Happy New Year (to those who celebrate). Let’s get random.
Those of you who know me well will know I’m a big fan of Debian. I find running manual apt commands on my various Raspberry Pis therapeutic, but an automated approach is probably better. This is a great article on how to configure automated security updates on Debian automatically.
I miss Tru64, and Solaris for that matter. I don’t miss HP-UX. And I definitely won’t miss AIX. Read about the death of Unix over at El Reg – Unix is dead. Long live Unix!
The I3.metal is going away very soon. Remember this is from a sales perspective, VMware is still supporting the I3.metal in the wild, and you’ll still have access to deploy on-demand if required (up to a point).
I (sadly) haven’t touched Rubrik in around a year now, but I couldn’t resist linking to Frederic’s post on Active Directory recovery with Rubrik. Great how-to article as always.
This short, sharp piece from JB is the best. Too often I’ve found myself grinding through a TV show because I had high hopes for it, or so many people told me it was great. What I should have realised is that amateur TV critics (i.e. your friends and colleagues) are often like home theatre enthusiasts who have bought their first subwoofer. Whether it’s good or bad, that’s the choice they made, and they need you to endorse that choice so they can feel better about it as well.
Finally, the blog turned 15 years old recently (about a month ago). I’ve been so busy with the day job that I forgot to appropriately mark the occasion. But I thought we should do something. So if you’d like some stickers (I have some small ones for laptops, and some big ones because I can’t measure things properly), send me your address via this contact form and I’ll send you something as a thank you for reading along.
Whenever I read articles about home Internet connectivity, I generally chuckle in Australian and move on. But this article from Jeff Geerling on his experience with Starlink makes for interesting reading, if only for the somewhat salty comments people felt the need to leave after the article was published. He nonetheless brings up some great points about challenges with the service, and I think the endless fawning over Musk as some kind of tech saviour needs to stop.
In the “just because you can, doesn’t mean you should” category is this article from William Lam, outlining how to create a VMFS datastore on a USB device. It’s unsupported, but it strikes me that this is just the kind of crazy thing that might be useful to folks trying to move around VMs at the edge.
Karen Lopez is a really smart person, and this article over at Gestalt IT is more than just the “data is the new oil” schtick we’ve been hearing for the past few years.
Speaking of Pure Storage, Kyndryl and Pure Storage have announced a global alliance. You can read more on that here.
Mike Preston wrote a brief explainer on S3 Object Lock here. I really enjoy Mike’s articles, as I find he has a knack for breaking down complex topics into very simple to digest and consume pieces.
Remember when the movies and TV shows you watched had consistent aspect ratios? This article from Tom Andry talks about how that’s changed quite a bit in the last few years.
I’m still pretty fresh in my role, but in the future I hope to be sharing more news and articles about VMware Cloud on AWS. In the meantime, check out this article from Greg Vinton, where he covers some of his favourite parts of what’s new in the platform.
In unrelated news, this is the last week to vote for the #ITBlogAwards. You can cast your vote here.
One of the many reasons I like Chin-Fah is that he isn’t afraid to voice his opinion on various things. This article on what enterprise storage is (and isn’t) made for some insightful reading.
VMware Cloud Director 10.3 is now GA – you can read more about it here.
Feeling good about yourself? That’ll be quite enough of that thanks. This article from Tom on Value Added Resellers (VARs) and technical debt goes in a direction you might not expect. (Spoiler: staff are the technical debt). I don’t miss that part of the industry at all.
Speaking of work, this article from Preston on being busy was spot on. I’ve worked in many places in my time where it’s simply alarming how much effort gets expended in not achieving anything. It’s funny how people deal with it in different ways too.
I’m not done with articles by Preston though. This one on configuring a NetWorker AFTD target with S3 was enlightening. It’s been a long time since I worked with NetWorker, but this definitely wasn’t an option back then. Most importantly, as Preston points out, “we backup to recover”, and he does a great job of demonstrating the process end to end.
I don’t think I talk about data protection nearly enough on this weblog, so here’s another article from a home user’s perspective on backing up data with macOS.
