• Installed vSphere environment

• Binaries are downloaded from https://support.broadcom.com

• vCenter version at least 9.0.x

Start the Installation process

• Connect to your vCenter UI, go to “Inventory”, right-click on your cluster and select “Deploy OVF Template…”

• In the “Select an OVF template” screen, select “Local file” and click “UPLOAD FILES”

• Within the file browser, select your downloaded OVA file and click “Open”

• Proceed with “NEXT”

• Give the new VM a name, a location and proceed with “NEXT”

• Select a compute resource (host or cluster) and click “NEXT”

• Ignore the certificate warning and click “NEXT”

• Accept the license agreement and click “NEXT”

• Configure the appliance size and click “NEXT” but keep in mind that you should use at least “medium” for production environments.

• Configure the storage placement for your log appliance and proceed with “NEXT”.

• Customize the virtual network your VM should run on.

• Customize additional settings for the appliance and proceed with “NEXT”.

  • Initial root password - This will be used as an initial password for the root user account.

  • Hostname - The hostname or the fully qualified domain name for this VM. Leave blank if DHCP is desired.

  • Default Gateway - The default gateway address for this VM. Leave blank if DHCP is desired.

  • Domain Name - The domain name of this VM. Leave blank if DHCP is desired.

  • Domain Search Path - The domain search path (comma or space separated domain names) for this VM. Leave blank if DHCP is desired.

  • Domain Name Servers - The domain name server IP Addresses for this VM (comma separated). Leave blank if DHCP is desired

  • Network 1 IP Address - The IP address for this interface. Leave blank if DHCP is desired.

  • Network 1 Netmask - The netmask or prefix for this interface. Leave blank if DHCP is desired.

• Review the summary and click “FINISH”

Wait for the deployment to be completed.

• Power on the VM and connect to the URL.

On the initial SETUP, click “NEXT” to start the process.

• On the next screen you can choice to start a new deployment or join an existing one. In our case, we start a new deployment.

Wait for the initial configuration to be completed.

After a couple of minutes, you must specify the admin credentials.

Specify your mail server or your http post system, leave blank if you want to do this later

Correct time is essential, so configure your time source.

I do not have a SMTP server ready, so I will skip that, but you can configure SMTP if you want to.

You can change the SSL certificate right now, I am fine with the default self-signed certificate so I will skip that.

Select “FINISH” to end the initial setup wizard.

After clicking “FINISH” you have to integrate VCF Operations for Logs with your vSphere environment.

• To configure vSphere Integration click on “Configure vSphere integration »”

• On the upper right corner, select “ADD VCENTER SERVER”

Provide the following information then click “TEST CONNECTION” and if successful, click “SAVE”

Close the screen with the “<-” in the upper left, then you should see something like this.

Congratulations!

You have completed the basic deployment of VCF Operations for Logs!

• Installed VCF Installer (latest version)

• Depot Configuration has been done

• Binaries are downloaded with status “Success”

• vCenter version at least 9.0.x

• Your virtual switch infrastructure is based on DVS

for more Information on Preparing to Deploy a new VMware Cloud Foundation or vSphere Foundation Platform, please visit:

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-0/deployment/deploying-a-new-vmware-cloud-foundation-or-vmware-vsphere-foundation-private-cloud-/preparing-your-environment.html

Start the migration process

• Connect to your VCF Installer appliance via https and provide the credentials.

• After logging into VCF Installer, select “DEPLOYMENT WIZARD” to start the migration process.

• To import an existing vCenter, opt in the checkbox next to “Use an existing vCenter as the management domain vCenter.” and click “NEXT”

• Select the target version and proceed with “NEXT”

Optionally, you can enable “Auto-generate passwords for newly installed appliances” or disable “Enable Customer Experience Improvement Program (CEIP)”

• VCF Operations is a core component for VVF and VCF, it is responsible for e.g. Licensing

  • Operations Appliance Size: Size of the appliance – small is only recommended for lab environments!

