Introduction

The topic of resource reservation and allocation is very delicate. I am of the school of thought that is better to have enough resources to make everyone happy and still be at 75% utilization rather than having to manage resource shares. Well, in an ideal world everyone gets its own share and never takes more, right? For the real world in which the budget is never enough, and VM’s roam the hosts consuming resources unscrupulously we have the vSphere feature of resource allocation/management.

Resource Allocation Shares

Shares specify the relative importance of a virtual machine (or resource pool). If a virtual machine has twice as many shares of a resource as another virtual machine, it is entitled to consume twice as much of that resource when these two virtual machines are competing for resources.

Shares are typically specified as High, Normal, or Low and these values specify share values with a 4:2:1 ratio, respectively. You can also select Custom to assign a specific number of shares (which expresses a proportional weight) to each virtual machine.

These values depend on the number of vCPUs and RAM on each VM. Take a look at Table 2-1 on page 12 in the vSphere Resource Management pdf (link at the bottom).

Figure 1. Right click on a VM and select Edit Resource Settings:

Figure 2. Edit Resource Settings Window:

Here you will find the values I mentioned before, and a couple more. The Reservation is the guaranteed allocation of resources and the Limit is the upper limit.

We can also configure Resource Pools to simplify the administration of resources, instead of configuring resources on a per VM basis, we can manage those VMs in groups.

One last concept you should be familiar with is Admission Control (before we dive into the blueprint for this topic).

When you power on a virtual machine, the system checks the amount of CPU and memory resources that have not yet been reserved. Based on the available unreserved resources, the system determines whether it can guarantee the reservation for which the virtual machine is configured (if any). This process is called admission control. If enough unreserved CPU and memory are available, or if there is no reservation, the virtual machine is powered on. Otherwise, an Insufficient Resources warning appears.

Check this post about Resource Pools by Duncan Epping on Yellow-Bricks, it is a little bit old, but I think is still relevant.

After this brief introduction, I am going back to the exam blueprint and try to explain each concept. In this section we are going to cover the following topics:

• Create/Remove a Resource Pool
• Add/Remove virtual machines from a Resource Pool
• Configure custom resource pool attributes
• Determine the effect of the Expandable Reservation parameter on resource allocation
• Create a resource pool hierarchical structure
• Determine how resource pools apply to vApps
• Describe vFlash architecture
• Create/Delete vFlash Resource Pool
• Assign vFlash resources to VMDKs
• Given a scenario, determine appropriate shares, reservations and limits for hierarchical Resource Pools

Create/Remove a Resource Pool

From you Home view in the vSphere Web Client, click Hosts and Clusters in the middle pane, then right click on a host to find the New Resource Pool link.

Figure 1. New Resource Pool

Figure 2. New Resource Pool Configuration Window

After you create a Resource Pool you ca delete it by going to the same view from which you created it and right cl1ck on the Resource Pool name.

Fogire 3. Remove Resource Pool

Click Yes on the popup confirmation dialog window and done.

Add/Remove virtual machines from a Resource Pool

You can drag and drop the VM in and out of at Resource Pool or you can migrate the VM into a Resource Pool.

Video 1. Migrate a VM to a new Resource Pool

Configure custom resource pool attributes

Going back to Resource Allocation Shares:

Shares are typically specified as High, Normal, or Low and these values specify share values with a 4:2:1 ratio, respectively. You can also select Custom to assign a specific number of shares (which expresses a proportional weight) to each virtual machine.

Figure 4. Custom Resource Pool Attributes

If you click on the Resource Pool (RP-Parent) then you can click on Edit resource pool settings and the configuration dialog will appear.

Determine the effect of the Expandable Reservation parameter on resource allocation

When the check box is selected (default), expandable reservations are considered during admission control. If you power on a virtual machine in this resource pool, and the combined reservations of the virtual machines are larger than the reservation of the resource pool, the resource pool can use resources from its parent or ancestors.

In other words, if my son wants to watch a movie and he only has $3 he will come to me and ask for money, if I have some cash and I can give it to him, then he can go to the theater, if not he stays home.

There is a great example on page 57 of the Managing Resource Pools pdf (link at the bottom).

Create a resource pool hierarchical structure

Figure 5. Parents, Children, and Siblings in Resource Pool Hierarchy

The root resource pool is the cluster in this case.

Determine how resource pools apply to vApps

A vSphere vApp allows packaging of multiple interoperating virtual machines and software applications that you can manage as a unit and distribute in OVF format.

A vApp can contain one or more virtual machines, but any operation carried out on the vApp, such as clone or power off, affects all virtual machines in the vApp container

Reservations on vApps and all their child resource pools, child vApps, and child virtual machines count against the parent resources only if those objects are powered on.

Procedure
1. Navigate to a vApp in the inventory and click Edit vApp Settings.
2. In the Deployment section, click CPU resources to allocate CPU resources to this vApp.

3. In the Deployment section, click Memory resources to allocate memory resources to this vApp.

4. Click Ok.

Describe vFlash architecture

VMware vSphere Flash Read Cache virtualizes server side flash providing a high performance read cache layer that dramatically lowers application latency. The caching is fully transparent to the VM without requiring any guest agents. Flash Read Cache enables allocation of flash resources at a per-VMDK granularity providing VMware vSphere vMotion consistent read caching and integration with VMware vSphere Distributed Resource Scheduler for initial placement.

vFRC is enabled on a per-VMDK basis. Each VMDK can be configured with a certain size of flash cache with a certain cache block size. Once vFRC is enabled for a virtual disk, the cache is created when the virtual machine boots. vFRC is a writethrough cache. This means that even though write I/O requests are cached by vFRC, I/O request completion status is sent to the guest virtual machine only after the data is written to physical storage. Because of this design, there is no change in the existing data reliability and availability guarantees.