Stupid title, but ransomware has been in the news quite a bit recently. I’ve had some tabs open in my browser for over twelve months with articles about ransomware that I found interesting. I thought it was time to share them and get this post out there. This isn’t comprehensive by any stretch, but rather it’s a list of a few things to look at when looking into anti-ransomware solutions, particularly for NAS environments.
It Kicked Him Right In The NAS
The way I see it (and I’m really not the world’s strongest security person), there are (at least) three approaches to NAS and ransomware concerns.
The Endpoint
This seems to be where most companies operate – addressing ransomware as it enters the organisation via the end users. There are a bunch of solutions out there that are designed to protect humans from themselves. But this approach doesn’t always help with alternative attack vectors and it’s only as good as the update processes you have in place to keep those endpoints updated. I’ve worked in a few shops where endpoint protection solutions were deployed and then inadvertently clobbered by system updates or users with too many privileges. The end result was that the systems didn’t do what they were meant to and there was much angst.
The NAS Itself
There are things you can do with NetApp solutions, for example, that are kind of interesting. Something like Stealthbits looks neat, and Varonis also uses FPolicy to get a similar result. Your mileage will vary with some of these solutions, and, again, it comes down to the ability to effectively ensure that these systems are doing what they say they will, when they will.
Data Protection
A number of the data protection vendors are talking about their ability to recover quickly from ransomware attacks. The capabilities vary, as they always do, but most of them have a solid handle on quick recovery once an infection is discovered. They can even help you discover that infection by analysing patterns in your data protection activities. For example, if a whole bunch of data changes overnight, it’s likely that you have a bit of a problem. But, some of the effectiveness of these solutions is limited by the frequency of data protection activity, and whether anyone is reading the alerts. The challenge here is that it’s a reactive approach, rather than something preventative. That said, companies like Rubrik are working hard to enhance its Radar capability into something a whole lot more interesting.
Other Things
Other things that can help limit your exposure to ransomware include adopting generally robust security practices across the board, monitoring all of your systems, and talking to your users about not clicking on unknown links in emails. Some of these things are easier to do than others.
Thoughts
I don’t think any of these solutions provide everything you need in isolation, but the challenge is going to be coming up with something that is supportable and, potentially, affordable. It would also be great if it works too. Ransomware is a problem, and becoming a bigger problem every day. I don’t want to sound like I’m selling you insurance, but it’s almost not a question of if, but when. But paying attention to some of the above points will help you on your way. Of course, sometimes Sod’s Law applies, and things will go badly for you no matter how well you think you’ve designed your systems. At that point, it’s going to be really important that you’ve setup your data protection systems correctly, otherwise you’re in for a tough time. Remember, it’s always worth thinking about what your data is worth to you when you’re evaluating the relative value of security and data protection solutions. This article from Chin-Fah had some interesting insights into the problem. And this article from Cohesity outlined a comprehensive approach to holistic cyber security. This article from Andrew over at Pure Storage did a great job of outlining some of the challenges faced by organisations when rolling out these systems. This list of NIST ransomware resources from Melissa is great. And if you’re looking for a useful resource on ransomware from VMware’s perspective, check out this site.
I covered multi-tenancy with Rubrik some time ago, but things have certainly advanced since then. One of the useful features of Rubrik CDM (and something that’s really required for Envoy to make sense) is the Organizations feature. This is the way in which you can use a combination of LDAP sources, roles, and tenant workloads to deliver a packaged multi-tenancy feature to organisations either within or external to your company. In this article I’ll run through the basics of setting up an Organization. If you’d like to see how it can be applied in a practical sense, it’s worth checking out my post on deploying Rubrik Envoy.
It starts, as these things often do, by clicking on the gear in the Rubrik CDM UI. Select Organizations (located under Access Management).
Click on Create Organization.
You’ll want to give it a name, and think about whether you want to give your tenant the ability to do per-tenant access control.
You’ll want an Org Admin Role to have particular abilities, and you might like to get fancy and add in some additional roles that will have some other capabilities.
At this point you’ll get to select which users you want in your Organization.
