default port.

A vpx:// connection is currently restricted to a single ESX server. This might be relaxed in the future. The path part of the URI is used to specify the datacenter and the ESX server in it. If the ESX server is part of a cluster then the cluster has to be specified too.

An example: ESX server example-esx.com is managed by vCenter example-vcenter.com and part of cluster cluster1. This cluster is part of datacenter dc1.

vpx://example-vcenter.com/dc1/cluster1/example-esx.com

Datacenters and clusters can be organized in folders, those have to be specified as well. The driver can handle folders since 0.9.7.

vpx://example-vcenter.com/folder1/dc1/folder2/example-esx.com

?no_verify=1&auto_answer=1&proxy=socks://example-proxy.com:23456

Authentication¶

In order to perform any useful operation the driver needs to log into the ESX server. Therefore, only virConnectOpenAuth can be used to connect to an ESX server, virConnectOpen and virConnectOpenReadOnly don't work. To log into an ESX server or vCenter the driver will request credentials using the callback passed to the virConnectOpenAuth function. The driver passes the hostname as challenge parameter to the callback. This enables the callback to distinguish between requests for ESX server and vCenter.

Note: During the ongoing driver development, testing is done using an unrestricted root account. Problems may occur if you use a restricted account. Detailed testing with restricted accounts has not been done yet.

Certificates for HTTPS¶

By default the ESX driver uses HTTPS to communicate with an ESX server. Proper HTTPS communication requires correctly configured SSL certificates. This certificates are different from the ones libvirt uses for secure communication over TLS to a libvirtd one a remote server.

By default the driver tries to verify the server's SSL certificate using the CA certificate pool installed on your client computer. With an out-of-the-box installed ESX server this won't work, because a newly installed ESX server uses auto-generated self-signed certificates. Those are signed by a CA certificate that is typically not known to your client computer and libvirt will report an error like this one:

error: internal error curl_easy_perform() returned an error: Peer certificate cannot be authenticated with known CA certificates (60)

Where are two ways to solve this problem:

• Use the no_verify=1 Extra parameters to disable server certificate verification.

• Generate new SSL certificates signed by a CA known to your client computer and replace the original ones on your ESX server. See the section Replace a Default Certificate with a CA-Signed Certificate in the ESX Configuration Guide

Connection problems¶

There are also other causes for connection problems than those related to Certificates for HTTPS .

• As stated before the ESX driver doesn't need the remote transport mechanism provided by the remote driver and libvirtd, nor does the ESX driver support it. Therefore, using an URI including a transport in the scheme won't work. Only URIs as described in URI Format are supported by the ESX driver. Here's a collection of possible error messages:

  $ virsh -c esx+tcp://example.com/
  error: unable to connect to libvirtd at 'example.com': Connection refused

  $ virsh -c esx+tls://example.com/
  error: Cannot access CA certificate '/etc/pki/CA/cacert.pem': No such file or directory

  $ virsh -c esx+ssh://example.com/
  error: cannot recv data: ssh: connect to host example.com port 22: Connection refused

  $ virsh -c esx+ssh://example.com/
  error: cannot recv data: Resource temporarily unavailable

• Since 0.7.0 libvirt contains the ESX driver. Earlier versions of libvirt will report a misleading error about missing certificates when you try to connect to an ESX server.

  $ virsh -c esx://example.com/
  error: Cannot access CA certificate '/etc/pki/CA/cacert.pem': No such file or directory

  Don't let this error message confuse you. Setting up certificates as described on the tls certificates page does not help, as this is not a certificate related problem.

  To fix this problem you need to update your libvirt to 0.7.0 or newer. You may also see this error when you use a libvirt version that contains the ESX driver but you or your distro disabled the ESX driver during compilation. Since 0.8.3 the error message has been improved in this case:

  $ virsh -c esx://example.com/
  error: invalid argument in libvirt was built without the 'esx' driver

Restrictions¶

There are some restrictions for some values of the domain XML config. The driver will complain if this restrictions are violated.

• Memory size has to be a multiple of 4096

• Number of virtual CPU has to be 1 or a multiple of 2. Since 4.10.0 any number of vCPUs is supported.

• Valid MAC address prefixes are 00:0c:29 and 00:50:56. Since 0.7.6 arbitrary MAC addresses are supported.

