Vcac6 on The IT Hollow

vRealize Automation 6 with NSX – Firewall

Mon, 30 Nov 2015 15:08:27 +0000

So far we’ve talked a lot about using our automation solution to automate network deployments with NSX. But one of the best features about NSX is how we can firewall everything! Lucky for us, we can automate the deployment of specific firewall rules for each of our blueprints as well as deploying brand new networks for them.

Use Case: There are plenty of reasons to firewall your applications. It could be for compliance purposes or just a good practice to limit what traffic can access your apps.

Create a Day 2 Operations Wrapper

Mon, 16 Nov 2015 15:08:30 +0000

Just deploying virtual machines in an automated fashion is probably the most important piece of a cloud management platform, but you still need to be able to manage the machines after they’ve been deployed. In order to add more functionality to the portal, we can create post deployment “actions” that act on our virtual machine. For instance an action that snapshots a virtual machine would be a good one. We refer to these actions that take place after the provisioning process a “Day 2 Operation”, probably because it’s likely to happen on the second day or later. Clever huh?

vRealize Automation 6 with NSX – Load Balancing

Mon, 09 Nov 2015 15:19:10 +0000

If you’re building a multi-machine blueprint or multi-tiered app, there is a high likelihood that at least some of those machines will want to be load balanced. Many apps require multiple web servers in order to provide additional availability or to scale out. vRealize Automation 6 coupled with NSX will allow you to put some load balancing right into your server blueprints.

Just to set the stage here, we’re going to deploy an NSX Edge appliance with our multi-machine blueprint and this will load balance both HTTPs and HTTP traffic between a pair of servers.

vRealize Automation 6 with NSX - NAT

Mon, 02 Nov 2015 15:10:54 +0000

You’re network isn’t fully on IPv6 yet? Ah, well don’t worry you’re certainly not alone, in fact you’re for sure in the majority. Knowing this, you’re probably using some sort of network address translation (NAT). Luckily, vRealize Automation can help you deploy translated networks as well as routed and private networks with a little help from NSX.

A quick refresher here, a translated network is a network that remaps an IP Address space from one to another. The quickest way to explain this is a public and a private IP Address. Your computer likely sits behind a firewall and has a private address like 192.168.1.50 but when you send traffic to the internet, the firewall translates it into a public IP Address like 143.95.32.129. This translation can be used to do things like keeping two servers on a network with the exact same IP Address.

vRealize Automation 6 with NSX - Routed Networks

Mon, 26 Oct 2015 14:00:28 +0000

Any corporate network thats larger than a very small business is likely going to have a routed network already. Segmenting networks improves performance and more importantly used for security purposes. Many compliance regulations such as PCI-DSS state that machines need to be segmented from each other unless there is a specific reason for them to be on the same network. For instance your corporate file server doesn’t need to communicate directly with your CRM database full of credit card numbers. The quickest way to fix this is to put these systems on different networks but this can be difficult to manage in a highly automated environment. Developers might need to spin up new applications which may need to be on different network segments from the rest of the environment. Its not very feasible to assume we can now spin up test and delete hundred of machines each day, but need the network team to manually create new network segments and tear them down each day. That wouldn’t be a nice thing to do to your network team.

vRealize Automation 6 with NSX - Private Networks

Mon, 19 Oct 2015 14:05:45 +0000

Of the types of networks available through NSX, private networks are the easiest to get going because they don’t require any NSX edge routers to be in place. Think about it, the NSX edge appliance is used to allow communication with the physical network which we won’t need for a private network.

A quick refresher here, a private network is a network that is not connected to the rest of the environment. Machines that are on the private network can communicate with each other, but nothing else in the environment. Its simple, think of some machines connected to a switch and the switch isn’t connected to any routers. The machines connected to the switch can talk to each other, but thats it.

Software Defined Networking with vRealize Automation and NSX

Mon, 12 Oct 2015 14:30:53 +0000

This is a series of posts helping you get familiarized with how VMware’s vRealize Automation 6 can leverage VMware’s NSX product to provide software defined networking. The series will show you how to do some basic setup of NSX as well as how to use Private, Routed and NAT networks all from within vRA.

vRealize Automation 6 with NSX - NSX Setup

vRealize Automation 6 with NSX - Private Networks

vRealize Automation 6 with NSX - Routed Networks

vRealize Automation 6 with NSX - NAT

vRealize Automation 6 with NSX - Load Balancing

vRealize Automation 6 with NSX - Firewall

vRealize Automation 6 with NSX - Initial Setup of NSX

Mon, 12 Oct 2015 14:00:22 +0000

Before we can start deploying environments with automated network segments, we need to do some basic setup of the NSX environment.

NSX Manager Setup

It should be obvious that you need to setup NSX Manager, deploy controllers and do some host preparation. These are basic setup procedures just to use NSX even without vRealize Automation in the middle of things, but just as a quick review:

Install NSX Manager and deploy NSX Controller Nodes

NSX Manager setup can be deployed from an OVA and then you must register the NSX Manager with vCenter. After this is complete, deploy three NSX Controller nodes to configure your logical constructs.

vRealize Automation and vCloud Air Integration

Mon, 21 Sep 2015 14:07:42 +0000

vRealize Automation is at its best when it can leverage multiple infrastructures to provide a hybrid cloud infrastructure. One of the things we might want to do is to set up VMware vCloud Air integration with your vRA instance.