  • Operations primary FQDN -e.g. when you will have more than 1 appliance, specify the load balancer (VIP) name as FQDN

  • Administrator Password

  • Root Password

• Specify the current vCenter credentials for importing the existing vCenter into the VVF or VCF Environment, click “NEXT”

  • vCenter: FQDN of your existing vCenter appliance

  • Root Password: root password of your existing vCenter appliance

  • SSO user name: e.g. administrator@vsphere.local

  • SSO password: e.g. Password of your administrator@vsphere.local account

• You have to confirm the vCenter certificate to proceed.

• Review the planned deployment or download the json spec.

  • Optional: You can download the json spec and edit with your preferred editor to modify values or options which are not present in the UI.

• You can then import the json spec at the very beginning to deploy your customized environment.

• The “Validate & Deploy” Stage checks all settings and validates the environment.

• Correct any error and analyze all warnings prior clicking “DEPLOY”

• You can monitor the deployment status within the VCF Installer UI.

If any error occurs, consult the log file and correct the problem. After that, simply restart the deployment with the button on the upper right corner which will be visible in case of an error.

But don't panic! This installation takes time! In my LAB environment I had to wait approx. 35 Minutes.

• When completed, follow the next steps regarding the licensing of the environment

Troubleshooting:

ssh into your VCF Installer appliance and look at /var/log/vmware/vcf/domainmanager/domainmanager.log for any installation issues.

Connect VCF Operations with vCenter

• Login into VCF Operations

• Go to Administration -> Integrations, select “ADD” and select “vCenter” as account type.

• Fill out all required fields and click “VALIDATE CONNECTION”, on success, click “ADD”

• Confirm this information.

• Within the List of Integrations, expand the entry with status “Stopped” and click the three dots

• Select “Start Collecting All” to enable metric collection

• Now, the Integration is displaying a warning, but this should disappear after a while.

After approx. 10 minutes, the status is green.

Integrate VCF Operations for Logs with VCF Operations

This step is optional but highly recommended!

VCF Operations for Logs is a component where you can store your logs in a central place for troubleshooting.

• Navigate to “Infrastructure Operations” -> “Analyze” and click “CONFIGURE OPERATIONS-LOGS APPLIANCE”

• On the “Operations-Logs Appliance Integration” provide the connection details for your manually deployed VCF Operations for Logs appliance and click “VALIDATE CONNECTION”.

• Click “SAVE” when the connection test was successful.

• Check the integration – Navigate to “Infrastructure Operations” -> “Analyze” and see, if your syslog Information is displayed.

Congratulations!

You have completed the basic VVF 9.0.2 deployment!

• Ensure, that your cluster uses image based updating – baselines are no longer supported.

• Please note that after upgrading to version 9.0.2, your licenses will run in trial mode for 60 days.

• Make sure to upgrade to VVF 9.0.2 or VCF 9.0.2 in a timely manner.

Prerequisites:

• Hosts and vCenter are prepared with or running on version 8.0U3
• vCenter ISO version 9.0.2 is downloaded from https://support.broadcom.com to your PC.

It is strongly recommended to take a backup or at least a snapshot from your vCenter appliance prior starting the upgrade process!

Start Upgrade via vCenter UI

• Mount the vCenter installer ISO within the vCenter 8 appliance.

  • This can be done via e.g. the VMware remote console application.

• Within vCenter UI, go to the “Inventory” and select the vCenter object – on the right side select “Updates”

  

• On the upgrade wizard, click “RECHECK” to analyze the currently mounted ISO file. This results in showing the correct target version from the ISO file.

  

• Proceed with “NEXT”

  

• Verify your backups and check “I have backed up the vCenter Server and all the required data using VMware product or a third party utility.”

  

• Now we need to upgrade the “Upgrade Plug-in” so the installer is aware of vCenter 9.0.2 requirements. Select “UPGRADE PLUG-IN”

  

  You can monitor the progress

  

  After successfully upgrading the plug-in, you need to run the pre-checks.

