Skip to main content

VCF 9 : VCF Automation Provider Setup with VMware vSphere Supervisor (VKS), FLB and NSX Edge GW – Part 1


In this blog I am going to discuss about creating VCF Automation(VCF-A) as workload provisioning platform using vSphere Kubernetes services(VKS) along with Foundation Load balancer and NSX VPC. We will look at the high level architecture of my lab while deploying the VCF Automation , VKS and Provider gateway (NSX Edge gateway) for the supervisor cluster. I have extended my VCF instance using fleet management to deploy the VCF Automation. VCF Automation provider layer needs a deployment target which in my case is the supervisor created in the vSphere environment.
 

Here is the High level architecture of my lab


Components used in the overall architecture and their role in this deployment

  • VCF 9 Instance
  • VCF Automation instance provisioned through VCF fleet management
  • NSX- Manager
  • NSX Edge Cluster
  • Edge gateway used as Provider gateway for supervisor (VKS)
  • VMware vSphere Supervisor
  • Foundation Load Balancer (FLB)

vSphere Supervisor

When enabled on vSphere clusters, it allows Kubernetes workloads to run directly on ESXi hosts and enables the creation of upstream Kubernetes clusters within dedicated namespaces called vSphere Namespaces. vSphere Supervisor establishes a Kubernetes control plane directly on the hypervisor layer. As a vSphere administrator, you can activate existing vSphere clusters for vSphere Supervisor, which creates a Kubernetes layer within the ESXi hosts that are part of these clusters.

Foundation Load balancer

 vSphere supervisor supports three types of load balancers during the supervisor deployment – AVI, HA Proxy and FLB. Foundation Load Balancer is packed with vCenter and provides load balancing support to the Supervisor and the workloads running on it. It works only with VDS.

Namespaces with VKS Clusters

It is a network-scoped tenancy on Supervisor, used to host VKS clusters. Sphere Namespaces also provide networking, role permissions, persistent storage, resource quota, and content library and VM class integration.

Namespace class

  Namespace class object is a wrapper around the VM class, storage class, content library, supervisor and resource limits for pods. This will drive the resource limits and classes when a project binding is created for the namespace class.

VM classes

VM classes are the T-shirt sizes that you define for a workload VM provisioning within the k8s workload clusters, based on the classes defined and assigned at the project level they will be available for the end user to use for workload provisioning.

Zones, Regions, Namespaces  

Zones are the containers which will define the resources assigned for the project. Region will have one or more zones configured to ensure the availability of resources in case of failures . Namespaces will be created using zones and will use resources on the zones. Namespaces will further partition the region resources to run application specific workloads providing isolation of resources for this workloads although underlying zone is same for two different applications

Projects

Projects will be created with association to namespaces which will implicitly be drawing its resources from the underlying region which is getting the resources from one or more zones.



The overall steps used for creation of the VCF Automation base setup

The following section talks about the process workflow I used to create the VCF-A environment with VKS and NSX

Deploy VCF Automation using VCF Fleet management


  • Create NSX Edge cluster and Edge gateway

  • Supervisor deployment using Foundation Load balancer

  • Zone

  • Create Region in VCF-A
  • Region Network Settings

  • Create organization in VCF-A

  • Create a name space in vSphere Supervisor (VKS)

  • Create a project and assign the namespace to the project

  • Create a VKS workload cluster in the namespace for workload provisioning

Topology in VCF Operations

Using VCF Operations one case see how the entire topology looks like for all the components in VCF-A, VCF and VKS use case for workload deployment.

VCF operations will automatically integrate all the newly deployed components like VCF-A and VKS and the infrastructure admin does not need to bother about these integrations unlike what we used to see prior to VCF 9 where each integration need to be explicitly done into Aria operations post deployment. In this case VCF operations will do all these things for the admin on its own and will use internal integration accounts and manage their Lifecyle is very simplified manner.



You can explore more from the VCF 9 documentation about the latest features and capabilities here

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-0/provider-management/overview-of-vcloud-director-administration.html

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-0.html

Comments

Post a Comment

Popular posts from this blog

  Issue with Aria Automation Custom form Multi Value Picker and Data Grid https://knowledge.broadcom.com/external/article?articleNumber=345960 Products VMware Aria Suite Issue/Introduction Symptoms: Getting  error " Expected Type String but was Object ", w hen trying to use Complex Types in MultiValue Picker on the Aria for Automation Custom Form. Environment VMware vRealize Automation 8.x Cause This issue has been identified where the problem appears when a single column Multi Value Picker or Data Grid is used. Resolution This is a known issue. There is a workaround.  Workaround: As a workaround, try adding one empty column in the Multivalue picker without filling the options. So we can add one more column without filling the value which will be hidden(there is a button in the designer page that will hide the column). This way the end user will receive the same view.  
Post a Comment
Read more

57 Tips Every Admin Should Know

Active Directory 1. To quickly list all the groups in your domain, with members, run this command: dsquery group -limit 0 | dsget group -members –expand 2. To find all users whose accounts are set to have a non-expiring password, run this command: dsquery * domainroot -filter “(&(objectcategory=person)(objectclass=user)(lockoutTime=*))” -limit 0 3. To list all the FSMO role holders in your forest, run this command: netdom query fsmo 4. To refresh group policy settings, run this command: gpupdate 5. To check Active Directory replication on a domain controller, run this command: repadmin /replsummary 6. To force replication from a domain controller without having to go through to Active Directory Sites and Services, run this command: repadmin /syncall 7. To see what server authenticated you (or if you logged on with cached credentials) you can run either of these commands: set l echo %logonserver% 8. To see what account you are logged on as, run this command: ...
Post a Comment
Read more
  The Guardrails of Automation VMware Cloud Foundation (VCF) 9.0 has redefined private cloud automation. With full-stack automation powered by Ansible and orchestrated through vRealize Orchestrator (vRO), and version-controlled deployments driven by GitOps and CI/CD pipelines, teams can build infrastructure faster than ever. But automation without guardrails is a recipe for risk Enter RBAC and policy enforcement. This third and final installment in our automation series focuses on how to secure and govern multi-tenant environments in VCF 9.0 with role-based access control (RBAC) and layered identity management. VCF’s IAM Foundation VCF 9.x integrates tightly with enterprise identity providers, enabling organizations to define and assign roles using existing Active Directory (AD) groups. With its persona-based access model, administrators can enforce strict boundaries across compute, storage, and networking resources: Personas : Global Admin, Tenant Admin, Contributor, Viewer Projec...
Post a Comment
Read more