Certificate Management in VCF 9.x with Microsoft CA

Manish Jha

In a production environment, certificate expiry is one of those problems that never announces itself until it’s too late. The self-signed certificates on various appliances quietly tick toward their expiration date, and nobody notices. Then one Monday morning, every management UI throws a browser warning, API integrations start failing, and backup jobs silently break. This is a huge operational gap for any organization.

Certificate Management in pre-VCF 9.x Era

The older VCF releases had support for integrating an external CA with the SDDC Manager, but the cert replacement was totally manual. Neither was there any way to automatically replace certificates that are about to expire, nor any alerting functionality in the UI.

Certificate Management in VCF 9.x

TLS certificates secure every management interface in a VCF deployment — vCenter, NSX Manager, SDDC Manager, ESX hosts, and the various VCF Operations components. Each one gets a certificate from a default signing CA at deployment time, and best practice has always been to replace those defaults with certificates from a trusted enterprise CA.… Read the rest

VCF 9.1 Home Lab Series – Part 12: Deploy VCF Operations for Logs

Manish Jha

Welcome to part 12 of the VCF-9.1 home lab series. The previous post in this series discussed configuring provider management in VCFA. This post will demonstrate deploying and configuring VCF Operations for logs.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

11: VCFA Provider Management Configuration

In VCF 9.1, log management has been further unified into VCF Operations. Rather than deploying it as a standalone appliance (VCF 9.0 and earlier), it now runs as a service on the VCF Services Runtime Cluster—the same Kubernetes-based platform that also hosts Fleet Management and other management components.… Read the rest

Remediating Password of a Stubborn Edge Node in VCF 5.2

Manish Jha

Recently, while working in my lab, I encountered an issue in which an edge node’s password had fallen out of sync with SDDC Manager, causing all attempts to update or remediate it to fail. The most common causes of a failed password rotation are the following:

  • SSH connectivity to the edge appliance is blocked.
  • The account is locked.
  • The password has already expired (so SDDC Manager can’t authenticate to change it).
  • The edge node’s hostname/FQDN case doesn’t match what’s stored in the SDDC Manager database.

Upon logging into the edge node, I confirmed that the password had not expired and that the edge node’s FQDN matched the value stored in the database, indicating that the underlying issue was simply a password out of sync with SDDC Manager. Every attempt to update or remediate the password continued to fail at the pre-validation stage.

I checked the API that the SDDC Manager was executing in the backend for the password update operation, and the API response reported that the edge node was not in the active state.… Read the rest

VCF 9.1 Home Lab Series – Part 11: VCFA Provider Management Configuration

Manish Jha

Welcome to part 11 of the VCF-9.1 home lab series. The previous post in this series discussed deploying a new instance of VCF Automation. In this post, I will demonstrate provider management configuration.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

In VCFA, objects are categorized under provider and organization. The provider admin creates organizations (tenants) and resources that these organizations can consume. VCFA supports two different types of organizations:

  • All-Apps: Requires a supervisor and supports running VMs and container workloads.
  • VM-Apps: Only supports running VMs (the old Aria Automation way)

The diagram below shows the high-level architecture of the VCFA.… Read the rest

VCF 9.1 Home Lab Series – Part 10: Deploy VCF Automation

Manish Jha

Welcome to part 10 of the VCF-9.1 home lab series. The previous post in this series discussed enabling a supervisor in the workload domain. In this post, I will demonstrate deploying and configuring VCF Automation.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

VMware Cloud Foundation (VCF) 9.1 represents a landmark release that fundamentally reshapes how organizations build, operate, and consume private cloud infrastructure. At its core, VCF Automation transforms the traditional infrastructure delivery model into a self-service, policy-governed cloud experience that rivals the simplicity of public cloud consumption while retaining the sovereignty and security of on-premises deployments.… Read the rest

VCF 9.1 Home Lab Series – Part 9: Deploy Supervisor in Workload Domain

Manish Jha

Welcome to part 9 of the VCF-9.1 home lab series. The previous post in this series discussed deploying the Avi load balancer in the workload domain. In this post, I will demonstrate deploying the supervisor in a workload domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

While creating a new workload domain, you will observe that the toggle button for enabling supervisor post domain deployment is activated. You can turn off the toggle if you wish. I did the same, as I wanted to cover this topic in a separate post and discuss the networking stack on which a supervisor can be deployed.… Read the rest

VCF 9.1 Home Lab Series – Part 8: Deploy Avi Load Balancer

Manish Jha

Welcome to part 8 of the VCF-9.1 home lab series. The previous post in this series discussed setting up network connectivity in the management domain. In this post, I will demonstrate deploying the Avi load balancer in the workload domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

Avi and VCF Integration

VCF 5.2.X was the first version that enabled deploying the Avi load balancer using SDDC Manager. Although the deployment of the controller nodes was automated and some aspects of the Avi life-cycle management (password, certificates, and upgrade) were tied to the SDDC Manager, the configuration was largely manual and error-prone.… Read the rest

VCF 9.1 Home Lab Series – Part 7: Deploy Workload Domain

Manish Jha

Welcome to part 7 of the VCF-9.1 home lab series. The previous post in this series discussed setting up network connectivity in the management domain. In this post, I will demonstrate deploying a new workload domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

A typical VCF deployment includes a management domain and one or more VI workload domains. Each VI workload domain can be configured with specific resources, network configurations, and policies to support its intended workloads. The VI workload domains are isolated from the management domain and used for hosting business applications and providing a public cloud-like experience within a VCF private cloud.… Read the rest

VCF 9.1 Home Lab Series – Part 6: Configure Network Connectivity

Manish Jha

Welcome to part 6 of the VCF-9.1 home lab series. The previous post in this series discussed the bringup process of the management domain. In this post, I will demonstrate setting up network connectivity in the management domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

Why Deploy an Edge Cluster in the Management Domain Even If You Run Nothing There?

The Management Domain Edge Cluster in VCF 9.1 is the network spine of the entire software-defined fabric — it carries transit, external, and inter-VPC traffic even though no workload VMs run on it. Think of it less as a compute resource and more as a dedicated routing/NAT appliance for the whole VCF environment.… Read the rest

VCF 9.1 Home Lab Series – Part 5: Management Domain Bringup

Manish Jha

Welcome to part 5 of the VCF-9.1 home lab series. The previous post in this series discussed setting up an offline depot. In this post, I will demonstrate deploying the VCF 9.1 management domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: Whats New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

After you configure the depot settings and download the installation binaries to the VCF installer appliance, you start the deployment by clicking the deployment wizard button and selecting the option VCF.

On the introduction page, the very first page is About the deployment wizard, and it provides a high-level overview of the VCF fleet and VCF instances.

The next screen presents the different deployment paths supported in VCF 9.1. If this is a greenfield deployment, you must select the first option to deploy to a new VCF fleet.… Read the rest