“Manual ‘ClickOps’ provisioning created severe configuration drift. Tenant A’s network was never identical to Tenant B’s, creating endless troubleshooting delays.”

Executive Summary

In 2021, during my tenure as a Systems Integration Advisor at NTT Data, a major financial services client faced an infrastructure bottleneck. Onboarding a new isolated tenant pod required two senior network engineers to spend ten days clicking through vCenter and NSX user interfaces.

I architected an automated Zero-Touch Provisioning (ZTP) pipeline using vRealize Automation (vRA) and Ansible. By transitioning to declarative Infrastructure as Code (IaC), we cut tenant provisioning time from 10 days down to 4 hours.

---

The Challenge

Manual GUI provisioning led to inconsistent security baselines across business units.

• Provisioning Delays: Senior engineers spent up to 80 hours per tenant manually configuring Tier-1 gateways, overlay segments, and firewall rules.
• Configuration Drift: Human error resulted in unstandardized security policies and inconsistent subnets across tenant pods.
• Audit Blockers: Regulators could not verify compliance because live infrastructure diverged from approved architecture diagrams.

[!IMPORTANT] Manual GUI clicks introduce subtle configuration drift. Without declarative version-controlled playbooks, security audits fail due to inconsistent firewall rules.

---

The Solution

We modeled the complete tenant network footprint as declarative YAML files, orchestrated via Ansible Automation Platform and the NSX-T Policy API.

Technology Stack

• SDN Platform: VMware NSX-T Data Center 3.1
• Orchestration: vRealize Automation (vRA 8.2)
• Automation Engine: Ansible Tower (utilizing vmware.ansible_nsxt module)
• API Interface: NSX-T Policy REST API (/policy/api/v1/infra)

Technical Architecture

When a business unit requested a new tenant environment in the self-service catalog:

1. vRA Event Trigger: vRA invoked an Ansible Tower job template, passing tenant metadata parameters (VLAN ID, CIDR block, tenant name).
2. Git Inventory Pull: Ansible pulled the golden YAML spec from Git containing predefined Tier-1 routing, NAT, and Distributed Firewall (DFW) policy templates.
3. Declarative API Execution: Ansible executed a single declarative PATCH request to the NSX-T Policy API, instantiating the entire logical network topology in a single atomic transaction.

[!NOTE] Atomic Policy API: Unlike legacy imperative APIs, the NSX-T Policy API processes full topology specs declaratively. If any segment fails, the entire transaction rolls back cleanly.

# # Ansible Declarative NSX-T Tenant Pod Spec
- name: Provision NSX-T Tenant Pod
  vmware.ansible_nsxt.nsxt_policy_tier1:
    hostname: "{{ nsx_manager }}"
    username: "{{ nsx_user }}"
    password: "{{ nsx_password }}"
    display_name: "T1-Tenant-Pod-{{ tenant_id }}"
    tier0_id: "T0-Core-Gateway"
    state: present

Automated Orchestration Flow

graph TD
    User[Self-Service Portal] -->|Select Tenant Pod| vRA[vRealize Automation 8]
    vRA -->|API Event Hook| Tower[Ansible Tower Engine]
    Tower -->|Fetch Golden Spec| Git[Git Repository (YAML Specs)]
    Tower -->|Declarative API PATCH| NSX[NSX-T Policy Manager]
    
    subgraph "Automated NSX-T Fabric Generation"
    NSX -->|Instantiate| T1[Tier-1 Gateway]
    NSX -->|Provision| Seg[Overlay Segments]
    NSX -->|Enforce| DFW[Zero-Trust DFW Rules]
    end

---

Business Impact

• Provisioning Speed: Reduced tenant deployment turnaround from 10 days to 4 hours (a 96% velocity gain).
• Zero Configuration Drift: Guaranteed every tenant pod was 100% mathematically identical to the approved architecture spec.
• Seamless Auditing: Passed financial compliance audits with zero findings, presenting Git commit histories as immutable proof of security posture.

---

The Verdict

Key Takeaway

Replace ClickOps with Declarative API Automation.

Never manually configure virtual network topologies in production. Moving from manual GUI operations to Ansible and the NSX-T Policy API guarantees deployment speed, audit compliance, and zero configuration drift.