Deploying Tanzu on VDS Networking-Part 1: HA Proxy Configuration

Manish Jha

VMware Tanzu is the suite or portfolio of products and solutions that allow its customers to Build, Run, and Manage containerized applications (Kubernetes controlled). An earlier release of Tanzu was offered along with VCF leveraging NSX-T networking. Later VMware decoupled Tanzu from VCF and the solution is called vSphere with Tanzu and can be deployed directly on vSphere VDS without having NSX-T. 

vSphere with Tanzu on VDS has the following limitations: 

  • No support for vSphere Pod if NSX-T not used. 
  • No support for Harbor Image Registry.

When Tanzu (Workload Management) is enabled on vSphere, a supervisor cluster is deployed which consists of 3 nodes for high availability. So you need some kind of load balancing to distribute traffic coming to the supervisor cluster. VMware uses a customized version of HA Proxy as a software load balancer for supervisor nodes. 

This series of blogs will cover the following topics:

1: HA Proxy Deployment & Configuration

2: Enable Workload Management

3: How to Deploy Applications in TKG Cluster

Networking Requirements for HA Proxy

Before I jump into the lab and walk through deployment/configuration steps, I want to discuss networking pre-requisites for HA proxy first. … Read More

Nested ESXi Gotchas with VCF

Manish Jha

Nested ESXi is a great way to quickly spin up a test/demo environment and fiddle around things in the lab. I have been doing so for quite a bit now. VCF is very dear to my heart and because VCF needs a hell lot of resources, I always test new versions/features in my nested lab.

Nested ESXi doesn’t always behave nicely and sometimes gives you a hard time and I encountered this recently in one of my VCF deployments. 

What was the problem and how it started?

The problem was with ESXi UUID and due to which vSAN configuration was failing. I will talk about more this later in this post. 

To save time, I created a nested ESXi template following this article. Deployed few ESXi hosts and everything was working fine. One day I tweaked my template to inject some advanced parameters and booted the template VM. This generated a new UUID entry for ESXi in /etc/vmware/esx.conf… Read More

NSX-T Routing With OSPF

Manish Jha

Introduction

NSX-T 3.1.1 introduced support for OSPFv2 routing protocol for Tier-0 gateways. This feature was one of the most awaited features for some time. The introduction of OSPF to NSX-T solves one of the major hindrances that was stopping customers from migrating to NSX-T.

There are lots of customers who are still running NSX-V in their environment and OSPF as routing protocol used in their infrastructure. Now since NSX-T supports OSPF, customers can do a greenfield deployment of NSX-T and switch workloads from NSX-V to NSX-T using the L2 bridge and without much changes to their physical network.

Since this feature is pretty new, it will be interesting to see how soon customers adopt this in their environment. 

Disclaimer: This post is inspired by an original blog post written by  Peter Milchov

Before jumping into the lab, let’s revisit some important facts associated with OSPF support.

  • NSX-T 3.1.1 supports OSPFv2 only.
… Read More

Whats New in HCX 4.0

Manish Jha

VMware HCX 4.0 is all set to be released today. HCX 4.0 is a major release that introduces new functionality and enhancements.

In this post, I will be explaining these feature additions. The new feature sets can be widely categorized as follows:

  • Migration Enhancements
  • Network Extension Enhancements
  • Interconnect Enhancements

Let’s discuss this one by one.

Migration Enhancements

1: Migration Event Details: When VM migration is in progress, the HCX migration platform captures high-level status for the major phases like transfer, continuous replication, and switchover, and the status reported in the UI is always shown as “Transfer in Progress,”  “Switchover in Progress,” etc.

The actual details about “what state the migration is in right now” and “how long it has been in that state” are hidden from the end user. Also, the platform does not report the exact reason if the migration fails or why the migration is taking a long time to move to the next state.… Read More

Layer 2 Bridging With NSX-T

Manish Jha

In this post, I will be talking about the Layer 2 Bridging functionality of NSX-T and discuss use cases and design considerations when planning to implement this feature. Let’s get started.

NSX-T supports L2 bridging between Overlay logical segments and VLAN-backed networks. When workloads connected to the NSX-T overlay segment require L2 connectivity to either VLAN-connected workloads or need to reach a physical device (such as a physical GW, LB, or Firewall), NSX-T Layer 2 bridge can be leveraged. 

