- Hello, and welcome to
Managing Serial Numbers
for Individual macOS Virtual Machines.
My name is Spike Burton,
and I'm a senior software developer
at MacStadium where I work on Orka,
which is our homegrown solution
for virtualizing and orchestrating macOS
using Kubernetes
on authentic Apple hardware.
So we're gonna talk a little bit
about serial numbers.
As I'm sure most of you are very
well aware, the serial number
for a Mac computer is available
by going to the Apple menu and clicking on
About This Mac.
It's listed at the very bottom
of the system information,
and it's a 12-to-15 character
alphanumeric sequence,
as it's circled above in red here.
So first of all, why do we care?
Well, as an Apple administrator,
you're often doing things like
interacting with Apple Business Manager,
making use of Apple's
Device Enrollment Program,
and integrating with
a Mobile Device Management platform
like Jamf or Jamf Pro.
And the serial number is kind of
the important piece of information
that makes this all work
behind the scenes.
It's what's used to verify the device.
So why virtualization?
In the context of needing
an Apple desktop, whether this is for
a lab environment
or a training course of some sort,
setting up and tearing down bare metal
is time consuming and labor intensive.
The machines have to be charged
and wiped clean in between each use.
And spinning up and tearing down
virtual machines is a process
that can be automated.
Virtual machines can easily be provisioned
with a standard starting configuration
in a reproducible way,
and there's no need to set up, reset,
or reconfigure hardware or software
in between each use.
So with authentic Apple hardware,
it's enrolled and managed
via the serial number, but this is
more of an implementation detail
that we need not worry ourselves with.
That all happens behind the scenes.
Virtualized macOS
is a little bit different story.
macOS has no concept
of what an "authentic" serial number is,
quote unquote.
But in this scenario, what we can do
is the serial number can be presented
to macOS via the system management BIOS
or SMBIOS.
This is what provides
management information
to the operating system that's available
from the system firmware.
And in the context of a virtual machine,
SMBIOS is emulated
and the serial number can be injected.
So I'd like to talk a little bit
about a case study
for the Jamf Nation User Conference
last year, 2020.
It was held virtually, as I'm sure
most of you or all of you are well aware,
due to the pandemic.
And the Interactive Labs
were actually powered by Orka.
A little bit more information can be found
by going to macstadium.com/customers/jamf
if you're curious to read.
A little bit about us, who we are.
MacStadium is the leading provider
of Mac Infrastructure as a service.
This includes VMware, Anka,
our own solution, Orka,
as well as bare metal.
We have data centers worldwide
which host genuine Apple hardware,
and we offer enterprise-grade
private clouds with top-grade storage,
networking, and security solutions.
So this includes Cisco
and Palo Alto firewalls, Cisco switches,
as well as Pure Storage FlashBlades.
I mentioned Orka a little bit.
Orka is an acronym for
Orchestration with Kubernetes on Apple.
So as I mentioned previously,
this is our own solution for virtualizing
and orchestrating macOS.
We leverage Kubernetes for this.
A little more information can be found
at macstadium.com/orka.
But I've got an architectural diagram here
on the right hand side which is
a little bit more of a visual aid here.
So basically, what we do is
we take a group of Mac hosts,
we turn that into a Kubernetes cluster,
which is connected to a storage area
network for data sharing.
On each physical host, we put a hypervisor
and then we use Kubernetes
to orchestrate containers in the cluster.
And inside of each container,
we stuff a full-blown macOS VM.
So for JNUC 2020, as I mentioned before,
the conference was held virtually
due to the COVID-19 pandemic,
and we needed a solution to provide
virtual attendees with an opportunity
for hands-on experience with Jamf.
So MacStadium actually partnered with Jamf
to provide Mac infrastructure
for the Interactive Labs,
and those Interactive Labs
use virtual Mac remote desktops,
which were powered by Orka.
So the technical challenge here
is how do we enroll a virtual machine
with Apple Device Enrollment
and integrate it with something like Jamf?
The Jamf team essentially needed to
assign an "owned" serial number
to each virtual machine,
so what this means is that
a physical piece of hardware
that was owned by the company,
we took that serial number and
injected that into the virtual machine.
Those virtual machines could then be
enrolled in Jamf Device Management.
And in order to accomplish this,
we on the Orka team created a custom
Docker image using a serial number
which Jamf provided.
Each virtual machine
deployed in the Kubernetes cluster
then used this custom Docker image.
And just kind of as a review of
the overall architecture here with Orka,
each macOS VM is actually housed
inside of a container.
And so what we were able to do
was add to the container image that
serial number which was able to be used
by the macOS VM.
So this solution provided
a one-to-many relationship
between the serial number
and the virtual machines.
In other words, that same custom
serial number was used for
every virtual machine
which was deployed in the cluster.
Overall, the JNUC 2020
Interactive labs were a huge success
for Jamf and for us as well.
Afterwards, another team at Jamf
approached us with a similar need
for putting on training courses
using remote macOS desktops.
For this, the Orka team,
we worked with Jamf again
to provide them a custom Docker image
with a serial number that they provided us
which was very similar to the setup
that they had for JNUC last year.
So there was a little bit room
for improvement here.
The Jamf team actually needed to
assign a unique serial number to each
virtual machine and they needed to be able
to assign that at the time of deployment.
So what we did on the Orka team
was we actually took this request
and developed it into a full-blown feature
which we released in Orka 1.6
which is now widely available
to all Orka customers.
To learn a little bit more about this,
please feel free to visit
orkadocs.macstadium.com/docs/
bring-your-own-macos-serial-number
which goes a little bit more into depth
about how the feature works,
how it's available to you,
and what you're able to do with it.
So thanks for listening.
I hope you found this talk to be
informative and interesting,
and I hope that you enjoy
the rest of the JNUC conference this year.