Part-IV vCloud Director
Networking in VMware vCloud Director (vCD)
1️⃣ Integration with NSX-T and NSX-V
vCloud Director integrates tightly with VMware NSX, the network virtualization platform that enables software-defined networking (SDN). Depending on the environment, vCD can use NSX-V (legacy) or NSX-T (modern).
🔹 NSX-V Integration (Legacy)
● Uses VXLAN as the network encapsulation technology.
● Networking is based on:
○ Distributed Logical Routers (DLRs)
○ Edge Services Gateways (ESGs)
● Each OrgVDC gets one or more Edge Gateways for routing, NAT, and firewall services.
● Network Pools are VXLAN-backed.
Limitations:
● NSX-V is deprecated (EOL after vSphere 8).
● Not compatible with Kubernetes or vSphere 8.
● Migration to NSX-T is strongly recommended.
🔹 NSX-T Integration (Modern Architecture)
● Uses Geneve encapsulation for overlays.
● Fully supports:
○ Tier-0 and Tier-1 gateways
○ Distributed routing
○ Policy-based security
○ Micro-segmentation
● Each tenant OrgVDC connects to a dedicated Tier-1 Gateway that uplinks to a Provider-managed Tier-0 Gateway.
● Provides isolation, scalability, and automation.
Benefits:
● Multi-tenant isolation with shared Tier-0 uplinks.
● Native Load Balancing, VPN, and NAT support.
● Supports Kubernetes CSE (Container Service Extension).
🔹 Typical NSX-T Integration Workflow
[ Physical Network ]
↓
[ NSX-T Tier-0 Gateway ]
↓
[ Tenant Tier-1 Gateway (OrgVDC Edge) ]
↓
[ Org Network / vApp Network ]
↓
[ VMs / vApps ]
Each OrgVDC’s networking stack is built on NSX-T Tier-1 routers, ensuring complete isolation and self-service network control.
2️⃣ Network Types in vCloud Director
vCloud Director defines three main network types, each serving a different scope and purpose.
🔸 External Networks
● Managed by the provider.
● Represent connections to the physical datacenter network or internet.
● Backed by NSX-T Tier-0 or VLAN-backed segments.
● Shared among multiple tenants.
Usage: Provide outbound internet access or connect multiple tenants to a shared upstream service (e.g., LDAP, NTP).
🔸 Organization (Org) Networks
● Belong to a specific tenant OrgVDC.
● Created and managed by tenant administrators.
● Backed by NSX-T Segments.
● Can be:
○ Routed: Connected to an Edge Gateway (default).
○ Isolated: Internal only, no external routing.
○ Direct: Connected directly to an external network.
Usage: For VM-to-VM or vApp-to-VM communication within a tenant.
🔸 vApp Networks
● Exist within a single vApp.
● Created on-demand by tenants when deploying vApps.
● Used for internal communication between VMs in the same vApp.
● Can be fenced (isolated) or connected to an Org Network.
Usage: Lab or application environments needing internal routing, independent from the tenant’s Org network.
🔹 Network Hierarchy Overview
External Network (Provider-managed)
↓
Org Edge Gateway (Tier-1)
↓
Org Networks
↓
vApp Networks
↓
VMs
3️⃣ Edge Gateways
The Edge Gateway is the network gateway appliance for each OrgVDC. In NSX-T, it corresponds to a Tier-1 Logical Router.
Configuration and Role
● Handles north-south traffic between tenant networks and the external network.
● Provides the following services:
○ Routing
○ NAT (SNAT/DNAT)
○ DHCP
○ Firewall
○ VPN (IPSec and SSL)
○ Load Balancing
High Availability (HA)
● In NSX-T, Tier-1 Gateways can be deployed in Active/Standby mode for redundancy.
● Provider Tier-0 Gateways usually use ECMP (Active/Active) for scalability.
● HA failover is automatic and transparent to tenants.