  

  Wait until it is finished.

  

  Proceed with “NEXT”

  

• Configure the vCenter Server target appliance.

  In this step, we are configuring the settings for a new and empty vCenter appliance. The installer will deploy the new OVA and then migrate all data from the old to the new one.

  

  Accept the license agreement and click “NEXT”

  

  Opt. in or out the Join the Broadcom’s Customer Experience Improvement Program. Checkbox – proceed with “NEXT”

  

  Specify the target location for the newly installed vCenter appliance.

  If you choose “Deploy in the same location as source.” You do not have to specify any details; you can click “NEXT”.

  

  You can use the same parameters for the new appliance or configure aur own set of values

  

  During the upgrade the target Virtual Machine will have suffix ’temp’ added to its name and when the upgrade is over the Virtual Machine will have the same name as the source Virtual Machine.

  Specify a temporary root password and click “NEXT”

  

  On the “Network Settings” page, select “Manual” from the “Network configuration” drop down to specify an IP address – choosing “Automatic” will result in a DHCP configuration.

  

  Fill out the form and click “NEXT”

  

  Review your configuration and click “FINISH”

  

• After a view seconds click “NEXT to proceed.

  

• Upgrade to new version.

  Upgrade happens in two stages, Prepare and Switchover.

  In the Prepare stage, a new vCenter Server is deployed and data is replicated.

  In the Switchover stage, expect a system downtime of a few minutes during which the configuration is transferred from the source vCenter Server to the newly deployed target appliance.

  Click on “START UPGRADE” to begin the process.

  

  Select Switchover Execution “Policy”

  You can select

  „Manual“ -You must start phase 2 manually.

  “Automated” – Phase 2 is starting right after stage 1.

  “Scheduled” – Phase 2 is starting at a given point of time.

  

  Now you can monitor progress.

  

  As you can see, there is a new VM which will be the new home of your vCenter data and configuration.

  

  Both VMs are running temporarily side by side until the old one is pored off by the workflow.

  

  You can also monitor what’s going on when navigating to https://<your_temporary_adress>:5480

  

  

  

  Don’t panic! It takes some time until the switchover starts!

  You can monitor the progress within the “old” vCenter UI.

  

  As you can see, phase 2 started automatically.

  

  Do not go back, refresh, or close this screen till the upgrade completes.

  After a few minutes you should see this

  

  As you can see, the vCenter 8.X appliance was renamed to shati-m01-vc01-old-8.0.3.00000 and is powered off, the new one has the original name shati-m01-vc01.

  

Now it´s time to upgrade our ESX hosts

Navigate to your cluster and select “Updates”, then click “EDIT”

Edit the image and select the correct versions for ESX, Vendor Addon and optionally other components. When finished, click “SAVE”

A cluster compliance check is triggered automatically to determine which hosts need to be upgraded to be compliant.

When finished, click on “REMEDIATE (ALL)” to start upgrading your hosts.

Review the “Review Remediation Impact” Page and click “START REMEDIATION”

Wait until all hosts are upgraded.

Congratulation!

You have successfully upgraded your environment to vSphere 9.0.2

But wait! The environment must now be converted to a VVF or VCF environment!

Prerequisites

1. Download PhotonOS 5 minimal OVA from:

   OVA:

   https://packages.vmware.com/photon/5.0/GA/ova/

   or ISO:

   https://packages.vmware.com/photon/5.0/GA/iso/

2. Download VMware VCF Download Tool (Latest Version)

   https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Cloud%20Foundation&displayGroup=VMware%20Cloud%20Foundation%209&release=9.0.2.0&os=&servicePk=537791&language=EN

Deploy PhotonOS VM

Using OVA:

• Goto vSphere Client
• Right click your Cluster where you want to deploy your VM
• Select “Deploy OVF Template”

• Select “Local file”

• Select “UPLOAD FILES” and browse to your PhotonOS 5 minimal OVA
  e.g.
  

