Containers and VMware

I´ve heard a lot of times in the last months about the containers will replace the virtual machines but nothing could be more untrue.

This kind of conversations come from the lack of knowledge about the different technologies and a bit of misunderstanding about what we can do with VMs or containers.

A container is an isolation unit of the kernel from the kernel subsystem but linked or bound to the same kernel where it was created or run. Nowadays, there are a lot of companies that develop container technologies: Docker, Rocket, Garden, etc.

Now, let´s review about what Docker is explained by VMware as it is the most famous container runtime: "Docker is not a container technology. It uses Libcontainer directly or in conjunction with LXC, libvert, OpenVZ, and others. Docker introduced the idea of creating images out of containers.  These images reside on a layered filesystem.  Each layer consists of a change made to a container.  This allows for quick image updates and downloading of new images.  You can build an image from a container that you created or you can download an existing image, update it and then commit the changes into a new image.  These images can reside locally in a private registry like VMware Harbor or in a publicly available registry, like DockerHub"

So, what's about VMware? how VMware can help in this new container technology wave? One of the best approach is join the best of both worlds: VMs and Containers.

In the next image you can see the stack for VMware: storage VSAN, network NSX, hypervisor vSphere, containers VCH and mgmt with vRealize... at the end operations an developer world fits into the same datacenter.  

To accomplish that, VMware had developed different open-source projects. You can find all of them in Github: Admiral, Harbor and vSphere Integrated Containers:

vSphere Integrated Containers (VIC) is the add of three components: Engine, Harbor and Admiral.

Admiral is the container management portal.

Harbor is the container registry for containers.

https://github.com/vmware/admiral

https://github.com/vmware/harbor

 https://github.com/vmware/vic

An important piece of VIC is Photon: "an OSS based linux container host runtime optimized for VMware vSphere"  https://vmware.github.io/photon/ 

How all this projects fits together? check this schema to understand how: VIC Engine + Admiral + Harbor

At the end of the day, what you will get is that with VIC containers will be created in vSphere as  virtual machines so you will be able to apply most of the features in vSphere to them (functions, monitoring, automation, security, networking, etc) in a transparent fashion for the developers as they will continue to use API to create containers, apps, and so on.  You win visibility of the container environment as VMs, which is critical to manage a infrastructure.

Last but least, just to clarify, "vSphere Integrated Containers is available to all vSphere 6.0 and above Enterprise Plus customers. There is no additional license subscription required to use vSphere Integrated Containers. You can download it from myvmware.com"

Microsegmentación con Firewall Distribuido de NSX (DFW)

Revisemos primero los tipos de FW que disponemos:

-Fisicos: aunque aun son necesarios, los cortafuego perimetrales tienen limitaciones sobre el ancho de banda que pueden gestionar asi como la carga de analisis que obliga a una escalabilidad horizontal compleja y que aumenta la complejidad del entorno.

-Virtuales, mismo servicio que los fisicos pero en formato virtual, son un buen complemento para los FW fisicos aunque estan limitados a una mdia de 1 y 4 Gb de ancho de banda.

-Distribuidos: son el complemento perfecto para los fw fisicos en un entorno de vSphere. EL FW de NSX esta basado en el rendimiento del kernel del hypervisor (ESXi), permiten una gran escalabilidad horizontal muy agil y que no implica aumentar la complejidad del entorno y que permite un ancho de banda de hasta 20Gbps por host.

Gracias al nuevo paradigma que presentan los servicios distribuidos de NSX, como en este caso el de FW,  es posible plantear otros escenarios a donde las capas de los servicios fisicos tradicionales no estaban llegando, en este caso, el esquema de firewall perimetral se amplia a un esquema de una relacion 1:1 entre VM y FW como vemos en al siguiente imagen:

De la idea anterior nace el concepto de "microsegmentación": el trafico se inspecciona ahora en las tarjetas de las maquinas virtuales a nivel de capa 2, 3 y 4 gracias a NSX.

