VCF 9.1 - New HTTP Offline Depot Support for VCF Installer & Fleet Depot Service

VMware vSphere Foundation (VVF) and VMware Cloud Foundation (VCF) 9.0 introduced the concept of a unified VCF Software Depot, which can connect to either Broadcom’s online repository or an offline depot that is hosted within an organizations environment.

By default, an offline VCF Software Depot requires HTTPS with basic authentication. In VCF 9.0, HTTPS can be disabled using this workaround, which remains applicable in VCF 9.1, however, basic authentication is still required.

Note: If you do not or can not  setup a basic web server for your VCF Offline Depot, you can use this simple Python script to serve up depot locally from your desktop as long as its accessible by VCF Installer and/or VCF Fleet Depot Service.

With VCF 9.1, both the VCF Installer and the new VCF Fleet Depot Service support an offline Software Depot configured with HTTP and no basic authentication. To take advantage of this capability, you must use the VCF Installer API for the initial VCF Fleet deployment, which automatically applies the same configuration to the Fleet Depot Service.

Note: The VCF 9.1 Installer UI currently does not support connecting to an offline VCF Software Depot using HTTP, the VCF Installer API must be used to apply this configuration.

If you accidentally used the VCF 9.0 workaround, you will need to reapply the HTTP configuration after the VCF Fleet has been deployed using the new VCF Fleet Depot Service API.

Here is a quick table on the different supported scenarios and applicable workarounds:

VCF Installer

As mentioned earlier, in order for the VCF 9.1 Installer to connect to an HTTP offline depot without basic authentication, you will need to use the VCF Installer API. Below is a PowerShell example that you can use to apply this configuration.

Note: If you apply the configuration below, you will NOT have to run the Fleet Depot Service as the configuration will automatically be transferred to your deployed VCF Fleet and the VCF Fleet Depot Service will contain your HTTP offline depot configuration.

$VCFInstallerFQDN = "sddcm01.vcf.lab"
$VCFInstallerRootPassword = "VMware1!VMware1!"
$VCFInstallerOfflineDepot = "http://192.168.30.29:8888"

# DO NOT EDIT BEYOND HERE #

$payload = @{
    username = "admin@local"
    password = $VCFInstallerRootPassword
}

$body = $payload | ConvertTo-Json

$params = @{
    Uri                  = "https://${VCFInstallerFQDN}/v1/tokens"
    Method               = 'POST'
    Headers              = @{
        'Content-Type' = 'application/json'
    }
    SkipCertificateCheck = $true
    Body                 = $body
}

$requests = Invoke-WebRequest @params

if ($requests.StatusCode -eq 200) {
    $accessToken = ($requests.Content | ConvertFrom-Json).accessToken
}

$depotPayload = @{
    depotConfiguration = @{
        isOfflineDepot = $true
        url            = $VCFInstallerOfflineDepot
    }
}

$depotBody = $depotPayload | ConvertTo-Json

$params = @{
    Uri                  = "https://${VCFInstallerFQDN}/v1/system/settings/depot"
    Method               = 'PUT'
    Headers              = @{
        Authorization = "Bearer ${accessToken}"
        'Content-Type' = 'application/json'
    }
    SkipCertificateCheck = $true
    Body                 = $depotBody
}

Invoke-WebRequest @params

VCF Fleet Depot Service

As mentioned earlier, if you have applied the VCF 9.0 Installer workaround for connecting to an HTTP offline depot with basic authentication, once the VCF Fleet has been deployed, the offline depot configuration is NOT automatically transferred over to new VCF Fleet Depot Service. This is by design as the previous workaround was more of a "hack" to support non-HTTPS offline depot.

If you find yourself in this situation and would like to continue using an HTTP offline depot without basic authentication, then you will need to re-apply the configuration using the VCF Fleet Depot Service API. This API may also be applicable where you might want to reconfigure to alternative HTTP offline depot, so there maybe other Day-N use cases where you might find this to be useful. Below is a PowerShell example that you can use to apply this configuration.

# --- Configuration Variables ---
$VCFMSFQDN                = "vcf-msr01.vcf.lab"
$VCFMSAdminPassword       = "VMware1!VMware1!"
$VCFFleetFQDN             = "vcf-flt01.vcf.lab"
$VCFInstallerOfflineDepot = "http://192.168.30.29:8888"

# --- Authentication ---
$authParams = @{
    Uri                  = "https://${VCFMSFQDN}/api/v1/identity/token"
    Method               = 'POST'
    Headers              = @{
        'Content-Type' = 'application/x-www-form-urlencoded'
    }
    SkipCertificateCheck = $true
    Body                 = @{
        grant_type = 'password'
        username   = "*protected email*"
        password   = $VCFMSAdminPassword
    }
}

$authResponse = Invoke-WebRequest @authParams

if ($authResponse.StatusCode -eq 200) {
    $accessToken = ($authResponse.Content | ConvertFrom-Json).access_token
} else {
    Write-Error "Failed to authenticate. Status Code: $($authResponse.StatusCode)"
    return
}

# --- Update Depot Service ---
$depotPayload = @{
    depotConfiguration = @{
        depotType = "OFFLINE"
        url       = $VCFInstallerOfflineDepot
    }
}

$depotBody = $depotPayload | ConvertTo-Json

$connectivityParams = @{
    Uri                  = "https://${VCFFleetFQDN}/depot-service/api/depot/v1/connectivity"
    Method               = 'PUT'
    Headers              = @{
        'Content-Type'  = 'application/json'
        'Authorization' = "Bearer ${accessToken}"
    }
    Body                 = $depotBody
    SkipCertificateCheck = $true
}

Invoke-WebRequest @connectivityParams