• Select “Open” to continue
  

• Select “NEXT” to specify a VM name and location for the VM
  

• Select “NEXT” to choose your compute resource

• Select „NEXT“ to review details

• Click “Ignore” on the certificate warning and then click “NEXT” to continue

• Accept the License agreements and continue with “NEXT”

• Choose a storage to deploy on – in my case, it is the one and only vSAN Datastore. Proceed by clicking “NEXT”

  

• Specify your Network (Port Group) and click “NEXT”

  

• Review the summary and click “FINISH”

• Power ON your VM
• Connect to your VM via the web console and login as user “root” with password “changeme”

• You have to change the root password immediately!

Set a static IP Address

Before you set a static IP address, obtain the name of your Ethernet link by running the following command:

networkctl

To create a network configuration file that systemd-networkd uses to establish a static IP address for the eth0 network interface, execute the following command

cat \> /etc/systemd/network/10-static-en.network \<\< "EOF"

\[Match\]

Name=eth0

\[Network\]

Address=192.168.0.2/24

Gateway=192.168.0.1

DNS=192.168.0.99 192.168.0.100

EOF

Change the new file’s mode bits by running the chmod command:

chmod 644 10-static-en.network

Apply the configuration by running the following command:

systemctl restart systemd-networkd

Change Hostname

Replace “depot.yourdomain.com” with the FQDN of your VM

Run

hostnamectl set-hostname depot.yourdomain.com

systemctl restart systemd-networkd

systemctl restart systemd-resolved

Update your System:

Run to check for Updates:

tdnf check-update

Run update:

tdnf update

Optional:

Install Network Config Manager

tdnf install network-config-manager 

Add a disk for storing the depot binaries

In vCenter, edit the properties of your depot VM and add a secondary disc.

I am using a 1 TB thin provisioned disk because I would store different versions and Upgrades on it.

• Install FS-Utility parted:

tdnf install parted

• Scan for New Disk: Log in to Photon OS via SSH/Console and run:

fdisk \-l

Note: The new disk will likely be /dev/sdb.

• Partition the New Disk: Use parted to create a partition table:

parted /dev/sdb mklabel gpt

parted /dev/sdb mkpart primary ext4 0% 100%

• Format the Partition: Create an ext4 filesystem:

mkfs \-t ext4 /dev/sdb1

• Mount the Disk:

  • Create a mount point:

  mkdir /depot/

• Mount the disk:

  mount /dev/sdb1 /depot

• Configure permanent mount (/etc/fstab):

  • Identify the partition UUID:

  blkid \-s PARTUUID \-o value /dev/sdb1

• Edit /etc/fstab:

vi /etc/fstab

• Add this line:

PARTUUID=\<your-partuuid-here\> /depot ext4 defaults 0 2

• Verify:

mount |grep \-i /depot

Install WEB Server

Run for installing the httpd binaries:

tdnf install httpd tar jq –assumeyes

Create Certificate for WEB Server

Create a working directory and build the ssl config file, replace the yellow parts with your values:

mkdir /root/http-certificates

openssl genpkey \-out /root/http-certificates/server.key \-algorithm RSA \-pkeyopt rsa\_keygen\_bits:2048

cat \<\< ‘EOF’ \> /root/http-certificates/ssl.cfg

\[req\]

distinguished\_name \= req\_distinguished\_name

req\_extensions \= req\_ext

prompt \= no

\[req\_distinguished\_name\]

C \= \<your country code\>

ST \= \<your state\>

L \= \<your locality\>

O \= \<your organization\>

OU \= \<your organizational unit\>

CN \=depot.yourdomain.com

\[req\_ext\]

subjectAltName \= @alt\_names

\[alt\_names\]

IP.1 \= 172.16.10.11

DNS.1 \= depot.yourdomain.com

EOF

Let´s create a .csr using the .key and ssl template:

openssl req \-new \-key server.key \-out server.csr \-config ssl.cfg

Now you should have 3 files

Submit the base64 .csr to the CA of your choice and the return file must be a full chained base64 formatted .crt file.