Ademas permite integración con soluciones de terceros que aumentan la capacidad de analisis de las aplicaciones como de capa 7.

Por ultimo es importante destacar que si la VM se mueve de host hypervisor (ESXi), las reglas de esta VM se van con ella, y no es necesario ningun tipo de reconfiguracion con lo que es 100% compatible con las tecnicas de asignacion dinamica de recursos (DRS) y de caracteristicas como HA de VMware para dotar de alta disponibilidad a las maquinas virtuales. 

La microsegmentacion nos permite aislar y segmentar las aplicaciones de diferentes formas como podemos ver en la siguiente imagen:

Rendimiento del Firewall Distribuido (DFW) de NSX

En los siguientes post, desmontaremos algunos de los mitos que existen sobre el rendimiento y la visibilidad de operaciones que existen relacionadas con NSX, en este caso nos centraremos el el rendimiento del cortafuegos implementado por NSX.

Una buena metrica para analizar el rendimiento del DFW de NSX; es medir las conexiones por segundo que puede alcazar un firewall con un numero determinado de reglas.

En el siguiente grafico vemos como incluso con 100 reglas de firewall por host se alcanzan sin problemas las 80.000 conexiones por segundo.

En la siguiente gráfica podemos observar como apenas hay perdida de rendimiento incluso cuando se transmiten 20Gbps a través de un solo host (con dos enlaces de 10 Gbps)

Es importante tener en cuenta que con el DFW (Firewall Distribuido de NSX) la carga que debe soportar y gestionar cada FW es el de las VMs que residen en ese host o del trafico que se envia y/o recibe en un solo host; a diferencia de los FW fisicos tradicionales que tienen que soportar el trafico de todo el entorno tanto fisico como virtual ya que son un punto único de filtrado de trafico. Esto ademas obliga a que el trafico circule por toda la ed hasta llegar la FW fisico, en cambio con el DFW de NSX, se llega al extremo de que si el trafico es entre VMs ubicadas en el mismo no host no tengan ni que salir del host para comunicarse entre ellas.

Ademas, la posibilidad de combinar las vRealize Automation (vRA) con NSX, nos permite implementar las aplicaciones y los servicios de forma muy ágil y flexible:

-implementaciones de aplicaciones multinivel en redes aisladas.

-implementaciones de VMs en redes planas.

-implementaciones de reglas para aplicaciones que se apliquen en el momento de su activación.

-implementar servicios combinados de FW y LB o VPNs

How to revert ESXi to a previous version

In case you need to revert your ESXi to a previous version, there is an option to do that trough the DCUI (Direct Console User Interface):

1. In the console screen of the ESXi host, press Ctrl+Alt+F2 to see the Direct Console User Interface (DCUI) screen.
2. Press F12 to view the shutdown options for the ESXi host.
3. Press F11 to reboot.
4. When the Hypervisor progress bar starts loading, press Shift+R. You will see the warning:
   Current hypervisor will permanently be replaced
   with build: X.X.X-XXXXXX. Are you sure? [y/n]
5. Press Y to roll back the build.
6. Press Enter to boot.

Don´t forget to backup your configuration before the revert.

VMworld San Francisco 2015: resumen

En este post podréis leer un resumen de las novedades y tendencias presentadas en el pasado VMworld 2015 SF (USA) cortesía de Jose M. Maldonado (Global Solutions Consultant en VMware.) @maldonjo

DevOps y contenedores

VMware Integrated Containers - Permite la ejecución de aplicaciones en contenedores directamente sobre la infraestructura vSphere o en vCloud Air, haciendo uso de las mismas capacidades y procesos actualmente existentes. Actualmente en fase beta podrá comenzar a probarse a finales de año de cara a usar el propio vSphere como un host para Docker. Permite que los desarrolladores utilicen sus herramientas Docker preferidas e IT soporte los servicios con la misma disponibilidad y flexibilidad como hasta ahora, pudiendo gestionarlos directamente desde vCenter.

