Agent Install

[RBarlow92]

Is there an offline/air gapped installer for the VM Agent?

Currently in order to install the agent it either needs internet or a connection the management VM.

As we are going to run customer VMs we can't allow them a route to the management VM.

In vCenter it mounts an iso for the first install is this an option or in the pipeline?

Making all VMs need eithert internet or a route to the management VM is not a good idea at all.

[duru19]

Hi,

An offline installer would help with the initial installation, but the Morpheus guest agent still needs to communicate with the Manager afterwards. HPE’s documentation specifies access to the configured Appliance URL over TCP 443, so installing it from an ISO would not remove that requirement. Internet access itself is not mandatory if the Manager is reachable.

If your customer VMs cannot have any access to the Manager, you can select Skip Agent Install during provisioning or disable Install Agent on the Virtual Image. You would lose the features provided by the agent, such as guest-level monitoring, log collection and task execution, although some utilization statistics are still available without it.

I haven’t found a documented ISO-based installer for the Morpheus guest agent or any public roadmap information confirming one is planned.

I understand your concern about keeping customer networks separate from the management network. For that setup, the requirement goes beyond an offline installer—the agent would also need a way to communicate without a network connection from the guest to the Manager.

https://support.hpe.com/hpesc/public/docDisplay?docId=sd00008769en_us&page=GUID-206AB627-EE3C-4F56-AA25-0DFDECB86281.html

https://support.hpe.com/hpesc/public/docDisplay?docId=sd00008769en_us&page=GUID-E5BD72D4-D17D-4B2D-AE72-CB13FF3B9526.html

[RBarlow92]

That is horrendous. VMWare talks to the agent to handle monitoring/VM tasks why can't HPE VME?

Giving routes to the manager VM from all VMs is a terrible security issue.

Is there nothing in the roadmap to make this work in the way VMWare does?

I can't be the only person who has raised this as a security issue as a simple jump from one customer vm over the VME vm then allows access to the entire VM estate.

[duru19]

I understand your point. Keeping customer networks isolated from the management plane is a reasonable requirement, and skipping the agent does not give you the equivalent functionality you are asking for.

One distinction I should have made clearer in my earlier reply is that the Morpheus agent and the QEMU Guest Agent are separate components. QEMU already supports guest-to-host communication through virtio-serial, without requiring an IP route from the guest to the Manager. HPE also documents its use for certain snapshot consistency operations. So this is not an inherent limitation of KVM.

The Morpheus agent, however, currently has a documented requirement to reach the Appliance URL over TCP 443. That explains the current behaviour, but it does not resolve your isolation concern.

Being able to reach that service does not, by itself, grant access to the rest of the VM estate; that would require an additional compromise or authorization failure. Nevertheless, exposing a central management service to customer workloads is a valid concern.

I don’t have any confirmed roadmap information for moving these functions to a host-mediated channel. This needs an answer from HPE’s product team: whether they plan to support the required monitoring and guest operations without customer VMs needing network access to the Manager.