vRA 7.2 Detailed Implementation VIDEO Guide

Welcome to the vRealize Automation 7.2 Detailed Implementation VIDEO Guide. This is a collection of all the videos making up the full vRealize Automation 7.2 Detailed Implementation Guide.

The guide (and these videos) was put together to help you deploy and configure a highly-available, production-worthy vRealize Automation 7.2 distributed environment, complete with SDDC integration (e.g. VSAN, NSX), extensibility examples and ecosystem integrations. The design assumes VMware NSX will provide the load balancing capabilities and includes details on deploying and configuring NSX from from scratch to deliver these capabilities.

Be sure to refer back to the full guide for detailed configuration steps or more info on any given topic.

 

01, Introduction

High-Level Overview

  • Production deployments of vRealize Automation (vRA) should be configured for high availability (HA)
  • The vRA Deployment Wizard supports Minimal (staging / POC) and Enterprise (distributed / HA) for production-ready deployments, per the Reference Architecture
  • Enterprise deployments require external load balancing services to support high availability and load distribution for several vRA services
  • VMware validates (and documents) distributed deployments with F5 and NSX load balancers
  • This document provides a sample configuration of a vRealize Automation 7.2 Distributed HA Deployment Architecture using VMware NSX for load balancing

Implementation Overview

To set the stage, here’s a high-level view of the vRA nodes that will be deployed in this exercise.…

vRA 7.2 DIG – 06.1, NSX Load Balancer Config

Next we’ll be configuring load balancing and high availability policies for the distributed components. An NSX Edge Service Gateway (ESG) will be providing the load balancing and availability services to vRA as an infrastructure service. vRA supports In-Line and One-Arm load balancing policies. This implementation will be based on an In-Line configuration, where the vRA nodes and the load balancer VIPs are on the same subnet.

(If you do not plan on using NSX for HA services, you can skip this configuration)

 

 

The vRA Load Balancing Guide provides additional details and load balancing guidelines for NSX, F5, and NetScaler.

NSX Load Balancing configuration consists of creating a Application Profile, Health Monitoring policy, Server Pool(s), and a Virtual Server (VIP) per load-balanced pair. These services can be configured after the initial deployment (preferred) to avoid any potential deployment issues related to load balancing config.

 

 

Load Balancer Application Profile Config

Server Role Type SSL Pass-through Persistence Persistence Time-Out (sec)
vRealize Automation HTTPS Enabled Source IP 1800
vRealize Automation IaaS Web HTTPS Enabled Source IP 1800
vRealize Automation IaaS Manager HTTPS Enabled NONE N/A

 

Load Balancer Service Monitoring Config

Server Role Type Interval Timeout Retries Method URL Receive Expected
vRealize Automation HTTPS 3 10 3 GET /vcac/services/api/health 204
vRealize Automation IaaS Web HTTPS 3 10 3 GET /wapi/api/status/web REGISTERED
vRealize Automation IaaS Manager HTTPS 3 10 3 GET /VMPSProvision ProvisionService

 

Load Balancer Pool Config

Server Role Algorithm Monitors Members Port Monitor Port
vRealize Automation ROUND-ROBIN <vRealize Automation monitor> vRA VA Nodes 443 443
 vRA Remote Console ROUND-ROBIN <vRealize Automation monitor> vRA VA Nodes 8444 443
vRealize Automation IaaS Web ROUND-ROBIN <vRealize Automation IaaS Web monitor> IaaS Web Nodes 443 443
vRealize Automation IaaS Manager ROUND-ROBIN <vRealize Automation IaaS Manager monitor> IaaS Manager Nodes 443 443

 

Virtual Server (VIP) Config

Server Role Port Default Pool Application Profile
vRealize Automation Pool 443 <vRealize Automation Pool> <vRealize Automation Profile>
 vRA Remote Console 8444 <vRealize Automation Remote Console Pool> <vRealize Automation Profile>
vRealize Automation IaaS Web 443 <vRealize Automation IaaS Web Pool> <vRealize Automation IaaS Web Profile>
vRealize Automation IaaS Manager 443 <vRealize Automation IaaS Manager Pool> <vRealize Automation IaaS Manager Profile>

 

vRA 7.2 Detailed Implementation Guide

Welcome to the vRealize Automation 7.2 Detailed Implementation Guide (DIG). This series of posts — made up of detailed how-to, end-to-end videos, plenty of commentary, and other related content — was put together to help you deploy and configure a highly-available, production-worthy vRealize Automation 7.2 distributed environment, complete with SDDC integration (e.g. VSAN, NSX), extensibility examples and ecosystem integrations. The design assumes VMware NSX will provide the load balancing capabilities and includes details on deploying and configuring NSX from from scratch to deliver these capabilities.

This little project has been in the works for quite some time and will continue to expand as I include additional how-to’s for a variety of use cases (e.g. IPAM and ITSM integration).

Target Audience

This guide was created for anyone looking to install and/or configure vRealize Automation 7.2 in any environment. And, as were my intentions in previous POC guides, the content here can be used as a form of training and education or simply a reference document for existing or new vRA environments.

As for skill level, this guide assumes you have a general idea of vRealize Automation and VMware’s broader Cloud Management products. However there is no expectation that you’ve previously deployed and configured vRA.…

VMware SDDC Technical Whiteboard

One of my favorite things to do is whiteboard. In my line of work, the whiteboard allows me to tell a story…one that can be broad in coverage, yet tuned on-the-fly to best align with the needs of the audience. It started as a “cloud” whiteboard back when vCloud Director (vCD) was released and the first vCloud Suite offering was announced. The first storylines were all about VMware’s cloud and management framework and leveraging vCD to align with a set of industry-accepted characteristics that defined “cloud”. There have been several iterations over time as new technologies (and acquisitions) came to fruition, with an evolving storyline to highlight modern challenges and the transformative nature of the Software-Defined Datacenter.