Create/Delete vFlash Resource Pool

Figure 6. Navigate to Host and Clusters -> Click a Host -> Click Manage -> Click Settings -> Click Virtual Flash Resource Management and then click on Add Capacity

Figure 7. Selection Dialog Window

After you select the capacity in figure 7, you will be able to see the available amount in figure 6.

Assign vFlash resources to VMDKs

Figure 8. Edit settings on a VM to add vFlash to a vmdk. Click Advance to enable the cache

Given a scenario, determine appropriate shares, reservations and limits for hierarchical Resource Pools

For individual VMs take into consideration the number of vCPUs and the amount of memory:

For example, an SMP virtual machine with two virtual CPUs and 1GB RAM with CPU and memory shares set to Normal has 2×1000=2000 shares of CPU and 10×1024=10240 shares of memory.

You can find a good example on pages 56 and 57 of the vSphere Resource Management.

====

Resources

vSphere Resource Management

Managing Multi-Tiered Applications with vSphere vApp

vFlash

Two weeks ago I was fortunate to be at VMworld 2015. I think it was of great value for me as a professional to be able to attend because by participating in the different sessions and Hands on Labs I learned and validated a lot of the knowledge I use on a day to day basis. I wrote some of this in my post VMworld PEX, but I would like to go over one of the sessions that was about Best Practices for vSphere across different scenarios. The session started with the presenter talking about virtualization all in. There is no reason or, in other words, there is not a single application that could not be virtualized and work for production. He made the disclaimer that the design might call for a change in hardware to accommodate for the performance needed, but in the end it could be done. Here is a summary:

• VMware all in!
• vSphere is achieving low network latency, into the microseconds.
• Due the characteristics of virtualization and its optimizations, VMware was able to score better performance running a hadoop cluster than the physical counterpart.
• The  vCenter Web Client runs faster on Chrome
• Install the vCenter DB close to the vCenter, avoid having the database across the network.
• Place the vCenter and its database on Tier one storage.
• Don’t change statistics levels, the ones that come with the vCenter are practically useless, use Operations Manager instead.
• Check VMware KB 2021302 (previous to 6) for JVM correct sizing.
• Size the VM into the pNUMA node if possible. (https://blogs.vmware.com/vsphere/tag/vnuma)
• Don’t use vCPU Hot-Add, this disables the vNUMA.
• Select High Performance in the BIOS
• Enable Hyper-threading
• Use the latest Virtual Hardware Version
• Use vmxnet3 for network
• Jumbo Frames provide value, use it.
• Use Latency Sensitivity cautiously, it reserves a core.
  

  You can adjust the latency sensitivity of a virtual machine to optimize the scheduling delay for latency sensitive applications.
  ESXi is optimized to deliver high throughput. You can optimize your virtual machine to meet the low latency requirement of latency sensitive applications. Examples of latency sensitive applications are VOIP or media player applications, or applications that require frequent access to the mouse or keyboard devices.

• Use multiple vSCSI adapters
• Don’t user RDM’s. And if you need them for Microsoft Cluster then stop using MS cluster :).
• Follow you OEM’s integration guides, all vendors have white papers on how to configure this or that specifically for their equipment.
• In Windows set the Power Policy to High Performance to avoid core parking.
• The use of network receive side scaling (RSS) must be enabled at the guest NIC and Windows OS.
• Rightsize is better that oversize, configure the VM’s with what they need. I would add to oversize a bit on the host side.
• For Linux, be sure to use the latest kernel and Elevator=noop. Check this old KB that explains some of the I/O schedulers. (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2011861)
• Database Recommendations
  • Use Large Memory Pages
  • Ensure vNuma is correct and aligned
  • Tune SQL MAXDOP Cost Threshold (https://msdn.microsoft.com/en-us/library/ms189094.aspx)
  • Oracle doesn’t leverage NUMA well and often benefits from disabling it at the database level
  • Disable Interrupt Coalescing
• Messaging Recommendations
  • Disable Interrupt Coalescing
  • Fast Storage!
• In general, single threaded applications will benefit from higher frequency CPU’s, a high multicore CPU will work better for applications with a higher degree of parallelism.
• Don’t over commit the memory, design for approximately 75% RAM use. Take into consideration your admission control.
• HPC: http://www.vmware.com/files/pdf/techpaper/Virtualized-Hadoop-Performance-with-VMware-vSphere6.pdf

I hope this is somewhat helpful to everyone out there.

Last night I experienced what happens after hours around VMworld, and it was a lot of fun. First I headed to the vExpert reception and there were vExperts from around the world literally, I met people from Costa Rica, Australia and of course, the US. After a couple of speakers, Pat Gelsinger came down to the floor to share a few minutes with us, it was really exciting. After that we walked to the VMware Latin America appreciation event, it is always refreshing to share some time talking about whatever we can think about, but in Spanish. While at this event we heard that VEEAM was throwing a party and apparently it had a great reputation, so we headed that way. We finish our night at the VEEAM party, it lived to the hype, and we had a lot of fun.