Edge Service Levels
Service | Purpose |
Routing | Connects Org networks to external uplinks. |
NAT | Translates internal IPs to public/external IPs. |
Firewall | Controls ingress/egress per network. |
VPN | Provides site-to-site or remote access connectivity. |
Load Balancer | Distributes traffic to backend VMs. |
DHCP | Provides IP addressing for tenant networks. |
4️⃣ Tenant Networking Isolation
Tenant isolation is achieved through NSX logical constructs and OrgVDC boundaries.
● Each tenant gets a dedicated Tier-1 Gateway.
● Each Org Network has its own Geneve/VXLAN segment.
● Routing between Org Networks is localized to the tenant’s Edge.
● Security policies (firewall, NAT) are scoped per OrgVDC.
Benefits:
● No VLAN sprawl — thousands of isolated overlays.
● No cross-tenant visibility.
● Consistent security boundaries across multiple tenants.
5️⃣ Advanced Networking
Tier-0 and Tier-1 Gateways
● Tier-0 Gateway (Provider Managed): Connects to the physical network (North-South routing). Aggregates multiple Tier-1 gateways.
● Tier-1 Gateway (Tenant Managed): Handles internal routing (East-West) for tenant networks.
Design Example:
Tier-0 (Provider)
├── Tier-1 (Tenant-A)
│ ├── Org Network 1
│ └── Org Network 2
└── Tier-1 (Tenant-B)
└── Org Network 3
Route Advertisement and BGP
● Tier-0 Gateways advertise connected routes to physical routers using BGP.
● Tier-1 Gateways can selectively advertise tenant networks to Tier-0.
● Provides dynamic routing and scalable cloud networking.
Common BGP Design:
● ECMP-enabled Tier-0 with dual uplinks.
● eBGP peering with ToR switches.
● Tenant routes summarized and propagated dynamically.
6️⃣ Network Pools and Backing Types
Network Pools define how networks are created and backed in NSX/vCenter.
Pool Type | Backing | Use Case |
VXLAN-backed | NSX-V | Legacy VXLAN overlays |
Geneve-backed | NSX-T | Modern overlay networks |
VLAN-backed | Physical VLAN | Direct L2 connectivity |
Port Group-backed | vSphere PG | Simple single-tenant networks |
Each pool provides segments from which vCD automatically assigns Org and vApp networks when tenants create them.
7️⃣ DHCP, NAT, and Firewall Rules
A. DHCP Services
● DHCP servers are built into NSX Edge.
● Managed per Org Network or OrgVDC.
● Support for:
○ Static bindings
○ Lease management
○ IP pool automation
Example Terraform DHCP Config:
resource "vcd_dhcp_pool" "web_network_dhcp" {
org_network_id = vcd_network_routed.web_net.id
ip_range {
start_address = "192.168.10.50"
end_address = "192.168.10.100"
}
default_lease_time = 3600
max_lease_time = 7200
}
B. NAT Configuration
● SNAT: For outbound traffic.
● DNAT: For inbound traffic.
Example PowerCLI:
Connect-CIServer -Server vcd.cloud.local -User admin -Password pass
$edge = Get-EdgeGateway -Name "TenantA-Edge"
New-NatRule -EdgeGateway $edge -Type SNAT -OriginalIp 192.168.10.0/24 -TranslatedIp 203.0.113.10
C. Firewall Rules
● Enforced at the Edge Gateway level.
● Support stateful inspection.
● Configurable via API, UI, PowerCLI, or Terraform.
Example Terraform:
resource "vcd_nsxt_firewall_rule" "allow_https" {
edge_gateway_id = vcd_nsxt_edge_gateway.tenant.id
name = "Allow HTTPS"
direction = "in"
source_ips = ["any"]
destination_ips = ["192.168.10.10"]
action = "allow"
services = ["HTTPS"]
}
8️⃣ Load Balancing and VPN in vCD
A. Load Balancing
● Provided via NSX Edge Gateway.
● Supports:
○ Layer 4 and Layer 7 balancing
○ Health monitoring
○ SSL termination
● Configuration available in both UI and Terraform/PowerCLI.
