Episode 28: On vApps
Hello, and welcome to episode 28 of the VCD roundtable. Today, we have another technical topic, and we want to actually, share with you some of the, yeah, I would say, mystery insights. It's really a mystery insight. Not 100% sure. But what you can actually do with the v app and why we still think the age of the v app is not gone yet, where some people say the VM is actually the the primary thing to move forward, I would still say there are good reasons to use the v app still.
Yves Sandfort:We still use that, for example, for, web kits and others because it just makes it a lot easier. But before we go into the details of the advantages and, miracles around the v app, let's do a quick round of introduction, throwing the ball over to Matthias.
Matthias Eisner:Yeah. This is Matthias. Looking forward talking about the v f's tonight. Sascha.
Sascha Schwunk:Yeah. My name is Sascha, and, yeah, happy to be here in this round. Toni.
Tobias Paschek:Yeah. Also, hello and welcome from my side. Also happy talking about the mystery about the
Matthias Eisner:And and Sasha is happy he he's here because he wants to learn something. No?
Yves Sandfort:So the yeah.
Matthias Eisner:As as Yves started because, a bit of I came up with the topic. So what I see a lot out there, if you talk with CSPs, especially about customers of the CSPs, our questions around how can I distribute ready to run services, because a virtual machine cannot be placed into catalog? And, of course, how can I manage a group of virtual machines as a single instance? And what additional features and configuration options is Avia providing? And then what I figured out is that, many people out there have no idea how a via works, what it does, what the advantages are, and what someone should take care of if we use v apps in cloud director to distribute services and manage groups of virtual machines.
Matthias Eisner:And as Yves mentioned, we're we're hosting lab kits for for trainings and therefore, a v app is a a perfect, perfect mechanism to, firstly, deploy whole infrastructures for testing purposes and also secure those smaller groups of virtual machines in terms of, the whole remaining infrastructure. So that's what we are going to talk about today. Anything I missed? Maybe yes. Maybe no.
Tobias Paschek:Yeah. Maybe maybe networking them a little bit, but this is part of the
Matthias Eisner:v app. Exactly. So the v app. First and foremost, a single virtual machine in CallDirector, I think that's that's very interesting. So with which version of VCT the VM as a first class citizen showed up?
Matthias Eisner:I don't know. Was it 9 something? 10 something? I kinda I think it
Yves Sandfort:in the HTML 5 user interface was kind of useful. I'm pretty sure it wasn't there in the flash UI, so it must be 9, 7, or 10.
Matthias Eisner:Okay. Yeah. Sounds reasonable to me. And being really honest, even if you create a virtual machine as a first class citizen and co director, it's still a v app. It's a hidden v app.
Matthias Eisner:Because a virtual machine itself is is a bit different. And you can always convert a single virtual machine into a v app. And the interesting part is if you add a single virtual machine into a catalog, it implicitly converts it into a via. So I think that's the first, shocking moment. I saw it in a project, I think, last year or 2 years ago because CSP just called me and said, Matthias, I added a virtual machine to catalog, and if I deploy, I have a v app.
Matthias Eisner:What am I doing wrong? I said nothing. That's how it works. So what is a v app? Let's start at the basics.
Matthias Eisner:A a v app is outside an additional management layer to cover additional configurations of 1 or multiple virtual machines, including additional networking, as Toby already mentioned. Additional networking is something like also services, like, firewalling for the group of virtual machines, net rules for a group of virtual machines. And, also, permissions. So you can share via. So we have so many topics to cover.
Matthias Eisner:Where where are we going to start? Okay. I start. I start, let's say, with a group of virtual machines. So, I think we're all aware a service, in many cases, consists of maybe 2 or even multiple virtual machines which are dependent of each other.
Matthias Eisner:If we go back to a lab kit and and we could also treat this as a testing environment, configuration because companies also use additional configurations to test software because they need the the exact same infrastructure over and over and over to deploy an application to test, or for developers. Right? So they develop some code and you need to deploy new testing environment. So that's basically a lab kit. So lab kit is more a generic term.
