Random Short Take #71

Welcome to Random Short Take #71. A bit of home IT in this one. Let’s get random.

VMware Cloud on AWS – TMCHAM – Part 3 – SDDC Lifecycle

In this episode of Things My Customers Have Asked Me (TMCHAM), I’m going to delve into some questions around the lifecycle of the VMware-managed VMware Cloud on AWS platform, and what customers need to know to make sense of it all.

 

The SDDC

If you talk to VMware folks about VMware Cloud on AWS, you’ll hear a lot of talk about software-defined data centres (SDDCs). This is the logical construct in place that you use within your Organization to manage your hosts and clusters, in much the same fashion as you would your on-premises workloads. Unlike most on-premises workloads, however, the feeding and watering of the SDDC, from a software currency perspective, is done by VMware.

Release Notes

If you’ve read the VMware Cloud on AWS Release Notes, you’ll see something like this at the start:

“Beginning with the SDDC version 1.11 release, odd-numbered releases of the SDDC software are optional and available for new SDDC deployments only. By default, all new SDDC deployments and upgrades will use the most recent even-numbered release. If you want to deploy an SDDC with an odd-numbered release version, contact your VMware TAM, sales, or customer success representative to make the request.”

Updated on: 5 April  2022

Essential Release: VMware Cloud on AWS (SDDC Version 1.18) | 5 April 2022

Optional Release: VMware Cloud on AWS (SDDC Version 1.17) | 19 November 2021

Basically, when you deploy onto the platform, you’ll usually get put on what VMware calls an “Essential” release. From time to time, customers may have requirements that mean that they qualify to be deployed on an “Optional” release. This might be because they have a software integration requirement that hasn’t been handled in 1.16, for example, but is available for 1.17. It’s also important to note that each major release will have a variety of minor releases as well, depending on issues that need to be resolved or features that need to be rolled out. So you’ll also see references to 1.16v5 in places, for example.

Upgrades and Maintenance

So what happens when your SDDC is going to be upgraded? Well, we let you know in advance, and it’s done in phases, as you’d imagine.

[image courtesy of VMware]

You can read more about the process here. VMware also does the rollout of releases in waves, so not every customer has the upgrade done at the same time. If you’re the type of customer that needs to be on the latest version of everything, or perhaps you have a real requirement to be near the front of the line, you should talk to your account team and they’ll liaise with the folks who can make it happen for you. When the upgrades are happening, you should be careful not to:

  • Perform hot or cold workload migrations. Migrations fail if they are started or in progress during maintenance.
  • Perform workload provisioning (New/Clone VM). Provisioning operations fail if they are started or in progress during maintenance.
  • Make changes to Storage-based Policy Management settings for workload VMs.

You should also ensure that there is enough storage capacity (> 30% slack space) in each cluster.

How Long Will It Take?

As usual, it depends. But you can make some (very) rough estimates by following the guidance on this page.

Will My SDDC Expire?

Yes, your SDDC version will some day expire. But it will be upgraded before that happens. There’s a page where you can look up the expiration dates of the various SDDC releases. It’s all part of the lifecycle part of the SDDC lifecycle.

Correlating VMware Cloud on AWS with Component Releases

Ever found yourself wondering what component versions are being used in VMware Cloud on AWS? Wonder no more with this very handy reference.

 

Conclusion

There’s obviously a lot more that goes on behind the scenes to keep everything running in tip-top shape for our customers. All of this talk of phases, waves, and release notes can be a little confusing if you’re new to the platform. Having worked in a variety of (managed and unmanaged) service providers over the years, I do like that VMware has bundled up all of this information and put it out there for people to check out. As always, if you’ve got questions about how the various software integrations work, and you can’t find the information in the documentation, reach out to your local account team and they’ll be able to help.

Random Short Take #70

Welcome to Random Short Take #70. Let’s get random.

VMware Cloud on AWS – TMCHAM – Part 2 – VCDR Notes

In this episode of “Things My Customers Have Asked Me” (or TMCHAM for short), I’m going to dive into a few questions around VMware Cloud Disaster Recovery (VCDR), a service we offer as an add-on to VMware Cloud on AWS. If you’re unfamiliar with VCDR, you can read a bit more about it here.

