VCSA – Page 32

Configuring VCSA 6.0 as vSphere Web Client Server for vSphere 5.5

04.22.2015 by William Lam // 11 Comments

The vSphere 6.0 Web Client has been greatly improved with the release of vSphere 6.0 which includes a number of performance and UX enhancements. If you are interested in some of the details, be sure to check out this blog post by Dennis Lu, Product Manager of the vSphere Web Client. To really get the best possible user experience and to take advantage of all the new performance enhancements, it is recommend that you upgrade your entire vSphere environment which includes vCenter Server to vSphere 6.0. Having said that, I know this may not be possible for everyone immediately and it will take some time depending on your organizations software upgrade cycles and procedures, qualifications, burn in time, comfort left, etc. with vSphere 6.0 before completely moving over.

Over the last couple of weeks, I have seen quite a few requests from customers who have expressed interest in being able to just use the new vSphere 6.0 Web Client with their existing vSphere 5.5 environment as they make their transition over to vSphere 6.0. I can definitely understand where these customers are coming from and honestly, the vSphere Web Client should just be that, a UI Client. We should be able to decouple it from vCenter Server and be able to iterate on it based on feedback from our customers and partners. I did some investigation and I actually discovered that we in fact support something called Mixed-Version Transitional Environment in vCenter Server for Windows Upgrade. This is a bit of a mouth full but basically you can have a hybrid vCenter Server environment that consists of both vSphere 5.5 and 6.0 as you upgrade to full a full vSphere 6.0 environment.

I spent a couple of days researching this topic a bit more to see if I can come up with a solution that would ideally reduce number of changes introduced to a customers existing vSphere 5.5 environment while being able to leverage the new vSphere 6.0 Web Client. After many discussions, prototyping, snapshot reverts and with the help of one of my good GSS buddy G. Blair Fritz, we have come up with a very cool solution using the VCSA 6.0 as a "thin" vSphere 6.0 Web Client Server. The overall goal is to provide a period of time in which customers can use the new vSphere 6.0 Web Client with their existing vSphere 5.5 environment and when the time comes for a complete vSphere 6.0 upgrade, this "thin" vSphere 6.0 Web Client can be decommissioned and removed.

Disclaimer: Though this hybrid configuration is supported, using the VCSA as a "thin" vSphere Web Client Server is not officially supported. Please use at your own risk. It is still recommended that you upgrade your existing vSphere 5.5 environment to vSphere 6.0 as soon as possible to get the full benefits of the enhancements made to the vSphere 6.0 Web Client.

Requirements:

vSphere 5.5 running Windows using an External SSO Server
At least one vCenter Server 5.5 pointing to the External SSO Server

Here is the high level workflow as well as a diagram to help you visualize the process:

Step 1 - Upgrade your external SSO from vSphere 5.5 to new PSC 6.0
Step 2 - Deploy VCSA 6.0 and configure it to point the newly upgraded PSC 6.0
Step 3 - Running a configuration script within the VCSA 6.0 to optimize it as a "thin" vSphere Web Client Server

In my test environment, I have deployed a vCenter Server 5.5 which points to an external SSO (also running vSphere 5.5).

Step 1 - The first step is to upgrade the SSO server to the new PSC 6.0, you will follow the existing procedure by mounting the ISO and going through the guided installation. At this point, you can continue logging into the existing vSphere 5.5 Web Client and access your vCenter Server and its hosts and VMs.

Step 2 - Next, you will need to deploy a new Embedded VCSA 6.0 using either the Guided or Scripted Installation. You will need to make sure that it is joining to an existing SSO Domain by specifying the upgraded Windows PSC that you performed in step one. The SSO Domain Name should be vsphere.local as this was not a configurable option in earlier vSphere releases. At this point, you can now login to the VCSA 6.0 which provides the vSphere 6.0 Web Client but you will notice that you only see an empty inventory of the new vCenter Server 6.0 as well as an error message stating "Login failed due to invalid credentials for one or more vCenter Server systems"

The reason for this is that you need to restart the vpxd service on your vCenter Server 5.5 for it to be visible in the new vSphere 6.0 Web Client.

Note: It is important that if your external PSC is joined to an Active Directory Domain that you ensure the NTP Server specified in the VCSA 6.0 deployment also points to the same AD Server for the time source to be synchronized else you will run into problems later.

Step 3 - Login to your vCenter Server 5.5 and restart the vCenter Server service using the Services utility.

Step 4 - Once the vCenter Server service has restarted, you can now open a browser to the Hostname/IP Address of the VCSA 6.0 and you will see both vCenter Servers. You can now manage your vSphere 5.5 environment using the vSphere 6.0 Web Client.

I was pretty happy when I got this solution working but I was still not content. The smallest deployment size for an Embedded VCSA requires 8GB of memory, which is still a considerable amount of resources in my opinion. I wanted to optimize it further by turning off unnecessary services, modify the memory requirements for the unused services as well as un-registering the vCenter Server 6.0 endpoint so that you only see your vSphere 5.5 vCenter Servers only. Surprisingly, this took up the bulk of our research to figure out what could be turned off, how to properly turn it off and then un-registering the VC endpoint.