Matthias Eisner:And within a lab kit or a testing environment, you have virtual machines which are dependent of each other. Maybe let's start with a very simple approach like a domain controller. So we have authentication and DNS as a starting point, and then we might have some additional dependent virtual machines on DNS. So with management of multiple virtual machines, I could start with Avia provides a start and stop order configuration. So we configure which virtual machine starts first and what is the behavior of the starting process.
Matthias Eisner:So do we wait for a certain time? Are we waiting for, VMware tools to be ready in a in a virtual machine before we continue to to fulfill all the dependency needs a whole lab kit has or a testing environment has to boot successful because we are aware of if maybe let's do the the really straightforward example if so because if DNS is not working, many services just refuse to start. Even Cloud Director. Or let's do some, VMware based example, like a vCenter server. I've tried to to boot a vCenter without DNS, so it's not stopping.
Matthias Eisner:So we have dependencies, and that's something which can be managed using a v app.
Tobias Paschek:I would the the only thing I would like to add here is there are also pitfalls.
Matthias Eisner:It's it's always DNS. No. But please go yeah. Go ahead. Be my
Tobias Paschek:Because there is really as as you already mentioned, the beauty of the v app is it is you get the possibility to do a start up and also a shutdown order. We can do it in both directions. If we can go with do it in the starting phase, but also in the in the in the powering off phase. But the pitfall on one hand is, AJ is not respecting the v app at the end.
Matthias Eisner:Oh, that's a very good one. Thank you.
Tobias Paschek:Oh, so if you have really well configured everything in your VCT environment, and then still it happens from time to time. We have seen it a couple of days ago, that the host going offline, and you have some of your VMs are running on some of your VMs which are based off the VR by running on this host, they then get started not in any kind of order or not any kind of restart mechanism is there. They are just restarted by AJ. So this is something we need to be aware or you you need to be aware. It is only as long as Cloud Director cares about the stuff.
Tobias Paschek:As soon as any other solution like recent AJ kicks in.
Matthias Eisner:Yeah. Oh, that's a very good catch. And as you as you speak, it just pops up in my mind. We should mention a a Cloud Director vApp is not related to a vCenter vApp. Oh, just just say so, if if you create the v app in Cloud Director, you're it's not implicitly creating a v app in the vCenter.
Matthias Eisner:No. So the vCenter is not aware of the whole v app concept in Cloud Director. And that just popped up, Toby, because you are so right with the h a thing. Yes. And and the second pitfall is if you add a new virtual machine, a v app has a very unique default behavior because the shutdown or the power off action is power off and not shutdown of the virtual machine.
Matthias Eisner:So that needs to be changed for every single object manually or by the API. Yeah. True. That's really good.
Yves Sandfort:And on the other side, you can basically export both as an OVF. And the file format is actually pretty similar. The or the OBF. So you can actually take in Cloud Director if you ever need to get rid of or if you wanna move a v f or something like that. You can actually do a complete OBA, OVF export.
Yves Sandfort:The main difference between that one in the Cloud Director and in vSphere is that the CloudDirector one will take all the configuration around network, storage profiles, and all of that with it. Whereas the vCenter one will just be a bundle of actual machines vApp from, vCenter and actually import that into Cloud Director, but it does not work the other way around. An OVA export for Mal for, vApp from Cloud Director cannot be re imported into the vCenter.
Matthias Eisner:That's true. And also speaking about about power controls, the v app in Cloud Director has power controls because with the power controls of the v app, you initiate the start and stop behavior of the v app. In the past, it was a bit like, you need to think how it works in Cloud Director because you click shutdown, but shutdown was a power off because you followed the v app starting order. So you need to be careful. They changed the naming again.
Matthias Eisner:So with, the current versions of call director, you have start, stop, and power off. So that's very simple start, power on, and follow the start up order configure. Stop. Please execute the stop order in the v app, and then it shuts down the v app. And power off is, Norman Est Oman.
Matthias Eisner:It's a power off of everything immediately. There is also the ability to use stop, force, stop, which is the same. Power off everything immediately.
Tobias Paschek:And and you need to power off the v app, not only the virtual machines because still the v app is running. This is also something you should have in mind. When you go with v apps, you still have the possibility to power off single VMs, but still your v app is running and consumes maybe some additional services. Was more related in the past for this n s x v, not been with n s 16 nowadays, but over n s x nowadays. But in the past, it was something you should have in mind.
