# Overview

By providing developers with end-user self-service provisioning of VMs on VMware vSphere can significantly boosts developer productivity by removing friction, reducing delays, and fostering agility in development workflows.

Info

Review the [benefits](https://docs.rafay.co/template_catalog/vm/benefits/) of this approach.

* * *

## Architecture

The diagram illustrates how Rafay enables end-user self-service VM provisioning on VMware vSphere infrastructure, streamlining developer access to virtual machines while maintaining enterprise-grade control and visibility.

### Customer Data Center

At the heart of the deployment is the customer’s on-premises data center(s), which houses:

- VMware vCenter and vSphere, responsible for VM lifecycle management.
- Rafay Agent, deployed within the customer environment, which securely interfaces with vCenter using VMware APIs.
- Virtual Machines (VMs) provisioned and managed by vSphere based on user requests.

### Rafay Controller & Self-Service Portal

The Rafay Controller (SaaS or Self Hosted in the customer's datacenter) communicates with the Rafay Agent over port 443 (outbound only)—ensuring secure, firewall-friendly connectivity without inbound port requirements. End users interact with the Self-Service Portal, a web based portal provided by Rafay, where they can request VMs as needed.

VMvSpherevCenterRafayAgentRafayControllerSelfServicePortalDeveloperVMvSpherevCenterRafayAgentRafayControllerSelfServicePortalDeveloperRequest VMForward VM requestInitiate provisioning workflowCall vCenter API to provision VMTrigger VM creationInstantiate new VMVM ReadyNotify VM provisionedProvisioning completeStatus updateNotify userAccess via SSH

* * *

## 🔒 Security & Access

All communication between the Rafay Controller and the customer environment is outbound and encrypted, preserving perimeter security.

- VM access for users is typically via secure protocols like SSH, and access control policies can be enforced centrally.
- Optional VPN integration ensures secure connectivity for VM access in private environments.