<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title>Org Builder on The Nested Lab</title>
    <link>https://thenestedlab.com/series/org-builder/</link>
    <description>Recent content in Org Builder on The Nested Lab</description>
    <generator>Hugo</generator>
    <language>en-gb</language>
    <lastBuildDate>Mon, 05 Oct 2026 00:00:00 +0100</lastBuildDate>
    <atom:link href="https://thenestedlab.com/series/org-builder/index.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>Introducing Org Builder</title>
      <link>https://thenestedlab.com/posts/introducing-org-builder-for-vcf-automation/</link>
      <pubDate>Mon, 05 Oct 2026 00:00:00 +0100</pubDate>
      <guid>https://thenestedlab.com/posts/introducing-org-builder-for-vcf-automation/</guid>
      <description>Why we built Org Builder, our tool for VCF Automation organizations: catalog services built in one organization have to reach others, and rebuilding them by hand or scripting every API call doesn&amp;rsquo;t scale. Packages, site files and versioned releases, in brief.</description>
      <content:encoded><![CDATA[<p>In our lab we build VCF Automation catalog services from start to finish. A
blueprint is only part of it. There are the property groups it reads, the
request form people fill in, the images it boots from, the projects allowed
to see it and the catalog item that puts it in front of them.</p>
<p>Getting all of that working together is the satisfying part. Then another
organization needs it: production after development, a second team, a
customer, a partner.</p>
<h2 id="the-problem">The problem</h2>
<p>A catalog service isn&rsquo;t one thing you can hand over. It&rsquo;s a set of objects
that point at each other. A catalog item points at a blueprint version, the
blueprint reads a property group, the property group names images, and the
images sit in a content library each project has to be able to see.</p>
<p>Rebuilding that in another organization means working through several
portals in the right order, copying values from one page into the next.
Some values are the same everywhere. Many belong to the site: names,
networks, storage, the ids images get when they arrive. Each one typed by
hand is a chance to get it wrong, and the mistake tends to show up when
someone orders the item.</p>
<p>The alternative is to automate it: a chain of API calls, written for each
organization and kept up to date as the catalog changes. That works, right
up until the next organization is slightly different. Either way, every
organization you build costs a lot of manual effort.</p>
<h2 id="what-org-builder-is">What Org Builder is</h2>
<p>Org Builder is a web page that runs on an administrator&rsquo;s workstation and
builds VCF Automation organizations through the platform&rsquo;s own APIs.
Nothing is installed on the platform. It works with three ideas:</p>
<ul>
<li><strong>A package</strong> says what to build: blueprints, property groups, request
forms, catalog items and the rest, with a version number.</li>
<li><strong>A site file</strong> says where: one organization&rsquo;s own values, such as names,
networks, storage and image ids.</li>
<li><strong>A record</strong> of every object it touches, marked as made or found, so it
knows what is its own to change or take away.</li>
</ul>
<p>The content never carries one site&rsquo;s values; the site file supplies them.
So one package can build the same service in any number of organizations.</p>
<p>Before it builds anything, Org Builder reads the destination. What the
platform already has becomes a pick-list, so values are chosen rather than
typed. Then it checks the site against what the package needs, and shows
what it will change before it changes anything.</p>
<p><img alt="Org Builder&rsquo;s Discover stage: ten of twelve reads done in seven seconds, and tiles for VCF Automation, the Supervisor, host memory, vSAN, external IPs, NSX, images and VM classes" loading="lazy" src="/images/org-builder-discover.jpg">
<em>Discover reads what the platform and the organization already have. Nothing changes.</em></p>
<p><img alt="The Platform group of the site file: region f06 and zone domain-c9, each picked from a list and marked found" loading="lazy" src="/images/org-builder-choose.jpg">
<em>Values the platform already has are picked from what Discover found, not typed.</em></p>
<p><img alt="Plan: the new site file&rsquo;s name, a Write button, and its changes against the template shown as a diff before anything is written" loading="lazy" src="/images/org-builder-plan.jpg">
<em>The site file, shown as changes against its template before a single line is written.</em></p>
<h2 id="install-or-move">Install, or move</h2>
<p>Org Builder does two jobs. <strong>Install</strong> puts a package into an organization,
new or existing. It builds each component only after the ones it depends
on, and stops to ask when a step needs a person.</p>
<p><strong>Move</strong> starts from an organization that already works. Export reads it
and writes a bundle: the content, plus the questions the destination must
answer about values that belonged to the source. Import builds it in another