Matthias Eisner:It should Tobi, just tell us which services.
Tobias Paschek:Yeah. The the edge service gateway, for example, in the good old days.
Matthias Eisner:And the networks are there.
Tobias Paschek:And the and the network. Networks.
Matthias Eisner:And maybe let's let's start with with, networks or continue with networks because we now covered, the the power actions and then start and stop orders. So NetV Apps have their own networking configuration, and that's very powerful. So from a language perspective, we differentiate between 3 types of networks in contractor. First, we have external. Secondly, we have OVDC networks.
Matthias Eisner:And the third type I'm referring to are what we call a VF network. So a VF network itself has, 3 types. It could be direct connect, routed, or isolated. So we are back with the same naming conventions as we use for OVDC networks. So I think we there is no need to cover an isolated via network.
Matthias Eisner:But the beauty, maybe we just add one sentence to the isolated via network. An isolated v app network is local to a v app. If you deploy the same v app twice and each contains an isolated v app network with the same name, it's still local to each of the v apps. So a virtual machine cannot communicate outside of the v app using this isolated network. Torbj, any thoughts about routed, v app networks?
Tobias Paschek:You get the you you have still, you have your KeyOne gateway. Oh, very interesting. There is an there is a fancy fancy stuff happening in the background.
Matthias Eisner:Don't say fencing. That's something different.
Tobias Paschek:Yeah. Fencing it. Fancy. Not fencing. Fancy.
Tobias Paschek:Nope. Routed behavior, you you have the connection to your k one gateway. You can utilize services like NAT. Port forwarding for inbound, outbound stuff, it needs to be configured, to be honest. It is not there automatic.
Tobias Paschek:It need it's it's it it is not there automatically. You need to configure everything. There has been some change with the default firewall rule set, but normally, it was a default block all rule. Could be in the next couple of days that maybe there are default allow rules there.
Matthias Eisner:Oh.
Tobias Paschek:I've heard something.
Matthias Eisner:Stop hearing voices.
Tobias Paschek:Yeah. That's it from from from a routed perspective more or less from from our perspective.
Matthias Eisner:We should be a bit more precisely, Toby, because the v app edge, and now I set the name, is a dedicated edge. It's not related to the edge gateway which exists. In most cases, let's be honest, in most cases for an organization or being, again, more precisely for an OVDC. So the v a batch is a second t one. It's not the same.
Matthias Eisner:On the connected using a service interface or something?
Tobias Paschek:On on a dedicate on a dedicated edge cluster, to be honest. This is also something which we should have in mind. It must be a dedicated edge cluster.
Matthias Eisner:You could place it on the other one. You can place it on the edge cluster. What I think what you're referring to is you need to configure the edge cluster in the o v d c, which is used to place the edge gateways on.
Tobias Paschek:Yeah. Sorry. Must additional configuration. Yeah.
Matthias Eisner:Yeah.
Tobias Paschek:That's that's
Matthias Eisner:what Exactly. You already mentioned them. That's that's very important again, because out of the box, even if you have connected CallDirector to NSX, you have provider gateways, edge gateways. Everything's configured. Dynamic right away, it's not related to a v event.
Matthias Eisner:So, and that's that that's so true, and that's very, very well hidden property.
Tobias Paschek:Absolutely. That's also because you you just mentioned before the isolated network, and maybe there is also some some concern about the isolated network because do it, do I still have any kind of possibility to utilize DHCP services, for example? And, yes, it is true. You can utilize DHCP on a, on isolated network as well because the the isolated network is, still as in fully isolated, is still connected to the VF Edge. That's the most important part.
Matthias Eisner:Yep. So the p services are provided by the VF Edge. Yeah. So I just looked it up. So the the edge cluster needs to be configured on the o v d c object in the system context.
Matthias Eisner:So if you wanna use VF edges, please go to system as a sysadmin, grab the OVDC, so the organization virtual data center. Hop into the configuration. So by just click on the name and navigate to networking edge clusters, and there is an entry which is called edge cluster and the name and that is, by default It's it's empty, not configured, whatever. It's empty. And you just need to change the value to the edge cluster, which you would like to use to deploy via edges too.