I have created the following shell script called setup_vcsa_as_webclient_client.sh which needs to be uploaded to the VCSA (need to enable Bash shell on the VCSA). The following three variables must be updated prior to running:

PSC_SERVER - The Hostname/IP Address of your external PSC
SSO_USERNAME - The SSO Administrator account
SSO_PASSWORD - The SSO Administrator password

Once everything completes successfully, you should turn off your VCSA and modify the memory from 8GB to 3GB. From my limited amount of testing, the overall memory utilization was sitting around ~2-2.5GB of memory, so I think configuring it to 3GB should be plenty and you can always adjust accordingly. Since we have disabled all the unnecessary services, the VCSA boot time should be pretty quick and now when you login to the vSphere Web Client, you should only see your vSphere 5.5 vCenter Servers and nothing else.

When the time comes and you are ready to fully upgrade your vSphere 5.5 environment to vSphere 6.0, you can decommission and remove this "thin" vSphere Web Client Server by following the procedure outlined in this VMware KB 2106736. I think it would be really nice to be able to update the vSphere Web Client outside of updating vCenter Server and truly providing a "client" that is decoupled. What do you think?

vCenter Server 6.0 Tidbits Part 6: Customizing VCSA's DCUI

04.21.2015 by William Lam // Leave a Comment

For those of you who have deployed the latest VCSA 6.0, you may have noticed that it now includes a DCUI interface similar to that of ESXi. Just like ESXi, it provides some basic functionality such as network configuration, restarting of the management interface, enabling SSH/Shell access and viewing support logs. For some customers, there is a mandatory requirement in terms of compliance to be able to display a security or warning banner prior to logging into a system which can also include interactive console UI's like the DCUI.

With ESXi, it was possible to customize the DCUI as seen in the screenshot below (more serious customizations are used in customer environments of course). For more details, please take a look at this blog post here.

Luckily, with the VCSA 6.0, it is also now possible to customize some of the text on the DCUI interface. However, you will not have complete free range like you did with the ESXi's DCUI interface but will be specific part of the screen. Here is an example of what can be added to the VCSA's DCUI screen:

There is a section before the IP Address and a section after the IP Address which you can append custom text. This is controlled by the following configuration file located in: /etc/vmware/appliance/dcui.cfg and specifically with the following two variables: CONNECTION_MESSAGE which is the message before the IP Address and CONNECTION_MESSAGE_AFTER_IP for the message after the IP Address.

Here is an example of what the above customization looks like:

{
    "PRODUCT_NAME": "VMware vCenter Server Appliance 6.0",
    "CONNECTION_MESSAGE_BEFORE_IP": "https://",
    "CONNECTION_PORT": "443",
    "CONNECTION_MESSAGE": "\n\t### Message BEFORE IP ###\n",
    "CONNECTION_MESSAGE_AFTER_IP": "\n\n\t### Message AFTER IP ###\n"
}

For the changes to take affect, you will need to reload the DCUI interface which you can do by running the following command:

kill $(ps -ef | grep dcui.py | grep -v grep | awk '{print $2}')

vCenter Server 6.0 Tidbits Part 5: New method of patching the VCSA/PSC

04.17.2015 by William Lam // 9 Comments

In previous releases of the VCSA, patching and updating of the VCSA was performed through what was known as the VAMI interface which provided both a UI as well as a command-line which I have blogged about here. The simplest and easiest method was of course using the UI which just required opening a browser to https://[VCSA]:5480 as seen in the screenshot below.

UPDATE (09/04/15) - In vSphere 6.0 Update 1, URL based patching is now available. You can find more details here.

In the VCSA 6.0, the old VAMI UI interface no longer exists and to update/patch the VCSA you will need to use the appliancesh command-line interface. There is a command called "software-packages" which is used to update/patch the software on the VCSA. This information is also documented here.

VMware just recently released a patch update to vSphere 6.0 and one of the updates is applicable to VCSA (Embedded) and VC/PSC (External) as noted in this VMware KB 211640. There are two patches (Third Party & Bug/Security Fix) which are available as an ISO which can be downloaded from here.

Before you can apply the patch/update, you will need to mount the patch ISO to your VCSA/PSC using either the vSphere C#/Web Client as you would with any other ISO. The second step is to login to the VCSA/PSC and if you have disable the appliancesh, you just need to type "appliancesh" and you will be prompted to login with your root credentials.

Once logged into the applianesh, the software-packages supports two options:

Stage patches from ISO and then install
Stage patches from ISO and install at a later time

If you wish to perform the update/patch in a single step by staging and installing, you can run the following command:

software-packages install --iso --acceptEulas

If you wish to only stage the patches but not install, you can do so by running the following command:

software-packages stage --iso --acceptEulas

Once you are ready to install the staged patches, you will need to run the following command:

software-packages install --staged