The journey to the cloud has been slow but steady. Many enterprises are looking to reduce costs and at the same time add new services. Even though at some point there must be a limit to the “do more with less” mentality, the ever-moving wheel of innovation allows keeping that trend. In this post, I will present definitions of the first steps to follow the path to the cloud. There are two ways to get to the cloud, be born in the cloud or migrate to it. In the case of migrating to the cloud, the best option is to start by virtualizing the environment.

Virtualization

In computing, virtualization refers to the act of creating a virtual (rather than actual) version of a computer hardware (CPU, RAM), operating systems (Windows, Linux, etc…), storage capacity, or computer network resources.

Keep in mind that you could still have multiple virtualization platforms or multiple virtualized Silos. Migrating an enterprise from multiple physical systems, for example, the production and developer environments, to multiple virtualized systems will keep the enterprise in a “silo” style configuration, but it will start the journey to the cloud.

Virtualized Silos

To move to the Virtualized Datacenter, the system will need shared resources between those silos, and the administrators need new skills, and they would have to learn new techniques.

Virtualized Data Center (VDC)

A highly efficient and optimized data center allowing the business to do more within the confines of the available resources (servers, power, cooling, sq. ft.). It also can adapt to changes in the business and workload requirements.

The number one drive for the virtual data center is the efficiency or reducing overhead and waste. This new paradigm takes advantage of true sharing with resource pooling and standardization at its core.

Key characteristics:

• Virtualized hardware stack
• Resource pooling / shared resources
• Automation
• Standardization
• Reporting for management and chargeback/showback.
• Policy-based security

Cloud computing

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released (elastic) with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.

The number one drive for the cloud is the agility. The speed and the agility that cloud brings to the business is the main reason most datacenters are on its way from the VDC to the cloud model.

Essential Characteristics:

• On-demand self-service. A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.
• Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).
• Resource pooling. The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand.
• Rapid elasticity. Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.
• Measured service. Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.
• Policy Based Security: an approach to security that automates the implementation of rules based on a specific criterion.

Service Models:

• Software as a Service (SaaS). The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, except for limited user-specific application configuration settings.
• Platform as a Service (PaaS). The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.
• Infrastructure as a Service (IaaS). The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer can deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

Deployment Models:

• Private cloud. The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
• Community cloud. The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.
• Public cloud. The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider.
• Hybrid cloud. The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

Benefits of the Cloud

• Self service provisioning in minutes, compared to days or even weeks in the VDC or the virtualized but siloed datacenter.
• Application development and testing are flexible and self-service enabled.
• Relocation from test and development is predictable and seamless.
• Resources scale smoothly to meet growing or reduced demand.
• Service level easily adjusted after the initial provisioning.
• Resource granularity permits an optimized metering providing better utilization and reducing cost.
• Low (or even none) Capital Expense, which enables developers to start and test new ideas with ease.

As a summary, we could say the first step to this agile and efficient model is to virtualize your datacenter. The following image illustrated the path and vision for the datacenter of the future.

An enterprise can be at any stage of this journey to the cloud and still have a completely functional system that meets the requirements and produces the desired results. The closer to the cloud the enterprise gets, the closer it should be to a fully automated, self-service and elastic system.

Most of the definitions for this post were taken from the National Institute of Standards and Technology.

• Create/Edit/Remove a Host Profile from an ESXi host
• Import/Export a Host Profile
• Attach/Apply a Host Profile to an ESXi host or cluster
• Perform compliance scanning and remediation of an ESXi host using Host Profiles

Using Host Profiles
The Host Profiles feature creates a profile that encapsulates the host configuration and helps to manage the host configuration, especially in environments where an administrator manages multiple hosts or clusters in vCenter Server.

Host Profiles provide an automated and centrally-managed mechanism for host configuration and configuration compliance. Host Profiles can improve efficiency by reducing reliance upon repetitive, manual tasks. Host Profiles capture the configuration of a pre-configured and validated reference host, store the configuration as a managed object and use the catalog of parameters contained within to configure networking, storage, security and other host-level parameters. Host Profiles can be applied to either individual hosts or to a cluster; applying a Host Profile to a cluster will affect all hosts in the cluster and result in a consistent configuration across all hosts in that cluster.

Host Profiles can be used to validate the configuration of a host by checking compliance of a host or cluster against the Host Profile that is associated with that host or cluster.

Create a Host Profile
You create a new Host Profile by extracting the designated reference host’s configuration.

Note
You can also extract a host profile by navigating to the specific host or cluster.

Prerequisites
Verify that you have a working vSphere installation and at least one completely and properly configured host that will act as the reference host.
Procedure
1. Navigate to the Host profiles view.
2. Click the Extract Profile from a Host icon ( ).
3. Select the host that will act as the reference host and click Next.

The selected host must be a valid host.
4. Type the name and enter a description for the new profile and click Next.
5. Review the summary information for the new profile and click Finish.
The new profile appears in the profile list.

Note
Host profiles do not capture offline or unpresented devices. Any changes made to offline devices after extracting a host profile will not make a difference to the compliance check results.

Edit a Host Profile
You can view and edit Host Profile policies, select a policy to be checked for compliance, and change the policy name or description.

Procedure
1.vNavigate to the Host Profile that you want to edit and click the Manage tab.
2.vClick Edit Host Profile.
3. (Optional) Change the profile name and description and click Next.
4. Make changes to the profile policies.