Matthias Eisner:Yeah. That's a nice one. So that's routing. The third option we have is, a Direct Connect via network. Direct Connect VF network is configured by the, organization admin and connects to an OVDC network.
Matthias Eisner:So in the end, if you add a new virtual machine to the v app and connect it to the v app network, which is direct connect to OVDC network, you connect the virtual machine to the OVDC network. Yeah. That's that's the third option we have. Pretty cool. Also for for v apps, that's new in 10.5 in the UI.
Matthias Eisner:If you deploy v app and you have via app networks. During the deployment, for each of the source networks, you can choose to which destination network or which destination network should be used for the VF network or you just leave it with please keep the v app networks. And that works perfectly fine if you have a v appatch in front of it. So the v a batch also enables us to create an or or build an implicit fencing. If you prefer to deploy the exact same environment over and over and over.
Matthias Eisner:And now we are back with, the software testing use cases to have the exact same environment to test, software releases. And you or you just click on fencing in Cloud Director, but I still have no idea what that does.
Yves Sandfort:Right? Dancing in Cloud Director is a completely different beast because it it basically it is built for a software development. It's if you would have ever been in the generation of Lab Manager, then, you would know that.
Matthias Eisner:So now we're back to my statement. I because I always say Eve started designing Cloud Director in 1834.
Yves Sandfort:Something like that. Now the point is the the old concept behind the fencing is that you can take an application as it is, including its MAC addresses, IP addresses, and everything else. And actually, re basically, reset it on the network as a secondary one. So what's going to happen is inside the v app, the application is still seeing its same IP addresses, make addresses, etcetera. But from the outside, you can basically address it from a different address.
Yves Sandfort:It sounds a bit like nothing, but it would also work with this with things which are not TCP, IP, or UDP. So it's really working on layer 2 because goes down to the MAC addresses. However, it's also, it has its challenges because it's, when you go to the outside, it actually, seems, license activation and all of that shouldn't be affected by it. All should be great. But it's really it has a lot of other implications because it does 1 on whatnots for each IP address and MAC address.
Yves Sandfort:So whereas when you think about what we do for lab kits, where you have one external address for the v app, in that specific scenario, every virtual machine gets a a virtual external address. The other thing is for a fenced network, the expectation is is that the outside network from a CIDR is exactly the same as the inside network. So you're basically putting, you're taking an existing VM, which is directly connected or something like that. Fence it and actually put it out again as the fenced one. So and now the edge gateway has to basically do all the MAC and IP address translation, inbound and outbound.
Yves Sandfort:And also make sure that if something happens on the inside, it's not going to go completely freeze. I'm to be honest, I all I have seen it working properly. I always had challenges to ever get it really working the way it should work by myself. And it's one of these rare cases, but I'm pretty sure because they never got rid of it, that there somewhere is a very large customer massively utilizing that. Because otherwise because they must have ported that from NSX v to t on top of it because it's still there with t now.
Tobias Paschek:Yeah. But in in t, to be honest, it was it was there out of the box more or less because the the the the whole stateful nut was there in NSX from the from the beginning. And I guess, to be able not not the large customer, but I know one customer who comes from Lab Manager and is utilizing fencing. Also, still nowadays in Cloud Director.
Yves Sandfort:So Toby is also owned. Yes.
Matthias Eisner:Look at his haircut.
Tobias Paschek:I have played around with Lab Manager multiple years.
Matthias Eisner:Alright. So we we covered all those networking options, and, we're we're mainly dealing with an implicit fencing, so we configure that on the VIA batch, to have the same environment over and over and over deployed. Could also be used to deploy a few ESXi hosts in virtual machines to test some infrastructure related features. So the V app itself so we now covered virtual machines and you can add and delete virtual machines. You can create a template out of it, store it in a catalog, and deploy it over and over and over and over.
Matthias Eisner:But the v app object itself has some additional options, like, you could create a snapshot. Oh, so you do a backup. Oh, no. No. No.
Matthias Eisner:No. No. So you create this. Snapshots are not backup. So you can create a snapshot, but what what happens in the in the back end?
