VMware 3V0-21.23 - VMware vSphere 8.x Advanced Design

The solution will ensure that all VMware ESXi hosts within a site have access to the local VMFS datastore containing the shared VMware Tools repository.

This decision ensures that each site has local access to the VMware Tools repository, which minimizes traffic across the low-bandwidth, high-latency inter-site link. By keeping the repository within each site, the local ESXi hosts can access the repository without needing to traverse the inter-site link frequently.

The solution will set the UserVars.ProductLockerLocation advanced system setting on each VMware ESXi host to point to the local site shared repository.

This ensures that each ESXi host points to the local site repository for VMware Tools. This approach minimizes inter-site traffic by ensuring that all updates and patches are performed using local resources, avoiding the need to transfer VMware Tools files over the low-bandwidth, high-latency connection.

The solution will create a shared repository on a VMFS datastore within each site that contains all approved versions of VMware Tools.

This decision ensures that both sites have a local copy of the approved VMware Tools versions, in line with REQ001, which mandates that only IT Security Team-approved versions of VMware Tools should be installed. Additionally, it minimizes inter-site traffic, as both sites will use their local repositories.

To meet the requirement of maximum tolerable downtime (MTD) of one hour per month, the system must ensure that in the event of a host failure, the production applications (virtual machines) are restarted as quickly as possible. Configuring vSphere HA Host Failure Response to Restart VMs ensures that VMs are automatically restarted on available hosts in the cluster if a host failure occurs. This setup minimizes downtime and ensures that the system can recover within the specified MTD of one hour per month.

Strict Lockdown Mode is the correct choice because it restricts all access to the ESXi host directly, ensuring that configuration can only be performed through VMware vCenter. This is in line with the requirement that configuration can only be done via vCenter.

Strict Lockdown Mode disables the Direct Console User Interface (DCUI) and SSH services, which aligns with the customer's requirement to have these services disabled for security purposes.

vSphere Lifecycle Manager helps reduce operational expenditure (OPEX) by automating the patching and management of the vSphere environment. It provides centralized management for host updates,ensuring consistency across the environment and reducing the manual effort required for ongoing operations. This leads to reduced operational overhead, which directly addresses the requirement to reduce OPEX.

Given that VMware Tools 11 or higher is installed on all virtual machines and VMware PowerCLI is available in the environment, the architect can leverage PowerCLI to interact with VMware Tools and collect information about active services running inside the virtual machines.

VMware PowerCLI allows you to query virtual machines for information about their services by accessing the guest operating system, provided VMware Tools is installed and running. You can use PowerCLI cmdlets to retrieve service data, such as which services are running on the VM, their statuses, and other details necessary for planning the migration.

This option is cost-effective since there is no budget available for additional discovery tooling, and it aligns well with the existing tools and infrastructure already in place.

The goal here is to ensure that, in the event of a host failure, the workloads are restarted in the correct order based on their dependencies:

Workload 3 (Identity Broker) is required by both Application A and Application B as a dependency. It needs to be set to High Restart Priority, ensuring that it is restarted before the other dependent workloads.

Workload 4 (Reporting Tool) is required by Application B and Application C, so it should be set to High Restart Priority to ensure it is available before the other dependent workloads (like Workload 5).

Workload 5 (Management Tool) is required by Application C and should have a Medium Restart Priority, meaning it will be restarted after Workload 4.

Workloads 1 and 2 (Self-Service Portal and Database) have Low Restart Priority because they are dependent on Workload 3 (and Workload 4), but they do not have further critical dependencies after Workload 3, so they should be restarted last in the event of a failure.

This setup ensures that all applications can be recovered properly in the event of a host failure, with each workload restarting in the correct order to maintain the application dependencies.

Based on VMware vSphere 8.x Advanced documentation and VMware Validated Solutions resources, the architect needs a solution to monitor the operational state of a VMware Cloud Foundation (VCF) environment using ad-hoc reporting, custom dashboards, alerts, and notifications. VMware Validated Solutions are pre-tested, well-architected implementations designed to address specific use cases on VCF, providing detailed design, implementation, and operational guidance.

Requirement Analysis:

Monitor operational state: The solution must provide visibility into the health, performance, and compliance of the VCF environment.

Ad-hoc reporting and custom dashboards, alerts, notifications: The solution should leverage tools like VMware Aria Operations (formerly vRealize Operations) to deliver customizable monitoring and alerting capabilities.

VMware Validated Solutions: The solution must be a specific validated solution tailored to VCF monitoring needs.

Evaluation of Options:

A. Private Cloud Automation for VMware Cloud Foundation:

Why incorrect: This validated solution focuses on deploying VMware Aria Automation (formerly vRealize Automation) to provide cloud automation services, such as self-service provisioning and orchestration for VCF. It addresses automation and workload deployment, not monitoring or reporting. It does not meet the requirement for ad-hoc reporting, dashboards, alerts, or notifications.

This is a business factor that will impact the design because rebranding the hotels in Mexico could lead to changes in the company's requirements, such as the need for new branding, updated infrastructure, or integration of new services. These factors will influence the design decisions related to the edge hosting solution, potentially requiring special configurations or considerations for these locations.

Virtual Machine Encryption

To ensure that the application’s confidential data is protected, Virtual Machine Encryption should be applied. This will ensure that even if someone gains access to the storage layer or the underlying infrastructure, the data in the virtual machine is encrypted and cannot be accessed outside of the VM, as required by the security and compliance requirements.

The vSphere Native Key Provider

The vSphere Native Key Provider can be used to manage encryption keys within the vSphere environment. Since no budget is available for additional infrastructure components or software, leveraging vSphere's native capabilities for key management ensures that encryption is securely handled without introducing external dependencies. This also aligns with the requirement to not introduce additional infrastructure.

External Key Management Service (KMS) provider

While the vSphere Native Key Provider can manage keys within the environment, if there is a requirement for a more secure or compliant key management solution, an External Key Management Service (KMS) may be used. The KMS provider allows for centralized management of encryption keys, ensuring that the keys are securely stored and controlled according to compliance standards (e.g., FIPS 140-2). Although the Native Key Provider may suffice, this option ensures that key management adheres to stricter compliance needs, especially for confidential data.