POV Templates

Author the templates a POV is built from, and save the recipes that build one.

This lab platform is not configured. Set its API URL, username and API token in Settings → Integrations, then use Test connection there before building anything here.

cannot save an environment back as a template, so templates cannot be built on it. The Blueprints tab still works.

Build a template

Run this as root on the control node if you would rather install the metadata runner and its container runtime by hand — then bake the environment into a template. It is what the build installs automatically, it is idempotent, and it is deliberately plain ASCII so it survives being typed into a console with no clipboard.

Base template The environment is cloned from this, prepared, and saved as a new template. New template name Description Control node VM name Blank auto-detects the one Linux VM in the template, which is what a POV built from it will do too. A name is matched exactly, case-insensitively. Project ID Blank uses the configured default. Install the metadata runner and Docker on the control node Publishes SSH on the control node for the length of the build, installs the runner and a container runtime, and revokes it. This reaches a NAT-ed high port on the lab platform, not the API host — if your egress only allows HTTPS to the API URL, clear this and use the install script above. The guest also needs a route to download.docker.com unless it already has Docker; the build says which half landed. Keep the build environment after baking For inspecting what was baked. It stays running and it bills — Discard reaps it.

Contract check —

Whether the runner is actually installed cannot be read from the platform — it is a file inside the guest. A build answers that by installing one.

Builds

Template	From	Status	Runner	Build env	Created
				reaped		Job
No templates built yet.

Cloud templates

What a POV on this cloud gets built from: a list of VMs, and the private network they sit on. Nothing here is created until a POV names this template.

Name

Lowercase letters, digits and hyphens.

Description

Region

Private network

Each POV gets its own. Nothing listens on it from outside.

Purdue zones Builds enterprise, DMZ and plant subnets instead of one. A VM's zone follows its cell role: OT simulator in the plant, OT DMZ broker in the DMZ, everything else in enterprise. The plant gets no internet and no public address. Needs a /22 or larger network. See Demo cells in a POV.

VMs

Exactly one VM may be the control node — it runs the dashboard agent and the Gateway, and it is picked by its role, not its name. Images are resolved when a POV is built, not now — so a template can name a catalog image that has not been promoted to this cloud yet. A cell role (Linux targets only) makes Wire up add that cell's PRA items — see Demo cells in a POV.

No VM has the control node role, so a POV from this template will have no dashboard agent. Pick it in a VM's role column.

Blueprints

Saved POV recipes. Picking one on the POV page fills the create form.

Name Lowercase letters, digits and hyphens. Template Description Control node VM name Suspend on idle

These pickers list the tenants registered under BeyondTrust tenants on the POV page — not the single set in Settings, which is one tenant for the whole instance. Left unchosen, a POV built from this blueprint falls back to that set. No tenants are registered yet, so the pickers are empty.

Gateway name Resource Broker VM Resource Broker zone Resource Broker installer asset Nothing is wrong with the blueprint — the installer list could not be read, so this picker cannot say whether one is staged. A Windows installer is staged, but not on the active storage backend () the install fetches from: . Use Move on Storage to relocate it, then reload this page. No Windows installer is staged, so this picker is empty. Upload the Resource Broker bootstrapper — an .exe — on Storage first; it runs from Config Management. A blueprint may be saved without it and the POV's panel will ask.

No secret is stored on a blueprint, and nothing here runs by itself. The Gateway deploy key and the Password Safe installer key are per-tenant, and both installs go through the control node's agent, which does not exist until minutes after a POV comes up. A blueprint fills these fields in so the panels open ready to press.

Name	Template	Control node	Tenants
			none
No blueprints saved yet.