Calm VM is a standalone VM that you can deploy on AHV and ESXi hypervisors and leverage calm functionality without the Nutanix infrastructure.

You can deploy Calm using the image at the Nutanix Support Portal - Downloads page and manage your applications across a variety of cloud platforms. Calm VM deployment eliminates the need of the complete Nutanix infrastructure to use Calm features.

For information on Calm VM deployment on AHV, see Deploying Calm VM on AHV.

Showback allows you to estimate the overall service cost of the applications running on your on-prem cloud. You can also view the graphical representation of the cost of the applications.

To enable and configure showback, see Enabling Showback.

The policy engine is a single-VM setup for the single or scale-out Prism Central. When you enable the policy engine for your Calm instance, a new VM is created and deployed for the policy engine. All you need is an available IP address that belongs to the same network as that of your Prism Central VM for the policy engine VM.

As an administrator, you can enable the policy engine to:

• Enforce resource quota policy for the infrastructure resources (compute, memory, and storage) on Nutanix and VMware. The quota policy enforcement allows better governance on resources across infrastructures at the provider and project levels. See Quota Policy Overview.
• Orchestrate applications through tunnels on a virtual private network (VPC) on Nutanix accounts. See VPC Tunnels for Orchestration.
• Enforce approval policies to manage resources and control actions in your environment. See Approval Policy Overview.
• Schedule application actions and runbook executions. See Scheduler Overview.

You can view the protection and recovery status of a Calm application when:

• The VMs of the application running on a Nutanix platform are protected by a protection policy in Prism Central.
• You enabled the option to show application protection status in Calm.

You can view the protection and recovery status of the application on the Application Overview page. For more information, see Overview Tab.

To enable the option to show application protection status, see Enabling Application Protection Status View.

Calm automatically archives run logs of the deleted applications and custom actions that are older than three months. You can download the archives within 7 days from the time of archive creation.

For a running application, data is not archived for the system-generated Create actions.

You can get the following information for Start, Restart, Stop, Delete, and Soft Delete system-generated actions and user-created actions.

• Started by
• Run by
• Status

Calm archives all action details of a deleted application.

Only an administrator can view and download the application log archive. For more information, see Downloading Application Log Archive.

All AHV clusters that are registered to your Prism Central instance are automatically added as provider accounts to Calm.

You can also configure any remote Prism Central (PC) as an account in Calm to deploy applications on the remote PC. For more information, see Support for Multi-PC Setup.

Calm automates the provisioning and management of infrastructure resources for both private and public clouds. When any configuration changes are made directly to the Calm-managed resources, Calm needs to sync up the changes to accurately calculate and display quotas and Showback information.

Platform sync enables Calm to synchronize any changes in the clusters that are managed by Calm on connected providers. These changes can be any IP Address changes, disk resizing, unavailability of VMs, and so on.

For example, when a VM is powered off externally or deleted, platform sync updates the VM status in Calm. Calm then adds the infrastructure resources consumed by the VM (memory and vCPU) to the total available quota.

You can specify an interval after which the platform sync must run for a cluster. For more information, see Configuring a Remote Prism Central Account and Configuring a VMware Account.

Credentials are used in multiple Calm entities and workflows.

• Environment

  Environment allows a Project Admin to add multiple credentials and configure VM default specifications for each of the selected providers as a part of project and environment configurations.

  Project admins must configure an environment before launching an application from the marketplace. The recommendation is to have at least one credential of each secret type (SSH or password) to be defined under each environment in the project. These values get patched wherever the credential values are empty when you launch your marketplace items.

• Blueprints and runbooks

  Developers can add credentials to a blueprint. These credentials are referenced after the VM is provisioned. Credentials defined within an environment of a project have no significance or impact on the credentials you define within the blueprint.

  Calm supports export and import of blueprints across different Prism Central or Calm instances along with the secrets. The developer uses a passphrase to encrypt credentials and then decrypts credentials in a different instance using the same passphrase to create a blueprint copy.

• Marketplace

  All global marketplace items have empty credentials values. However, locally published blueprints can have the credential values if the developer published the blueprint with the Publish with Secret s option enabled.

  When you launch a marketplace item, credentials are patched wherever the value is empty. In case there are multiple credentials of a particular type configured within the environment of a project, you get the option to select a credential for the launch.

• Applications

  Owners can change the credential value of an application multiple times until the application is deleted. The latest value of a credential that is available at that point in the application instance is used when an action is triggered.

  Any change in the credential value at the application level does not impact the credential value at the corresponding blueprint level.

Calm allows managing the following types of credentials:

• Static Credentials

  Static credentials in Calm are modelled to store secrets (password or SSH private key) in the credential objects that are contained in the blueprints that the applications copy.

