VMware 5V0-31.22 - VMware Cloud Foundation Specialist (v2)

https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-1B136277-E46C-41FC-9C8C-3E78E9B97F5C.html

vSphere with Tanzu uses the First Class Disk (FCD) type of virtual disks to back persistent volumes. FCD, also known as Improved Virtual Disk, is a named virtual disk not associated with a VM. FCDs are identified by UUID and can be managed independently of VMs.

Thick provisioned VMDK, Raw Device Mapping (RDM), and Virtual Volumes (vVOLs) are not used as the backing disks for persistent volumes in vSphere with Tanzu.

The references are:

Using Persistent Storage in vSphere with Tanzu, section “Persistent Volume”

vSphere with Tanzu Storage, section “First Class Disk”

This is because according to VMware documentation6, these are three initial shared storage types that are supported for deploying a new VI Workload Domain into an existing VCF environment. You can also add other supported storage types after deploying the VI Workload Domain.

https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-with-tanzu-installation-configuration/GUID-544286A2-A403-4CA5-9C73-8EFF261545E7.html

After creating storage policies, a vSphere administrator can perform the following tasks: Assign the storage policies to the Supervisor. The storage policies configured on the Supervisor ensure that the control plane VMs, pod ephemeral disks, and container images are placed on the datastores that the policies represent. Assign the storage policies to the vSphere Namespace. Storage policies visible to the namespace determine which datastores the namespace can access and use for persistent volumes. The storage policies appear as matching Kubernetes storage classes in the namespace. They are also propagated to the Tanzu Kubernetes cluster on this namespace. DevOps engineers can use the storage classes in their persistent volume claim specifications.

The storage policies appear as matching Kubernetes storage classes in the namespace. They are also propagated to the Tanzu Kubernetes cluster on this namespace. DevOps engineers can use the storage classes in their persistent volume claim specifications https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-with-tanzu-installation-configuration/GUID-544286A2-A403-4CA5-9C73-8EFF261545E7.html

vSphere Single Sign-On (SSO) provides secure authentication and authorization services for VMware Cloud Foundation components, including vCenter Server and Platform Services Controller (PSC). In a consolidated architecture deployment of VMware Cloud Foundation, the vSphere SSO configuration is shared across all the workload domains.

To ensure that subsequent workload domains can use the same identity sources as an external identity source registered in a consolidated architecture, the administrator needs to replicate the vSphere SSO configuration. This can be achieved by configuring the same identity sources for vSphere SSO across all the workload domains.

Configuring IWA (Integrated Windows Authentication) or LDAPS (Lightweight Directory Access Protocol over SSL) as an identity source is a part of configuring the vSphere SSO configuration for identity sources.

Keeping the pre-configured defaults does not guarantee that the subsequent workload domains will use the same identity sources as the external identity source registered in a consolidated architecture.

References:

VMware Cloud Foundation Operations and Administration Guide: https://docs.vmware.com/en/VMware-Cloud-Foundation/index.html

VMware vSphere Security Guide: https://docs.vmware.com/en/VMware-vSphere/7.0/vsphere-security-guide.pdf

To ensure that any subsequent workload domains can be accessed using the same identity sources, it is necessary to replicate the vSphere SSO configuration across all the workload domains in a consolidated architecture deployment. This can be achieved by replicating the vSphere SSO configuration between the primary and additional SDDC Manager instances. This ensures that all the workload domains registered with the SDDC Manager will be able to consume resources and services from the same identity sources without any additional configuration in each individual workload domain.

https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-177C23C4-ED81-4ADD-89A2-61654C18201B.html

According to the VMware Cloud Foundation documentation1, the prerequisites for creating a vSphere Namespace are:

Configure a cluster with vSphere with Tanzu. This is the first step to enable Workload Management on a vSphere cluster and create a Kubernetes management cluster known as a Supervisor Cluster2

Create storage policies for persistent storage. Storage policies can define different types and classes of storage, for example, gold, silver, and bronze. They are used to specify the storage requirements for the vSphere Namespace and the workloads that run on it1

A. Define CPU and Memory limits is not a correct option, because it is not a prerequisite for creating a vSphere Namespace, but a configuration option that can be done after creating the namespace. CPU and Memory limits are used to specify the resource allocation for the vSphere Namespace and the workloads that run on it1