Example Terraform:
resource "vcd_lb_virtual_server" "web_lb" {
edge_gateway_id = vcd_nsxt_edge_gateway.tenant.id
name = "Web-LB"
pool_id = vcd_lb_pool.web_pool.id
ip_address = "203.0.113.11"
protocol = "HTTP"
port = 80
}
B. VPN Services
● IPSec VPN: Site-to-site tunnels.
● SSL VPN: Remote client access.
Common Use Case:
● Tenant establishes secure connection between vCD OrgVDC and on-prem datacenter.
● Managed independently per tenant, preserving isolation.
9️⃣ Network Automation with Terraform & PowerCLI
A. Terraform Automation
Provider: vmware/vcd
Enables IaC-driven network management:
● Create Org Networks
● Configure Edge Gateways
● Manage DHCP/NAT/Firewall
● Deploy Load Balancers
Example Workflow:
terraform init
terraform plan
terraform apply
Output:
Apply complete! Resources: 4 added, 0 changed, 0 destroyed.
B. PowerCLI Automation
PowerCLI supports the VimAutomation.Cloud module for vCD operations.
Example: Create Org Network
Connect-CIServer -Server vcd.mycloud.local -User admin -Password 'VMware123!'
$org = Get-Org -Name "TenantA"
$vdc = Get-OrgVdc -Org $org -Name "TenantA-VDC"
New-OrgVdcNetwork -OrgVdc $vdc -Name "AppNetwork" -Gateway "192.168.20.1" -Netmask "255.255.255.0"
C. CI/CD Integration
● Combine Terraform + GitLab CI pipelines for automated tenant onboarding.
● Trigger network deployments via API hooks.
● Export configurations using PowerCLI for compliance audits.
✅ Summary Table: vCD Networking
Component | Description |
NSX-V / NSX-T | Underlying SDN platform. |
External Network | Provider-managed uplink network. |
Org Network | Tenant-level network (routed/isolated/direct). |
vApp Network | Intra-vApp connectivity. |
Edge Gateway | Provides routing, NAT, FW, VPN, LB. |
Tier-0 / Tier-1 | Routing hierarchy (Provider vs Tenant). |
Network Pools | Source of network segments for Org/vApp. |
Automation | Terraform & PowerCLI for IaC and scripting. |
⚙️ Part 4: Storage and Compute Resource Management in vCloud Director
(~10 pages of architect-level detail)
1️⃣ Storage Policies in vCloud Director
Storage policies in vCD determine where and how tenant VMs are stored. They map vSphere Storage Policies (defined in vCenter) into vCD as Storage Profiles, giving tenants logical storage tiers such as Gold, Silver, Bronze.
🔹 How It Works
In vCenter, administrators define Storage Policies using capabilities like:
○ vSAN storage classes (All-Flash, Hybrid)
○ Datastore tags (SSD, Archive)
○ Vendor capabilities (e.g., IOPS, RAID levels)
In vCD, these are imported and exposed as Storage Profiles.
Each OrgVDC is assigned one or more storage profiles that tenants can consume.
🔹 Benefits
Benefit | Description |
Tiering | Offer Gold/Silver/Bronze storage tiers. |
Isolation | Prevent tenants from accessing provider datastores directly. |
Policy Control | Align SLAs with performance (SSD vs HDD vs Archive). |
Automation | Assign storage dynamically during vApp deployment. |
🔹 Example Scenario
Storage Policy | Backing Datastore | Tier | Purpose |
Gold SSD | vSAN-AllFlash-01 | High Perf | Production DB VMs |
Silver SATA | NFS-Tier2 | Mid-Range | App/Web Servers |
Bronze Archive | NFS-Archive | Low Cost | Backup or Test VMs |
Tenants select the storage profile when creating VMs or vApps.
2️⃣ Datastore Mapping and Storage Tiering
Storage tiering allows providers to offer different performance levels based on backend storage capabilities.
🔹 Datastore Mapping Process
vCenter Level:
Datastores are grouped into storage policies.
vCD Level:
Provider maps these policies to Storage Profiles within a Provider VDC.
