vCD for a SaaS Co Questions

[chadc1979]

I have some questions I hope can be answered,

A little background on what I provide:

I've got a single vCenter deployment managing both Management, Edge, and Compute Clusters.

In Compute Cluster 1 are Tenant VMs, each Tenant environment is in it's own Resource Pool with it's own VXLAN/Subnet.

In Compute Cluster 2 are shared VMs, these are Horizon RDSH VMs with and without graphics cards for vGPU use. The same VMs are accessed by multiple tenants to access their applications.

The Tenant VMs are Database and Line-of-Business applications.

I want to use vCD to provide a view into the Tenant VMs, resources, statiscs, performance etc etc but without the ability to make resource modifications, they can reboot and have console access.

I'd also like a Tenant admin to be able to reset AD User passwords and add/remove users from defined AD Groups that grant access to LOB applications.

I have configured LDAP, the vSphere Lookup Service, vCenter and NSX resources, created Storage Policies and assigned them to the existing VMs, configured SMTP.

I need to still deploy vRealize Operations Tenant Apps and vCD Management Pack.

But I think I am at the point I need to create a Provider VDC, Organization, and Organization VDC but am not sure about Network Pools, External Networks, and Edge Gateways as this has all been and will remain a managed service that is built out by us using old school designs for housing financial and public company data.

So can I do all of the above, how hard would it be to pull all the existing VMs and Tenant Resource Pools into vCD, would I need to change any of that configuration to make it easier?

Any recommendations on the Provider VDC in the above design along with all the networking pieces such as Pools, Networks, and Gateways?

Thanks for any help that can be offered or pointing me to blogs that might have a similar setup to learn from.

[chadc1979]

As I work my way through creating a Provider VDC and External Network, my Compute and Edge Clusters are separate utilizing their own dvSwitches and on the Compute dvSwitch I don't have a PortGroup for the External VLAN as it wasn't needed.

When creating the Provider VDC would I add both my Edge and Compute Clusters or just the Compute Clusters?

For the dvSwitch should I add the External VLAN PG or just use the Edge dvSwitch in vCD External Networks?

[paluszekd]

We have a concept called "Adopt a vCenter/VM" within VCD which allows one to migrate existing VM's into a VCD resource pool. For this to work properly, one would need to import these while consuming the exposed External Network (dvPG) to that specific oVDC. I wrote about a migration option here using this along with cutting over to VCD NSX networking: https://www.paluszek.com/wp/2018/10/23/migrate-vms-and-networking-to-vcloud-director-video-walkthrou...

https://www.paluszek.com/wp/2018/10/23/migrate-vms-and-networking-to-vcloud-director-video-walkthrou...

Moving existing VM's to VCD is pretty straightforward and easy. However, if you desire to utilize NSX/Virtual Network Services within VCD, you'll need to cutover the networking to a org Edge and change over any routing. This will likely require a maintenance window for any production workloads.

As for mapping your Compute Clusters to VCD, I do not see any issues there but just be aware of your resource considerations. I presume you are using NSX-V, so you have two options for creating a Network Pool (i.e. Transport Zone) - 1) create a new TZ (or consume an existing one) that's specific to VCD or 2) allow VCD to create a default NP. Note that it will attempt to create it with multicast, so change it if necessary.

Hope this helps.

-Daniel

[chadc1979]

That’s a good video, couple questions though.

I’m already using an NSX backed VXLAN, can I import that Or do I have to let vDC create a new one?

My provider network doesn’t look to different from what you documented, I’ve got an Edge-Gateway and behind that a DLR that all the VXLANs are connected to and then I’ve got OneArm loadBalancers in the VXLANs where needed for large environments with multiple application servers that need to be balanced.

Would I be able to use all that or would I need to redesign how all that is setup?

So I’d only have a single step, move the VMs into the Tenant VDC resourcePool?

[paluszekd]

You could import existing logical switches as External Networks or direct routed networks, but Edges must be created inside of VCD for self-serviceability.

It boils down to the following: If you want to provide UI self-serviceability of network services (VPN, Edge F/W, NAT, etc), the NSX constructs must be created by VCD. If you just want to consume just a logical switch, it can be imported as a External Network or direct routed org network.

[chadc1979]

I don't want any of that ability for the tenants, maybe later if I get into completely dedicated deployments.

Right now I share AD, File Services, SMTP, etc etc out of the Management Network and then the tenant deployments are front ended by a VMware Horizon farm that is centralized (for most tenants) so everyone is using the same RDSH VMs for access to their applications, those VMs wouldn't be presented in vCD.

Just presenting the VMs that are dedicated to the tenant but still utilizing everything out of the management network.

[paluszekd · Accepted solution]

Then it sounds like you're fine, but if you plan on offering self-serviceability - just be aware of the above. Also note you could granularly control write privileges for network services too using Rights Bundles/RBAC structure within VCD.

[chadc1979]

One more question before I create a demo org VDC, do I add my tenant logical switches in the external networks tab?

[paluszekd]

Sure, it can also be created post-oVDC creation too.

[chadc1979]

That did the trick!

Under Network Pools create a new NP and point it to your existing Global Transport Zone, under External Networks point it at the VXLAN portGroup and fill out the CIDR info, in the Tenant Portal under Networks add a new Direct network connected to the External Network created earlier and then move your VMs into the OrgVDC and it takes a long time to find the VMs (I'm guessing it's a timer on how often it looks to see if any new VMs exist in the ResourcePool.

Now if only the console proxy worked, it just sits on connecting and I am using public certs on everything and the public addresses have been defined.

I did have to hop back and forth between H5UI and Flex, H5 wouldn't show me any storage policies while creating an OrgVDC.