See Edit a Policy for detailed instructions for editing a Host Profile policy. See Disable Host Profile Component for detailed instructions on enabling or disabling a policy from compliance check or remediation.
5. (Optional) Customize the hosts.

Make any changes to the available configuration values for this profile.
6. Click Finish.
The changes are made when the “Update Host Profile” task is completed in the Recent Tasks status. If you attempt to remediate the profile before the task is complete, the profile configuration does not contain the change.

Disable Host Profile Component
You can decide whether a Host Profile component is applied or considered during compliance check. This allows administrators to eliminate non-critical attributes from consideration or ignore values that, while part of the Host Profile, are likely to vary between hosts.

Procedure
1. Edit a Host Profile.
2. Expand the Host Profile Component hierarchy until you reach the desired component or component element.
3. Disable the checkbox next to a component to remove it from being applied during remediation or considered during a profile compliance check.

Note
The check box is enabled by default. If you disable the check box so this component or component element is not checked for compliance or applied during remediation, the other policies that are enabled will still be applied and checked.

Import a Host Profile
You can import a profile from a file in the VMware profile format (.vpf).

When a host profile is exported, administrator and user profile passwords are not exported. This is a security measure and stops passwords from being exported in plain text when the profile is exported. You will be prompted to re-enter the values for the password after the profile is imported and the password is applied to a host.
Procedure
1. Navigate to the Host Profiles view.
2. Click the Import Host Profile icon ( ).
3. Click Browse to browse for the VMware Profile Format file to import
4. Enter the Name and Description for the imported Host Profile, and click OK.
The imported profile appears in the profile list.

Export a Host Profile
You can export a profile to a file that is in the VMware profile format (.vpf).

When a host profile is exported, administrator and user profile passwords are not exported. This is a security measure and stops passwords from being exported in plain text when the profile is exported. You will be prompted to re-enter the values for the password after the profile is imported and the password is applied to a host.
Procedure
1. Navigate to the Host Profile you want to export.
2. Right-click the profile and select Export Host Profile.
3. Select the location and type the name of the file to export the profile.
4. Click Save.

Attach Entities to a Host Profile
After creating a Host Profile from a reference host, you must attach the host or cluster to the Host Profile.

Procedure
1. From the Profile List in the Host Profiles main view, select the Host Profile to be applied to a host or cluster.
2. Click the Attach/Detach Hosts and clusters to a host profile icon.
3. Select the host or cluster from the expanded list and click Attach.

The host or cluster is added to the Attached Entities list.
4. (Optional) Click Attach All to attach all listed hosts and clusters to the profile.
5. Click Next.
6. (Optional) You can update or change the user input parameters for the Host Profiles policies by customizing the host.

See Host Profiles and vSphere Auto Deploy.
7. Click Finish to complete attaching the host or cluster to the profile.

Detach Entities From a Host Profile
In order to remove the policy-managed configuration from a host or cluster, that host or cluster must be detached from the Host Profile.

When a Host Profile is attached to a cluster, the host or hosts within that cluster are also attached to the Host Profile. However, when the Host Profile is detached from the cluster, the association between the host or host within the cluster and that Host Profile remains.
Procedure
1. From the Profile List in the Host Profiles main view, select the Host Profile to be detached from a host or cluster.
2. Click the Attach/Detach Hosts and clusters to a host profile icon.
3. Select the host or cluster from the expanded list and click Detach.

The host or cluster is added to the Attached Entities list.
4. (Optional) Click Detach All to detach all listed hosts and clusters from the profile.
5. Click Next.
6. Click Finish to complete attaching the host or cluster to the profile.

Check Compliance
You can confirm the compliance of a host or cluster to its attached Host Profile and determine which, if any, configuration parameters on a host are different from those specified in the Host Profile.

Procedure
1. Navigate to a Host Profile.

The Objects tab lists all Host Profies, the number or hosts attached to that Host Profile, and summarized results of the last compliance check.
2. Click the Check Host Profile Compliance icon.
In the Objects tab, the compliance status is updated as Compliant, Unknown, or Non-compliant.

A non-compliant status indicates a discovered and specific inconsistency between the profile and the host. To resolve this, you should remediate the host. And unknown status indicates that the compliance of the host could not be verified; to resolve the issue, remediate the host through the Host Profile.

Note
Host profiles do not capture offline or unpresented devices. Any changes made to offline devices after extracting a host profile will not make a difference to the compliance check results.
What to do next
To see more detail on compliance failures, select a Host Profile from the Objects tab for which the last compliance check produced one or more failures. In order to see specific detail on which parameters differ between the host that failed compliance and the Host Profile, click on the Monitor tab and select the Compliance view. Then, expand the object hierarchy and select the failing host. The differing parametersare displayed in the Compliance window, below the hierarchy.

Remediate a Host
In the event of a compliance failure, use the Remediate function to apply the Host Profile settings onto the host. This action changes all Host Profile managed parameters to the values contained in the Host Profile attached to the host.

Prerequisites
Verify that the profile is attached to the host.
Procedure
1. Navigate to the profile you want to remediate to the host.
2. Select the Monitor tab, then click Compliance.
3. Right-click the host or hosts that you want remediated and select Host Profiles > Remediate

Note
Certain Host Profile policy configurations require that the host be rebooted after remediation. In those cases, you are prompted to place the host into maintenance mode.
4. (Optional) You can update or change the user input parameters for the Host Profiles policies by customizing the host, and click Next.

