SANITIZED LAB EXAMPLES

These are copies of the author's lab scripts, not supported VMware products or a general-purpose installer. No vendor .pyc, password hash, password, SSH key, certificate or live configuration is included. Example addresses and example.com names must be adapted.

FILES AND EXECUTION HOST
patch-native-ztp-cpu.py: Run on the vCenter appliance using the Python version matching the vendor bytecode. Changes only the chosen hostBootKs response. Other hosts remain unchanged. Target host ID and disk model placeholders must be replaced throughout the file, including mock checks. Edit example IPs, gateway, DNS, hostname, NTP, datastore name and disk model throughout the file. Keep management VLAN 0 only when your switch uses the intended native VLAN.
set-edge-root-password.py: Run as root on vCenter. Prompts securely; passes the password through stdin to OpenSSL SHA-512 crypt; atomically stores root:deploy mode 640 /etc/vmware-rbd/edge-root-password.hash. Creates a hash for future installs, not an existing-host password change. This path must match the patch.
wanctl.py: Run as root on an Ubuntu simulator with iproute2/tc, the wantransit interface and the ifbwan device already configured. Edit nets and both interface names to match your routing. It does not install routes, VLANs, IFB devices or DHCP. Delay and rate apply in each direction; 40 ms adds roughly 80 ms RTT. Zero rate means no configured rate cap.

PATCH WORKFLOW
Back up the appliance first. Inspect the entire script and the generated Kickstart before use. The patch makes all disks eligible for clearpart --alldrives --overwritevmfs, then installs on the named disk. THIS ERASES PARTITIONS ON ALL INSTALLER-VISIBLE DISKS, including disks other than the selected installation disk. Disconnect disks you intend to preserve. Modify clearpart if that behavior is not intended.
The first-boot example enables SSH and ESXi Shell, uses CommunitySupported acceptance and installs William Lam's mock hardware VIB with --no-sig-check. It disables the CPU uniformity check and memory isolation salting for the lab. Review or remove these lab-specific choices before use; these examples are not production defaults. Secure Boot may prevent first-boot processing. No first-boot hostname reset or certificate regeneration is performed.

1. Edit placeholders and example values. Keep patch and password-helper hash paths consistent.
2. On vCenter: python3 set-edge-root-password.py
3. On vCenter: python3 patch-native-ztp-cpu.py
   Dry run validates the matching vendor implementation and mock responses; no mutation.
4. Only after review: python3 patch-native-ztp-cpu.py --apply
5. Restart vmware-rbd-watchdog and verify the served boot.ks for the chosen host. Do not expose the rootpw hash in screenshots or public logs.
6. If needed: python3 patch-native-ztp-cpu.py --rollback /full/path/to/the/printed/backup
   Restart vmware-rbd-watchdog after rollback. Rollback restores the module; it cannot restore erased disk data.

The patch refuses different interpreter bytecode and unexpected vendor handler structure. A passing dry run is not proof of compatibility with every appliance build. Bytecode modification is an unsupported lab workaround and appliance updates may replace it. Keep the reported original backup path and SHA256 values privately. Real appliance bytecode is never redistributed here.

WAN CONTROLS (on Ubuntu after prerequisite network setup)
sudo python3 wanctl.py status
sudo python3 wanctl.py set --delay-ms 40
sudo python3 wanctl.py clear
Do not use set/clear on a shared interface with unrelated qdiscs. The script replaces its root and ingress qdiscs. It applies to listed routed prefixes and IPv4 traffic, not a full WAN outage model.

Checks: Python syntax; mocked local/desired-state responses; other-host response preservation; insecure hash rejection; apply placeholder rejection. No execution against a reader's appliance or networking environment has been tested.