To start, we need to have a vCloud Air account which you can currently sign up for with some initial credits to get you started for free. Once you’ve got an account you’ll be able to setup a VDC and will have some catalogs that you can build VMs from. If you’re concerned about these steps, don’t worry a default VDC including some storage and a network will be there for you by default.

vPostgres for vRealize Automation Gotcha

Tue, 21 Apr 2015 13:45:15 +0000

If you’re planning on doing a full distributed installation of vRealize Automation, you’ll likely want to have some protection for the vPostgres database. Having a single point of failure defeats the purpose of doing a full distributed install. I’ve been doing a bunch of work on this lately and wanted to warn people of a gotcha if you’re using a load balancer.

Non-Distributed Install

To give us a better understanding, take a look at a pair of vRealize Automation Appliances that aren’t in a high availability solution. In the picture below, there are two vRealize Automation Appliances and each of them is communicating with their own embedded vPostgres Database. This is the default configuration when deployed from VMware and works just fine.

vRealize Automation vPostgres Failover

Mon, 13 Apr 2015 14:15:41 +0000

Clustering the vPostgres database is an important part of a fully distributed vRealize Automation install. The simple install only requires a single vRealize Appliance and an IaaS Server, but the fully distributed install requires many additional pieces including load balancers to ensure both high availability as well as handling extra load placed by users. The vPostgres database is included with the vRealize Automation appliances, but for a full distributed install, these must be modified so that there is an active and standby vPostgres database running on them. The primary vPostgres database will replicate to a standby read-only database.

Custom Options for vRealize Automation Server Requests

Mon, 30 Mar 2015 13:42:16 +0000

vRealize Automation is a great way to allow teams to deploy virtual machines and manage them throughout their entire lifecycle. You can control exactly where you want the machines deployed and the processes that must happen in order to meet company guidelines. Sometimes, you’d like to give some additional options to the end user when they deploy a machine. To do this, we can use a custom property.

Build a Property in the Property Dictionary

To start, lets build a new property in the property dictionary. To do this, go to the Infrastructure Tab –> Blueprints –> Property Dictionary. From there, we can add a “New Property Definition”. In the example below I’ve created a very generic “HollowTestProperty” and left the display name the same. A description is always a good idea and the Control Type I changed to “DropDownList”. This will mean that we can enter a series of values to be selected by the end user at the time of the request. Be sure to click the green check mark to save the entry.

vRealize Automation 6.2 Upgrade

Tue, 16 Dec 2014 14:56:53 +0000

Upgrades for the vRealize Automation software (formerly vCloud Automation Center) seem to be coming quite often these days. This post gives a quick overview on how to upgrade your current environment to the latest release. Of course for official documentation, please check out VMware’s documentation for details. vRealize Upgrade Instructions

Pre-Install Steps

Obviously you should ensure that you’ve got backups in the event something catastrophic should occur. Be sure to grab a backup of the IaaS database, and snapshot your vRA appliances, as well as any of the servers running the IaaS components such as the Model Manager, DEM Workers, Orchestrators and Agents. For this guide, we have a vRA appliance, and a single IaaS Server running the rest of the components. A separate SQL Server is housing the database.

VMware Appliance Console Certificates

Mon, 27 Oct 2014 13:01:33 +0000

During a recent install, I got stuck on an issue (or so I thought) assigning an SSL Certificate to some of the vRealize Automation Appliances. I went through all of the installation procedures and the appliance stated “SSL Certificate Installed Successfully”, but when I went to the appliance, the certificate still showed the default VMware certificate.

You can see when I go to the appliance, I was getting a warning on the SSL Certificate.

vRealize Automation 6 Customizations

Mon, 08 Sep 2014 11:01:25 +0000

It may seem like a trivial thing, but setting up some customizations for your vCAC (now renamed vRealize Automation) deployment can really make your IaaS solution stand out, and a good looking portal might help with buy-in from your users.

Branding

Setting up your portal with a logo and a color scheme that mimic’s your organization is a typical thing to do after getting a portal up and running.

Login to your vCAC instance with a Tenant Administrator login, go to the Administration Tab –> Branding. Here, you can upload your logo, add a product name (or department name), background colors, text colors and whatever you’d like.

vRealize Automation 6 Approvals

Mon, 08 Sep 2014 11:00:30 +0000

Your powerful new cloud automation software is up and running, but we need to have some sort of check and balance to be sure that people aren’t creating VMs on a whim because it’s so easy to do. For this, we can use an approval process. Maybe a supervisor, or even the CIO can approval the additional resources.