See Host Profiles and vSphere Auto Deploy for more information about vSphere Auto Deploy.
5. Review the tasks that are necessary to remediate the Host Profile and click Finish.
The compliance status is updated.

• Identify ESXi Autodeploy requirements
• Configure Autodeploy
• Explain PowerCLI cmdlets for Autodeploy
• Deploy/Manage multiple ESXi hosts using Autodeploy

Installing ESXi Using vSphere Auto Deploy
vSphere Auto Deploy lets you provision hundreds of physical hosts with ESXi software.

Using Auto Deploy, experienced system administrators can manage large deployments efficiently. Hosts are network-booted from a central Auto Deploy server. Optionally, hosts are configured with a host profile of a reference host. The host profile can be set up to prompt the user for input. After boot up and configuration complete, the hosts are managed by vCenter Server just like other ESXi hosts. Auto Deploy can also be used for stateless caching or stateful installs.

Important
Auto Deploy requires a secure separation between the production network and the management or deployment networks as discussed in Auto Deploy Security Considerations. Using Auto Deploy without this separation is insecure.

Stateless caching
By default, Auto Deploy does not store ESXi configuration or state on the host disk. Instead, an image profile defines the image that the host is provisioned with, and other host attributes are managed through host profiles. A host that uses Auto Deploy for stateless caching still needs to connect to the Auto Deploy server and the vCenter Server.
Stateful installs
You can provision a host with Auto Deploy and set up the host to store the image to disk. On subsequent boots, the host boots from disk.

Preparing for vSphere Auto Deploy
Before you can start to use vSphere Auto Deploy, you must prepare your environment. You start with server setup and hardware preparation. You must register the Auto Deploy software with the vCenter Server system that you plan to use for managing the hosts you provision, and install the VMware PowerCLI.

Prepare Your System and Install the Auto Deploy Server
Before you can PXE boot an ESXi host with vSphere Auto Deploy, you must install prerequisite software and set up the DHCP and TFTP servers that Auto Deploy interacts with.

Prerequisites
■ Verify that the hosts that you plan to provision with Auto Deploy meet the hardware requirements for ESXi. See ESXi Hardware Requirements.

Note
You cannot provision EFI hosts with Auto Deploy unless you switch the EFI system to BIOS compatibility mode.

■ Verify that the ESXi hosts have network connectivity to vCenter Server and that all port requirements are met. See vCenter Server Required Ports.
■ If you want to use VLANs in your Auto Deploy environment, you must set up the end to end networking properly. When the host is PXE booting, the UNDI driver must be set up to tag the frames with proper VLAN IDs. You must do this set up manually by making the correct changes in the BIOS. You must also correctly configure the ESXi port groups with the correct VLAN IDs. Ask your network administrator how VLAN IDs are used in your environment.
■ Verify that you have enough storage for the Auto Deploy repository. The Auto Deploy server uses the repository to store data it needs, including the rules and rule sets you create and the VIBs and image profiles that you specify in your rules.

Best practice is to allocate 2 GB to have enough room for four image profiles and some extra space. Each image profile requires approximately 350 MB. Determine how much space to reserve for the Auto Deploy repository by considering how many image profiles you expect to use.
■ Obtain administrative privileges to the DHCP server that manages the network segment you want to boot from. You can use a DHCP server already in your environment, or install a DHCP server. For your Auto Deploy setup, replace the gpxelinux.0 file name with undionly.kpxe.vmw-hardwired.
■ Secure your network as you would for any other PXE-based deployment method. Auto Deploy transfers data over SSL to prevent casual interference and snooping. However, the authenticity of the client or the Auto Deploy server is not checked during a PXE boot.
■ Set up a remote Syslog server. See the vCenter Server and Host Management documentation for Syslog server configuration information. Configure the first host you boot to use the remote Syslog server and apply that host’s host profile to all other target hosts. Optionally, install and use the vSphere Syslog Collector, a vCenter Server support tool that provides a unified architecture for system logging and enables network logging and combining of logs from multiple hosts.
■
Install ESXi Dump Collector, set up your first host so that all core dumps are directed to ESXi Dump Collector, and apply the host profile from that host to all other hosts. See Configure ESXi Dump Collector with ESXCLI.
■ Verify that the Auto Deploy server has an IPv4 address. Auto Deploy does not support a pure IPv6 environment end-to-end. The PXE boot infrastructure does not support IPv6. After the deployment you can manually reconfigure the hosts to use IPv6 and add them to vCenter Server over IPv6. However, when you reboot a stateless host, its IPv6 configuration is lost.
Procedure
1. Install vCenter Server or deploy the vCenter Server Appliance.

The Auto Deploy server is included with the management node.
2. Configure the Auto Deploy service startup type.

a. Log in to your vCenter Server system by using the vSphere Web Client.
b. On the vSphere Web Client Home page, click Administration.
c. Under System Configuration click Services.
d. Select Auto Deploy, click the Actions menu, and select Edit Startup Type.

■ On Windows, the Auto Deploy service is disabled. In the Edit Startup Type window, select Manual or Automatic to enable Auto Deploy.
■ On the vCenter Server Appliance, the Auto Deploy service by default is set to Manual. If you want the Auto Deploy service to start automatically upon OS startup, select Automatic.