VCDR Roles and Permissions

Can RBAC roles be customised? Not really, as these are cascaded down from the Cloud Services hub. As I understand it, I don’t believe you have granular control over it, just the pre-defined, default roles as outlined here, so you need to be careful about what you hand out to folks in your organisation. To see what Service Roles have been assigned to your account, in the VMware Cloud Services, go to My Account, and then click on My Roles. Under Service Roles, you’ll see a list of services, such as VCDR, Skyline, and so on. You can then check what roles have been assigned. 

VCDR Protection Groups

VCDR Protection Groups are the way that we logically group together workloads to be protected with the same RPO, schedule, and retention. There are two types of protection group: standard-frequency and high-frequency. Standard-frequency snapshots can be run as often as every 4 hours, while high-frequency snapshots can go as often as every 30 minutes. You can read more on protection groups here. It’s important to note that there are some caveats to be aware of with high-frequency snapshots. These are outlined here.

30-minute RPOs were introduced in late 2021, but there are some caveats that you need to be aware of. Some of these are straightforward, such as the minimum software levels for on-premises protection. But you also need to be mindful that VMs with existing vSphere snapshots will not be included, and, more importantly, high-frequency snapshots can’t be quiesced.

Can you have a VM instance in both a standard- and high-frequency snapshot protection group?  Would this allow us to get the best of both worlds – e.g. RPO could be as low as 30 minutes, but with a guaranteed snapshot of 4 hours?  Once you do a high-frequency snap on a VM, it keeps using that mechanism thereafter, even if it sits in a protection group using standard protection. Note also that you set a schedule for a protection group, so you can have snapshots running ever 30 mins and kept for a particular period of time (customer selects this). You could also run snapshots at 4 hours and keep those for a period of time too. While you can technically have a VM in multiple groups, what you’re better off doing is configuring a variety of schedules for your protection groups to meet those different RPOs.

Quiesced Snapshots

What happens to a VM during a quiesced state – would we experience micro service outages? The best answer I can give is “it depends”. The process for the standard, quiesced snapshot is similar to the one described hereThe VM will be stunned by the process, so depending on what kind of activity is happening on the VM, there may be a micro outage to the service.

Other Considerations

The documentation talks about not changing anything when a scheduled snapshot is being run – how do we manage configuration of the SDDC if jobs are running 24/7?  Seems odd that nothing can be changed when a scheduled snapshot is being run? This refers more to the VM that is being snapped. i.e. Don’t change configs or make changes to the environment, as that would impact this VM. It’s not a blanket rule for the whole environment. 

Like most things, success with VCDR relies heavily on understanding the outcomes your organisation wants to achieve, and then working backwards from there. It’s also important to understand that this is a great way to do DR, but not necessarily a great way to do standard backup and recovery activities. Hopefully this article helps clarify some of the questions folks have around VCDR, and if it doesn’t, please don’t hesitate to get in contact.

VMware Cloud on AWS – TMCHAM – Part 1 – PCI DSS

I’m starting a new series on the blog. It’s called “Things My Customers Have Asked Me” (or TMCHAM for short). There are frequently occasions where the customer collateral I present on VMware Cloud on AWS doesn’t cover every single use case that my customers are interested in, or perhaps it doesn’t dive deeply enough into some of the material people would like to know more about. The idea behind these posts is that if I have one customer asking about this stuff, chances are another one might like to know about it too. I won’t be talking about internal-only stuff, or roadmap details in these posts (or anywhere publicly, for that matter), but hopefully these articles will be a useful point of information consolidation for folks who are into that sort of thing.

 

PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is the security standard adhered to by organisations handling credit card information from the major card vendors. You can find the official Attestation of Compliance (AoC) in the VMware Cloud Trust Center, and there’s also a comprehensive whitepaper here.

Getting Started on VMware Cloud on AWS

The capability was covered in March 2021, and you can see some of the details in the VMware Cloud on AWS Release Notes. You can also read my learned colleague Greg Vinton’s take on it here, and there’s a YouTube video for people who prefer that sort of thing. To enable PCI compliance on your Organization, you need to request the capability via your VMware account team. It’s not just something that’s configured by default, as some of the requirements around PCI DSS might be considered an unnecessary overhead by some folks. The account team will get it enabled on your Organization, and you can then deploy your SDDC. It’s important to note that your Organization needs to be empty – PCI DSS can’t be enabled on an Organization with SDDCs that are already deployed.