Approval Policies

To setup an approval policy, login as a Tenant Administrator and go to the Administration Tab –> Approval Policies. Click the familiar green “+” icon to add a new policy.

vRealize Automation 6 Custom Resource Properties

Mon, 08 Sep 2014 10:58:07 +0000

In the last post, we showed how to use vCAC to surface a vCO workflow. The problem presents itself when the vCO workflow is looking for something other than a string for a variable. What if you are looking for an object? For example there may be a user named “Clarice Starling” and that name could be a string. But the Active Directory object for user Clarice Starling has many attributes such as account, description, permissions etc and that is not a string. So if you want to perform an action on an object from vCAC, what do you do?

vRealize Automation 6 Service Blueprint

Mon, 08 Sep 2014 10:58:07 +0000

We’ve got the main section of vCAC (now renamed vRealize Automation) setup and running and have created some blueprints to create some servers, but that’s really just the tip of the iceberg. We can utilize vCAC to perform tasks as well and in my opinion this is where vCAC really makes a big difference.

Service Blueprints

Instead of creating server blueprints, now we create service blueprints. They’ll be a similar setup to what you’ve seen in previous posts. Go to the Advanced Services Tab –> Service Blueprints and click the green “+” sign to add a new blueprint.

vRealize Automation 6 Service Designer and vCO

Mon, 08 Sep 2014 10:57:25 +0000

vCAC 6 (now renamed vRealize Automation) allows us to provision more than just virtual machines. We can also publish vCenter Orchestrator packages. To do so, we need to configure the Service Designer.

Go to the Administration Tab –> Groups and create a group that will have access to the service designer. I just used the Domain Admins group, mainly because it’s my lab. Click the dropdown to edit the group properties.

vRealize Automation 6 Blueprints and Catalogs

Mon, 08 Sep 2014 10:56:13 +0000

We’re finally ready to start building some blueprints. Resources are available, reservations have been set, groups have been created and now we can build some blueprints.

Blueprints

Go to the Infrastructure Tab –> Blueprints –> Blueprints and then click “New Blueprint” –> Virtual –> vSphere (vCenter).

Give the blueprint a name and a description. In my case, I’m creating a server 2008 R2 blueprint. Select a Reservation Policy and a machine prefix. Then enter a number of days for Archives. This is the number of days the virtual machines will be available after they expire. Think recycling bin in Windows. Also, if you’re so inclined, you can enter a dollar amount to assign to this template per day, so that later on each department can see how much money these VMs cost the company.

vRealize Automation 6 Policies and Reservations

Mon, 08 Sep 2014 10:55:24 +0000

In this vCAC (now renamed vRealize Automation) series, we’ve got access to some of our resources now after connecting our vCenter Endpoint, so now we want to create some policies to control how our new VMs will be deployed.

Machine Prefixes

We’ll be creating a lot of new virtual machines so we’ll want to put a prefix on all these machines so we can identify them. You can have more than one prefix so that you can have different prefixes by department, company, user or so on.

vRealize Automation 6 vCenter Endpoint Setup

Mon, 08 Sep 2014 10:54:02 +0000

We’ve completed the vCAC (now rename to vRealize Automation) appliance deployment, installed IaaS components, setup tenants and identity stores. Now it’s time to get cracking on connecting to some resources that we can use for our applications. I would like to point out that for this section we’ll be logged in as a user that is both an infrastructure admin as well as a tenant admin. I’ve also chosen to complete this configuration under my newly created “Neighborhood Watch” tenant. When adding resources to your tenants, you can do this at the default tenant level and have the sub-tenants use them, or configure the resources at each tenant level. I would steer away from doing it in both places to make troubleshooting easier at a later date. I mean, what happens when you’re sharing the same vCenter at the default level as well as the sub-tenant level? That could get a bit tricky.

vRealize Automation 6 Basic Configurations

Mon, 08 Sep 2014 10:53:24 +0000

If you’ve followed the series this far, you’ve got your vCAC (now renamed vRealize Automation) appliance deployed and your IaaS components installed. The tricky parts are over with, and now the fun begins… configurations! What are you waiting for? Go login at the http://vcacapplaincename/shell-ui-app/ url.

Add a Tenant

Under Administration –> Tenants, you will see the default tenant which is vsphere.local. This is the context where you can create additional tenants and should probably be considered to be a “Do Not Touch” tenant. Even if you’re only going to have a single tenant, it would be a good idea to create a new one just in case. It’s pretty easy to create more tenants if you make a mistake, but tough to recreate the default tenant. Click the “+” to create a new tenant.

vRealize Automation 6.0 IaaS Installation

Mon, 08 Sep 2014 10:51:20 +0000

Deploying the vCAC (now renamed to vRealize Automation) appliance is only the first step towards getting your Infrastructure as a Service (IaaS) up and running. The next step is to get the IaaS components installed on a Windows machine. There are a number of prerequisites but luckily there is a powershell script that can take care of most of it for you. Find the script here. I must mention first that for vCAC 6 (at the time of this writing) .Net 4.5 is required. This does not mean that .Net 4.5 or higher needs to be installed. .Net 4.5 sp1 does not work with the IaaS components which also means that Server 2012 R2 is not a candidate to install the IaaS components on. Use a Server 2008R2 or Server 2012 with .Net 4.5 installed. (vRealize 6.1 fully supports .Net 4.5.1 according to the VMware rep I spoke with at VMworld)