1. Introduction

VMware introduced vSphere Configuration Profiles in vSphere 8.0 as an extension of vSphere Lifecycle Manager (vLCM). It enables administrators to define a desired cluster configuration and enforce compliance across all ESXi hosts. Uses JSON-based declarative configuration for consistency. Helps prevent misconfigurations that might introduce security vulnerabilities.

2. Requirements for vSphere Configuration Profiles

To use vSphere Configuration Profiles, the following prerequisites must be met:
✔ vSphere Lifecycle Manager (vLCM) must be enabled for the cluster.
✔ All ESXi hosts must run version 8.0 or later.
✔ Enterprise Plus License is required for cluster hosts.

3. About vSphere Configuration Profiles

Managing ESXi configurations manually across multiple hosts is challenging.vSphere Configuration Profiles simplify host management by defining settings at a cluster level. JSON-based configuration model allows: Defining desired cluster settings, Checking compliance of ESXi hosts, Remediating non-compliant hosts. The JSON document consists of: Profile section (common settings for all hosts), Host-specific section (unique settings per host), Host-override section (to apply exceptions).

4. Using vSphere Configuration Profiles

The overall process for enabling and using Configuration Profiles consists of:

• Creating a New Cluster, Activating Cluster-Level Lifecycle Options,
• Selecting an ESXi Version, Defining Desired Configuration (Extracting from a reference host or importing JSON configuration).

5. Creating a New Cluster

Steps to create a vSphere Cluster:

1. Open vSphere Client and navigate to Hosts and Clusters.
2. Click Create a New Cluster inside a Datacenter or Folder.
3. Enable the following options:
   1. Manage all hosts with a single image,
   2. Manage configuration at a cluster level.
4. Click Finish to create the cluster.

6. Activating Cluster Lifecycle Options

To enable vLCM for cluster-wide configuration management:

1. In the New Cluster Wizard, select: Single Image Management, Cluster-Level Configuration Management.
2. Click Next and complete the setup.
   Note: Single image management must be enabled before enabling vSphere Configuration Profiles.

7. Selecting the ESXi Version

Configuration Profiles only support ESXi 8.0 or later. You can optionally select Vendor Add-ons for hardware optimizations.

8. Navigating to Cluster Desired State Settings

Steps to access desired state settings:

1. Select the cluster in vSphere Client.
2. Navigate to Configure > Desired State > Configuration > Settings.

9. Generating Desired Configuration from a Reference Host

Instead of manually creating a JSON configuration, VMware allows extracting settings from a reference host.

Steps to extract configuration from a reference host:

1. Add a configured reference host to the cluster.
2. Navigate to Cluster > Configure > Desired State > Configuration > Settings.
3. Click Extract from Reference Host.
4. Select the reference host from the list.
5. Download the extracted JSON configuration document.

10. Setting the Desired Configuration

Steps to apply a JSON configuration:

1. Use either the extracted reference host document or an existing JSON file.
2. Navigate to Cluster > Configure > Desired State > Configuration > Settings.
3. Click Import Configuration from File.
4. Validate and apply the imported settings.

11. CLI Commands for Configuration Management

Administrators can verify compliance and apply configurations using PowerCLI.
Check Cluster Configuration Compliance

#Get-Cluster -Name “MyCluster” | Get-VSphereConfigurationProfileCompliance

Apply Configuration and Remediate Hosts

#Get-Cluster -Name “MyCluster” | Set-VSphereConfigurationProfile -Remediate

12. Monitoring and Compliance Checks

Once the desired configuration is applied, vSphere continuously monitors compliance. If a host is non-compliant, it can be remediated automatically.
To check compliance in vSphere Client:

1. Select Cluster in vSphere Client.
2. Navigate to Hosts and Clusters.
3. Check Compliance Status.
4. Click Remediate if required.

13. Best Practices for Configuration Profiles

🔹 Always use a Reference Host: Extracting from a reference host ensures consistency.
🔹 Regularly validate compliance: Automate compliance checks using PowerCLI.
🔹 Monitor Configuration Drift: Detect changes early and remediate non-compliant hosts.
🔹 Use Role-Based Access Control (RBAC): Secure configuration management.
🔹 Keep JSON Files Backed Up: Store copies of JSON configuration for rollback purposes.