Configuration Changes

There are a number of configuration changes needed to ensure that your SDDC is PCI-compliant too. This includes disabling add-on services like HCX and Site Recovery. To do this, go to Inventory – Settings, and scroll down to Compliance Hardening.

Note that you’ll only see the “Compliance Hardening” section if your Organization has been configured for PCI DSS compliance. You’ll need to finish your HCX migrations before your Organization is compliant. You’ll also need to change your NSX configuration (Network & Security Tab Access). There is some more info on that here and there’s a blog post that also runs through it step by step that you can read here. Note that you’ll need to use the API to change the local NSX Manager user password every 90 days. Information on that can be found here.

Other Considerations

One final thing to note is that this process doesn’t automatically make your Virtual Machines PCI compliant. You’ll still need to ensure that you’ve done the work in that respect. And I can’t repeat this enough – your Organization will only pass a PCI audit if you’ve done these additional steps. Merely requesting that VMware enable this at an Organization level won’t be enough.

Random Short Take #69

Welcome to Random Short Take #69. Let’s get random.

VMware Cloud on AWS – A Few Notes

If you’ve been following along at home, you may have noticed that the blog has been a little quiet recently. There were a few reasons for that, but the main one was that I joined VMware this year as a Cloud Solutions Architect focussed on VMware Cloud on AWS. It’s an interesting role, and an interesting place to work. I’ve been busy onboarding and thought I’d share some brief notes on VMware Cloud on AWS. I still intend to talk about other things on this blog too, but figured this has been front of mind for me recently, and it might be useful to someone looking to find out more. If you have any questions, or want to know more about something, I’m happy to help where I can. And it doesn’t need to be a sales call.

 

Overview

In short, VMware Cloud on AWS is “an integrated cloud offering jointly developed by Amazon Web Services (AWS) and VMware.” The idea is that you run VMware’s SDDC stack on AWS bare metal hosts and enjoy the best of both worlds – VMware’s software and access to a broad range of AWS services. I won’t be covering too much of the basics here, but you can read more about it on the product website. I do recommend checking out the product walkthroughs, as these are a great way to get familiar with how the product behaves. Once you’ve done that, you should also check out the solutions index – it’s a great collection of information about various things that run on VMware Cloud on AWS, including things like SQL performance, DNS configuration, and stuff like that. Once you’ve got a handle on the platform and some of the things it can do, it’s also worth running through the Evaluation Guide. This will give you the opportunity to perform a self-guided evaluation of the platform’s features and functionality. There’s also a pretty comprehensive FAQ that you can find here.

 

Hardware

Node Types

There are 2 types of nodes available at this time: i3.metal and i3en.metal. The storage for nodes is provided by VMware vSAN.

i3.metal i3en.metal
Intel Xeon Broadwell @ 2.3GHz, 36 Cores (Hyper-Threading Disabled) Intel Xeon Cascade Lake @ 2.5GHz, 48 Cores (Hyper-Threading enabled providing 96 Cores)
512 GiB RAM 768 GiB RAM
10 TiB NVMe (RAW) 45 TiB NVMe (RAW)
High IOPS High IOPS, High Bandwidth

Custom Core Counts

One of the neat things is support for custom core counts on a per-cluster basis. You still pay full price for the hosts, but the idea is that your core licensing for BigDBVendor, or whatever, is under control. Note that you can’t change this core count once your hosts are deployed.

Other Cool Features 

Elastic DRS lets you expand your SDDC as required, based on configured thresholds for CPU, RAM, and storage. You can read more about that here.

 

Configuration Backups

If you’re using HCX, you might want to back up your HCX Manager. You can read more on that here. There’s also a VMware Fling that provides a level of SDDC import / export capability. You can check that out here. (Hat tip to my colleague Michael for telling me about these).

 

Sizing It Up

If you’re curious about what your current on-premises estate might look like from a sizing perspective, you can run it through the online sizing tool. This has a variety of input options, including support for RVTools imports. It’s fairly easy to use,  but for complex scenarios I’d always recommend you get VMware or a partner involved. Pricing for the platform is also publicly available, and you can check that out here. There are a few different ways to consume the platform, including 1-year, 3-year, and on-demand options, and the discounting levels vary according to the commitment.