Matthias Eisner:So CloudDirector just creates a snapshot of each virtual machine being a member of the v app, but those snapshot snapshots are not in sync from a timely perspective. So the snapshots are created in a serial fashion. So please do not consider like, oh, I I create a snapshot on the v app, and all the virtual machine snapshots are at the same exact point in time because that's not going to happen.
Yves Sandfort:Plus it's only 1. If any of these machines has already a snapshot, and that snapshot will be, bye bye, John.
Matthias Eisner:Yeah. Or or or refusing to create another one.
Yves Sandfort:No. Normally normally, it should actually it will just, remove the old one and put a new one in. Nice. A new one. So That's they changed that.
Yves Sandfort:I think in the early days of Cloud Director, when they first introduced snapshots for Cloud Director, it was actually declining a snapshot if there was an existing one. And at one point in time, Simon found it a really clever idea to change that behavior and change it in a way so that it always will work. And so even if it has 10 snapshots from these fields, they are gone.
Matthias Eisner:Consistent.
Tobias Paschek:Not consistent.
Matthias Eisner:So that's a very interesting one. You can change the owner. So in a in a multi tenant environment and having multiple people inside a single organization working with virtual machines, networks, and and all the other types of objects, every object has an owner, even the v app. So you can't transfer a v app from one owner to another. So to the responsible person.
Matthias Eisner:And really cool, you can share a v app. So you can share and enable other people access it with the role, of course, the same v app again. Like you said, a read only, read, write, or full control. So these are the three options we have. Or we share a v app with an organization.
Matthias Eisner:So the same sharing mechanism, which is available for, example, catalogs is available for v apps as well on top. And if you have VCDA as part of the game, VCDA, Yes, sir. VCDA gets added to the context menu of the of the v app. So you just click a v app, go to availability, and replicate, migrate, whatever to another organization, another VCD instance, whatever, the whole v app. So that's also a pretty cool mechanism for, disaster scenarios, and you can replicate or use VCDA to replicate the whole v app to another site.
Matthias Eisner:Last but not least, a very beloved feature of the Via is it has its own lease time. So that's that's the set. That's the the the the trailing or the dependent mystery of disappearing virtual machines. Be careful with via at least times. If you shut down a via and you are not taking care of the individual lease time, which is configured by default?
Matthias Eisner:And he's like, yeah. I I I shut it down because I want to save on resources, and I will come back to my v app in 40, 50 days. You you can you can come back to your v app by restoring it from the back. So that's another very interesting history.
Tobias Paschek:Talking about the restore, there is something I would like to add, because this is also something which is very helpful and nice, to be honest, that is also there on the VIP, is the metadata information. Because you can utilize metadata information for automating your jobs, which whatever kind of backup vendor depends if he really is capable of getting out the information of, from BCD. But if you have a backup vendor, which is capable of reading out the information from BCD, you can utilize the metadata, information for automatic backups, and stuff like this. So this is also something which is quite handy on the on the, v app as well.
Matthias Eisner:Oh, it's really great, and you can use metadata. For example, for aria operations manager for the whole billing game, You have metadata. And based on metadata, you can, steer the billing system check, like, yeah, because it's a VR. We need to charge another $5 a month or whatever. That's also part of the game.
Matthias Eisner:Nice. I think I think that covered a lot around VMs.
Tobias Paschek:And you get a nice looking because I'm just I have to look into console. You get a nice looking network diagram. It's the most important part of the VM, to be honest.
Yves Sandfort:And and
Matthias Eisner:in the in the summary view, if you click on the console link, you get all virtual machine console. You can see that one of it. Yes. Speaking of consoles, add the proper certificate. Otherwise, the console is not working still.
Tobias Paschek:This that's not true. That's fake news.
Yves Sandfort:But it creates documentation by itself with the network diagram. That is much more than most people have about their applications. So from that
Matthias Eisner:Yes.
Tobias Paschek:Yes. But he
Matthias Eisner:is still write good code.
Tobias Paschek:But you're starting starts using Docker? So, not Docker.
Matthias Eisner:No. Fake news. Fake news.
Tobias Paschek:But he has to start using GitHub. So he's Fake news.
Matthias Eisner:No. No. No. No. No.