• Niveles de servicio garantizados, permite que los contenedores se comporten como máquinas virtuales: DRS, vMotion, HA/DR … minimizando el tiempo de indisponibilidad planificado.
• Utiliza las capacidades de Instant Clone para levantar nuevas VMs para ejecutar contenedores en base a las necesidades o el orquestado del servicio
• Integrable con el ecosistema de soluciones: Cloud Foundry, CoreOS, Tectonic, Docker, Kuebernetes, Mesosphere DC Operating System, …
• Garantiza la seguridad, aislamiento y autenticidad de los contenedores arrancando cada uno en una VM de forma eficiente gracias al vSphere Instant Clone
• Si se requiere almacenamiento y persistencia de datos, se podrán desplegar volúmenes de datos asociados a contenedores sobre plataforma vSphere.
• Comunicación granular gracias a NSX, pudiendo aplicar configuraciones en base a políticas a cada uno de los contenedores por separado

VMware Photon Platform - Es una plataforma optimizada para la ejecución de contenedores con gestión basada en APIs, compuesta por dos elementos:

• Máquinas Photon: Son los hosts de computación, sencillos, horizontalmente escalables y fácilmente reemplazables, con un "microvisor" basado en ESXi y un sistema operativo Linux optimizado para la ejecución de contenedores
• Controlador Photon: Controlador de hosts y orquestador de cargas de trabajo con un plano de gestión distribuido y multi-tenant

CONTINUAR... 

vRealize Operations Manager 6: How to create Projects

vRealize Operations Manager 6 - Part V - Create Custom Groups with vSphere Tags

One of the best vROps (old vCOps) features is the option to create custom groups where you can define the criteria membership and apply a policy rule to them.

There is a lot of environments where the Virtual Machines are not properly configured and defined, with the vSphere Folders or inventory VM names, no naming convention, etc.... 

Is here where the "vSphere Tags" win the game! You can easily tag your VMs!  ..use PowerCLI!!!! (next post incoming)

Imagine that you need to create a policy rule and a Custom Group but your VMs in vSphere are not organized...  Are you thinking in add one-by-one to a Custom Group? and what if tomorrow you add new VMs? ...manually adding Vms is not a good idea, so try to tag your VMs when you create it on the vSphere environment and keep it updated with your CMDB database.

But, how to tag your environment properly?  First of all, you "must" have clear the tags you want to add and how to categorize it.  Just an example, filter you DDBB Vms  (SQL, Oracle, MongoDB, etc) or filter by App Vms, or Bckp environment, or AV environment... and so on.....

Once you have your VMs tagged, you can create a custom group as shown below:

See previous Part I    -vRealize Operations Manager 6 - Part I - OVA deployment

See previous Part II   - vRealize Operations Manager 6 - Part II - Express Installation

See previous Part III  - vRealize Operations Manager 6 - Part III - Manage Solution

See previous Part IV  - vRealize Operations Manager 6 - Part IV -  How import LDAP users

Related with:  VMware vSphere: how to create tags - Part I

http://virtualshocks.blogspot.com.es/2015/04/vmware-vsphere-how-to-create-tags-part-i.html

VMware vSphere: how to create tags - Part II with PowerCLI

On the Part I post we learn how to add a Tag and a Category trough the GUI interface with vSphere Web Client, now, let´s take a look about how to do it with PowerCLI.

