vSphere

New Thunderbolt 3 to 10GbE options for ESXi

04/17/2019 by William Lam 11 Comments

With the help from Aquantia, we now have an ESXi driver to enable the built-in 10GbE adaptor for both the Apple 2018 Mac Mini and the iMac Pro. Although this was exciting news for our VMware/Apple customers, I was actually more excited for what this development meant for the larger VMware Community when it comes to 10GbE accessibility.

Many Enterprise customers have already been using Thunderbolt 2/3 to access their 10 Gigabit infrastructure, usually over SFP+ but Ethernet based options also exists such as the Sonnet solution which I had shared last year. This is especially common for VMware customers who virtualize Apple MacOS on vSphere for MacOS/iOS development and the use of Thunderbolt enables ESXi to connect to the underlying storage and networking infrastructure, which traditionally has been either Fibre Channel and/or IP-based storage running over a 10Gig link.

When you start looking at 10GbE accessibility for VMware home labs which could potentially apply to remote office/branch office (ROBO) and Edge/IoT environments, the cost and the complexity of the setup is something that many folks have to consider. There are definitely some creative options out there, most recently Chad Moon shared his solution using a Thunderbolt 3 to PCIe expansion chassis with his Intel NUCs which will run you about $230 per setup or you can be a true hardware hacker like Jack Harvest and use one of the M.2 slots in the Intel Skull Canyon NUC and connect that to PCIe 10GbE SFP+ card with a custom 3D printed chassis to hide everything for just $43.68 🙂

Enhanced vCenter Server Audit Event & Logging in vSphere 6.7 Update 2

04/08/2019 by William Lam Leave a Comment

A couple of years back I had published a detailed analysis on vCenter Server's Authentication (AuthN) and Authorization (AuthZ) from an auditing and logging standpoint. This has been the go to reference for many of our customers and the posts also includes a number of log samples which I have documented in the following Github repository.

In addition to serving as a reference for our customers, it has also helped our Product and Engineering teams understand where we still had some gaps and how we could improve the overall user experience. As hinted in the recently announced vSphere 6.7 Update 2 release, which will be available soon, there are number of new auditing enhancements that have been made to both vCenter Server and the vCenter Single Sign-On (SSO) service that I think customers will really appreciate.

"Real" client IP address in Events

When you look at a login or logout Event in vCenter Server today, you may have noticed the user's client IP Address is actually of the vCenter Server rather than the actual remote client's address and the reason for this is explained here. In vSphere 6.7 Update 2, the real client IP Address is now captured and is included in all successful login/logout and failed logins. This information can now enable administrators to easily identify unauthorized access and be able to quickly track down the systems initiating the connections.

How to immediately refresh the network GuestInfo using VMware Tools?

04/03/2019 by William Lam 1 Comment

We all know the benefits of installing VMware Tools into your guest operating system which also includes additional functionality such as the Guest Operations APIs, allowing administrators to perform operations directly within the guest (credentials required), even if networking is not available. In addition to all these benefits, customers also get better visibility into the guest such as the underlying OS that is actually installed, disk volumes and networking information such as hostname and IP Addresses for the different network interfaces.

I am assuming most of you have seen the VM Summary page in the vSphere UI and if VMware Tools is installed and running, some of the GuestInfo data will be displayed such as networking.

An interesting tidbit that I had learned recently about VMware Tools while working on Instant Cloning Apple MacOS (yup, this works!) is that there is a default polling interval of 30 seconds in which this GuestInfo data is updated. In general, this is not a problem as this type of information does not change frequently and the default should be more than sufficient for most customers.

However, if you are performing an Instant Clone and you are relying on the vSphere API and the GuestInfo data to determine the IP Address of the guest, having to wait up to 30seconds is not ideal, especially since the actual Instant Clone operation completes in just a few seconds. One option is to change the default polling interval, which I have outlined the details in the MacOS Instant Clone article, but rather than changing the default which can add some additional load, there is actually a much simpler solution.

With VMware Tools 10.1 or newer, customers now have a way to immediate initiate a refresh of the networking info, directly from within the guest. This is perfect for the Instant Clone use case where network configuration is applied through a customization script and you can then run the update command afterwards to ensure the GuestInfo data is immediately reflected. Below are the respective commands for each OS type and you will need to have administrator privileges to perform this operation.

Windows:

C:\Program Files\VMware\VMware Tools\VMwareToolboxCmd.exe info update network

Linux:

/usr/bin/vmware-toolbox-cmd info update network

MacOS:

/Library/Application\ Support/VMware\ Tools/vmware-tools-cli info update network

Integrating Github Actions with vSphere and VMware Cloud on AWS

04/01/2019 by William Lam Leave a Comment

I have always been a fan of event-driven automation, the idea where you can automatically trigger a workflow or an operation based on a specific event. In the consumer world, the most popular example is the If This, Then That (IFTTT) service, which I use on a regular basis to automate the sharing of new articles from virtuallyGhetto to different Social Media channels.

