VCAP6-DCV Deployment – Objective 1.2 – Deploy and Configure Core Management Infrastructure Components 3


Main Study Page

Objectives for 1.2 are broke down as the following

  • Deploy vCenter core components according to a deployment plan:
    • Deploy and Configure a Platform Services Controller (PSC):
      • Determine use case for embedded vs external PSC
      • Re-point a vCenter Server Appliance to another External PSC
    • Deploy and Configure Identity Sources for Single Sign-On:
      • Configure Single Sign-On users and groups
      • Change Default domain for Single Sign-On
      • List services registered with Single Sign-on
    • Deploy and configure vCenter Server
    • Deploy / Configure Enhanced Link Mode
  • Manage / Configure vCenter components according to a deployment plan:
    • Configure Global Permissions for vCenter services
    • Configure Dump Collector service
    • Configure the Syslog Collector / Syslog service
    • Managing vCenter Server advanced configurations

Deploy vCenter core components according to a deployment plan


Deploy and Configure a Platform Services Controller (PSC)

 Platform Services controller was introduced with vSphere 6.  The PSC includes services such SSO, licensing and VMCA, PSCs also replicate information such as licenses, roles and permissions.  PSC can be installed on the same machine with vCenter known as embedded or it can be on its own machine known as external.

Its important to know the support topologies and when to deploy an external PSC or an embedded.

For support topologies see  here

Advantages for embedded deployments include the communication between vCenter and PSC is not across the network, less Windows licenses if using Windows boxes and no need for load balancers.  Advantages for external deployments include support for Enhanced Linked Mode and high availability across multiple PSCs.   Following supported topologies if you are planning more than one vCenter within the site you must use an external PSC.

The following will illustrate the process how to deploy an external PSC as a virtual appliance, one of the opjectives for this section is to re point a vCenter appliance to another external PSC so in this example I am creating a new external PSC with the view to move my running embedded vCenter/PSC.  First download the vCenter appliance and run through the setup.  Point the installation to either an existing vCenter or a ESXi host in my case I use my running vCenter.

vcap1.2-02  vcap1.2-03

Choose a resource pool and give the appliance a name with a local root password

vcap1.2-04  vcap1.2-05

I choose to install an external PSC and join my existing SSO domain

vcap1.2-06  vcap1.2-07

I now need to pick the same SSO site as the embedded vCenter / PSC that I will change, one of the prerequisite to repoint the embedded PSC to an external one is the newly deployed external PSC must be in the same SSO site.

vcap1.2-08

I then choose the required datastore and set the IP information, a DNS record must exist for the IP address

vcap1.2-09  vcap1.2-10

Finish the wizard and monitor the deployment

vcap1.2-11

Now deployed I will move on to re pointing my existing embedded vCenter / PSC.  I SSH onto my existing embedded vCenter / PSC and run the following command and point to the new external PSC.  Note – the identifier for the PSC is case sensitive.

>cmsso-util reconfigure –repoint-psc lab-psc.vjenner.com –username administrator –domain-name vsphere.local -passwd Password123!

vcap1.2-12  vcap1.2-13

An important consideration is the VMCA, although its not listed as an objective at this point its still important, for my lab I have created the VMCA as a subordinate of my Enterprise PKI infrastructure which in turn has provided certificates for vCenter services and ESXi hosts.  By re pointing the PSC means my vCenter now needs its certificates updated again.

I need to update the VMCA on the new external PSC, to do this see my previous post here.  As this is now an external PSC I need to run the following on the vCenter server

>/usr/lib/vmware-vmca/bin/certificate-manager

This time I select option 3 for the machine certificates then option 6 for the user certificates and point to the external PSC when prompted.

When I first run this I get the below error

Error Message : Failed to connect to the remote host

If you get this error you must run the following on the vCenter appliance

>mv /var/lib/vmware/vmca/root.cer /var/lib/vmware/vmca/root.bkp

This renames the root.cer, once renamed I can run options 3 and 6 again.