Remember that Tags are a new feature available from vSphere 5.1 and the cmdlets are available from PowerCLI 5.5, so, we need at least a vCenter on vSphere 5.1 and the PowerCLI 5.5 installed but much better use las version PowerCLI 6 (not all cmdlets are present in PowerCLI 5.5 initial release)

Use this to verify the version you have installed: 

PowerCLI C:\> Get-VIToolkitVersion

Now with the New-Tag we can review the Tags configured, and with "New-TagCategory" create a Category and after with "New-Tag" the Tag

Now, we are ready to assign Tags to objects, in this case to Virtual Machine:

It´s time to verify it trough Web Client:

Something i didn´t mention jet, is that you can assign multiple Tags to an objet in vSphere , in our case to a Virtual Machine. It means that you can for example tag a VM with the "DDBB_tag" because it´s a SQL DDBB, and Tag it with "Cluster_tag" because it´s a Microsoft Cluster, or with another tag like "Test_tag" because it´s a DDBB SQL Cluster from the Lab Environment.

Why multiple Tags? For vROps it will be useful to create custom groups using different Tags criteria and fix different policies if its a VM from DDBB servers, or if its a VM from Lan Environment..... one VM could be placed in different Custom Groups at the same time :-)

First Part of this post: VMware vSphere: how to create tags - Part I

http://virtualshocks.blogspot.com.es/2015/04/vmware-vsphere-how-to-create-tags-part-i.html

VMware vSphere: how to create tags - Part I

What is a tag?

A tag is a label that you can apply to objects in the vSphere inventory. Tags allow you to attach metadata to objects to make them more sortable and searchable.

Tags are grouped into categories, which define how the tags can be applied to inventory objects.

What is a category?

A category groups together related tags in the vCenter Server inventory.

When you create a category, you specify whether multiple tags in that category can be assigned to a given object at one time, or whether only one tag can be assigned to an object at a time. For example, a category called Priority might contain the tags High, Medium, and Low, and be configured to allow only one tag in the category to be applied to an object at a time.

You also specify whether tags in a category can be applied to all objects, or only to specific object types, such as hosts or datastores.

...yes, this is just a Copy&Paste from the original explanation from tags and categories on the VMware documentation....but i´m sure that no one read it...or at least...just a few docu-addicts :-)

Once we have a crystal clear the idea about what Tags and Category are....let´s show how to create them:

continue reading....

VMware NSX Part I: Deployment

First steps with VMware Network Virtualization aka NSX:

-OVA deployment

-NSX connection to vCenter Server

vRealize Operations Manager 6 - Part IV - How import LDAP users

See previous Part I - vRealize Operations Manager 6 - Part I - OVA deployment

See previous Part II- vRealize Operations Manager 6 - Part II - Express Installation

See previous Part III  - vRealize Operations Manager 6 - Part III - Manage Solution

vRealize Log Insight - Part II - First Configuration

Se more at:  vRealize Log Insight - Part I - OVA deployment

vRealize Log Insight - Part I - OVA deployment

See more at: vRealize Log Insight - Part II - First Configuration

vRealize Operations Manager 6 - Part III - Manage Solution

Video about how to Manage solution  or how to add vCenters to vROps monitoring


See previous Part I - vRealize Operations Manager 6 - Part I - OVA deployment
See previous Part II- vRealize Operations Manager 6 - Part II - Express Installation

vRealize Operations Manager 6 - Part I - OVA deployment

See next step Part II  - vRealize Operations Manager 6 - Part II - Express Installation
See next step Part III - vRealize Operations Manager 6 - Part III - Manage Solution

.

vRealize Operations Manager 6 initial deployment

vRO is finally here (old vCOps). There is a lot of changes in the new GA so try to review the releases notes and the new documentation:

https://www.vmware.com/support/vrops/doc/vrops-60-release-notes.html

https://www.vmware.com/support/pubs/vrealize-operations-manager-pubs.html

There is a new sizing guide with 4 new sizes from Extra-Small to Large 
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2093783

The main different with the las releases is that right now there is only one VM instead the older 2 VM in the the vApp version.

