VirtualRealization: vCloud Director

Showing posts with label vCloud Director. Show all posts

Wednesday, February 17, 2016

vCD-SP 8: vCenter Server status error

Had issue this week come up where vCloud Director is unable to communicate with vCenter server. I had this many years ago but seems to be still relevant in vCD-SP8 so thought just write up about it with reference to good information:

In my environment this caused template deployments to fail with "Cannot retrieve list of the supported Operating Systems from Provider VDC "PVDC". Please ensure vCenter is connected and available."

Solution:

After reviewing vCenter Server vSphere resource under Manage and Monitor I found that vCenter is not connected.
KB 1035506 from VMware documents this issue but request that you call support to get this resolved.

The issue seems to be related to quart table and I am not going to get into much details here since Jason Boche wrote a nice detailed article how the problem comes about and how to resolve it.

http://www.boche.net/blog/index.php/2011/12/16/vcloud-director-and-vcenter-proxy-service-failure/

Wednesday, February 3, 2016

vCD-SP 8: Blank disconnected console or shows unavailable error

Verify that you have your Public Addresses entered in vCloud director:

System -> Administration

Under system settings select Public addresses

Fill in the necessary information, especially the FQDN for vCD public console proxy address.

vCD8-SP: Wildcard certificate

I have a wildcard.pfx certificate which I need to use in my vCD instance. Here are the steps to convert the certificate and import into vCD:

Convert the pfx to pem:

openssl pkcs12 -in certificate.pfx -out certificate.cer –nodes

Extract the private key from the certificate.cer.

copy from -----BEGIN PRIVATE CERTIFICATE-----
to end of -----END PRIVATE CERTIFICATE-----
Create new file called certificate.key and paste

Recreate pfx and set alias for http

openssl pkcs12 -export -in certificate.cer -inkey certificate.key -name http -passout pass:yourpassword -out http.pfx

Recreate pfx and set alias for consoleproxy

openssl pkcs12 -export -in certificate.cer -inkey certificate.key -name consoleproxy -passout pass:yourpassword -out consoleproxy.pfx

Import the 2 PKCS12 keystores into Java keystore using keystore

./keytool -importkeystore -srckeystore http.pfx -srcstoretype PKCS12 -destkeystore certificate.ks -deststoretype JCEKS -deststorepass yourpassword -srcalias http -destalias http -srcstorepass yourpassword
./keytool -importkeystore -srckeystore consoleproxy.pfx -srcstoretype PKCS12 -destkeystore certificate.ks -deststoretype JCEKS -deststorepass yourpassword -srcalias consoleproxy -destalias consoleproxy -srcstorepass yourpassword

Now import the root and intermediate certificates (if any) to the same keystore

./keytool -importcert -alias root -file GeoTrust_Global_CA.cer -storetype JCEKS -keystore certificate.ks -storepass yourpassword
keytool -importcert -alias intermediate -file RapidSSL.cer -storetype JCEKS -keystore certificate.ks -storepass yourpassword

To replace it your can read my previous blog post

vCD-SP 8: Replace certificates

I currently have some self signed certificates on my vCloud Director 8 installation and want to update them with new certificates. Here are the simplified steps to get this accomplished:

Firstly you need to create 2 certificates for each member of the group (cell) and import the certificates into host keystores. Each vCD has 2 IP address which allows support for 2 different SSL endpoints(http and consoleproxy). Each endpoint requires its own SSL certificate.

Requirements for cert include an X.500 distinguished name, while Subject Alternative Name is not necessary.

Replace certificate using vCD configuration script: (this does not work in 8.10 anymore)
this process will also validate the db connection and prompt for SSL certificate and skips all other.

Before doing any work, take a snapshot of your VCD Cells and backup your database.

SSH to vCD cell
Stop the vCD services

service vmware-vcd stop

Run the configuration

/opt/vmware/vcloud-director/bin/configure
Specify full path to java keystore that holds the new certificates
Provide keystore and certificate password

This will replace the certificates and restart the vCD services.

Replace certificates using the certificates command:

Certificates command of the cell management tool automates process replace certificates in JCEKS keystore.