For the Enterprise, this is also not a new idea and many folks including myself have been doing this for years in vSphere using vCenter Server Alarms. In fact, one example I still reference on a regular basis is from 2012 where you automatically apply a set of vSphere Security Hardening configurations to a Virtual Machine when a new VM Create Event is published by vCenter.

There are countless more examples of this concept beyond VMware but the general idea is to be able to subscribe to specific events and then automatically do something when a given event occurs. When Github Actions (Beta) was announced last year, I was really interested as I think this could open the door for a ton of interesting possibilities, especially from a VMware perspective around Continuous Integration/Development (CI/CD). I quickly registered for the Beta but did not get access until the start of this year. If you want to know what Github Actions can do, check out some of these demos that have been built by various folks from the community. The really exciting thing about Github Actions is that you can literally execute any workflow as long as you can containerized your business logic within a Docker Container. This means, you can use any language or tool that you are familiar with and make this work with Github Actions, pretty powerful stuff!

It was only recently while working on a personal project, which I hope will make its way to VMworld, that I finally got a chance to dig into Github Actions. I noticed in many of the online Github Action examples, that it included ways to deploy applications and containers to a Public Cloud but there was nothing that I found related to VMware. I figured, this would be a good learning opopournity for myself and I could even learn how to build my own Actions which can be useful for others to use or extend further.

Building your own Virtual Appliances using OVF properties Part 3

03/19/2019 by William Lam 2 Comments

To conclude this three-part blog series, we are now going take a look at reference implementation for building your own Microsoft Windows Virtual Appliance (VA). Similar to the Linux VA build, the Windows OVA will also support the ability to customize basic networking configuration including the use of a static or DHCP option.

In addition, to demonstrate the endless possibilities for building your own VA, I have also included an option to automatically join a Microsoft Active Directory Domain as part of the OVA deployment, which is a fairly common operation after deploying a Windows-based system. In the example below, I am using Windows Server 2016 and PowerShell to perform all the required automation.

Step 1 - Create a new VM in vCenter Server and then install Window Server 2016 using the ISO. Once you have completed the OS installation, you may want to apply any patches or packages that you want included as part of your VA. Once that is done, go ahead and shut down the VM.

Step 2 - Select the VM in the vSphere Inventory and then click on Configure->vApp and then check the Enable vApp Options. Once enabled, select OVF environment for the IP allocation scheme. In the OVF Details tab, select VMware Tools for the OVF environment transport. (Optionally) You can specify some additional metadata including appliance name and URLs to help others who maybe consuming your VA once it has been exported to an OVF/OVA.

Step 3 - Next, add the following 9 OVF properties which will be used as input to configure networking within PhotonOS. Click Add and provide a Label, Key and optional Category.

Label	Key	Category
Hostname	guestinfo.hostname	Networking
IP Address	guestinfo.ipaddress	Networking
Netmask	guestinfo.netmask	Networking
Gateway	guestinfo.gateway	Networking
DNS Server	guestinfo.dns	Networking
DNS Domain	guestinfo.domain	Networking
AD Domain	guestinfo.ad_domain	Active Directory
AD Username	guestinfo.ad_username	Active Directory
AD Password	guestinfo.ad_password	Active Directory

Step 3 - Power back on the VM and once it is available on the network (assuming DHCP), download and copy the sample first boot script customize-guest.ps1 to C:\Users\Administrator\Desktop. This script is where all the magic happens and will process the OVF property input and then configure the network settings and if specified, it will also perform the Active Directory domain join. Right now it assumes the networking fields are optional, meaning if they are left blank, it will default the system to DHCP. If you provide all input properties, then it will go ahead and configure a static network address.

vSphere Tag Attach/Detach events now in VMware Cloud on AWS

03/05/2019 by William Lam 2 Comments

The underlying products (vSphere, vSAN & NSX) that run within VMware Cloud on AWS (VMC) are constantly being improved with new capabilities and enhancements. As a service, VMC is updated more frequently than a traditional on-premise environment and one huge benefit for our customers is that they get to access all the latest and greatest features of the platform!

Yesterday, I came to learn about some improvements that we had made to our vSphere Tagging infrastructure to start publishing vCenter Server Events for when a vSphere Tag is attached or detached from an inventory object such as a Virtual Machine. This has been a frequently requested feature by our customers, especially for auditing purposes and this also enables the ability to perform additional actions through the use of a vCenter Alarm.

In the vSphere UI for a VMC vCenter Server, you can now see these new tagging events by selecting the vCenter Server inventory object and then go to Monitor->Events and filter by "attached tag" or "detached tag".