The first screen when you deploy the new vRO6 is a new helpfully wizard for an Express Installation, a New Installation(clustering) or Expand an Existing Installation adding new nodes:

CONTINUAR

Virtualizar un AD de Microsoft en VMware

Antes de virtualizar un dominio se debe tener en cuenta una serie de punto para evitar un comportamiento erratico de las fuciones de DC, especialmente en un Windows 2003 y 2008. 

Sin lugar a dudas, la mejor solucion es crear nuevos servidores "from scratch" (desde cero) y mover los roles y/o funciones del mismo. Ademas esto nos servira para actualizarnos de version de sistema operativo.... Windows 2003 termina soporte en 2015.

Todo esto cambia en Windows 2012 ya que Microsoft ha generado una nueva caracteristica llamada "VM-Generation ID" que permiote el clonado de AD evitando los problemas de roll-back de USN cuando una maquina virtual se revierte de una snapshot.

Esto tambien requiere que el hypervisor pueda generar un ID que exponga a la maquina virtual (VMware lo soporta desde las versiones vSphere 5-0 Update 2 (nivel de update que debe cumplir tanto en vCenter como en ESXi)

 

     Y que hay sobre la proteccion para un Disaster Recovery? Pues lo mejor es utilizar herramientas nativas de replicacion de AD y disponer de algun DC secundario en el site de recovery. SRM tambien es una opcion de proteccion pero teniendo siempre en cuenta una serie de puntos que se describen a partir del punto 4.4 del documento "Virtualizing Active Directory Domain Services On VMware vSphere"  

Must read Links:

• Virtualizing Active Directory Domain Services On VMware vSphere
• Microsoft Product Lifecycle Search
• Things to consider when you host Active Directory domain controllers in virtual hosting environments
• Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100)
• Virtualized Domain Controller Technical Reference (Level 300)

PowerCLI 5.8r1 new poster

Special thanks to Daniel Graf @vTagion for share this new PowerCLI 5.8r1 poster :-)

http://blogs.vmware.com/PowerCLI/2014/10/powercli-5-8r1-reference-poster-now-available.html

VMware logs locations

vSphere Suite

vCenter Server (formerly VirtualCenter Server):

• Location of vCenter Server log files (1021804)
• Location of vCenter Inventory Service log files (2056632)
• Location of vSphere Profile-Driven Storage log files (2056646)
• Location of vCenter Single Sign-On log files for vCenter Server 5.1 and 5.5 (2033430)
• Collecting diagnostic information for the vSphere Client or VMware Infrastructure Client (1003687)
• Location of vSphere Web Client service logs (2004090)
• Locating logs for VMware vSphere Update Manager 5.0 (2038036)

ESX(i):

• Location of vSphere ESXi Dump Collector log files (2003277)
• Location of ESX 3.0-4.1 log files (1021800)
• Location of ESXi 3.5-4.1 log files (1021801)
• Location of ESXi 5.0 log files (2004201)
• Location of ESXi 5.1 and 5.5 log files (2032076)

vSphere Data Recovery:

• Location of VMware Data Recovery (VDR) log files (1022680)

vSphere Storage Appliance:

• Location of vSphere Storage Appliance log files (2003547)

Site Recovery Manager

• Location of Site Recovery Manager log files (1021802)

vCloud Suite

vCloud Director:

• Location of vCloud Director log files (2021435)
• Overview of Lab Manager log files (1011478)

vShield/vCloud Networking and Security (vCNS):

• Overview of vShield logs (1026255)
• Obtaining logs and information needed for VMware vShield products (2012760)

VMware vCloud Automation Center 6.x:

• Log locations in VMware vCloud 6.x Suite (2074803)

vCenter Orchestrator:

• Location of vCenter Orchestrator log files (1010956)

Desktop Computing

View and Horizon View:

• Location of VMware View log files (1027744)

Horizon Mirage (formerly Mirage):

• Location of VMware Horizon Mirage log files (2046069)

VMware Workstation:

• Collecting diagnostic information for VMware Workstation (1346)

VMworld 2014 Europe: interview with Martin Casado = NSX