# cd /opt/vmware/vcloud-director/bin
# ./cell-management-tool certificates -j -k /tmp/<certificate-file-name>.ks -w keystorepassword
Restart the cell for changes to take affect.

# service vmware-vcd restart

Tuesday, February 2, 2016

vCD-SP 8 - what's new

I finally got around to installing vCD-SP 8 and here are my finding on what's new and upcoming.

Support for vCenter 6.0

ESXi and vCSA 6.0 U1 is a big advantage to 5.5 and allow SP's to take advantage of new features and optimization provided with 6.

Support for NSX 6.2 and 6.2.1!

This allows connection to a NSX manager instead of a vShield Manager appliance in backward compatibility mode.
When using NSX manager the VSE is deployed with version 5.5.4-2673026

vDC template

Create Organization specific virtual datacenter templates with pre-set resources delegation rule-set. Have not tested this but provide some feedback later.

vApp enhancements

Reconfigure of VMs within a vApp.
Reconfigure of networking connectivity and capabilities during creation.
I have not seen anything from a UI perspective on this but seems to be more under the cover work through API.

oAuth for identify source

tokens now supported.

Tenant throttling

This prevents noisy tenants from consuming all the resources of a single instance.
Helps ensure fairness of execution and scheduling of among tenants

As mentioned in previous blog VMware did post about new UI changes coming to vCD-SP in 2016 and the following advanced networking selections seems to indicate this. I did again not find anything in documentation on these menu selections but hopefully seem some of vCloud Air features soon:
https://www.vmware.com/au/cloud-services/infrastructure/vcloud-air-advanced-networking-services

Links:

http://pubs.vmware.com/vcd-80/index.jsp#com.vmware.vcloud.api.sp.doc_90/GUID-375148E9-601D-4BFA-9C10-4D2595D96D95.html

http://pubs.vmware.com/vcd-80/index.jsp#com.vmware.vcloud.api.sp.doc_90/GUID-AA9C56E3-B7AA-42E3-9AE0-46233E1FDD2A.html

http://pubs.vmware.com/vcd-80/index.jsp#com.vmware.vcloud.api.sp.doc_90/GUID-74126E65-F99E-4128-A023-0CCF88B04832.html

https://www.vmware.com/au/cloud-services/infrastructure/vcloud-air-advanced-networking-services

vCD-SP 8 - Failed to create external network as port group dvportgroup-XXX or its VLAN ID XXX is in use

I just received the following error in my lab when i tried to create a new external network. This seems to be a known issue in vCD 5.1 & 5.5 but has not been resolved in v8.

I did not delete any port groups or VSE's directly from vCenter server so assume the database was not successfully delete when i removed external networks.

VMware provides a comprehensive KB article on this so not going to get into to much details but solution is to remove the stale entries from Resource_Assignment table in the database.

KB: 2042474

Links:
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2042474

Friday, January 29, 2016

vCloud Director UI, then and what now?

Just more than a month ago we were given very exciting news from the vCloud team regarding further limited enhancements to the UI of vCD-SP for 2016.

Did you hear the news? We’re restarting the VCD UI development. Here’s what you need to know https://t.co/yfNN8LsOjw pic.twitter.com/QRKV6oSJYU
— VMware vCloud (@vCloud) December 14, 2015

How things can change within a month:

http://www.networkworld.com/article/3026996/hybrid-cloud/despite-layoffs-vmware-has-a-big-bet-on-this-one-cloud-innovation.html

https://www.thelayoff.com/vmware

Lets hope that none of these recent activities has any impact on the vCD-SP UI announcements but only time will tell...

Friday, April 10, 2015

vCloud director - running MAC OS X and Windows VM in same vApp.

Recently we installed in Mac Pro 6,1 hardware and provided MAC OS X virtual machines to our vCloud director environment.

This was configured in a separate cluster in vCenter server which provides all the regular capabilities like HA, DRS and vMotion which is great. Also created a separate storage cluster and assigned a new MAC storage profile to this cluster which was made available within vCD.

MAC OS X templates was created and added to catalog with storage set to pre-provision on default storage profile create for MAC cluster.

Problem:

In vCloud director a new Provider VDC was created and linked to the new vCenter server cluster.
Within the existing Organizations we created an additional virtual datacenter with MAC provider VDC selected. This created new resource pool in the cluster.

