WilliamLam.com

Enhancement in VCF 5.2.2 to bypass vSAN ESA HCL Check

by // Leave a Comment

When vSAN Express Storage Architecture (ESA) is selected as the primary storage for deploying VMware Cloud Foundation (VCF) 5.x, the Cloud Builder Appliance will validate the system against the vSAN ESA HCL and will block the deployment if the hardware components are non-compliant.


For a production deployment, this should be the default experience but for non-production or proof-of-concept (POC), this can be annoying if you wish to accept the risk and proceed with using non-certified vSAN ESA hardware.

Today, the most viable workaround is to install the vSAN ESA Hardware Mock VIB , which will allow users to proceed with the deployment but it does require the additional installation step for each ESXi host.

Having spoken with VCF Engineering about this topic awhile back, they have introduced a nice enhancement with the latest release of VCF 5.2.2 that will allow users to easily bypass the vSAN ESA HCL check without requiring additional ESXi configurations changes.

[Read more...]

Automated VMware Cloud Foundation (VCF) 9.0 Lab Deployment Script

by // 4 Comments

Now that VMware Explore Las Vegas has concluded, I finally have a small breather to publish my Automated VMware Cloud Foundation (VCF) 9.0 Lab Deployment Script, which utilizes Nested ESXi running on an existing physical vSphere environment, as shown in the diagram below.


I know many of you have used previous versions of my automated lab deployment scripts, so this should feel quite familiar along with some enhancements including the ability to externalize the environment configuration parameters from the actual deployment script.

You can find all the details and documentation at the following Github repo:

[Read more...]

VCF Automation Provider Organization as an OIDC Identity Provider for VCFA Tenant Organizations?

by // 4 Comments

VCF 9.0 Automation (VCF) contains two types of organizations, one for the Provider (also referred to System) and one for the tenants, which are just called Organizations. Both types of VCFA Organizations can be connected to an external Identity Provider (IdP) including OIDC, LDAP and SAML.

The VCFA Provider Organization can be configured to use the new VCF Single-Sign (SSO) feature, which is a capability of VCF Operations and utilizes a deployment of vIDB (Embedded or External) which is the identity broker to your desired external IdP like PingFederate or Okta as an example. While you can connect the VCFA Provider Organization directly to an external IdP, by using VCF SSO, administrators can now seamlessly login to all VCF management components, assuming you have been granted the appropriate permissions within each component.

For VCFA Tenant Organizations, where each organization could represent a completely different customer, such as in a service provider model, each individual VCFA organization can connect to their own independent external IdP, as represented in the diagram below.


For a typical Enterprise, you might only have a single IdP that you would use for both the Provider and Tenant Organizations. If you are using an OIDC IdP, you would need to create one OIDC Client for VCF SSO and then one additional OIDC Client for each organization that you would like to connect to the same OIDC IdP as shown below.


Instead of creating multiple OIDC Clients, could we just leverage the Provider Organization as the OIDC IdP for the VCF Tenant Organizations?

Note: Depending on your external IdP capabilities, you might need to have separate OIDC Clients for controlling multi-factor authentication (MFA) or customized login screen as I have demonstrated with using Keycloak as my external IdP.

[Read more...]