3. Configure the TFTP server.

a. In a vSphere Web Client connected to the vCenter Server system, go to the inventory list and select the vCenter Server system.
b. Click the Manage tab, select Settings, and click Auto Deploy.
c. Click Download TFTP Boot Zip to download the TFTP configuration file and unzip the file to the directory in which your TFTP server stores files.

4. Set up your DHCP server to point to the TFTP server on which the TFTP ZIP file is located.

a. Specify the TFTP Server’s IP address in DHCP option 66, frequently called next-server.
b. Specify the boot file name, which is undionly.kpxe.vmw-hardwired in the DHCP option 67, frequently called boot-filename.

5. Set each host you want to provision with Auto Deploy to network boot or PXE boot, following the manufacturer’s instructions.
6. Locate the image profile that you want to use and the depot in which it is located.

In most cases, you point to an image profile that VMware makes available in a public depot. If you want to include custom VIBs with the base image, you can use the vSphere ESXi Image Builder to create an image profile and use that image profile.
7. Write a rule that assigns an image profile to hosts.
8. (Optional) If you set up your environment to use Thumbprint mode, you can use your own Certificate Authority (CA) by replacing the OpenSSL certificate rbd-ca.crt and the OpenSSL private key rbd-ca.key with your own certificate and key file.

■ On Windows, the files are in the SSL subfolder of the Auto Deploy installation directory. For example, on Windows 7 the default is C:\ProgramData\VMware\VMware vSphere Auto Deploy\ssl.
■ On the vCenter Server Appliance, the files are in /etc/vmware-rbd/ssl/.

By default, vCenter Server 6.0 and later uses vSphere Certificate Authority.
When you start a host that is set up for Auto Deploy, the host contacts the DHCP server and is directed to the Auto Deploy server, which provisions the host with the image profile specified in the active rule set.
What to do next
■ Install vSphere PowerCLI. See Install vSphere PowerCLI and Prerequisite Software.
■ Use the vSphere PowerCLI cmdlets to define a rule that assigns an image profile and optional host profile to the host.
■ (Optional) Configure the first host that you provision as a reference host. Use the storage, networking, and other settings you want for your target hosts to share. Create a host profile for the reference host and write a rule that assigns both the already tested image profile and the host profile to target hosts.
■ If you want to have Auto Deploy overwrite existing partitions, set up a reference host to do auto partitioning and apply the host profile of the reference host to other hosts. See Consider and Implement Your Partitioning Strategy.
■ If you have to configure host-specific information, set up the host profile of the reference host to prompt for user input. See Host Customization in the vSphere Web Client.

Auto Deploy PowerCLI Cmdlet Overview
You specify the rules that assign image profiles and host profiles to hosts using a set of PowerCLI cmdlets that are included in VMware PowerCLI.

If you are new to PowerCLI, read the PowerCLI documentation and review Using Auto Deploy Cmdlets. You can get help for any command at the PowerShell prompt.

■ Basic help: Get-Help cmdlet_name
■ Detailed help: Get-Help cmdlet_name -Detailed
Note
When you run Auto Deploy cmdlets, provide all parameters on the command line when you invoke the cmdlet. Supplying parameters in interactive mode is not recommended.
Rule Engine PowerCLI Cmdlets

Using Auto Deploy Cmdlets
Auto Deploy cmdlets are implemented as Microsoft PowerShell cmdlets and included in vSphere PowerCLI. Users of Auto Deploy cmdlets can take advantage of all vSphere PowerCLI features.

Experienced PowerShell users can use Auto Deploy cmdlets just like other PowerShell cmdlets. If you are new to PowerShell and vSphere PowerCLI, the following tips might be helpful.

You can type cmdlets, parameters, and parameter values in the vSphere PowerCLI shell.

■ Get help for any cmdlet by running Get-Helpcmdlet_name.
■ Remember that PowerShell is not case sensitive.
■ Use tab completion for cmdlet names and parameter names.
■ Format any variable and cmdlet output by using Format-List or Format-Table, or their short forms flfl or ft. For more information, run the Get-Help Format-List cmdlet.
Passing Parameters by Name
You can pass in parameters by name in most cases and surround parameter values that contain spaces or special characters with double quotes.

Copy-DeployRule -DeployRule testrule -ReplaceItem MyNewProfile
Most examples in the vSphere Installation and Setup documentation pass in parameters by name.
Passing Parameters as Objects
You can pass parameters as objects if you want to perform scripting and automation. Passing in parameters as objects is useful with cmdlets that return multiple objects and with cmdlets that return a single object. Consider the following example.

1. Bind the object that encapsulates rule set compliance information for a host to a variable.

$tr = Test-DeployRuleSetCompliance MyEsxi42

2. View the itemlist property of the object to see the difference between what is in the rule set and what the host is currently using.

$tr.itemlist

3. Remediate the host to use the revised rule set by using the Repair-DeployRuleSetCompliance cmdlet with the variable.

Repair-DeployRuleSetCompliance $tr

The example remediates the host the next time you boot the host.

Provisioning ESXi Systems with vSphere Auto Deploy
vSphere Auto Deploy can provision hundreds of physical hosts with ESXi software. You can provision hosts that did not previously run ESXi software (first boot), reboot hosts, or reprovision hosts with a different image profile, host profile, or folder or cluster location.

The Auto Deploy process differs depending on the state of the host and on the changes that you want to make.