The users where now able to deploy MAC OS templates to this VDC, however a request came back quickly that users need to deploy both MAC OS X and Windows VM within the same vApp.

Troubleshooting:

The configuration as explained above obviously does not allow for this situation since during deployment of vApp you can only select a single VDC to deploy too as well for adding a VM you can only specify a single storage Policy, which will also be the one assigned to vApp's VDC . So all the VMs would need to run on the Apple hardware cluster which is not idea.

Solution:

Solution was pretty simple and can be accomplished by merging your provider VDC's which was introduced in vCloud director 5.1.1.

Login to vCloud director as system admin.
Select Manage & Monitor
Under Cloud resources select Provider VDCs
Right click the MAC provider VDC and select Merge
Select the Provider VDC that you want this merge with.
After completion you will now see your Provider VDC has additional resource pool, datastores and ORG VDCs
I then went ahead and deleted the VDC I initially created for the MAC deployments since only need the original VDC.

Now when you deploy a vApp select the existing VDC which contains the MAC Provider VDC and storage profile. Same can be accomplish for deploying VM within a vApp.

Monday, June 23, 2014

vCloud 5.5.1: Create new storage policy, add storage, migrate vApps.

We recently purchased new storage so the new datastores had to be added to vCloud director, and all the vApps migrated over. There are many ways to go about doing this but the best solution I found was to create a new storage cluster and put all datastores in it and also create a new storage policy and profile. I have been told it is also possible to just perform a storage vmotion on the VM's but i had mixed results with this approach. Here is my information which I hope might be useful to someone.

In Vcenter server:

Create tag category (I called mine "storage policies" to keep it simple", but description can also be used to describe the function)
Create tag and add to category
Open VM storage policies

Create new VM storage policy
Select vCenter
Enter a policy name
Provide description
Add tag-based rule and assign newly create tag from tag category.

I ALWAYS FORGET to enable the policy so here is not to you doing the same :)

select the new policy name
2nd icon from left is "Enable VM storage policies per compute resource.

Assign the newly created tag to datastore cluster
Assign the newly created tag to each datastore within the cluster.

In vCloud director:

Under Manage & Monitor tab select vCenters from vSphere resources.
Right click the vCenter server name and select "refresh storage policies

After you get the storage profile to show in storage policies you have to assign it:

Go to Provider VDC and open it
Select storage policies tab
Add new storage policy!
There is a BUG in 5.5.1 which does not refresh or show the storage policy and an outage is actually necessary to clean up the database with a script (not very nice but works)

Error on 5.5.1 (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2075366)

Go to Organizations and open the one which will be using the new storage
Select Virtual datacenter tab
Select Storage policies tab
Add the new storage policy
If you want the new policy to be the default - Right click the new storage policy and select "Set as default"

Migrating vAPPS to new storage profile:

The best method I found was to shutdown the vAPP and right click select "move to" and then each individual VM select the new storage policy.
You can also do this with a powered on VM and go to properties and change the storage polic

Saturday, January 25, 2014

vCloud Director: Error on provider VDC "No datastores accessible to VDC "

This normally happens when a new datastore is added to the storage cluster which is associate to a storage policy for the vCloud Director Organization. The rule-set (storage capability) was not properly set to the datastore before it was added to the datastore cluster.

All the datastores, datastore clusters and policies disappear and you get the following errors:

Error on provider VDC:
No datastores accessible to VDC

On Provider VDC storage policies tab:
This storage policy is not backed by any usable datastores accessible from this VDC.
There is no usable datastore accessible from this VDC that supports this storage policy. Ensure that this storage policy is backed by at least one datastore in vCenter Server, this datastore is enabled in vCloud Director, and the datastore(s) are accessible by the hosts in the clusters used by this VDC.

vCloud director 5.5: Catalogs problem #3 - Assigning catalog media files to different VDC within an ORG?

We have a public catalog which is shared to all ORGs within vCloud. This also contains some ISO media files for users to mount to cdrom of virtual machines.
However in order for a user to make use of a media file from a public catalog, that media file firstly needs to be copy to the local catalog of that ORG.

Within this ORG we have multiple vDCs. This is where things get interesting.