Datastore references¶

Storage is managed in datastores. VMware uses a special path format to reference files in a datastore. Basically, the datastore name is put into squared braces in front of the path.

[datastore] directory/filename

To define a new domain the driver converts the domain XML into a VMware VMX file and uploads it to a datastore known to the ESX server. Because multiple datastores may be known to an ESX server the driver needs to decide to which datastore the VMX file should be uploaded. The driver deduces this information from the path of the source of the first file-based harddisk listed in the domain XML.

MAC addresses¶

VMware has registered two MAC address prefixes for domains: 00:0c:29 and 00:50:56. These prefixes are split into ranges for different purposes.

The VMX files generated by the ESX driver always contain a MAC address, because libvirt generates a random one if an interface element in the domain XML file lacks a MAC address. Since 0.7.6 the ESX driver sets the prefix for generated MAC addresses to 00:0c:29. Before 0.7.6 the 00:50:56 prefix was used. Sometimes this resulted in the generation of out-of-range MAC address that were rejected by the ESX server.

Also since 0.7.6 every MAC address outside this ranges can be used. For such MAC addresses the ESX server-side check is disabled in the VMX file to stop the ESX server from rejecting out-of-predefined-range MAC addresses.

ethernet0.checkMACAddress = "false"

Since 6.6.0, one can force libvirt to keep the provided MAC address when it's in the reserved VMware range by adding a type="static" attribute to the <mac/> element. Note that this attribute is useless if the provided MAC address is outside of the reserved VMWare ranges.

Available hardware¶

VMware ESX supports different models of SCSI controllers and network cards.

...
<disk type='file' device='disk'>
  <source file='[local-storage] Fedora11/Fedora11.vmdk'/>
  <target dev='sda' bus='scsi'/>
  <address type='drive' controller='0' bus='0' unit='0'/>
</disk>
<controller type='scsi' index='0' model='lsilogic'/>
...

...
<disk type='file' device='disk'>
  <driver name='lsilogic'/>
  <source file='[local-storage] Fedora11/Fedora11.vmdk'/>
  <target dev='sda' bus='scsi'/>
</disk>
...

...
<interface type='bridge'>
  <mac address='00:50:56:25:48:c7'/>
  <source bridge='VM Network'/>
  <model type='e1000'/>
</interface>
...

Converting from VMware VMX config to domain XML config¶

The virsh domxml-from-native provides a way to convert an existing VMware VMX config into a domain XML config that can then be used by libvirt.

$ cat > demo.vmx << EOF
#!/usr/bin/vmware
config.version = "8"
virtualHW.version = "4"
floppy0.present = "false"
nvram = "Fedora11.nvram"
deploymentPlatform = "windows"
virtualHW.productCompatibility = "hosted"
tools.upgrade.policy = "useGlobal"
powerType.powerOff = "default"
powerType.powerOn = "default"
powerType.suspend = "default"
powerType.reset = "default"
displayName = "Fedora11"
extendedConfigFile = "Fedora11.vmxf"
scsi0.present = "true"
scsi0.sharedBus = "none"
scsi0.virtualDev = "lsilogic"
memsize = "1024"
scsi0:0.present = "true"
scsi0:0.fileName = "/vmfs/volumes/498076b2-02796c1a-ef5b-000ae484a6a3/Fedora11/Fedora11.vmdk"
scsi0:0.deviceType = "scsi-hardDisk"
ide0:0.present = "true"
ide0:0.clientDevice = "true"
ide0:0.deviceType = "cdrom-raw"
ide0:0.startConnected = "false"
ethernet0.present = "true"
ethernet0.networkName = "VM Network"
ethernet0.addressType = "vpx"
ethernet0.generatedAddress = "00:50:56:91:48:c7"
chipset.onlineStandby = "false"
guestOSAltName = "Red Hat Enterprise Linux 5 (32-Bit)"
guestOS = "rhel5"
uuid.bios = "50 11 5e 16 9b dc 49 d7-f1 71 53 c4 d7 f9 17 10"
snapshot.action = "keep"
sched.cpu.min = "0"
sched.cpu.units = "mhz"
sched.cpu.shares = "normal"
sched.mem.minsize = "0"
sched.mem.shares = "normal"
toolScripts.afterPowerOn = "true"
toolScripts.afterResume = "true"
toolScripts.beforeSuspend = "true"
toolScripts.beforePowerOff = "true"
scsi0:0.redo = ""
tools.syncTime = "false"
uuid.location = "56 4d b5 06 a2 bd fb eb-ae 86 f7 d8 49 27 d0 c4"
sched.cpu.max = "unlimited"
sched.swap.derivedName = "/vmfs/volumes/498076b2-02796c1a-ef5b-000ae484a6a3/Fedora11/Fedora11-7de040d8.vswp"
tools.remindInstall = "TRUE"
EOF

