vRA 7.3 High Availability and Load-balancing – Configuration Iteration

These are my concentrated notes on vRA distributed architecture, again there might be a plethora of notes on the Internet around this topic but I find that having a single note that one can revert back to refresh one’s memory is very much needed.

1. FQDNs, create static DNS A records for all appliances and VIPs.
2. A highly available MSSQL setup with MSDTC enabled (allow remote clients/administrator on all) on all cluster nodes, and the service account should have sysadmin rights on the instance.
3. vRA with vRO appliances (2 minimum) -> active/active (load balanced).
4. IaaS Servers:
   1. Don’t clone a base machine as with MSDTC enabled it gets touchy)
   2. Make sure the service account has local admin rights and is configured to run as a service, eventually you will be running the agent installation using this account.
   3. Provide internet access to the VMs unless you want to install JRE and configure %JAVA_HOME% to java installation directory manually where those are part of the installation agent tasks.
   4. You can disable local Windows firewall and UAC, unless you like to re-run the vRA installation more than once :-P.
   5. Personally, I’d keep the patch level on all of these hosts identical.
   6. Web (2 minimum) -> active/active (load balanced).
   7. Agent/DEMs  (2 minimum) -> active/active (provided that the proxy agents configuration is identical on all DEMs).
   8. Managers  (2 minimum) -> active/passive with automatic failover (load balanced).
5. A load balancer:
   1. (NSX or NSX or NSX, or hey you can use a physical load balancing ;-)) and this should be working in one-arm mode (in-line is supported but there is no solid requirement for it).
   2. Sizing for NSX ESG -> Not compact ;-).
   3. 1 VIP for vRA/vRO:
      1. Profile:
         1. HTTPS.
         2. SSL Passthrough.
         3. Source IP persistence with expiry is set to 1800.
      2. Health Monitor:
         1. Interval 3.
         2. Timeout 10.
         3. Max retries 10.
         4. Type HTTPS.
         5. Expected code -> 204
         6. Method -> GET
         7. URL pojnts towards /vcac/services/api/health
      3. Pool:
         1. Algorithm -> RoundRobin.
         2. When adding members use port 443.
         3. Assign the configured health monitor.
   4. 1 VIP for IaaS Managers:
      1. Profile:
         1. HTTPS.
         2. No persistence.
      2. Health Monitor:
         1. Interval 3.
         2. Timeout 10
         3. Max retries 3.
         4. Type HTTPS.
         5. Method -> GET
         6. URL points towards /VMPSProvision
         7. Receive -> ProvisionServer
      3. Pool [1]:
         1. Algorithm -> RoundRobin.
         2. When adding members use port 443.
         3. Assign the configured health monitor.
      4. Pool [2] Remote Console:
         1. Algorithm -> RoundRobin.
         2. When adding members use port 8444 with monitor port set to 443.
         3. Assign the configured health monitor.
   5. 1 VIP for IaaS Web Servers:
      1. Profile:
         1. HTTPS.
         2. SSL Passthrough
         3. Source IP persistence with expiry is set to 1800.
      2. Health Monitor:
         1. Interval 3.
         2. Timeout 10
         3. Max retries 3.
         4. Type HTTPS.
         5. Method -> GET
         6. URL points towards /wapi/api/status/web
         7. Receive -> REGISTERED
      3. Pool:
         1. Algorithm -> RoundRobin.
         2. When adding members use port 443.
         3. Assign the configured health monitor.
6. Installation Wizard (CLICK VALIDATE LIKE YOUR INSTALLATION DEPENDS ON IT ;-)):
   1. Select the deployment type (Enterprise obviously), preferably select install infrastructure as a service.
   2. Configure NTP (super important).
   3. Get the agent’s MSI and install it on all IaaS servers (use the first appliance when prompted for vRA appliance information).
   4. Back to the installation wizard and all installed IaaS servers nodes should be visible.
   5. Choose IaaS servers roles (remember: 2 managers, 2 web, 2 DEM/Agent).
   6. Check prerequisites, fix the installation (again this requires internet access on the IaaS nodes as mentioned before).
   7. vRA Host -> use the VIP for vRA/vRO management.
   8. SSO, set a password for the new vsphere.local domain.
   9. IaaS Host -> use the IaaS Web and IaaS Manager VIPs and use a secure password for the database passphrase.
   10. MSSQL Server -> The listener name for the highly available instance and follow along (depends on whether the database was pre-created or you want to create a new one).
   11. Web Role -> You can either settle for the default web site virtual directory or create a one of your own but it doesn’t have any advantage, also make sure to use the service account which was already configured for local admin and run as a service.
   12. Manager Service Role -> Select whom is going to have active, the passive is determined automatically, also make sure to use the service account which was already configured for local admin and run as a service.
   13. DEMs -> Make sure to use the service account which was already configured for local admin and run as a service.
   14. Agents -> Make sure to use the service account which was already configured for local admin and run as a service, it’s very important here to make sure that the agent name and endpoint name (this isto remember of course) are identical for both hosts. In addition, you can add additional agent configuration for both hosts if you have different vCenter Servers at that point in time.
   15. vRA Certificates -> Either generate a self-signed, or you can use your own signed certificates (certgen tool).
   16. Web Certificate -> Either generate a self-signed, or you can use your own signed certificates (cergen tool).
   17. Manager Certificate -> Either generate a self-signed, or you can use your own signed certificates (cergen tool).
   18. Load Balancers -> Look at the note mentioned and make sure that only the nodes that are shown to you are active on the load balancer and you must have the health monitors disabled (just during the installation).
   19. Validation -> Although we’ve validated things on each and every window, this runs again to validate all settings and will take some time.
   20. Snapshots -> Create snapshots of everything in case this fails in a hectic way and you need to redo everything.
   21. Installation Details -> Hit install, leave it, go watch a movie, eat or anything that would keep you for at least 1 hour away ;-).
   22. Licensing -> Enter the license key.
   23. Telemetry -> To participate or not to participate, it’s your choice.
   24. Post-Installation Options -> Don’t configure initial content, as you will be obviously wanting to create your stuff in your production environment.
   25. Enable the disabled nodes in the load balancer, enabled health monitors and finally MAKE SURE YOU DELETE THE SNAPSHOTS!.

The next thing to continue with the initial configuration to a point where you’re using all components and afterwards what you need to do is to conduct availability testing to make sure that all components behaviours is as expected.

References: https://docs.vmware.com/en/vRealize-Automation/index.html

Thank you,
(Abdullah)^2