Skip to main content

​
Before you start

  • Neo needs Prism Central pc.2024.3 or later: the release with the v4 API and service account API keys. Neo connects to Prism Central, not to a single cluster’s Prism Element.
  • Neo reaches Prism Central over the internet. Its API must answer on HTTPS with a certificate from a public certificate authority, at a public address. If a firewall or reverse proxy limits who can reach it, allow Neo’s addresses to reach /api/.

​
If Prism Central is only on your internal network

Most are. Publish only the API, never the whole console. Put a reverse proxy at your network edge that:
  • answers on a public name over HTTPS, with a certificate from a public certificate authority;
  • forwards only paths under /api/ to Prism Central (port 9440), and refuses every other path;
  • accepts connections only from Neo’s addresses;
  • passes the X-ntnx-api-key, If-Match and NTNX-Request-Id request headers, and the ETag response header, through unchanged.
Save the proxy’s public address in Neo.

​
1. Make a service account for Neo

1

Create the service account

In Prism Central, open Admin Center → IAM → Service Accounts and create a service account for Neo, such as neo-agent.
2

Give it roles

Assign the account the roles your agents need: Prism Viewer for an agent that only reads; a role with VM update and power permissions, such as Virtual Machine Admin, to resize and manage VMs; and the roles for anything else Neo should change. Scope each role to the clusters, projects or categories Neo should reach.
3

Create an API key

On the service account, create an API key and copy it. Prism Central shows it once.
Neo can do only what this service account may do, whatever the agent’s access profile says.
If the API key expires or you revoke it, Neo loses access until you save a new key here.

​
2. Add the key in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations → Nutanix, under Networking.
2

Save the address and the API key

Enter the address you open Prism Central at, with its port (for example https://pc.example.com:9440), and the API key, then click Save settings. Neo lists one VM with the key before saving, so a wrong address, an older Prism Central or a refused key is rejected straight away.

​
3. Turn Nutanix on per agent

Open the agent, go to its Tools & Settings tab, click Networking, and expand the Nutanix block. Agents see only what Neo’s service account can see.

​
Pick a preset

Read Only

Read VMs, clusters, storage, networks, alerts, tenants and statistics. Nothing is changed.

Helpdesk

Resolve alerts and follow tasks without approval. Any change to a VM, such as power, CPU, memory or disks, waits on a technician. Everything else is read only.

IT Admin

VMs, images, clusters, storage, networking, data protection and alerts change without approval, except the changes that always ask. Network security policies, users and access, Prism Central settings, upgrades and licensing, and tenants wait on a technician.

Full Automation

Every change runs without approval, except the changes that always ask a technician.

​
Or set each area by hand

Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting.

​
Changes that always ask a technician

These wait on a technician under every profile, whatever the area’s own approval setting:
  • Deleting a VM, a VM disk, a recovery point, an image, OVA or template, a storage container, a volume group or its disk, a physical disk, a file share, an object store, a node or an SP Central tenant, removing a node from a cluster, and clearing a container’s reserved space.
  • Uninstalling guest tools from a VM, and unregistering the vCenter extension.
  • Any change to users, roles, access, directory services, API key records, stored credentials or the cluster’s own account passwords.
  • Any change to Prism Central’s settings, backups, registration, certificates, encryption, key management servers, security profiles or approval policies.
  • Any change to alert policies or alert email, because a changed policy can silence the alert that would show a problem. Acknowledging or resolving an alert does not ask on its own.
  • Any change that stores a credential: a password, a secret, a private key, a token, an API key, an SNMP key, a guest’s Sysprep or cloud-init script, or the user name and password in a URL.

​
Troubleshooting