Minimal Permissions for Packer remote VMware-iso builder

Question

I'm trying to use Packer to build images from iso on a remote VMware cluster, and there are security concerns with allowing direct access to the host. What are the minimal permissions required for an account on the esxi host to successfully complete the build?

Answer 1

The user needs to be able to run the following commands:

1. vmkfstools
2. vim-cmd
3. test
4. sh
5. ls
6. rm
7. esxcli
8. stat
9. mkdir
10. shaXsum
11. md5sum

For vim-cmd it must be allowed to run:

1. vmsvc/power.getstate
2. vmsvc/reload
3. vmsvc/power.on
4. vmsvc/power.off
5. solo/registervm
6. vmsvc/unregister
7. vmsvc/destroy
8. vmsvc/tools.install

And for esxcli :

1. network ip connection list
2. network vm list
3. network vm port list
4. system version get
5. system settings advanced list -o /Net/GuestIPHack

If security is I high concern I would recommend to look into running a dedicated ESXi host for Packer builds or use nested virtualisation to run a ESXi on top of vSphere just as a build host.