Un-Registering Services from Lookup Service:
/usr/lib/vmware-sso/bin/vi_regtool listServices https://172.30.0.186:7444/lookupservice/sdk
description=vSphere Web Client at 172.30.0.185
A default VCSA installation contains the following 6 services:
- vSphere Web Client
- Security Token Service
- VMware Log Browser
- SSO Group Check Service
- vpxd (vCenter Server)
- SSO Administration Service
We will need to identify the serviceId which starts with local:# and unregister the vSphere Web Client, VMware Log Browser and the vpxd service which is not running locally on our vCenter SSO Server. To unregister a service, you will need to create a temporarily file which contains the serviceId and use the unregisterService option with the vi_regtool.
Note: Please make sure you identify the correct serviceId before unregistering, else you may potentially run into issues with your VCSA.
Let’s say we want to unregister the service that we showed earlier local:7, we would need to run the following two commands:
echo “local:7″ > /tmp/serviceid
/usr/lib/vmware-sso/bin/vi_regtool unregisterService -d https://172.30.0.185:7444/lookupservice/sdk -u root -p vmware -si /tmp/serviceid
The first command will “echo” the serviceId into a temporarily file called /tmp/serviceid and the second command will perform the actual un-registration and you will need to specify the root credentials. You will need to repeat this for the other two services and once you have finished un-registering the three services, you can now log back into the vSphere Web Client and the error message should go away (a service restart is not necessary).
Now that you have some background on how to run a standalone vCenter SSO on the VCSA and the minor tweak that is required, how do we go about automating all of this during deployment? For those of you who know me, know that I would not leave my readers hanging without some scripts to assist with this manual work.
Automating Deployment of vCenter SSO, vSphere Web Client & vCenter Server Component:
The following section will describe how to completely automate the deployment of 3 separate VCSA running vCenter SSO + Lookup Service, vSphere Web Client and vCenter Server + Inventory Service as seen in the diagram above.
Step 1 – Deploy 3 VCSA 5.1 and configure basic network connectivity. In my example, I have the following setup:
|vCenter SSO + LS||sso.primp-industries.com||172.30.0.185|
|vSphere Web Client||webclient.primp-industries.com||172.30.0.186|
|vCenter Server + IS||vcenter.primp-industries.com||172.30.0.187|
Step 2 – Configure the vCenter SSO by creating the following shell script called configureVCSASSOStandalone.sh
The only user configuration that is required is to update the SSO_IP_ADDRESS variable in the script to the IP Address of the vCenter SSO Server. You can execute the script via SSH without having to copy the script to the VCSA system, here is an example execution:
We can see from the screenshot above, we automatically look for the 3 services mentioned earlier and unregister it from the vCenter SSO Server running the Lookup Service. You can easily confirm this by re-running the listServices operation with the vi_regtool.
Step 3 – Configure the vSphere Web Client Server and you can use the configureVCSAvSphereWebClientStandalone.sh script noted in this article. The only user configuration that is required is to update the VCENTER_SSO_IPADDRESS variable in the script to point to the IP Address of your vCenter SSO Server. Here is an example execution:
Step 4 – Finally, the last step is to configure the vCenter Server and you can use the configureVCSAExtra.sh script noted in this article. The only user configuration that is required is to update the PRIMARY_VC variable in the script to point to the IP Address of your vCenter SSO Server. Here is an example execution:
Once the vCenter Server has successfully started, then you are now done with seperating out the three components of the vCenter Server using the VCSA. You can confirm additionally by logging back into the vCenter SSO Server and run the listServices and you should now see the IP Address or Hostname of your vSphere Web Client Server and vCenter Server being registered to the Lookup Service from the separate VCSA’s. You can now login to the vSphere Web Client server and make sure you specify the full URL which should be https://[hostname-or-ipaddress]:9443/vsphere-client and you should be able to see your vCenter Server.
Note: Steps 3 and 4 can be interchange as the order does not matter, as long as vCenter SSO system is setup first.