And it’s worth thinking about what users and / or groups you’ll be using from that LDAP source to populate your Organization’s user list.
You’ll also need to consider which role will be assigned to these users (rather than relying on Global Admins to do things for tenants).
You can then assign particular resources, including VMs, vApps, and so forth.
You can also select what SLA Domains the Organization has access to, as well as Archival locations, and replication targets and sources. This becomes important in a multi-tenanted environment as you don’t want folks putting data where they shouldn’t.
At this point you can download the Rubrik Envoy OVA, deploy it, and connect it to your Organization.
And then you’re done. Well, normally you would be, but I didn’t select a whole lot of objects in this example. Click Finish and you’re on your way.
Assuming you’ve assigned your roles correctly, when your tenant logs in, he or she will only be able to see and control resources that belong to that particular Organization.
I’ve recently been doing some work with Rubrik Envoy in the lab and thought I’d run through the basics. There’s a new document outlining the process on the articles page.
Why Envoy?
This page explains it better than I do, but Envoy is ostensibly a way for service providers to deliver Rubrik services to customers sitting on networks that are isolated from the Rubrik environment. Why would you need to do this? There are all kinds of reasons why you don’t want to give your tenants direct access to your data protection resources, and most of these revolve around security (even if your Rubrik environment is secured appropriately). As many SPs will also tell you, bringing private networks from a tenant / edge into your core is usually not a great experience either.
At a high level, it looks like this.
In this example, Tenant A sits on a private network, and the Envoy Tenant Network is 10.0.1.10. The Rubrik Routable Network on the Envoy appliance is 192.168.0.201, and the data management interface on the Rubrik cluster is 192.168.0.200. The Envoy appliance talks to tenant hosts over ports 12800 and 12801. The Rubrik cluster communicates with Envoy over ports 7500 and 7501. The only time the tenant network communicates with the Rubrik cluster is when the Envoy / Rubrik UI is used by the tenant. This is accessed over a port specified when the Organization is created (see below), and the Envoy to cluster communication is over port 443.
Other Notes
Envoy isn’t a data mover in its current iteration, but rather a way for SPs to present some self-service capabilities to tenants in a controlled fashion without relying on third-party portals or network translation tools. So if you had a bunch of workloads sitting in a tenant’s environment, you’d be better served deploying Rubrik Air / Edge appliances and then replicating that data into the core. If your tenant has a vCenter environment with a few VMs, you can use the Rubrik Backup Service to backup those VMs, but you couldn’t setup vCenter as a source for the tenant unless you opened up networks between your environments by some other means and added it to your Rubrik cluster. This would be ugly at best.
Note also that the deployment assumes you’re creating an Organization in the Rubrik appliance that will be used to isolate the tenant’s data and access from other tenants in the environment. To get hold of the Envoy OVA appliance and credentials, you need to run through the Organization creation process and connect the Envoy appliance when prompted. You’ll also need to ensure that you’ve configured Roles correctly for your tenant’s environment.
If, for some reason, you need to change or view the IP configuration of the Envoy appliance, it’s important to note that the articles on the Rubrik support site are a little out of step with CentOS 7 (i.e. written for Ubuntu). I don’t know whether this is because I’m using Rubrik Air appliances in the lab, but I think it’s maybe just a shift. In any case, to get IP information, you need to login to the console and go to /etc/sysconfig/network-scripts. You’ll find a couple of files (ifcfg-eth0 and ifcfg-eth1) that will tell you whether you’ve made a boo boo with your configuration or not.
Conclusion
I’m the first to admit it took a little while to understand the utility of something like Envoy. Most SPs struggle to deliver self-service capabilities for services that don’t always do network multi-tenancy very well. This is a good step in the direction of solving some of the problems associated with that. It’s also important to understand that, if your tenant has workloads sitting in VMware Cloud Director, for example, they’ll be accessing Rubrik resources in a different fashion. As I mentioned before, if there is a bit to protect on the edge site, it’s likely a better option to deploy a virtualised Rubrik appliance or a smaller cluster and replicate that data. In any case, I’ll update this post if I come across anything else useful.