Tenant Level:
Tenants consume these profiles through OrgVDCs.
vCenter Datastores → Storage Policies → vCD Storage Profiles → OrgVDC Allocation
🔹 Storage Tier Design Guidelines
Tier | Backing Storage | Latency | Cost | Typical Use |
Gold | vSAN All-Flash / SSD | Low | High | Mission-Critical DBs |
Silver | SATA / Hybrid | Medium | Medium | App Servers |
Bronze | NFS Archive | High | Low | Test / Backup Workloads |
🔹 Storage Policies and Compliance
vCD continuously evaluates whether VMs comply with their assigned storage policy. If a datastore changes capability, vCD flags the VM as Non-Compliant.
3️⃣ Compute Policy and Affinity Rules
🔹 Compute Policies in vCD
Compute policies control how CPU and Memory resources are allocated to VMs. They act as abstractions of vSphere compute configurations and are used to enforce placement logic.
Type | Description |
Placement Policy | Controls where VMs can run (based on cluster or host tags). |
Sizing Policy | Defines CPU/Memory limits and shares for VM deployments. |
These policies ensure VMs adhere to performance and licensing boundaries (e.g., pinning Windows VMs to specific clusters).
🔹 Affinity and Anti-Affinity Rules
vCD leverages vSphere DRS rules to maintain VM placement relationships.
Rule Type | Purpose | Example |
Affinity Rule | Keep VMs on the same host for low latency. | DB and App VMs on same ESXi |
Anti-Affinity Rule | Separate VMs for HA and fault tolerance. | Web Servers on different ESXi hosts |
vCD translates these rules into DRS policies within vCenter automatically.
🔹 Compute Policy Automation
Terraform Example:
resource "vcd_vm_sizing_policy" "large_vm" {
name = "Large-VM-Policy"
cpu_count = 8
memory_in_mb = 32768
}
PowerCLI Example:
New-ComputePolicy -Name "Gold-CPU-Policy" -CpuReservationMHz 4000 -MemoryReservationMB 16000
4️⃣ Fast Provisioning and Linked Clones
Fast Provisioning in vCD optimizes storage usage and VM deployment time using linked clones.
🔹 Mechanism
● When enabled, new VMs are created as linked clones of a base template.
● They share the same virtual disk blocks until changes occur (write-time copy-on-write).
● Significantly reduces space and speeds up provisioning.
Example Benefit:
● Deploying 10 VMs from a 20 GB template → only ~22 GB total used (with Fast Provisioning).
🔹 Design Considerations
Factor | Recommendation |
Storage Type | Use vSAN or NFS for linked clone support. |
Performance | Disable for heavy I/O workloads. |
Snapshots | Linked clones increase dependency chains – manage carefully. |
Template Placement | Keep templates on same datastore as OrgVDC for speed. |
5️⃣ IOPS Limits and Resource Control
vCD allows providers to enforce performance quotas through IOPS and compute limits, ensuring fair usage in shared environments.
🔹 IOPS Limit Per VM Disk
● Define min/max IOPS values per storage profile.
● vCD translates these to vSphere Storage I/O Control (SIOC) settings.
Example Configuration:
Profile | IOPS Min | IOPS Max |
Gold SSD | 500 | 5000 |
Silver SATA | 100 | 1000 |
Bronze Archive | 10 | 200 |
If a tenant exceeds their limit, I/O is throttled without impacting other tenants.
🔹 CPU and Memory Control
● CPU Reservation & Limit: Guarantee or cap CPU MHz per OrgVDC.
● Memory Reservation & Limit: Guarantee RAM per VM or tenant.
● Shares: Prioritize tenants during contention.
Example Allocation Model:
OrgVDC: 100 GHz CPU (50% Reserved), 200 GB RAM (Guaranteed)
🔹 Provider Quotas and Billing
● Resource usage (GB, GHz, IOPS) can be exported to vRealize Operations or Cloud Provider Commerce Portal.
● Supports pay-as-you-consume and reservation-based billing models.
6️⃣ Multi-Tenancy Resource Isolation
Multi-tenancy in vCD is achieved through OrgVDC boundaries, ensuring each tenant operates in a secure, dedicated slice of the provider infrastructure.