Provision a Host (First Boot)
Provisioning a host that has never been provisioned with Auto Deploy (first boot) differs from subsequent boot processes. You must prepare the host and fulfill all other prerequisites before you can provision the host. You can optionally define a custom image profile with Image Builder PowerCLI cmdlets.

Prerequisites
■ Make sure your host meets the hardware requirements for ESXi hosts.

See ESXi Hardware Requirements.
■ Prepare the system for vSphere Auto Deploy (see Preparing for vSphere Auto Deploy).
■ Write rules that assign an image profile to the host and optionally assign a host profile and a vCenter Server location to the host. See Managing Auto Deploy with PowerCLI Cmdlets.

When setup is complete, the Auto Deploy server and PowerCLI are installed, DHCP setup is complete, and rules for the host that you want to provision are in the active rule set.
Procedure
1. Turn on the host.

The host contacts the DHCP server and downloads iPXE from the location the server points it to. Next, the Auto Deploy server provisions the host with the image specified by the rule engine. The Auto Deploy server might also apply a host profile to the host if one is specified in the rule set. Finally, Auto Deploy adds the host to the vCenter Server system that is specified in the rule set.
2. (Optional) If Auto Deploy applies a host profile that requires user input such as an IP address, the host is placed in maintenance mode. Reapply the host profile with the vSphere Web Client and provide the user input when prompted.
After the first boot process, the host is running and managed by a vCenter Server system. The vCenter Server stores the host’s image profile, host profile, and location information.

You can now reboot the host as needed. Each time you reboot, the host is reprovisioned by the vCenter Server system.
What to do next
Reprovision hosts as needed. See Reprovisioning Hosts.

If you want to change the image profile, host profile, or location of the host, update the rules and perform a test and repair compliance operation. See Test and Repair Rule Compliance.

Section 9: Configure and Administer vSphere Availability Solutions

Objective 9.3: Setup and Configure App HA. In this objective we should be covering these topics:

• Identify vSphere App HA requirements
• Identify available services protected by vSphere App HA
• Add applications to vSphere App HA
• Configure vSphere App HA policies

vSphere App HA Overview
vSphere App HA is a plug-in to the vSphere Web Client. vSphere App HA allows you to define high availability for the applications that are running on your virtual machines in your environment.

 Setting Up vSphere App HA

After you deploy vSphere App HA, you must set up vSphere App HA and connect to the vCenter Hyperic server.

Prerequisites
■  Your vCenter Server license must include the vSphere App HA feature.
■  vCenter Hyperic server must be installed on vCenter Server.

Procedure
1. Log in to the vSphere Web Client using the vSphere App HA.Modify credentials at root level.
2. From the Inventory menu, navigate to Administration > vSphere App HA.
3. Click the Settings tab.
4. Type the following parameters to configure the vCenter Hyperic server and click Apply.

5. Approve the vCenter Hyperic certificate.
A connection to the vCenter Hyperic server is established.

Access vSphere App HA Using vSphere Web Client
You can access vSphere App HA through the vSphere Web Client. vSphere App HA is compatible only with the vSphere Web Client.

Prerequisites
Deploy the vSphere App HA plug-in on vSphere Web Client. For more information, see the vSphere App HA Installation and Configuration Guide.
Procedure
1. Open a Web browser and type the URL for accessing the vSphere Web Client, https://client-hostname:port/vsphere-client.

You can use the IP address of the vSphere Web Client as an alternative to the client host name.

By default the port is 9443, but this can be changed during vSphere Web Client installation.
2. Type the credentials in the Username and Password text boxes.
3. Click Login.
If vSphere App HA is deployed correctly, vSphere App HA is listed on the Administration page of vSphere Web Client. Also, the Applications Availability tab appears under the Monitor tab.

Enable a vSphere App HA Plug-In
You can enable a disabled vSphere App HA plug-in.

When you deploy a vSphere App HA plug-in, it is enabled by default. If you have had to disable the plug-in, you can re-enable it.
Procedure
1. Log in to the vSphere Web Client with vSphere administrator credentials.
2. From the Inventory menu, click Administration.
3. Click Solutions > Client Plug-ins.
4. Right-click the vSphere App HA plug-in and click Enable.

Disable a vSphere App HA Plug-In
You can disable the vSphere App HA plug-in.

Procedure
1. Log in to the vSphere Web Client with vSphere administrator credentials.
2. From the Inventory menu, click Administration.
3. Click Solutions > Client Plug-ins.
4. Right-click the vSphere App HA plug-in and click Disable.

Disabling the plug-in does not remove the plug-in from the vSphere Web Client. You must uninstall the plug-in to remove it.

Managing Services
You can use view the services in your virtual environment and perform management tasks, such as assigning policies and putting services into maintenance mode.

Service Availability Summary
The summary status of the services is displayed on the Monitor > Applications Availability tab.

Services can be designated as available, unavailable, of unknown status, unsynchronized, or in maintenance mode.

The Availability Status Summary icon above the table indicates the most critical status of the all the services in the table. A summary of all services that are not categorized as Available are listed below the icon.

Availability Status Summary

Services Availability Status
The Services Availability Status table provides details of all the application services that are running in your environment, including essential information such as the virtual machine name and install path of each service, its availability status and any remediation policy that is assigned to the service. You can also manage services such as assigning or changing a policy for a service, putting a service into maintenance mode, and so on. manage services.

You can filter and sort the table.