This is the second part of the super exciting article “Rubrik CDM Upgrades With Polaris”. In the first episode, I connected my Polaris tenancy to a valid Rubrik Support account so it could check for CDM upgrades. In this post, I’ll be covering the actual update process using Polaris. Hold on to your hats.
To get started, login to Polaris, click on the Gear icon, and select CDM Upgrades.
If there’s a new version of CDM available for deployment, you’ll see it listed in the dashboard. In this example, my test Edge cluster has an update available (5.3.1-p3). Happy days!
You’ll need to get this update downloaded to the cluster you want to install it on first. Click on the ellipsis and select Download.
You can then choose to download the release from Rubrik or locally.
Click on the version you want to download and click Next.
You then get the opportunity to confirm the download. Click on Confirm to do this.
It will then let you know that it’s working on it.
Once the update has downloaded, you’ll see “Ready for upgrade” on the dashboard.
Select the cluster you’d like to upgrade and click on Upgrade.
At this point, you’ll get the option to schedule the upgrade, and select to rollback if the upgrade fails for some reason.
Confirm the upgrade and you’ll be on your way.
Polaris lets you know that it’s working on it.
You can see the progress in the dashboard.
When it’s done, it’s done.
And that’s it. This highlights the utility of something like Polaris, particularly when you’re managing a large number of clusters and need to keep things in tip-top shape.
I decided to break this article into 2 parts. Not because it’s super epic or particularly complicated, but because there are a lot of screenshots and it just looks weird if I put it in one big thing. Should it have been a downloadable article? Sure, probably. But here we are. It’s been some time since I ran through the Rubrik CDM upgrade process (on physical hardware no less). I didn’t have access to Polaris GPS at that time, and thought it would be useful to run through what it looks like to perform platform upgrades via that rather than the CLI. This post covers the process of configuring Polaris to check for CDM updates, and the second post covers deploying those updates to Rubrik clusters.
Login to your Polaris dashboard, click on the Gear icon, and select CDM Upgrades.
Click on Connect to Support Portal to enter your Rubrik support account details. This lets your Polaris instance communicate freely with the Rubrik Support Portal.
You’ll need a valid support account to connect.
If you’ve guessed your password successfully, you’ll get a message at the bottom of the screen letting you know as much.
If you environment was already fairly up to date, you may not see anything listed in the CDM Upgrades dashboard.
And that’s it for Part 1. I can hear you asking “how could it get any more exciting than this, Dan?”. I know, it’s pretty great. Just wait until I run you though deploying an update in this post.
You’ve deployed your Rubrik virtual appliance (technically I should have used Air but let’s just go with it) and now you want to protect a VMware Cloud Director instance. When you add an instance, Rubrik automatically discovers all of the components of your VCD environment, including:
Organizations;
Organization virtual datacenters;
vApps; and
Virtual machines.
You can protect vApps by assigning the SLA Domain at various levels in the VCD hierarchy, and also by assigning it to individual VMs. vApp protection also protects vApp metadata including networks, boot order, and the access list. There are a few limitations with vApp protection to keep in mind as well.
Virtual machines in a vApp
Maximum of 128 virtual machines in a vApp. To protect a vApp with more than 128 virtual machines, use the exclude function to reduce the number protected.
Mounts
The Rubrik cluster performs all mounts for vApps at the virtual machine level.
Backup exclusion
Protection of vApps does not include Cloud Director Object Metadata.
Autodiscovery
Rubrik CDM ignores the Cloud Director auto discovery feature.
There’s good support for multi-tenancy and RBAC as well. There’s a bunch of other stuff I could write about VCD and Rubrik but let’s just get started on adding an instance. Click on the Gear and select “vCD Instances”.
You’ll then have the opportunity to enter your credentials.
I use all dots for my password too.
Once you’ve added the instance you’ll see it listed under “All vCD Instances”.
If you look under “Virtual Machines” you should see any vApps associated with the instance listed under “vCD Apps”. In this example my tenancy only has one vApp deployed.
And that’s it. This all gets a lot more interesting when you start messing about with the Rubrik VCD plug-in and the API, but that’s a story for another time.
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
+