Scenario:

When a vAPP is deployed from catalog you assign this vAPP to a specific vDC.
When you then try to mount an ISO from the local catalog media files, you are unable to do so since this media file is associate to a different vDC...mmm

Troubleshooting:

I believe the problem lies with how the Catalogs are done in 5.5. When creating or copying files into a Catalog, there is no method to accurately control where the item will be stored. This is more critical when there are multiple Org vDCs, and a file could be placed in an Org vDC to which the file is not intended for.

This is a departure from vCloud Director 5.1, where importing media allowed you to select a specific Organization vDC. Even when you could select a vDC, you still needed to have the ISO image in the vDC where the VM resides to be allowed to insert it.

I had a lot remote sessions and discussions with support on this issue since we could not find a way to assign a media file to specific VDC.

Workarounds:

Option 1 - Temporarily disable storage profiles before doing an ISO import. This would eliminate certain vDCs as an option, and force the selection process to go to the remaining vDC. this would be my recommendation.

Option 2 - Set the catalog to use a specific Storage Profile, from the desired Organization vDC and import the media again. This should send the imported files to the correct ORG vDC. You will need to import Media files multiple times to accomplish this. This only possible if you have multiple storage profiles which I currently do not have.

Option 3 - Have a catalog specific to an individual ORG vDC, name the catalog relative to the ORG vDC, and select the Storage Class/Profile from the same ORG vDC. This means that any ISOs will be sent up to the correct vDC when you import to a given catalog. On this option here are the steps to setup more catalog for more than one vDC:
1. Create a "master" catalog in the ORG on the Storage Profile vDC A
2. Publish the Catalog created in Step 1 externally
3. Create a "slave" catalog in the ORG on the Storage Profile vDC B, and have this catalog sync from the catalog created in step 1.
4. Repeat this to have Catalog C on Storage Profile C, and sync to Catalog A.
5. Whenever you add a new ISO image to the Master Catalog, it will automatically update the others in 24 hours or when a sync is requested.

vCloud director 5.5: Catalogs problem #2 - Error mounting catalog media ISO files to CDROM - "This media type is incorrect. Media type ISO was expected." (known issue)

Problem:

A users copies the media ISO file to local catalog however the file is not copied over correctly.

When users tries to attach the newly copied file from media to CDROM, the following error is observed:

"This media type is incorrect. Media type ISO was expected."

vCloud director 5.5: Catalogs problem #1 - browser crashes on "copy to catalog" (resolved)

Catalogs has had quiet a big revamp in vCloud 5.5 with some enhancements.
This can be read in the "whats's new" pdf:
http://www.vmware.com/files/pdf/products/vCloud/Whats-New-VMware-vCloud-Director-55-Technical-Whitepaper.pdf

We have a public catalog which is shared to all ORGs within vCloud. This also contains some ISO media files for users to mount to cdrom of virtual machines.
However in order for a user to make use of a media file from a public catalog, that media file firstly needs to be copy to the local catalog of that ORG.

Problem:

When a user log in directly to their respective ORG
Select the public catalog and go to media tab
Right click on media file select to "copy to catalog"
The browser crashes and restarts without any error messages.

Troubleshoot:

This was tested on MAC and Windows with each of the following browsers including Chrome, Firefox and Internet explorer.
Same problem appears when logged in as ORG or system admin.

However it works fine when I login as system admin to main vCloud Director login page. Only seems to crash browser when logged in direclty to any ORG site.

Solution:

Do not share the catalog with the radio button "all organizations", but rather select all the ORGs individually from the list.

I do not experience the same results as listed the following KB but same solution solves both problems:
http://kb.vmware.com/kb/2063431

Sunday, January 5, 2014

vCloud Director 5.5 - Replace current self-signed certificates with signed certificates

Initially I had very little time to get vCloud Director up and and running and just created self signed certificates.
After upgrading from vCloud 5.1 to 5.5, we found a known problem with VMware where MAC desktops cannot access VM console when using self-signed certificates.
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2058496

This provided the perfect opportunity to replacing initial self signed certificates with newly created signed certificates. (internal root CA server)

vCloud Director upgrade from 5.1 to 5.5

Current Version:

5.1.2 Build 1068441 vmware-vcloud-director-5.1.2-1968441.bin

New Version:

5.5.0 Build 1323688 vmware-vcloud-director-5.5.0-1323688.bin

I run a RHEL virtual machine with vcloud director installed, so before starting the upgrade I fully patch the RHEL environment.