🔹 Isolation Mechanisms
Layer | Isolation Type | Technology |
Compute | Resource Pools / DRS | vCenter |
Storage | Storage Profiles / Datastore Policies | vSphere |
Network | NSX Segments / Tier-1 Gateways | NSX-T |
Access Control | RBAC and Org Scoped API Tokens | vCD |
🔹 OrgVDC Boundary Example
Provider VDC: Cloud-Infra-01
├── OrgVDC-TenantA (Gold, Tier-1-A)
├── OrgVDC-TenantB (Silver, Tier-1-B)
└── OrgVDC-TenantC (Bronze, Tier-1-C)
Each tenant has its own isolated resource pool, datastore access, and network stack.
🔹 Security and Performance Considerations
● Enforce hard limits on OrgVDC CPU/RAM to avoid “noisy neighbor” effects.
● Use dedicated storage policies for premium customers.
● Implement DRS anti-affinity to prevent cross-tenant VM placement on same host.
● Regularly audit resource allocation through vROps.
7️⃣ Automation Examples
Terraform: Create OrgVDC with Storage Profiles
resource "vcd_org_vdc" "tenantA_vdc" {
org = "TenantA"
name = "TenantA-VDC"
allocation_model = "AllocationPool"
compute_capacity {
cpu {
allocated = 100000
limit = 100000
}
memory {
allocated = 204800
limit = 204800
}
}
storage_profile {
name = "Gold"
limit = 2048
default = true
}
}
PowerCLI: Set VM Storage Profile and IOPS Limit
Connect-CIServer vcd.provider.local -User admin -Password 'VMware123!'
$vm = Get-CIVM -Name "DB-Server01"
Set-CIVM -VM $vm -StorageProfile "Gold" -CpuLimitMHz 4000 -MemoryLimitMB 8192
8️⃣ Best Practices Summary
Category | Best Practice |
Storage | Use policy-based storage mapping and enable vSAN Storage Policies. |
Compute | Use compute policies to control placement and performance. |
Fast Provisioning | Enable only for test/dev tenants. |
IOPS Control | Define IOPS min/max per storage profile to prevent contention. |
Resource Isolation | Use dedicated OrgVDCs and separate Tier-1 Gateways per tenant. |
Monitoring | Integrate vROps for capacity planning and chargeback. |
✅ In Summary
● Storage Policies map vSphere capabilities to tenant consumable profiles.
● Datastore Mapping and Tiering provide SLA-based storage control.
● Compute Policies and Affinity Rules ensure placement consistency and performance.
● Fast Provisioning enhances efficiency through linked clones.
● IOPS Limits and Quotas enforce fair usage in shared clouds.
● Multi-Tenancy Resource Isolation guarantees security and predictable performance for each tenant.
========================================================================
Tenant Operations and Portal Management
1️⃣ Overview: Tenant Experience in vCloud Director
The tenant in vCloud Director represents a customer organization, department, or business unit that consumes resources (compute, storage, and network) provided by the cloud provider or enterprise IT.
Each tenant operates within an Organization (Org) that contains:
● One or more Org Virtual Data Centers (OrgVDCs)
● vApps and VMs
● Catalogs (vApp templates, ISO media)
● Networks and Edge Gateways
● Users and Roles (RBAC)
The Tenant Portal gives full visibility and control over these components in a secure, isolated, self-service interface.