I am using Update 2 and after I applied the certificates I received a SSO error using the Web Client and the C# client didnt log in at all.  If you have this error re apply the certificates and change the OU to match the relevant service.  See here for more details.


 Deploy and Configure Identity Sources for Single Sign-On

 To check existing identity services open the Web Client – Administration – Single Sign On – Configuration

vcap1.2-14

To add a new identity source select the Add icon and add the relevant details.  Below is an example to add an Active Directory domain

vca15

To make mark an identity source as Default Domain highlight the identity source and select the icon

vcap1.2-15

To list services registered with SSO I run the following command, the following relates to the virtual appliance to run this I need to be logged on to the appliance or connnected via SSH

>/usr/lib/vmidentity/tools/scripts/lstool.py list –url https://lab-psc.vjenner.com:7444/lookupservice/sdk

vcap1.2-16  vcap1.2-17

To run the same command on a Windows box run the following

>”C:\Program Files\VMware\vCenter Server\python\python.exe” “C:\Program Files\VMware\vCenter Server\VMware Identity Services\lstool\scripts\lstool.py” list –url http://localhost:7080/lookupservice/sdk


Deploy and configure vCenter Server

I have a previous post on a vCenter deployment using the virtual appliance here.


Deploy / Configure Enhanced Link Mode

Enhanced Linked Mode links multiple vCenter instances by using one or more PSCs.  This mode replicates roles, permissions and license data across vCenter systems.  You can log in to any linked vCenter instance with a single user name and password and view the inventory of all systems.

You must use the web client for Enhanced Linked Mode and be using vCenter Server Standard license.  In vCenter 5.5 linked mode data was stored and replicated using ADAM but in vCenter 6 this is no longer needed the PSC provides replication.

vcap1.2-18


Manage / Configure vCenter components according to a deployment plan


Configure Global Permissions for vCenter services

To view I open the Web Client – Administration – Access Control – Global Permissions

vcap1.2-19

To add select the Add icon – Users and Groups – Add.  Select an identity source previously added and select the user or group

vcap1.2-20

Then select a role for the user / group

vcap1.2-21


Configure Dump Collector service

The ESXi Dump Collector is installed but not running automatically to start it go to Web Client – System Configuration – Services – VMware vSphere ESXi Dump Collector.  I start the service and mark it as Automatic

autodeploy44


Configure the Syslog Collector / Syslog service

Syslog service can be configured to point to a syslog server on the network  Web Client – System Configuration – Services – VMware Syslog Service.  The syslog collector is also installed with vCenter, on the summary health message it will display the server details and if it is running

vcap1.2-22

If you want to change the local host to a remote central syslog server add the remote server details from the Manage tab

vcap1.2-23


Managing vCenter Server advanced configurations

In advanced settings you can modify the vpxd.cfg – the vCenter Server configuration file.  Browse to Web Client – vCenter Inventory List – vCenter Servers – vCenter – Manage – Advanced Settings

vcap1.2-24

To add a new entry select Edit and add the relevant Key and Value data

vcap1.2-25


Leave a comment

Your email address will not be published. Required fields are marked *

3 thoughts on “VCAP6-DCV Deployment – Objective 1.2 – Deploy and Configure Core Management Infrastructure Components

  • venkatesh

    Hi,

    Thanks for the nice blog and articles. I have a question on Re-point a vCenter Server Appliance to another External PSC.

    I have a Vcenter on a Windows server with embeded PSC. Now I installed PSC on appliance.

    I tried migrating with following commands, but failed.

    msso-util repoint –repoint-psc psc_fqdn_or_static_ip [–dc-port port_number]

    • Kyle jenner Post author

      Hi,

      The command should be cmsso-util reconfigure –repoint (make sure the – is a double – as the formatting on this page removes the second on. Please see the screenshot.

      Thanks
      Kyle