organization with those answers.</p>
<p><img alt="Export: what goes into the bundle, grouped by kind: the organization with its projects, namespace classes, VPCs, security profiles and content library; the identity source and groups with roles; and the catalog&rsquo;s images, property groups, blueprints, request forms and catalog items" loading="lazy" src="/images/org-builder-export.jpg">
<em>Export lists everything that makes up an organization, by kind. Untick what should stay behind.</em></p>
<h2 id="releases-and-updates-like-software">Releases and updates, like software</h2>
<p>Because a package has a version, an organization&rsquo;s setup can be released
the way software is: built and tested in one organization, given a number,
then installed in the next. A package is plain files and folders, so it
sits happily in version control.</p>
<p>An update is the next version of the package. Installing it over the last
one changes only what differs. A changed blueprint becomes a new blueprint
version, its catalog item moves to it, and VCF Automation keeps the earlier
versions to roll back to. The organization&rsquo;s own values stay in its site
file, and the update leaves them alone.</p>
<p>The made-or-found record matters here too. An uninstall takes back only
what the package made, and anything the organization had before stays put.</p>
<h2 id="what-it-can-package">What it can package</h2>
<p>Org Builder works with VCF Automation&rsquo;s own constructs:</p>
<ul>
<li>blueprints, each validated before it&rsquo;s saved, with their custom request
forms;</li>
<li>property groups, the shared values blueprints read;</li>
<li>catalog items, released at the right version into the right projects;</li>
<li>content libraries and the images in them;</li>
<li>projects, VPCs and namespace classes;</li>
<li>secrets, which blueprints refer to rather than contain;</li>
<li>policies, such as leases, approvals and day-2 actions;</li>
<li>an identity source, and its groups with their roles.</li>
</ul>
<h2 id="why-this-matters-outside-the-lab">Why this matters outside the lab</h2>
<p>Anyone running VCF Automation for more than one team meets this sooner or
later. A few places it fits:</p>
<ul>
<li><strong>Development to production.</strong> Build and test a catalog in one
organization, then release it to the next as a package, with that
organization&rsquo;s own values.</li>
<li><strong>A baseline for every new tenant.</strong> The same projects, networks,
policies and starter catalog in each new organization, different only in
its site file.</li>
<li><strong>One catalog, many customers.</strong> Build a service once, install it into
each customer&rsquo;s organization, and ship fixes as new versions.</li>
<li><strong>Environments that come and go.</strong> Stand an organization up for a demo or
a training event, then take it down again without touching what was there
before.</li>
<li><strong>Rebuilding from source.</strong> An organization described by its packages and
its site file can be built again from them, rather than from memory.</li>
</ul>
<h2 id="whats-next">What&rsquo;s next</h2>
<p>The next posts show it working, one small step at a time. First, a simple
move: a few blueprints and property groups exported from one organization
and imported into another, with the destination&rsquo;s own values changed on the
way. Then the same with a content library and its images, plus a package&rsquo;s
own instructions, shown to the person installing it at the step where they
matter.</p>
<h2 id="rules-learned">Rules learned</h2>
<ul>
<li>A package says what; a site file says where. Keep one site&rsquo;s values out
of the content, and the content travels.</li>
<li>Read before writing, and preview before changing. A pick-list of what
exists beats a text box.</li>
<li>Record what you made, so an update or an uninstall knows exactly what is
its own.</li>
</ul>
<h2 id="broadcom-documentation">Broadcom documentation</h2>
<ul>
<li><a href="https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/organization-management/managing-blueprints-in-vcf-automation/property-groups.html">Reusing a Group of Properties in VCF Automation</a>: property groups shared with the organization or kept to one project</li>
<li><a href="https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/organization-management/setting-up-the-content-hub-in-vcf-automation-for-all-apps-organizations/publishing-content-to-the-vcf-automation-catalog/publish-vcf-automation-blueprints-to-the-catalog.html">Publish a Blueprint to the Catalog in VCF Automation</a>: releasing a version, by default to the members of the blueprint&rsquo;s project</li>
<li><a href="https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/organization-management/managing-blueprints-in-vcf-automation/blueprint-versioning.html">Blueprint versioning in VCF Automation</a>: versions, releases and rolling back</li>
</ul>
<hr>
<p><em>Lab environment; opinions my own. Org Builder is our own tooling, not a
Broadcom product. VMware, VCF and VCF Automation are trademarks of Broadcom
Inc. or its subsidiaries.</em></p>
]]></content:encoded>
    </item>
  </channel>
</rss>