• Dynamic Credentials

  Calm supports external credential store integration for dynamic credentials. A credential store holds username and password or key certificate combinations and enables applications to retrieve and use credentials for authentication to external services whenever required. As a developer, you can:

  • Define credential attributes that you want to pass on to the credential provider from the blueprint during execution.
  • Define variables that the credential provider must use. By default, Calm defines the secret variable when you configure your credential provider.
    Note: To use the credential in the blueprint, the variables in the credential and the blueprint must match.
  • Define a runbook with eScript tasks in the dynamic credential provider definition. The tasks you define in the runbook can set the username, password, private key, or passphrase values for the credential.

  For more information about configuring a credential provider, see Configuring a Credential Provider.

  When a blueprint uses a dynamic credential, the secret (password or SSH private key) is not stored in the credential objects within the blueprint. The secret values are fetched on demand by executing the runbook within the credential provider that you configure in Calm and associate with the blueprint.

  Note:

  • You cannot add a dynamic credential when you configure an environment in our project. You can, however, allow the credential provider in the environment.
  • You cannot use dynamic credentials for HTTP variables, such as profile variables, service variables, runbooks, and so on.
  • You cannot use dynamic credentials for HTTP endpoints and Open Terminal in applications.
  • For ready-to-use blueprints or blueprints that are published without secrets, the empty credential values are patched with the credential along with its associated runbook and variable values.

The project construct defines various environment-specific settings. For example:

• Permissions, such as the user accounts and groups that can deploy a marketplace application.
• The networks that can be used when deploying an application.
• Default VM specifications and deployment options, such as vCPUs, vRAM, storage, base images, Cloud-Init or Sysprep specs.
• Credentials.

Figure. Projects Click to enlarge

Projects provide logical groupings of user roles to access and use Calm within your organization. To assign different roles to users or groups in a project, you use configured Active Directory in Prism Central.

A project in Calm offers the following user roles. Each role has predefined functions that a user with role assigned can perform in a project. For more information, see Role-Based Access Control in Calm.

• Project admin
• Developer
• Consumer
• Operator

As part of the project configuration, you also configure environments. Environment configuration involves configuring VMs and adding credentials for the accounts that you added to your project. You use a configured environment either during your blueprint creation or during an application launch. When you select a configured environment while launching an application from the marketplace, the values for the application launch are picked up from the selected environment.

Environment is a subset of a project. When you create a project, you can add multiple accounts of the same provider or accounts of different providers that you configured in Calm to your project. You can then configure one or more environments in your project.

When you create an application blueprint, you select a project and use the environments you configured for that project for application deployments. You can also optionally select one environment for each application profile in the blueprint.

Quota policies enforce a usage limit on an infrastructure resource for projects and restrict project members to use more than their specified quota limits. Quotas ensure that a single project or a few projects do not overrun the infrastructures. If the cluster runs out of a resource, project members cannot use the resource even if the project has not reached its specified limit.

Quota policies also enforce a usage limit on an infrastructure resource at the provider account level to ensure that the resource consumption is within the specified quota limits across all projects of that provider account.

Calm macros are part of a templating language for Calm scripts. These are evaluated by Calm's execution engine before the script is run.

Macros enable you to access the value of variables and properties that are set on entities. The variables can be user defined or system generated. For more information, see Variables Overview.

The following table lists the built-in macros that you can use to retrieve and display the entities.

You can access the properties of a VM by using the platform macros. The following section describes the macros to access the VM properties for different providers.

The following table lists the endpoint macros for HTTP, Linux, and Windows endpoint types.

The following table lists the runbook macros.

The following table lists the common properties of the virtual machine that are available for usage.

Macros provide a way to access the values of variables that you set on entities. Variables are either user defined or added to the entities by Calm. Variables are always present within the context of a Calm entity and are accessible directly in scripts running on that entity or any of its child entities.

Variable Value Inheritance

The variable value of a parent entity can be accessed by the child entity unless the properties or the variables are overridden by another entity.

For example, if Variable1 is a variable that you defined on the application profile, then all child entity of the application profile can directly access the value of Variable1 in any task or script running on it as @@{variable1}@@ unless overridden by another entity.

Figure. Variable Value Inheritance Click to enlarge

The following table lists the Nutanix variables that are available for usage.

The following table lists the built-in VMware macros that you can use to retrieve and display the entities.

The following table lists the built-in AWS macros that you can use to retrieve and display the entities.

The following table lists the built-in GCP macros that you can use to retrieve and display the entities.

The following table lists the built-in Azure macros that you can use to retrieve and display the entities.

The following table lists the Kubernetes variables that are available for usage.

Configuring the VM in your blueprint is specific to the provider account and the operating system you select for your blueprint. You can configure the VM in a blueprint with Nutanix, VMware, AWS, GCP, or Azure accounts.