Scale VMware ops without vRA complexity.

id: vmware-safe-patching
namespace: company.team
description: >
  Snapshot a vCenter VM, apply OS updates over SSH, health-check the VM after
  reboot, and automatically restore the snapshot if the health probe fails.

inputs:
  - id: vm_name
    type: STRING
    defaults: "prod-web-01"
  - id: vm_address
    type: STRING
    description: "Hostname or IP used to SSH into the VM and run the health probe."

tasks:
  - id: pre_patch_snapshot
    type: io.kestra.plugin.ee.vmware.vcenter.CreateVmSnapshot
    server: "vcenter.company.local"
    username: "{{ secret('VMWARE_VCENTER_USERNAME') }}"
    password: "{{ secret('VMWARE_VCENTER_PASSWORD') }}"
    vmName: "{{ inputs.vm_name }}"
    snapshotName: "pre-patch-{{ execution.startDate | date('yyyyMMdd-HHmm') }}"
    snapshotDescription: "Captured by Kestra execution {{ execution.id }} before OS patching."

  - id: apply_patches
    type: io.kestra.plugin.scripts.shell.Commands
    commands:
      - ssh -o StrictHostKeyChecking=no ops@{{ inputs.vm_address }} "sudo
        apt-get update && sudo apt-get -y upgrade && sudo reboot"
    allowFailure: true

  - id: wait_for_boot
    type: io.kestra.plugin.core.flow.Pause
    pauseDuration: PT1M

  - id: health_check
    type: io.kestra.plugin.core.http.Request
    uri: "http://{{ inputs.vm_address }}/health"
    method: GET
    options:
      timeout:
        connectTimeout: PT30S
        readIdleTimeout: PT30S
    retry:
      type: constant
      interval: PT30S
      maxAttempts: 10

  - id: notify_success
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    messageText: ":white_check_mark: *Patching succeeded.* VM `{{ inputs.vm_name }}`
      patched, rebooted, and health-check OK."

errors:
  - id: rollback
    type: io.kestra.plugin.ee.vmware.vcenter.RestoreVmFromSnapshot
    server: "vcenter.company.local"
    username: "{{ secret('VMWARE_VCENTER_USERNAME') }}"
    password: "{{ secret('VMWARE_VCENTER_PASSWORD') }}"
    vmName: "{{ inputs.vm_name }}"
    snapshotName: "pre-patch-{{ execution.startDate | date('yyyyMMdd-HHmm') }}"
    suppressPowerOn: false

  - id: notify_oncall
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    messageText: ":alert: *Patching failed.* VM `{{ inputs.vm_name }}` rolled back
      to pre-patch snapshot. <{{ execution.url }}|View execution>"

id: vm-event-based-cleanup
namespace: company.team
description: >
  Listen for VM removal events from vCenter, log the event details, and clean up
  downstream systems by removing DNS A records, deleting AD computer objects,
  and offboarding the host from CrowdStrike.

triggers:
  - id: vcenterTrigger
    type: io.kestra.plugin.ee.vmware.vcenter.Trigger
    interval: PT1M
    server: "vcenter.company.local"
    username: "{{ secret('VMWARE_VCENTER_USERNAME') }}"
    password: "{{ secret('VMWARE_VCENTER_PASSWORD') }}"
    eventType: VM_REMOVED
    vmNameRegex: "vm-.*"

tasks:
  - id: loop_events
    type: io.kestra.plugin.core.flow.Loop
    values: "{{ trigger.events }}"
    tasks:
      - id: log_vm_event
        type: io.kestra.plugin.core.log.Log
        message: "VM {{ json(item.value).vmName }} had event {{
          json(item.value).eventType }} at {{ json(item.value).timestamp }}"

      - id: trigger_cleanup
        type: io.kestra.plugin.core.flow.Sequential
        tasks:
          - id: remove_ad_entry
            type: io.kestra.plugin.scripts.powershell.Commands
            inputFiles:
              main.ps1: |
                # Remove DNS A record from AD by VM name
                Remove-DnsServerResourceRecord -ZoneName "yourdomain.com" -RRType "A" -Name "{{ json(item.value).vmName }}" -Force
            commands:
              - ./main.ps1

          - id: remove_ad_computer
            type: io.kestra.plugin.scripts.powershell.Commands
            inputFiles:
              main.ps1: |
                # Remove the computer object from Active Directory
                Remove-ADComputer -Identity "{{ json(item.value).vmName }}" -Confirm:$false -ErrorAction Stop
                Write-Output "Deleted AD computer object for VM {{ json(item.value).vmName }}"
            commands:
              - ./main.ps1

          - id: offboard_crowdstrike_host
            type: io.kestra.plugin.core.http.Request
            method: POST
            uri: "https://api.crowdstrike.com/devices/entities/devices-actions/v2"
            headers:
              Authorization: "Bearer {{ secret('CROWDSTRIKE_API_TOKEN') }}"
              Content-Type: "application/json"
            body: |
              {
                "action_name": "hide_host",
                "ids": ["{{ json(item.value).vmName }}"]
              }