When you have the new certificate, move the .key and .crt file to a secure location where the apache web server can access it.

mv server.key server.crt /etc/httpd/conf/

Set the correct permissions:

chmod 0400 /etc/httpd/conf/server.key /etc/httpd/conf/server.crt

chown root:root /etc/httpd/conf/server.key /etc/httpd/conf/server.crt

Of course, the Apache configuration must also be adjusted accordingly, replace the yellow parts with your values.

sed \-i 's|\#LoadModule ssl\_module|LoadModule ssl\_module|' /etc/httpd/conf/httpd.conf

sed \-i 's|\#LoadModule socache\_shmcb\_module|LoadModule socache\_shmcb\_module|' /etc/httpd/conf/httpd.conf

sed \-i 's|\#Include conf/extra/httpd-ssl.conf|Include conf/extra/httpd-ssl.conf|' /etc/httpd/conf/httpd.conf

sed \-i 's|DocumentRoot "/etc/httpd/html"|DocumentRoot "/depot"|' /etc/httpd/conf/extra/httpd-ssl.conf

sed \-i 's|ServerAdmin you@example.com|ServerAdmin your-email-address@your-domain|' /etc/httpd/conf/extra/httpd-ssl.conf

sed \-i 's|ServerName www.example.com:443|ServerName depot.yourdomain.com:443|' /etc/httpd/conf/extra/httpd-ssl.conf

Edit the file /etc/httpd/conf/extra/httpd-ssl.conf

vi /etc/httpd/conf/extra/httpd-ssl.conf

On the very bottom, insert these lines directly before </VirtualHost>

\<Directory /depot/PROD/COMP\>

        AuthType Basic

        AuthName "Basic Authentication"

        AuthUserFile /etc/httpd/conf/.htpasswd

        require valid-user

\</Directory\>

\<Directory /depot/PROD/metadata\>

        AuthType Basic

    AuthName "Basic Authentication"

    AuthUserFile /etc/httpd/conf/.htpasswd

    require valid-user

\</Directory\>

\<Directory "/depot/PROD/COMP/Compatibility/VxrailCompatibilityData.json"\>

        \# VxRail VVS Cookie Validation (VCF 5.0)

        \<If "%{HTTP:Cookie} \== 'ngssosession=ngsso-token' "\>

        Require all granted

        \</If\>

\</Directory\>

\<Directory /depot/PROD/vsan/hcl\>

        Require all granted

\</Directory\>

        \# Those Alias statements are needed only for VCF 5.1.0.0.

        Alias /products/v1/bundles/lastupdatedtime /depot/PROD/vsan/hcl/lastupdatedtime.json

        Alias /products/v1/bundles/all /depot/PROD/vsan/hcl/all.json

        \# Needed only if UMDS downloads are presented

\<Directory /depot/umds-patch-store\>

        Require all granted

\</Directory\>

Create the Basic Authentication user and password

Next, we need to create the Basic Authentication user and password that will be used. replace username with whatever you want the user to be called

htpasswd \-c /etc/httpd/conf/.htpasswd depotuser

chown apache /etc/httpd/conf/.htpasswd 

chmod 0400 /etc/httpd/conf/.htpasswd

Test the configuration

httpd \-t

Service enablement and service start

systemctl start httpd 

systemctl enable httpd

Update iptables firewall

Edit the file /etc/systemd/scripts/ip4save. Add these 2 entries directly before the “COMMIT” entry.