2️⃣ Tenant Portal Features
The vCloud Director Tenant Portal (HTML5 UI) provides a modern, responsive dashboard for self-service operations. Accessible via:
https://<vcd-fqdn>/tenant/<organization_name>/
🔹 Key Features Overview
Feature | Description |
Dashboard | Overview of resources (CPU, RAM, storage usage). |
vApps & VMs | Create, power on/off, snapshot, clone, and delete workloads. |
Networks | Create Org networks, attach to vApps, manage firewall and NAT. |
Edge Gateways | Configure routing, load balancing, and VPN. |
Catalogs | Upload ISO files, manage templates, share with others. |
Users & Roles | Create organization users with specific access rights. |
Tasks & Events | Track all ongoing operations with detailed audit logs. |
Reports | Export usage statistics and billing summaries. |
🔹 Tenant Portal Dashboard Example (Conceptual View)
------------------------------------------------------------
| Org: Tenant-A | Usage Summary |
|-----------------------------------------------------------|
| CPU: 42 GHz used of 100 GHz | Memory: 85 GB / 200 GB |
| Storage: 1.8 TB / 4 TB | VMs: 15 active |
|-----------------------------------------------------------|
| [Create vApp] [New Network] [Upload Template] [Add User] |
------------------------------------------------------------
Tenants can operate independently, without provider intervention, while still being governed by the provider’s global policies.
3️⃣ Catalog Management
Catalogs in vCloud Director are repositories that store vApp templates, ISO images, and scripts for rapid deployment.
They enable standardization and self-service provisioning.
🔹 Catalog Types
Type | Scope | Managed By |
Public Catalog | Shared across multiple organizations | Provider |
Organization Catalog | Private to a specific Org | Tenant Admin |
External Catalog | Published from another vCD site or organization | Provider |
🔹 Catalog Components
● vApp Templates: Pre-configured multi-VM applications (e.g., “LAMP Stack”, “Windows AD Template”).
● Media Files: ISO images for OS installation.
● Metadata: Descriptions, versions, and sharing permissions.
🔹 Catalog Workflow
Provider creates a Public Catalog with standard templates.
Tenants can:
○ Subscribe to public catalogs.
○ Copy templates to their private catalog.
○ Deploy vApps from catalog templates.
Updates to the public catalog are automatically propagated to subscribed tenants.
🔹 Example: Terraform Catalog Creation
resource "vcd_catalog" "tenant_catalog" {
org = "TenantA"
name = "TenantA-AppCatalog"
description = "Private templates for internal workloads"
}
🔹 Best Practices for Catalogs
● Maintain versioned templates (e.g., Win2022_v1, Win2022_v2).
● Use Public Catalogs for standard OS and DB builds.
● Restrict ISO uploads for compliance and storage optimization.
● Enable catalog synchronization between sites for DR and consistency.
4️⃣ Role-Based Access Control (RBAC)
vCloud Director implements fine-grained RBAC at the Organization level to ensure secure, role-specific access to resources.
🔹 RBAC Components
Component | Description |
Users | Accounts within the organization. |
Roles | Sets of permissions assigned to users. |
Rights Bundles | Grouped permissions managed by the provider. |
LDAP/AD Integration | Enables centralized authentication. |
🔹 Built-in Roles
Role | Access Scope |
System Administrator | Full provider-level control. |
Organization Administrator | Manage users, catalogs, and networks in their Org. |
vApp Author | Deploy and manage vApps and VMs. |
Catalog Author | Create and share catalog items. |
Console Access Only | Limited to VM console access. |
Read-Only User | View resources, no modification rights. |
🔹 Role Assignment Example
User | Role | Permissions |
John | Org Administrator | Manage entire OrgVDC |
Alice | vApp Author | Deploy and power on vApps |
Bob | Console Access | VM Console only |
Priya | Read-Only | View reports only |
🔹 Integration with LDAP/AD
vCD can connect to Active Directory or LDAP for user federation:
● Define LDAP endpoint in System > Administration > Identity Sources.
● Map AD groups to vCD roles.
● Enable Single Sign-On (SSO) with SAML or VMware Identity Manager.
🔹 Security Best Practices
● Limit direct System Admin access; delegate to Org Admins.
● Use custom roles for fine-grained access.
● Enable 2FA / SAML for external tenants.
● Regularly audit user rights and catalog permissions.
5️⃣ Federation and Multisite Management
vCloud Director supports federation to link multiple vCD instances across regions or datacenters, providing global service continuity and unified access.
🔹 Federation Concepts
Component | Description |
Multisite Configuration | Connects multiple vCD instances for unified portal access. |
Global Catalogs | Replicated or shared templates between sites. |
Cross-Site Authentication | Users log in once and access all sites. |
Workload Mobility | Move vApps/VMs between sites using vCloud Availability. |
🔹 Federation Benefits
● Geo-distributed cloud with a single tenant view.