Note that there are a number of other capabilities sold separately, including:

  • VMware Site Recovery
  • VMware Cloud Disaster Recovery
  • VMware NSX Advanced Firewall
  • VMware vRealize Automation Cloud
  • VMware vRealize Operations Cloud
  • VMware vRealize Log Insight Cloud
  • VMware vRealize Network Insight Cloud
  • VMware Tanzu Standard

 

Lifecycle

One of the things I like about VMware Cloud on AWS is that the release notes for the platform are publicly available, and provide a great summary of new features as they get rolled out to customers.

 

What Now?

I’ve barely scratched the surface of what I’d like to talk about with VMware Cloud on AWS, and I hope in the future to post articles on some of the stuff that gets me excited, like migration options with HCX, and using VMware Cloud Disaster Recovery. In the meantime, the team (it’s mainly Greg doing the hard work, if I’m being honest) is running a series of webinars next week. If you’re interested in VMware Cloud on AWS and want to know more, you could do worse than checking these out. Details below, and registration is here.

Design and Deploy a VMware Cloud on AWS SDDC
28 February 2022, Monday
9:30am IST | 12:00pm SGT | 1:00pm KST | 3:00pm AEDT
Join us as we walk through the process of Architecting and Deploying a VMware Cloud on AWS SDDC. We will cover: SDDC sizing for an application, sizing of the management CIDR block, connectivity design, VPN vs direct connect, basic networking and dependencies
Application Migration to VMC on AWS

1 March 2022, Tuesday
9:30am IST | 12:00pm SGT | 1:00pm KST | 3:00pm AEDT
In this session we will demonstrate the process of migrating a live application. Topics include: walk through the HCX architecture, HCX deployment process, HCX configuration, extending an L2 network, mobility (location) aware networking, migration types – conversation
Disaster Recovery – Protecting VMC on AWS or On-Prem Based Applications

2 March 2022, Wednesday 
9:30am IST | 12:00pm SGT | 1:00pm KST | 3:00pm AEDT
Listen to experts demonstrate the process of Architecting and Deploying a VMware Cloud Disaster Recovery (VCDR), with VMC on AWS to protect an application. We will cover: walk through the VCDR architecture, VCDR deployment process, considerations around VCDR, building a protection group, building a DR plan, executing DR and discuss failback options

VMware – VMworld 2017 – STO3194BU – Protecting Virtual Machines in VMware Cloud on AWS

Disclaimer: I recently attended VMworld 2017 – US.  My flights were paid for by ActualTech Media, VMware provided me with a free pass to the conference and various bits of swag, and Tech Field Day picked up my hotel costs. There is no requirement for me to blog about any of the content presented and I am not compensated in any way for my time at the event.  Some materials presented were discussed under NDA and don’t form part of my blog posts, but could influence future discussions.

Here are my rough notes from “STO3194BU – Protecting Virtual Machines in VMware Cloud on AWS”, presented by Brian Young and Anita Thomas. You can grab a PDF copy of my notes from here.

VMware on AWS Backup Overview

VMware Cloud on AWS

  • VMware is enabling the VADP backup partner ecosystem on VMC
  • Access to native AWS storage for backup target
  • Leverages high performance network between Virtual Private Clouds

You can read more about VMware Cloud on AWS here.

 

Backup Partner Strategy

VMware Certified – VMware provides highest level of product endorsement

  • Product certification with VMware Compatibility Guide Listing
  • Predictable Life Cycle Management
  • VMware maintains continuous testing of VAPD APIs on VMC releases

Customer Deployed – Same solution components for both on-premises and VMC deployments

  • Operational Consistency
  • Choice of backup methods – image-level, in-guest
  • Choice of backup targets – S3, EBS, EFS

Partner Supported – Partner provides primary support

  • Same support model as on-premises

 

VADP / ENI / Storage Targets

VADP

  • New VDDK supports both on-premises and VMC
  • VMware backup partners are updating existing products to use new VDDK to enable backup of VMC based VMs

Elastic Network Interface (ENI)

