WilliamLam.com

Automate Inventory of vSphere Supervisor Clusters & vSphere Kubernetes Service (VKS) Guest Clusters

by // Leave a Comment

As customers begin planning their upgrade to VMware Cloud Foundation (VCF) 9.1, vSphere Supervisor and vSphere Kubernetes Service (VKS) have been coming up more frequently in upgrade discussions.

Before you can determine the applicable upgrade path, it is important to understand what has been deployed. Depending on your environment, you may have multiple vSphere Supervisor Clusters running different Supervisor versions, VKS Service versions, and VKS Guest Cluster versions, which can make gathering a complete inventory challenging.

To help simplify the collection of information, I have created a small PowerCLI script called Get-vSphereSupervisorAndVKSInventory.ps1 (I actually had to create the initial base with me verifying specific cmdlets to provide to AI because it went on wild tangent when asked to create me such a script) which will automatically inventory your vSphere Supervisor and VKS deployments. At first, I was hoping AI could

VCF 9.1 - Quick Tip: Optimized Workflow for Configuring Distributed Transit Gateway (DTGW) with NSX Virtual Network Appliance (VNA)

by // Leave a Comment

With VMware Cloud Foundation (VCF) 9.1, the Distributed Transit Gateway (DTGW) connectivity model now supports NSX stateful network services through the Virtual Network Appliance (VNA) cluster. This makes it easy for VI Admins to provision Virtual Private Clouds (VPCs), which can then be used to deploy vSphere Kubernetes Service (VKS) workloads using either vCenter Server or VCF Automation (VCFA).

One of the most underappreciated benefits is the ability to complete various NSX workflows including an entire VNA cluster deployment and DTGW configuration directly from vCenter Server, without having to switch to the NSX Manager UI. While NSX Manager still provides the underlying micro-frontend interfaces that are integrated into the vSphere UI, I appreciate having the flexibility to perform these workflows from either the vCenter Server or NSX Manager interface, depending on your roles and responsibilities within an organization.

While there are a number of community blog posts covering DTGW and VNA deployments, they typically start in the vSphere UI for the initial VNA deployment before switching to the NSX Manager UI to complete the remaining configuration, which is perfectly valid. Personally, I prefer using the vSphere UI for as many workflows as possible, especially since enabling vSphere Supervisor and vSphere Kubernetes Service (VKS) is also performed through the vSphere UI.

[Read more...]

VCF 9.1 - Configuring vSphere Supervisor to use VCF Identity Broker (IDB) for External Identity Federation

by // 2 Comments

The majority of VMware Cloud Foundation 9.1 components can automatically be configured when enabling VCF Single Sign-On (SSO), with the exception of VCF Operations HCX, Log Management (formally VCF Operations for Logs) and VCF Operations for Networks.

These additional VCF components can still be configured to use VCF SSO, however users must first create a new OIDC Client Application from the VCF Identity Broker before completing the VCF SSO configuration for those respective components.

This ability to create custom OIDC Client Application from the VCF Identity Broker brings up an interesting capability for those using vSphere Supervisor and have not deployed VCF Automation (VCFA). vSphere Supervisor can support external identity federation and you would typically create an OIDC Client from your identity provider (e.g. Keycloak). For simplicity purposes, especially for lab or PoC purposes, you could take advantage of the VCF Identity Broker to simply use it as the IdP for vSphere Supervisor and get the benefit of having a single OIDC Client from your IdP.

Note: When VCFA is deployed and configured to use your vSphere Supervisor, it actually becomes the IdP interface where you would then configure your external IdP within VCFA Tenant Portals and VCF Identity Broker is not involved at all to cleanly separate infrastructure configuration from tenant configurations.

[Read more...]