Quick Tip - How to deploy vCenter Server Appliance (VCSA) to legacy CPU without VMX Unrestricted Guest feature?

I recently had a customer reach out who was having an issue deploying the latest vCenter Server Appliance (VCSA) 8.x to an ESXi host that had a CPU that was no longer supported. After the VCSA OVA was uploaded by the VCSA (UI/CLI) installer, it fails to power on the VM with the following error message:

The Intel "VMX Unrestricted Guest" feature is necessary to run this virtual machine on an Intel processor

This problem is only observed with older legacy CPUs that do not support some of the modern CPU instructions that is expected by most workloads today. There is workaround for those that still wish to run on unsupported hardware, which may yield other unexpected behaviors, by adding a VM Advanced Setting monitor.allowLegacyCPU = TRUE

However, there is a chicken/egg problem that user was not able to add this setting before the VM was automatically powered on by the VCSA Installer.

My initial response to the customer was to simply modify the OVA by converting it to an OVF, manually add the required setting and then convert it back to an OVA and the VCSA Installer will go ahead and deploy the VM with the additional setting. While this will work, there are multiple steps involved and most customers typically have never gone through this process before.

I am a huge fan of OVFTool, it is such a powerful client side utility for working with OVF/OVA. In fact, the VCSA Installer actually uses OVFTool under the hood to deploy the VCSA OVA and I decided to take another look at the options that OVFTool supports. I quickly noticed an option that would help with this particular scenario where a VM Advanced Setting needs to be injected into the VM and prior to it being powered on. Luckily, this can be achieved by using --extraConfig parameter.

To make this even easier, back in vSphere 6.5, the VCSA Installer was enhanced with a new OVFTool argument pass-through feature that would allow users to pass OVFTool specific parameters directly within the VCSA CLI installer deployment manifests. This meant that you still got the benefits of using the VCSA Installer, which all customers should be doing rather than deploying the OVA manually and still get the flexibility with some of the options provided by OVFTool.

Below is an example VCSA Installer deployment JSON file that is used to deploy a VCSA to an ESXi host and the only difference between a typical deployment and this specific one is the addition of the ovftool_arguments parameter which allows you to add additional OVFTool arguments.

{
    "__version": "2.13.0",
    "new_vcsa": {
        "esxi": {
            "hostname": "esxi.primp-industries.local",
            "username": "root",
            "password": "VMware1!",
            "deployment_network": "VM Network",
            "datastore": "sm-vsanDatastore"
        },
        "appliance": {
            "thin_disk_mode": true,
            "deployment_option": "tiny",
            "name": "vcsa.tanzu.local"
        },
        "network": {
            "ip_family": "ipv4",
            "mode": "static",
            "system_name": "192.168.30.67",
            "ip": "192.168.30.67",
            "prefix": "24",
            "gateway": "192.168.30.1",
            "dns_servers": [
                "192.168.30.2"
            ]
        },
        "os": {
            "password": "VMware1!",
            "ntp_servers": "pool.ntp.org",
            "ssh_enable": true
        },
        "sso": {
            "password": "VMware1!",
            "domain_name": "vsphere.local"
        },
        "ovftool_arguments" : {
            "extraConfig:monitor.allowLegacyCPU" : "TRUE"
        }
    },
    "ceip": {
        "settings": {
            "ceip_enabled": true
        }
    }
}

In summary, if you are deploying an OVA/OVF and need to add additional VM Advanced Settings, you can do so via OVFTool and the --extraConfigs parameter and if you need to do that for the VCSA, then use the additional OVFTool argument pass-through feature that natively integrates with the VCSA CLI Installer.