top of page
Search

Changing Passwords via VCF Operations Fleet Manager 9.0.2 API

Writer: Brock Peterson
Brock Peterson
10 minutes ago
3 min read

We've discussed the VCF Operations Fleet Manager API introduced in VCF 9.0 a few times.


I'd like to change a password via the the Fleet Manager API, here's how I did it.


First, you can access the VCF Operations Fleet Manager API here.



Once there you'll be presented with the Swagger UI, remember to authenticate with Base64 encoded credentials as discussed here.


Go the Environment Controller section and explore the /lcm/lcops/api/v2/environments endpoint by running a GET.



The curl for this looks like this:

curl -X GET "https://vcfops-bpeterson.vcfops.lab/lcm/lcops/api/v2/environments" -H  "accept: application/json" -H  "Authorization: Basic your_base64_encoded_token_goes_here"

The return will be an environment for each product you have deployed, in this lab I have Operations, Automation, and Logs.



In this blog, I'm going to change the root password for Operations for Logs, so I've scrolled down in the response to find the environmentID for Operations for Logs (product id vrli).



For the record, these are the Products | Product IDs | Node Types for reference.

  • vRealize Operations | vrops | master, replica, data

  • vRealize Log Insight | vrli | vrli-master, vrli-worked

  • vRealize Automation | vra | vrava-primary, vrava-secondary

  • vRealize Network Insight | vrni | vrni-platform, vrni-collector

  • VMware Identity Manager | vidm | vidm-primary, vidm-secondary


I now have my environment ID which is necessary for the next API call, which will be against the /lcm/lcops/api/v2/environments/{environmentid}/products/{productid}/nodes/{nodetype} endpoint in the Deployments Controller section.



Constructing the call looked like this.

  • environmentId was captured in previous API call

  • nodeType is vrli-master, which is the Logs Master Node

  • productId is vrli

  • updateNodePasswordRequestDTO was constructed as follows:

{
  "currentPassword": "locker:password:76a50a30-9932-475e-a981-12661e5b611d:3f24d620-c9dc-4976-a31e-6a069ac0d224-vrli-node-99e33ae3-dbf3-4bb2-9fa8-c70d84efd1b4",
  "hostName": "vcflogs-135-114.vcfops.lab",
  "newPassword": "locker:password:ac2e8c0d-13dd-4993-94ac-ab5782c76304:VMware123!VMware123!",
  "userNameToUpdate": "root"
}

which maps to the format requested:

{
  "currentPassword": "locker:password:<vmid>:<alias>",
  "hostName": "<fully qualified domain name of the node>",
  "newPassword": "locker:password:<vmid>:<alias>",
  "userNameToUpdate": "root"
}

currentPassword I got from the Internal API by running a GET /lcm/locker/api/v2/passwords and finding the vrli admin password.



I have hundreds of credentials in my Fleet Manager Locker so I ran the following command to get all of them and output to a flatfile for easier exploration.

curl -X GET "https://vcfops-bpeterson.vcfops.lab/lcm/locker/api/v2/passwords?from=0&size=650" -H  "accept: application/json" -H  "Authorization: Basic your_base64_encoded_token_goes_here" -k | jq > /tmp/a.out

I then searched that flatfile for me vrli master node root password, it looked like this.


{

"vmid": "76a50a30-9932-475e-a981-12661e5b611d",

"tenant": "default",

"alias": "3f24d620-c9dc-4976-a31e-6a069ac0d224-vrli-node-99e33ae3-dbf3-4bb2-9fa8-c70d84efd1b4",

"userName": "root",

"password": "PASSWORD****",

"createdOn": 1789507652013,

"lastUpdatedOn": 1789507652013,

"referenced": true

},


This provides me the vmid and alias required for the password change. I also captured the vmid and the alias for the new password I am setting it to.


{

"vmid": "ac2e8c0d-13dd-4993-94ac-ab5782c76304",

"tenant": "default",

"alias": "VMware123!VMware123!",

"userName": "admin",

"password": "PASSWORD****",

"passwordDescription": "VMware123!VMware123!",

"createdOn": 1790281486215,

"lastUpdatedOn": 1790281486215,

"referenced": true

},


I now have everything necessary to make the password change, it looked like this in the UI.



The curl looks like this.

curl -X PUT "https://vcfops-bpeterson.vcfops.lab/lcm/lcops/api/v2/environments/3f24d620-c9dc-4976-a31e-6a069ac0d224/products/vrli/nodes/vrli-master" -H  "accept: application/json" -H  "Authorization: Basic your_base64_encoded_token_goes_here" -H  "Content-Type: application/json" -d "{  \"currentPassword\": \"locker:password:76a50a30-9932-475e-a981-12661e5b611d:3f24d620-c9dc-4976-a31e-6a069ac0d224-vrli-node-99e33ae3-dbf3-4bb2-9fa8-c70d84efd1b4\",  \"hostName\": \"vcflogs-135-114.vcfops.lab\",  \"newPassword\": \"locker:password:ac2e8c0d-13dd-4993-94ac-ab5782c76304:VMware123!VMware123!\",  \"userNameToUpdate\": \"root\"}"

I verified I could log into the Operations for Logs Master Node VM with the new root password. You can also confirm the new root password was set by exploring the one in use in the UI.



Checking Locker will verify it.



You can confirm it's using the new password you set by selecting the three dots on the right.



Select View Password and provide the Fleet Manager root credentials to view it.



You can change other credentials this same way, explore the options for the different Product IDs described above: vrops, vra, vrni, etc.

Comments

    bottom of page