Within a VMware Cloud Foundation (VCF) 9.0 fleet, a single VCF Operations instance provides centralized license management and fleet management capabilities for all managed VCF instances.
That said, additional Standalone VCF Operations 9.0 instances can also be deployed for monitoring only use cases, which is a scenario that has been coming up more frequently with customers.
Although the VCF 9.0 Licensing documentation briefly references this supported use case, there is not much details on how this actually works. After getting a quick primer on this use case from fellow colleague Jared Burns and the VCF Licensing PM, I thought I would put together a quick blog post using some visuals I had created to help explain how this scenario can be setup.
While the VCF Operations instance (green) within the VCF Fleet is still responsible for providing license management for VCF Instances, users can deploy an additional Standalone VCF Operations (orange) instance(s) which can be used for aggregation purposes with VCF Operations Federation or simply provide additional redundancy in monitoring of metrics when the VCF Operations instance in the fleet is under maintenance.
The additional VCF Operations instance (orange) must still be licensed and follows the exact same flow as the VCF Operations instance (green), with entitlement retrieved from the Broadcom Business Service Console (BSC) using either Connected or Disconnected mode.
One neat optimization that is supported when using an additional Standalone VCF Operation instance(s) is that it can receive its entitlements from the existing VCF Operations from within the VCF Fleet as depicted in the diagram below.
Technically speaking, the VCF entitlement would come from one of the managed vCenter Server that is licensed by the VCF Operations instance within the VCF Fleet but conceptually, this would remove the need to go through the license entitlement workflow for each additional standalone VCF Operation instance.
Enough about the concept, how do you actually set all this up?
Step 1 - Deploy a VCF 9.0 Fleet and the VCF Operations instance (green) which I will be referring to as vcf01.vcf.lab
Step 2 - Deploy additional VCF Operations instance (organge) using the OVA image, which you can fully automate (see here and here) and I will be referring to that as vcf02.vcf.lab
Step 3 - Once vcf02.vcf.lab is up and running, login to VCF Operations UI and navigate to Administration->Integrations and add a new VCF integration and provide your SDDC Manager FQDN and credentials. I also enabled the automatic domain monitoring in advanced setting as shown in screenshot below.
Once you complete the VCF integration wizard, you will get an additional pop-up asking whether you would like to associate the vCenter Server(s) for monitoring purposes, which is the default selection and then click Add button to finish.
It can take a minute or so for vcf02.vcf.lab to retrieve its entitlement from vcf01.vcf.lab and the vCenter Server that is associated within the VCF Management Domain. If you now navigate to License Management->Licenses, we can see that vcf02.vcf.lab has been successfully entitled by vc01.vcf.lab which is the vCenter Server that has already been entitled by vcf01.vcf.lab.
Note: I have seen in some cases if the entitlement does not automatically occur, you can simply logout of vcf02.vcf.lab and log back in and that can sometimes do the trick.
On additional scenario that I wanted to cover since this was something I had experimented with was that if vcf02.vcf.lab had existing vSphere integrations and that they would need entitlements, then you would NOT be able to use the method above to monitor both vCenter Servers from vcf01.vcf.lab AND license the existing attached vCenter Server(s).
For this scenario today, it would require both VCF Operations instances vcf01.vcf.lab (green) and vcf02.vcf.lab (orange) to retrieve their entitlements separately from BSC.
How to license standalone Host now? For example Hosts that has all backup VMs and should not be managed by vCenter, security wise. To make attack surface as small as possible....
If you're asking about Standalone ESX host, they need to be connect to a vCenter and VCF Operations instance (which is what provides license management) to vCenter Server and ESX hosts
Yes, it is customer requirement to have backup server (in this case Veeam) disconnected from as many sources as possible (no vCenter, no XCC/iLO central managed,...).
For example: compromised AD -> gain access to vSphere -> ESX access -> destroy backup data. Or XCC Console access used to hack root password of ESX host,....etc...
Anyway, is there some fix for that scenario and still be license compliant? Even if that means manual upload token every 3 months....