PRE-CHECKLIST:

Setup ORG VDC within vCloud Director

I have put some bullet points together for myself to setup a new Organization with Org VDC. Might be useful to someone else. Nothing advances and if you are a beginner i would probably view another blog or VMware documentation for assistance.

1. Vsphere client:

a. Setup ESXi hosts

b. Setup new Datacenter.

c. Setup new cluster

d. Setup two different vDSs, one for management/vmotion and one for external & VCDNI networks. If setting up VXLAN, I would recommend setting up a separate vDS for this.

e. Create port groups for external networks within 2^nd vDS which was configured.

f. IF VXLAN used, prepare the new vDS for VXLAN

i. http://blogs.vmware.com/vcloud/2012/10/vcloud-director-5-1-vxlan-configuration.html

g. Create storage profile.

i. Create Storage capabilities.

ii. Create Storage profile and assign storage capabilities to profile.

iii. Assign Storage capabilities to datastores within created cluster

iv. Make sure to enable the storage profile! (very often overlooked)

2. vCloud director:

a. Create Provider VDC

i. Select previously created cluster

ii. Select storage profile.

iii. Select host to prepare.

iv. Done

b. Setup new Organization

i. Simple setup wizard and very easy to follow and understand

c. Setup network pool for virtual switch.

i. Select network pool type ( I pick network isolation-backed for simplicity)

ii. Specify VLAN and max VCDNI networks.

iii. Select vDS created before.

d. Setup external network and link to port groups created for external networks.

e. Create ORG VDC

i. Select organization

ii. Select Provider VDC

iii. Select allocation model.

iv. Configure model. (for our QA/DEV labs I prefer pay-as-you-go)

v. Allocate storage

vi. Select network pool

vii. Configure Edge Gateway

viii. Select external network

ix. Set IP addresses

x. Sub-allocate IP Pools

xi. Create ORG VDC network

xii. Name ORG

Tuesday, September 24, 2013

vCloud Director - Migration of storage to new storage profile

Scenario:

Migration from local direct attached storage on single ESXi host to more flexible environment with multiple ESXi host with new shared storage profile.

Some considerations:

The migration will create full clone VMs on new storage profile so please take the storage usage into consideration before starting the move. Look at thin provisioning on VMs hard disk.
Can you afford to shut down the VMs or not for migration, this will affect your effort.
Just not vAPPs needs to be moved, also remember your vAPP templates and media. I would start with the vAPPs and media first.

vCloud Director 5.1.2 – Bug - Retain IP/MAC resources does not apply when you use the “Move to” task to move to new Storage profile.

In previous blog post I mentioned the usefulness of this setting, but during our storage migration to new profile for vCloud director we ran into a bug where this is not applied.

I have opened a case with VMware and they verified this as a bug and now has a SR. Hopefully get this fixed within the next build.

My current vcloud director version where this applies:

vCloud director 5.1.2.1068441

Debugging the problem:

When you have to move vAPPs to new storage profile the easiest way is to shut down the vAPP and select “move to”.

However when you perform this task the vAPP will actually release the Org VDC NAT'd address for the VM.

If you have any NAT's configured on the Edge gateway, this will now be out of sync.

Workaround:

I will discuss this in next blog post.

VMware Labs Flings: Lctree - Visualization of linked clone VM trees

Flings: Lctree

I was just pointed to Flings by the VMware support team.

These apps and tools build by VMware engineers are great and already found my favorite for vCloud director.

Lctree - http://labs.vmware.com/flings/lctree

This tool is designed for the visualization of linked clone VM trees created by VMware vCloud Director when using fast provisioning.

I managed Lab Manager before and always found the build in context view feature useful to show the relationship and dependencies between virtual machines.

This helped me a lot in finding the information about shadow copies in our environment as well as the visualizing the chain length and make decisions on when to consolidate.

Applications are not supported so no fixes and use at own risk.

vCloud director setting – Retain IP/MAC resources

This is a great setting and very useful, which I hope all users are aware of.