Use Cases of Layer 2 Bridging

A few of the use cases that come to the top of my mind are: 

1: Migrating workloads connected to VLAN port groups to NSX-T overlay segments: Customers who are looking for migrating workloads from legacy vSphere infrastructure to SDDC can leverage Layer 2 Bridging to seamlessly move their workloads.

When planning for migrations, some of the challenges associated with migrations are Re-IP of workloads, migrating firewall rules, NAT rules, etc.… Read More

What’s New in VMware Cloud Foundation 4.2

Manish Jha

VMware Cloud Foundation 4.2 will be out soon and like every other release, 4.2 is coming up with exciting new features. In this post, I will be explaining a few of those. So let’s get started. 

1: Static IP Pool for NSX-T TEPs: This one is probably one of the most awaited features of VMware Cloud Foundation. VCF 4.2 allows you to leverage static IP pools for NSX-T Host Overlay (TEP) networks as an alternative to DHCP. Now you no longer need to maintain additional infrastructure items (DHCP Server).  Both management domain and VI workload domains can now make use of static IPs.

In the VCF configuration workbook, you will now see an additional section where you can specify the IP range for Host TEP.

2: Release Versions UI: A new tab (Available Versions) has been added in the SDDC Manager UI which shows the information on the Bill Of Materials, new features, and end of general support dates for each available VCF release.… Read More

Configure VCD in HCX via API

Manish Jha

In my last post, I documented the HCX installation workflow for VCD-based clouds. In this post, I will show how to do the same via API. 

Once HCX Cloud Manager has been deployed and boots up, you can use the below API to integrate VCD into HCX. 

1: Import VCD Certificate

Response Output

2: Configure VCD

… Read More

HCX Integration With VMware Cloud Director 10x

Manish Jha

This blog post provides an overview of the HCX installation workflow for VMware Cloud Director based Clouds.

The below diagram taken from VMware official docs shows the high-level architecture of HCX architecture for VCD based clouds.

HCX Cloud System & Network Requirements

Before starting HCX Cloud installation, please ensure that you’ve met all the System and Network Port/Protocol requirements. These are documented Here

Firewall Requirements

  • The site’s WAN firewall will need to allow inbound HTTPS connections destined for the HCX Cloud. HCX Cloud will make outbound HTTPS requests.
  • The HCX Cloud site firewall also needs to allow inbound UDP-500 and UDP-4500 connections destined for the HCX appliances.
  • All other flows allow HCX to integrate with VMware SDDC components, typically these are not firewalled within the datacenter

The below diagram shows various ports that must be allowed in the firewall for a successful HCX cloud deployment in the destination environment.

VMware Cloud Director Pre-requisites

Make sure the following is already configured in VCD:

1: VCD Public Address is set and load balancer cert is imported (for multi-cell deployment)

2: RabbitMQ is installed and configured into VCD. … Read More

Upgrading HCX Interconnect Appliances via API

Manish Jha

HCX Interconnect appliances are deployed from the OVA’s which are included in the HCX Manager appliance. When HCX Manager is upgraded to a newer version, it contains the corresponding upgrade bits for IX appliances which are used to upgrade the IX components. 

There is a GET /appliances API call which when fired, looks for newer versions of OVA.  Once the newer version of ova is found, its version is then compared with the version of the deployed appliance. If both versions are the same, no action is taken. However, if the deployed version is lower than the newly discovered version, info about the upgrade is returned in the API call response. 

Below are the API calls which we need to execute for upgrading IX appliances.

Step 1: Obtain Auth Token

… Read More

Upgrading HCX Manager via API

Manish Jha

While working on an HCX related request from one of the hyperscaler, I came across an interesting ask where hyperscaler is looking for automating HCX upgrade via API. 

On checking HCX’s official API guide and swagger documentation and did not found any API to upgrade the HCX Manager appliance. The only available API’s are to upgrade HCX interconnect appliances.

After searching through internal documentation for an hour, I did not found any concrete info and I decided to explore the Network Inspect option in a browser which exposes APIs for any operation you trigger from UI. 

In this post, I am going to demonstrate what are the API calls needed for a successful HCX Manager upgrade. 

Disclaimer: HCX Manager upgrade APIs are not yet supported officially and will be shipped with the upcoming release of HCX.

Step 1: Check HCX Appliance Current Upgrade Status

Although this step is optional, I would recommend verifying the current upgrade status to ensure you do not accidentally attempt to upgrade an appliance that is already on the target version. … Read More