  • Provide access to high speed, low latency network between VMC and AWS Virtual Private Clouds
  • No ingress or egress charges within the same availability zone

Backup Storage Targets

  • EC2 based backup appliance – EBS and S3 storage
  • Direct to S3

 

Example Backup Topology

  • Some partners will support in-guest and image level backups direct to S3
  • Deduplicates, compresses and encrypts on EC2 backup appliance
  • Store or cache backups on EBS
  • Some partners will support vaulting older backups to S3

 

Summary

  • VADP based backup products for VMC are available now
  • Elastic Network Interface connection to native AWS services is available now
  • Dell EMC Data Protection Suite is the first VADP data protection product available on VMC
  • Additional VADP backup solutions will be available in the coming months

 

Dell EMC Data Protection for VMware Cloud on AWS

Data Protection Continuum – Where you need it, how you want it

Dell EMC Data Protection is a Launch Partner for VMware Cloud on AWS. Data Protection Suite protects VMs and enterprise workloads whether on-premises or in VMware Cloud

  • Same data protection policies
  • Leveraging best-in-class Data Domain Virtual Edition
  • AWS S3 integration for cost efficient data protection

 

Dell EMC Data Domain and DP Suite

Data Protection Suite

  • Protects across the continuum – replication, snapshot, backup and archive
  • Covers all consumption models
  • Broadest application and platform support
  • Tightest integration with Data Domain

Data Domain Virtual Edition

  • Deduplication ratios up to 55x
  • Supports on-premises and cloud
  • Data encryption at rest
  • Data Invulnerability Architecture – best-in-class reliability
  • Includes DD Boost, DD Replicator

 

Dell EMC Solution Highlights

Unified

  • Single solution for enterprise applications and virtual machines
  • Works across on-premises and cloud deployments

Efficient

  • Direct application backup to S3
  • Minimal compute costs in cloud
  • Storage-efficient: deduplication up to 55x to DD/VE

Scalable

  • Highly scalable solution using lightweight stateless proxies
  • Virtual synthetic full backups – lightning fast daily backups, faster restores
  • Uses CBT for faster VM-image backup and restore

 

Solution Detail

Backup of VMs and applications in VMC to a DD/VE or AWS S3. The solution supports

  • VM image backup and restore
  • In-guest backup and restore of applications using agents for consistency
  • Application direct to S3

 

ESG InstaGraphic

  • ESG Lab has confirmed that the efficiency of the Dell EMC architecture can be used to reduce monthly in-cloud data protection costs by 50% or more
  • ESG Research has confirmed that public cloud adoption is on the rise. More than 75% of IT organisations report they are using the public cloud and 41% are using it for production applications
  • There is a common misconception that an application, server, or data moved to the cloud is automatically backed up the same way it was on-premises
  • Architecture matters when choosing a public cloud data protection solution

Source – ESG White Paper – Cost-efficient Data Protection for Your Cloud – to be published.

 

Manage Backups Using a Familiar Interface

  • Consistent user experience in cloud and on-premises
  • Manage backups using familiar data protection UI
  • Extend data protection policies to cloud
  • Detailed reporting and monitoring

 

Software Defined Data Protection Policies

Dynamic Polices – Keeping up with VM data growth and smart policies

Supported Attributes

  • DS Clusters
  • Data Center
  • Tags
  • VMname
  • Data Store
  • VMfolder
  • VM resource group
  • vApp

 

Technology Preview

The Vision we are building towards (screenshot demos).

 

Further Reading

You can read more in Chad’s post on the solution. Dell EMC put out a press release that you can see here. There’s a blog post from Dell EMC that also provides some useful information. I found this to be a pretty useful overview of what’s available and what’s coming in the future. 4 stars.

VMware – VMworld 2017 – LHC3371BUC – VMware Cloud on AWS – The Painless Path to Hybrid Cloud

Disclaimer: I recently attended VMworld 2017 – US.  My flights were paid for by ActualTech Media, VMware provided me with a free pass to the conference and various bits of swag, and Tech Field Day picked up my hotel costs. There is no requirement for me to blog about any of the content presented and I am not compensated in any way for my time at the event.  Some materials presented were discussed under NDA and don’t form part of my blog posts, but could influence future discussions.