D. Enable Harbor Image Registry is not a correct option, because it is not a prerequisite for creating a vSphere Namespace, but an optional feature that can be enabled after creating the namespace. Harbor Image Registry is an embedded container registry that provides secure image management for the Supervisor Cluster and Tanzu Kubernetes clusters. It is only available when using NSX-T networking for the Supervisor Cluster3

E. Assign user and groups access is not a correct option, because it is not a prerequisite for creating a vSphere Namespace, but a configuration option that can be done after creating the namespace. User and group access are used to specify the permissions for the vSphere Namespace and the workloads that run on it1

References: 1: Create and Configure a vSphere Namespace - VMware Docs 2: Prerequisites for Configuring vSphere with Tanzu on a vSphere Cluster - VMware Docs 3: Harbor Registry Overview - VMware Docs

https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-admin/GUID-9EBC6D42-B799-4177-9EFF-78E98FDBA0FD.html

See 'Figure 25. Configure Cloud Builder validation' at https://infohub.delltechnologies.com/l/dell-poweredge-mx-deployment-with-vmware- cloud-foundation-deployment-guide/vmware-cloud-builder-configuration-validation https://my-cloudy-world.com/2021/05/28/vmware-cloud-builder-bringup-validation-tasks/

A. Generate Certificate Signing Requests from SDDC Manager - In order to replace the self-signed certificates with third-party signed certificates, the Certificate Signing Requests (CSRs) need to be generated. This can be done from the SDDC Manager UI.

C. Create and package the certificates in a domain_name.tar.gz file - After the CSRs are generated, they can be used to obtain third-party signed certificates from a certificate authority. Once the certificates are obtained, they need to be packaged in a domain_name.tar.gz file and uploaded to SDDC Manager.

Generate Certificate Signing Requests (CSRs) from SDDC Manager for each component that requires a certificate1. You can do this from the SDDC Manager UI or using an API call1.

Have the CSRs signed by a third-party Certificate Authority of your choice1. You can use any external provider that meets your security policy requirements.

Create and package the certificates in a domain_name.tar.gz file according to the naming convention and folder structure specified by SDDC Manager1. You can use any compression tool that supports gzip format.

Upload and install the certificates using SDDC Manager UI or API1. You can also verify and troubleshoot the certificate installation using SDDC Manager.

https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-admin/GUID-80431626-B9CD-4F21-B681-A8F5024D2375.html

To create a VI workload domain with VMFS on FC storage, the hosts must be commissioned with VMFS on FC as the storage type and must be associated with a vMotion only or vMotion and NFS network pool. https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-4EBF9094-F732-4800-86FF-30C5D88B9758.html

To deploy a VI Workload Domain with VMFS on FC storage, the hosts must be associated with a network pool that contains the vMotion network information. This is because the vMotion network is required for adding a host to the SDDC Manager inventory and for migrating workloads between hosts.

A NFS only network pool, a network pool with vMotion and iSCSI, or an iSCSI only network pool are not valid options for deploying a VI Workload Domain with VMFS on FC storage. These network pools are used for different types of storage, such as NFS, vVols on iSCSI, or vSAN.

The references are:

Network Pool Management, section “Information Required for a Network Pool”

Hosts | VMware Cloud Foundation API Reference Guide APIs, section “The hosts, if intended to be used for VMFS on FC, domain must be associated with either a NFS enabled or vMotion enabled network pool.”

The correct tool to use for replacing the vSAN Witness appliance for a VMware Cloud Foundation stretched vSAN cluster is the vSphere Client. According to the VMware Cloud Foundation documentation1, you can replace or change the vSAN witness host for a stretched cluster using the vSphere Client without affecting life cycle operations of SDDC Manager. You need to select a new host to use as the vSAN witness host, claim disks on the new witness host, and review the configuration.

vSphere Update Manager is not the correct tool, because it is used for patching and upgrading ESXi hosts, not for replacing vSAN witness hosts2

SDDC Manager is not the correct tool, because it does not have a workflow for replacing vSAN witness hosts. You need to use the vSphere Client for this task1

vSAN PowerCLI is not the correct tool, because it is a PowerShell module that provides cmdlets for managing and automating vSAN environments, not for replacing vSAN witness hosts3

References: 1: Change the vSAN Witness Host in a Stretched Cluster - VMware Docs 2: Upgrade ESXi Hosts Using vSphere Update Manager - VMware Docs 3: VMware PowerCLI User’s Guide - VMware Docs