\-A INPUT \-p tcp \-m tcp \--dport 443 \-j ACCEPT 

\-A INPUT \-p tcp \-m tcp \--dport 22 \-j ACCEPT

To apply these changes, the service must be restarted.

systemctl restart iptables

Optional cleanup:

Cleanup these files/folders:

rm \-rf /root/http-certificates

rm \-f /depot/index.html

VCF Installer Certificate

If you are using a self-signed TLS certificate or custom root CA, we need to perform an additional step by importing the root CA into the VCF Installer, so that a trust is established or you will not be able to connect to your offline depot.

Copy the root CA certificate (e.g. rootCA.pem) onto the VCF Installer filesystem and then run the following command which will add it to the trust store and then restart the VCF Installer services for the certificate to be trusted.

STOREPASS=$(cat /etc/vmware/vcf/commonsvcs/trusted\_certificates.key)

DEPOT\_ALIAS="vcf\_offline\_depot"

DEPOT\_CERT="/tmp/rootCA.pem"

keytool \-importcert \-alias $DEPOT\_ALIAS \-file $DEPOT\_CERT \-keystore /etc/vmware/vcf/commonsvcs/trusted\_certificates.store \-storepass $STOREPASS \-noprompt

echo 'Y' | /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager\_restart\_services.sh

VMware Download Tool

• Copy the tar.gz file to your VM
• Create a target directory for the vcf-download-tool

mkdir \-p /opt/vmware-download-tool

• Untar the binaries

tar \-zxvf vcf-download-tool-9.0.2.0.25151284.tar.gz \-C /opt/vmware-download-tool/

Create a token file with your vmware download token, replace the yellow part with your tocken.

Echo \<token\> \>\> /opt/vmware-download-tool/token

Initiate Download:

Goto /opt/vmware-download-tool/bin

cd /opt/vmware-download-tool/bin

This command downloads the install packages from the source:

./vcf-download-tool binaries download \--depot-download-token-file=/opt/vmware-download-tool/token \-d /depot \--vcf-version=9.0.2 \--automated-install \--type=INSTALL

Or, if you just want to download the upgrade packages

./vcf-download-tool binaries download \--depot-download-token-file=/opt/vmware-download-tool/token \-d /depot \--vcf-version=9.0.2 \--type UPGRADE

For a complete download tool description, please visit:

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-0/lifecycle-management/binary-management-for-vmware-cloud-foundation/what-is-the-vcf-download-tool-.html

Download ESX Upgrade Binaries

SDDC Manager is looking for ESX patches for a folder named umds-patch-store and is the default directory for ESX patching.

UMDS is integrated within vcf-download-tool but needs to be installed and configured.

Install Perl:

tdnf install perl

Install UMDS:

Goto /opt/vmware-download-tool/bin

cd /opt/vmware-download-tool/bin

./vcf-download-tool umds install

Configure UMDS

mkdir /depot/umds-patch-store

./vcf-download-tool umds run \-S \--add-entitlement-token \<your token\> 

./vcf-download-tool umds run \-S \-P /depot/umds-patch-store

./vcf-download-tool umds run \-S \-e embeddedEsx-9.0-INTL

./vcf-download-tool umds run \-S \-e embeddedEsx-8.0-INTL

./vcf-download-tool umds run \-S \-d embeddedEsx-7.0-INTL

./vcf-download-tool umds run \-S \-d esxio-8.0-INTL

./vcf-download-tool umds run \-S \-d esxio-9.0-INTL

./vcf-download-tool umds run vmware-umds \-D

For a complete list of options, please visit:

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-0/lifecycle-management/binary-management-for-vmware-cloud-foundation/what-is-the-vcf-download-tool-/vcf-download-tool-update-manager-download-service–umds–commands.html

Set permissions on /depot

chown apache \-R /depot

find /depot \-type d \-exec chmod 0500 {} \\;

find /depot \-type f \-exec chmod 0400 {} \\;

NOTE: You must reset the permissions every time you download the portfolio

Restart apache

systemctl restart https

Next Step: Configure your SDDC Manager, Installer or another component to use this offline Depot.