$ virsh -c esx://example.com domxml-from-native vmware-vmx demo.vmx
Enter username for example.com [root]:
Enter root password for example.com:
<domain type='vmware'>
  <name>Fedora11</name>
  <uuid>50115e16-9bdc-49d7-f171-53c4d7f91710</uuid>
  <memory>1048576</memory>
  <currentMemory>1048576</currentMemory>
  <vcpu>1</vcpu>
  <os>
    <type arch='i686'>hvm</type>
  </os>
  <clock offset='utc'/>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>destroy</on_crash>
  <devices>
    <disk type='file' device='disk'>
      <source file='[local-storage] Fedora11/Fedora11.vmdk'/>
      <target dev='sda' bus='scsi'/>
      <address type='drive' controller='0' bus='0' unit='0'/>
    </disk>
    <controller type='scsi' index='0' model='lsilogic'/>
    <interface type='bridge'>
      <mac address='00:50:56:91:48:c7'/>
      <source bridge='VM Network'/>
    </interface>
  </devices>
</domain>

Converting from domain XML config to VMware VMX config¶

The virsh domxml-to-native provides a way to convert a domain XML config into a VMware VMX config.

$ cat > demo.xml << EOF
<domain type='vmware'>
  <name>Fedora11</name>
  <uuid>50115e16-9bdc-49d7-f171-53c4d7f91710</uuid>
  <memory>1048576</memory>
  <currentMemory>1048576</currentMemory>
  <vcpu>1</vcpu>
  <os>
    <type arch='x86_64'>hvm</type>
  </os>
  <devices>
    <disk type='file' device='disk'>
      <source file='[local-storage] Fedora11/Fedora11.vmdk'/>
      <target dev='sda' bus='scsi'/>
      <address type='drive' controller='0' bus='0' unit='0'/>
    </disk>
    <controller type='scsi' index='0' model='lsilogic'/>
    <interface type='bridge'>
      <mac address='00:50:56:25:48:c7'/>
      <source bridge='VM Network'/>
    </interface>
  </devices>
</domain>
EOF

$ virsh -c esx://example.com domxml-to-native vmware-vmx demo.xml
Enter username for example.com [root]:
Enter root password for example.com:
config.version = "8"
virtualHW.version = "4"
guestOS = "other-64"
uuid.bios = "50 11 5e 16 9b dc 49 d7-f1 71 53 c4 d7 f9 17 10"
displayName = "Fedora11"
memsize = "1024"
numvcpus = "1"
scsi0.present = "true"
scsi0.virtualDev = "lsilogic"
scsi0:0.present = "true"
scsi0:0.deviceType = "scsi-hardDisk"
scsi0:0.fileName = "/vmfs/volumes/local-storage/Fedora11/Fedora11.vmdk"
ethernet0.present = "true"
ethernet0.networkName = "VM Network"
ethernet0.connectionType = "bridged"
ethernet0.addressType = "static"
ethernet0.address = "00:50:56:25:48:C7"

Fedora11 on x86_64¶

<domain type='vmware'>
  <name>Fedora11</name>
  <uuid>50115e16-9bdc-49d7-f171-53c4d7f91710</uuid>
  <memory>1048576</memory>
  <currentMemory>1048576</currentMemory>
  <vcpu>1</vcpu>
  <os>
    <type arch='x86_64'>hvm</type>
  </os>
  <devices>
    <disk type='file' device='disk'>
      <source file='[local-storage] Fedora11/Fedora11.vmdk'/>
      <target dev='sda' bus='scsi'/>
      <address type='drive' controller='0' bus='0' unit='0'/>
    </disk>
    <controller type='scsi' index='0'/>
    <interface type='bridge'>
      <mac address='00:50:56:25:48:c7'/>
      <source bridge='VM Network'/>
    </interface>
  </devices>
</domain>