The whiteboard has been delivered on your standard everyday office whiteboard, table-tops, glass walls, flip charts, notepads, napkins, and electronically via powerpoint, iPad, and digital sketch pads. Regardless of delivery medium, I have found the whiteboard to be the most effective means of articulating the often-confusing details and associated benefits of the Software-Defined Datacenter at any level of depth…and without yawn-generating, ADD-invoking death by powerpoint.

My most recent iteration of the SDDC whiteboard doubles as field and partner enablement, so I had to put a little more thought into the storyline to ensure it closely resembles how customers have typically leveraged vSphere, NSX, VSAN, and the vRealize Suite evolve their existing datacenters to quickly build and gain the benefits of SDDC.…

vRA and NSX – Part 3, Security Groups and Policies

Introduction

Recapping Part 2 of this series: We staged a number of NSX Logical Switches to be consumed by vRA machines as External Networks. vRA collects and identifies these networks as traditional [vSphere] Network Paths and allows them to be wired for consumption in the Converged Blueprint (CBP) designer as needed (or using custom properties, but that’s beyond this post). Logical Switches can be created for a consumption-only model, automatically created per Deployment when using On-Demand services, or some combination of these.

Moving on…

Similar to it’s relationship with NSX Logical Switches, vRA provides both consumption-based and dynamic security services to deliver a number of use cases leveraging NSX Security Groups and Security Policies.

A Security Group defines — and logically groups — the objects you want to protect (e.g. virtual machines) and the policies that protect them (via a security policy). Group membership can be static or dynamic (e.g. based on logical naming, containers, tags, or as members of other security groups). Pre-created security groups are collected by vRA endpoint inventory and consumed as Existing Security Groups (SG) within the Converged Blueprint designer. These security groups may ultimately contain a combination of unmanaged vSphere VMs and vRA-managed machines.

vra7-327vRA also supports On-Demand Security Groups (ODSG) within CBP, which requires the use of an existing Security Policy.…

vRA and NSX – Part 2, Staging Logical Networks

Introduction

A logical switch emulates a traditional network switch by creating logical networks that can be used to connected one or more vnics of a virtual machine to the corresponding logical network. In an NSX environment, logical switches are directly mapped to an available Transport Zone (VXLAN) and is stretched across all hosts and clustered configured with that VXLAN. Similarly, a Universal Logical Switch is deployed when used with Universal Transport Zones and can be stretched across hosts, clusters, and even vCenters. Logical switches are typically created and managed using the vSphere Web Client. Once created, machines can be logically wired to them for connectivity to other machines and/or upstream services (e.g. NSX Edge Services Gateway or Distributed Logical Router…or anything else wired to the resulting logical network). Thanks to the power of NSX, these networks can be spun up rapidly (albeit statically) and exist exclusively in the virtualization layer, saving countless management cycles and associated overhead (+ cost).

As you are well versed by now, NSX delivers the critical services needed for a modern network infrastructure while lifecycle automation of network and security services — from provisioning to decommissions (and everything in between) — are defined by the automation layer.…

vRA and NSX – Intro to Network and Security Automation

Network and security automation — and specifically the use of on-demand services — will continue to play a more significant role as NSX (and network virtualization in general) continues to become more and more prominent. Customers are still trying to understand the impacts of app-centric networking and whether or not they’re ready to hand these critical services to automation tools. There’s a perception that automation reduces control and/or visibility into networking and security services that traditionally involve a ton of ownership, red tape, and several siloed personalities that love to hear their own voice (I used to be one!). Plus, there are personal domains and certifications to protect!

Once these folks realize vRA + NSX will provide greater control, more governance, and better visibility than they’ve ever had before, heads tend to deflate a bit. NSX adoption is on a rocketship and its benefits are resonating with traditional network silos and modern shops alike. As adoption (and resulting trust) continues to grow within an enterprise, the second part of the equation — automation — become the obvious next step for streamlining network and security services, often getting kicked off with two wonderful words: now what? Enter vRealize Automation.

For its part, vRA is designed to bridge the gap between a pure consumption model and on-demand everything.…

vRA and NSX – Part 1, vSphere Prep

Introduction

There are a few prerequisite steps to complete on the vSphere and NSX side before vRA can be configured to consume its services or deliver on-demand networking and security. In Part 1 of this series, we will use the vSphere Web Client to review the NSX baseline deployment and add the necessary configurations for staging. What is configured here will depend on the desired objectives and use cases…I’ll cover minimum requirements.

Note: These steps assume you have already deployed NSX Manager, registered NSX with vSphere, and prepared hosts / clusters per best practice.

Objectives:

  • Review NSX deployment in vSphere to ensure prerequisites are in tact
  • Validate Logical Network / VXLAN configuration

As mentioned previously, this guide assumes a basic NSX deployment has been completed. This section will review the lab configuration and validate NSX has been properly deployed and configured.

1.  Log in the vSphere Web Client.

2.  Navigate to Networking & Security to review the existing NSX deployment configuration.

3.  Select Installation in the Networking & Security pane.

4.  In the Management tab, verify that at least one primary NSX Manager is available and at least one NSX Controller Node has been deployed (with status: Connected):

vra7-135

5.  In the Host Preparation tab, expand the target clusters and ensure Installation status, Firewall, and VXLAN are all showing a green check mark:

vra7-133

In this example, there are two configured clusters — Cloud Cluster and Mgmt Cluster.