Services Availability Table

Assign a Policy to Application Services
You can assign a policy to one or more application services that are of the same service type.

Prerequisites
■ Define a policy. For more information about policy creation, see Create a Policy.
■ Verify that you have vSphere App HA.Modify privileges for each virtual machine on which the services to which you will apply a policy are running.
Procedure
1. Log in to the vSphere Web Client using the vSphere App HA.Modify credentials.
2. On the Monitor tab, click the Application Availability tab.
3. Select the services for the applications to which you want to assign a policy.

If you select one or more services that are incompatible with the service type, the Assign Policy icon disappears.
4. Click the Assign Policy icon .

The Assign Policy window appears, which filters and lists all the policies according to service type in a tabular form.
5. Select a policy.
6. Click OK.
The selected policy is assigned to the application services that you specified.

Unassign a Policy
You can unassign a policy from one or more application services. The unassigned policy is removed from the application service.

Prerequisites
Verify that you have vSphere App HA.Modify privileges for each virtual machine on which the services from which you are unassigning a policy are running.
Procedure
1. Log in to the vSphere Web Client using the vSphere App HA.Modify credentials.
2. On the Monitor tab, click the Application Availability tab.
3. Select the services for the applications from which you want to unassign a policy.

Services do not have to be of the same service type.
4. Click the Unassign Policy icon .
The policy is unassigned from the selected application services.

Policies in vSphere App HA
A policy is an object that defines the service type, and the remediation actions to occur when a service becomes unavailable .

You can assign a policy to multiple services.

The service type that you define in the policy must be compatible with the service it is assigned to.

You can view all the policies in the policies table on the Policies tab. The policies can be filtered and sorted.

You can also delete policies on the Policies tab.

Create a Policy
You can create a policy in which you define the remediation actions to take place when the service is unavailable or unstable.

Prerequisites
■ To get email notifications, you must have configured the vCenter Server mail server, using vSphere Web Client.
■ To trigger alarms, you must have configured the VMware vCenter AppHA Plug-in on thevCenter Hyperic server.
Procedure
1. Log in to the vSphere Web Client using the vSphere App HA.Modify credentials at root level.
2. Navigate to Administration > vSphere App HA.
3. On the Policies tab, click the Create Policy icon (+).
4. Type the Policy Name and Description, and click Next.

The policy name must be unique. The description is optional.
5. From the Application Service drop-down menu, select an application service type.
6. Complete the information in the service configuration text boxes, or verify that the Use current configuration check boxes are selected, and click Next.
7. (Optional) Select the remediation actions that take place when the service is unavailable or unstable.

8. Click Next.
9. (Optional) Create a vCenter Server alarm for the policy by selecting the Service has stopped event to trigger the vCenter Server alarm.
10. (Optional) Type comma separated email addresses for notification purposes, and click Next.
11. In the Ready to Complete screen, verify the settings and click Finish.
A policy is created and is listed in the policy definition table. You can assign this policy to services of the same type.

View a Policy
You can view details that you specified for a policy.

Procedure
1. Log in to the vSphere Web Client.
2. Navigate to Administration > vSphere App HA.
3. On the Policies tab, click the View Policy icon .
In the policy wizard you can view all the information that was specified for the policy. You can select wizard screens in random order. The data is read only.

Edit a Policy
You can change the values in a policy, including policies that have already been assigned to services.

If a conflict occurs between the changes that you make to an assigned policy and the required settings of the service, the policy is detached from that service and an error appears in the Policy column of the Service Availability table.

Some of the key reasons that might cause this issue are:

■ bad configuration in the edited policy
■ inability to communicate with the vCenter Hyperic server
■ the VMware vCenter AppHA Plug-in not being configured.

You can edit the policy again and reassign it, or assign a new policy to the services.
Prerequisites
■ When the policy that you are editing is assigned to services, you must have vSphere App HA.Modify privileges for each virtual machine on which the services are running.
■ When the policy that you are editing is assigned to services, those services must be in maintenance mode before you edit the policy.
Procedure
1. Log in to the vSphere Web Client using the vSphere App HA.Modify credentials at root level.
2. Navigate to Administration > vSphere App HA.
3. On the Policies tab, select the policy to edit and click the Edit Policy icon .
4. Change the values of the policy as required, and click Next.
5. In the Ready to Complete screen, verify the settings and click Finish.

Duplicate a Policy
You can use an existing policy as a template for a new policy, using the Duplicate Policy function.

When you duplicate a policy, the default name is Copy of original policy name. All other details are the details of the original policy.
Procedure
1. Log in to the vSphere Web Client using the vSphere App HA.Modify credentials at root level.
2. Navigate to Administration > vSphere App HA.
3. On the Policies tab, click the Duplicate Policy icon .
4. (Optional) If required, change any of the values provided in the wizard.
5. In the Ready to Complete screen, verify the settings and click Finish.
The policy is created and is listed in the policy definition table. You can assign this policy to services of the same type.

Delete a Policy
You can delete a policy and remove it from the policy definition table.

Prerequisites
If a policy is assigned to a service, you must unassign the policy before you can delete it.
Procedure
1. Log in to the vSphere Web Client using vSphere App HA.Modify credentials at root level.
2. Navigate to Administration > vSphere App HA.
3. On the Policies tab, select the policy to be deleted in the policy definition table.
4. Click the Delete Policy icon .
5. Click Yes on the confirmation message.
The policy is deleted from the policy definition table.