● DR and workload mobility using vCloud Availability (vCDA).
● Consistent catalogs and templates across multiple data centers.
● Simplified provider management for multi-region MSPs.
🔹 Example Use Case
Site | Region | Purpose |
Site-A | Mumbai | Primary Production |
Site-B | Amsterdam | DR / Failover |
Site-C | Singapore | Test & Dev |
All sites share a common tenant identity and catalog synchronization through federation.
6️⃣ Self-Service VM and vApp Operations
The tenant portal allows complete VM lifecycle management, giving tenants cloud-like autonomy.
🔹 Common Operations
Operation | Description |
Create vApp | Combine multiple VMs and networks into a single deployable unit. |
Power On/Off / Suspend / Reset | Manage VM states directly from the UI or API. |
Snapshot / Revert | Create and restore VM snapshots. |
Clone / Copy | Duplicate VMs or vApps. |
Console Access | HTML5 remote console (no vSphere access needed). |
Network Connection | Connect/disconnect NICs to Org or vApp networks. |
Storage Profile Change | Move VM between storage tiers (Gold → Silver). |
🔹 Example: vApp Deployment from Catalog
Step 1: Tenant selects catalog → template (e.g., Ubuntu-LAMP). Step 2: Chooses network → OrgVDC → storage policy. Step 3: vCD deploys VM(s) via vCenter API. Step 4: Tenant configures IPs and starts the application.
All of this happens without any provider intervention.
🔹 PowerCLI Example: VM Creation
Connect-CIServer -Server vcd.tenant.local -User "alice" -Password "Tenant@123"
New-CIVApp -Name "WebApp01" -OrgVdc "TenantA-VDC" -Catalog "TenantA-Catalog" -Template "Ubuntu-WebServer"
Start-CIVApp -VApp "WebApp01"
🔹 Terraform Example: vApp Deployment
resource "vcd_vapp" "webapp" {
name = "WebApp01"
org = "TenantA"
vdc = "TenantA-VDC"
network {
name = "AppNetwork"
}
power_on = true
}
🔹 VM Console Access
● vCD provides HTML5 console (no vSphere Client required).
● Accessible directly from the tenant portal.
● Uses WebSocket tunneling via the vCD cell.
7️⃣ Task Monitoring and Audit
Every operation in vCD (VM creation, network change, etc.) generates task and event logs that are visible in the portal and via API.
Log Type | Description |
Tasks | Real-time progress (e.g., "Creating vApp..."). |
Events | Completed actions with status (success/failure). |
Audit Logs | System-level operations (e.g., user logins, API calls). |
Integration: These logs can be sent to vRealize Log Insight or SIEM for compliance.
8️⃣ Reporting and Usage Monitoring
Tenants can view usage metrics via the portal:
● CPU, RAM, and Storage consumption.
● VM uptime reports.
● Edge Gateway throughput.
● Billing reports (if integrated with vCloud Usage Meter or vROps).
Provider Integration:
● Providers use VMware Chargeback Manager or vROps Tenant App to generate invoices based on resource consumption.
9️⃣ Best Practices for Tenant Management
Area | Recommendation |
Catalogs | Maintain versioned templates, automate sync between sites. |
RBAC | Use LDAP and custom roles for fine control. |
Federation | Use multisite federation for DR and global reach. |
Automation | Empower tenants with Terraform & PowerCLI. |
Security | Limit Org Admin privileges and enforce MFA. |
Monitoring | Export usage data to vROps for visibility. |
✅ In Summary
Concept | Description |
Tenant Portal | Self-service access for all vApp, VM, and network operations. |
Catalogs | Predefined templates and media repositories for rapid deployment. |
RBAC | Fine-grained access control for secure multi-tenancy. |
Federation | Enables multi-site vCD management with unified login and catalogs. |
Self-Service Operations | Empower tenants with full lifecycle control and automation tools. |
Comments