Here are my rough notes from “LHC3371BUC – VMware Cloud on AWS – The Painless Path to Hybrid Cloud”, presented by Eric Hanselman (Chief Analyst, 451 Research) and Andy Reedy (Partner Solutions Architecture, AWS). You can grab a PDF or my notes here. Andy does the intro and then Eric takes the stage.

 

Infrastructure Change is Difficult

“In the middle of difficulty lies opportunity” – Albert Einstein

Infrastructure change is difficult

  • … but necessary
  • Competitive pressures
  • Resource contraints
  • Business requirements

We need to be able to manage our environments. 451 Research did a survey on expected cloud uptake. The shift of workloads to cloud environments over the next 2 years is dramatic, from 41% overall today to 60% expected in 2 years. Off-premises workloads will also move from 35% to 52% in two years, and cloud providers will account for 76% of all cloud workloads.

 

Hybrid Momentum

  • 32% single cloud
  • 32% multi-cloud
  • 22% multi-cloud + (integrated on and off-premises environments)
  • 15% Hybrid – single business function distributed to multiple execution venues

There’s a lot of technical debt in the enterprise and while the promise of hybrid cloud is really attractive, getting there is difficult.

 

Strategies

  • Targeted
  • New workloads
  • Internal / external
  • DR / continuity
  • Test / dev
  • “Bursting” (This one isn’t terribly practical for a lot of enterprise applications)
  • Repatriation

 

An Opportunity

  • Integrated cloud management platforms – alliances that change the equation
  • Addressing risks – 3 Ts – transition, training, transformation
  • Facilitating change – Buying options at low cost

Test and development Use Case

 

Integrated management benefits

  • Common tool chains – reduced ops effort
  • Reduced error potential – single path, reduce brittleness

 

Performance Improvement

  • Getting closer to mobile users
  • Data sources on premises
  • Front ends to the cloud

 

Lifecycle management

  • Moving out of fixed cost infrastructure

What do customers want in hybrid?

  • Run workloads on-premises
  • Run workloads on the cloud
  • Tight integration
  • Without buying new hardware

 

The Challenge of Hybrid

  • Multiple machine formats
  • Incongruent networks
  • Operational inconsistency
  • Skillsets and tooling

The challenge is duplicate effort. <- This should be printed on t-shirts and given out with every conference backpack.

 

VMware Cloud on AWS

 

Account Structure

VMware Cloud SDDC Account

  • A new AWS account created to run a single customer’s SDDC resources
  • Is owned, operated, and paid for directly by VMware
  • Each account is a single tenant for all ESXi hosts

AWS Customer Owned Account

  • Is owned, operated, and paid for directly by the customer
  • Has private connectivity to the VMware Cloud SDDC
  • Has full access to the entire catalogue of native AWS services

 

Topology

Fully configured SDDC running on state of the art infrastructure provisioned on-demand in minutes / hours.

Latest Software

  • VCSA, ESXi, NSX, vSAN, HTML5 Client

Dynamic Capacity

  • DRS / HA Compute Cluster (Intel x86)
  • vSAN Storage Cluster (SSDs)
  • NSX Network Virtualisation (10Gbs+)

Flexible Topology

  • Standalone cloud cluster
  • Hybrid connectivity to on-premises
  • cloud to cloud connectivity

2 different networks – management gateway and compute gateway

 

Connectivity Options

 

Hybrid Use Cases

Consolidate + Migrate

  • DC contract for 12+ months
  • Depreciating assets
  • Long Migration is hybrid

Maintain + Expand

  • Geographic expansion
  • Capacity needs
  • Mainframe

 

Putting It All Together

  • AWS Physical Infrastructure – No dealing with power, cooling, physical security, cross-connects
  • VMware Lifecycle Management – Patching of ESXi, vCenter, NSX, vSAN. Provisioning / deprovisioning
  • Workload flexibility – seamlessly move workloads between on-site and VMware Cloud
  • Elasticity – Scale vSphere clusters up or down based on business demand
  • Cost – convert large capex expenditures to variable expense based on use
  • Expand globally – deploy new DCs through consoles / APIs, not Customs agents
  • AWS Services – 90+ cloud services such as RDS, Amazon Redshfit, S3, and Lambda

Interesting session, I need to dig deeper in terms of tech and business. 3.5 stars.