Matthias Eisner:No. That's not that's not true.
Tobias Paschek:That's fake news.
Yves Sandfort:If you would have now told me that he's using GitHub in combination with Copilot, then I would be completely shocked.
Matthias Eisner:I even can't say
Yves Sandfort:Copilot is. So he jump in and actually tell him how to optimize his code.
Matthias Eisner:No. He he documents my code. Alright. So always just joking. Sasha, anything to add about v apps?
Sascha Schwunk:No. I think you covered all. So Thank you.
Matthias Eisner:What did you learn today?
Sascha Schwunk:Yeah. I heard, yeah, nearly all of it before. So Nothing new, but it's it becomes more and more important to talk about more about this. Let's call it more or less basics for the daily use. So give an idea to every service provider what can be used with Cloud Director.
Sascha Schwunk:What are the options with Cloud Director because what we saw the last weeks months is a lot is that many of the service provider currently don't use cloud director, only have the complete environments in vSphere and struggling with, yeah, multi tenancy and how to get access for the customers. And so I think it becomes more and more important to talk more about this for us as basics to show what's possible and brings the service provider to a level to say, hey. Yeah. Let's take a look at cloud director. Let's start with this complete multitenancy.
Sascha Schwunk:Let's start with the apps, though, getting better overview, get, your permissions per customer, though, that not my complete administrators have access to all of my customers. In most cases, that makes no sense, especially if I started as a bigger service provider with 100, 200 customers.
Matthias Eisner:Mhmm. Good one. Yeah. I think we covered most of the aspects around v apps.
Yves Sandfort:I think there's one which we didn't cover, but I'm not sure. I might stay corrected for that because I didn't play enough with 105 yet if that behavior has changed. But as often 4, VIP is the only thing you can actually add to a catalog.
Matthias Eisner:That's what I said 30 minutes ago.
Yves Sandfort:We are not even
Matthias Eisner:No. Just just saying. But but you're right.
Yves Sandfort:As as always, I don't listen to you.
Matthias Eisner:That's true. Alright, guys. So some famous so I I kept talking for a long time. So, guys, some famous last words?
Tobias Paschek:Not from my side.
Yves Sandfort:Remove the VM back to the VM.
Matthias Eisner:Yes, sir. And just provide a a very short outlook for episode 29 because Sasha because of his statement, I have a very a great idea. How to move current, like, multi tenant treated vCenter environments with CloudDirector to even multi tenant vCenter access using Cloud Director proxies and stuff like this. So we could
Tobias Paschek:cover this
Matthias Eisner:one in episode 29.
Tobias Paschek:And then I would say 29 will be about multi tenancy. Exactly. Multi tenancy. So
Yves Sandfort:the the the the Whoever actually has taken
Matthias Eisner:multi tenancy.
Yves Sandfort:Yeah. So whoever has taken that decision, please write that information forward to the colleague who is maintaining the media plan. So Matias just for that one so that we get that a media plan and b on the calendar. So I guess it's in 2 weeks. So
Sascha Schwunk:Yes.
Yves Sandfort:Yeah. We don't know where we are going to be there. But, currently, we are still in Germany, but that might change. Okay. Good.
Yves Sandfort:Then I would say, we have further run. We have a topic for the next, session. Stay tuned, as a service provider in the next week or 2 for a lot of updates. I posted a video this morning. You need to report your CCM by Monday, which is interesting for those countries which have bank holiday today.
Yves Sandfort:Because, if you don't do that, I have no clue. I think then you're at least if you wanna change your aggregator, you should really need to make sure that you do that by Monday, which only affects the people who are live with us. The other ones will not hear it in time. Otherwise, I think that will be locked in for the next 3 years. So, do that now.
Yves Sandfort:And I'm pretty sure from what I hear between the lines, we can be expecting that we get now daily news and updates and changes so that all the systems are going to be released. So stay tuned. Subscribe to our newsletters or, actually watch out for my VMware by Broadcom series. That should keep you updated as well just in case your email inbox isn't showing you whatever is going to. That being said, I would say have a good remainder of the week, a weekend, and we'll hear you in 2 weeks.
Yves Sandfort:Toby, goodbye. Bye bye.
Creators and Guests
