VMware Cloud Foundation 5.2 Administrator (2V0-11.25)Demo

The Supportability and Serviceability (SoS) utility on the VMware Cloud Builder appliance collects the deployment and bring-up diagnostic data needed to troubleshoot a failed Management Domain bring-up. SDDC Manager is the appropriate SoS location only after bring-up has completed successfully.

When deduplication is enabled, a single disk failure affects the whole vSAN disk group and the UI may not identify the failed physical device. ESXCLI can list vSAN disk details, identify the failed disk by UUID, and remove the affected disk group as part of remediation.

An expired ESXi host evaluation period or host license causes that individual host to disconnect from vCenter. Existing powered-on VMs continue running, but VMs that are powered off cannot be powered on until the host is properly licensed. In contrast, an expired vCenter Server evaluation or license disconnects all hosts managed by that vCenter instance.

Workload Management requires an available Content Library for the required Kubernetes content, vSphere with Tanzu licensing on every host in the selected cluster, and a deployed, available NSX Edge cluster to provide the required NSX networking. The workflow does not universally require the cluster to use vSAN or prescribe a sufficient number of distributed-switch port groups as a prerequisite.

Inspecting the SDDC Manager appliance with top identifies processes or services consuming excessive CPU; Broadcom documents an SDDC Manager high-CPU case in which top identifies an nfsd process consuming more than 100% CPU. Reviewing CPU utilization and contention on the management-domain ESXi hosts can identify host overcommitment that prevents the SDDC Manager VM from receiving sufficient physical CPU scheduling time.

When a management network on a vSphere Distributed Switch is misconfigured and the host loses vCenter connectivity, the Direct Console User Interface provides the per-host recovery path. Selecting Network Restore Options and then Restore vDS lets the administrator supply the correct VLAN, uplink, and blocked settings; ESXi moves the management VMkernel adapter to a new host-local port so the host can reconnect to vCenter.

A VM storage policy controls the vSAN availability configuration for the VMs to which it is assigned. Setting Failures to Tolerate to 2 with RAID-6 erasure coding protects against two host failures while using an erasure-coded layout optimized for capacity, unlike RAID-1 mirroring, which is optimized for performance. Creating a separate policy preserves the default policy for other workloads, and applying the new policy makes the target VMs use the required storage layout.

Each additional NSX Edge node requires a unique management IP address for management-plane connectivity, two Tunnel Endpoint (TEP) addresses for its overlay transport configuration, and a DNS record so its hostname resolves correctly. Expanding the cluster does not require adding an NSX VDS uplink per new node or placing the existing Edge cluster into maintenance mode.

vSphere IaaS control plane enables the Supervisor capability on vSphere clusters. Kubernetes namespaces consume storage through vSphere storage policies, and NSX supplies the networking stack required for Supervisor/Kubernetes cluster networking. Aria Automation can automate deployments but is not required, and HCX is used for workload migration rather than Kubernetes integration.

vSphere Lifecycle Manager in the VI workload domain vCenter supports bulk VMware Tools upgrades. The VM-level process is performed from a selected cluster’s Updates > VMware Tools view, where the applicable VMs can be selected and upgraded to match the host. Auto Update applies the upgrade at a later power-on or restart, so it does not satisfy an immediate no-reboot upgrade requirement.

A local Content Library must be enabled for publishing before other vCenter Server instances can subscribe to it. Those instances use subscribed libraries that synchronize with the published source; a subscribed library is not the publishing source.

VMware Aria Suite Lifecycle requires routed connectivity between the application virtual networks, management network, and DNS/NTP services. Its FQDN, lcm.vcf.company.com, must have a forward DNS A record resolving to the appliance address, 10.0.0.150. Deployment also requires a free IP address for the standalone NSX Tier-1 gateway service interface used to provide load-balancing for VMware Aria components. A reverse record, if required, would correspond to the appliance IP address rather than the gateway address 10.0.0.1; a CA-signed certificate is not required before deployment.

VCF-aware mode integrates VMware Aria Suite Lifecycle with SDDC Manager, which can create a load balancer in the NSX-T environment when requested during supported Aria component deployment. This load-balancer capability is available only when Aria Suite Lifecycle is deployed through SDDC Manager in VCF-aware mode.

Network I/O Control on a vSphere Distributed Switch applies traffic shares during physical-uplink contention and supports bandwidth allocation for virtual-machine system traffic. A network resource pool supplies the shares, limits, and reservation controls used to prioritize the virtual machines’ network traffic; the virtual-machine traffic type also needs a configured bandwidth allocation.

A vSAN-backed vSphere cluster in a VI Workload Domain requires a minimum of three hosts. vSphere Lifecycle Manager image-managed clusters can use only two hosts only when their principal storage is NFS, VMFS on FC, or vVols; that exception does not apply to vSAN.

A three-VDS management-domain topology is outside the predefined VDS profiles available in the VCF Deployment Parameter Workbook. A custom JSON specification can define the separate VDS assignments for management/vMotion, vSAN, and NSX overlay traffic and is used for the VCF bring-up process.

Workload Management enables vSphere with Kubernetes by deploying the Supervisor, which provides the platform for Kubernetes container orchestration. In VMware Cloud Foundation, the VI Workload Domain is prepared with NSX networking for vSphere with Kubernetes, integrating Supervisor-based workloads with NSX networking.

VMware Cloud Foundation design guidance recommends statically assigned IP addresses for all ESXi hosts, including those in the Management Domain, to provide stable SDDC connectivity and simpler tracking and maintenance.

The VCF upgrade workflow includes taking backups of SDDC Manager and the managed vCenter Server and NSX Manager instances, running SDDC Manager lifecycle prechecks to identify conditions that could prevent a successful upgrade, and initiating the SDDC Manager upgrade from its Lifecycle Management interface. Bundle downloads can be handled through SDDC Manager or an approved offline workflow; disabling DRS and HA on every cluster is not a required upgrade step.

An NSX Edge Cluster must be deployed before Kubernetes Workload Management is enabled for a VI workload domain using NSX networking. Enabling Workload Management provisions the vSphere Supervisor, and a vSphere Namespace with resource quotas supplies the authorized resource boundary in which Tanzu Kubernetes clusters are deployed.

Memory Hot Add permits memory to be added while a virtual machine is running, and CPU Hot Add permits virtual processors to be added while it is running. These hot-add settings must be configured while the virtual machine is powered off. Memory Hot Add does not support removing memory from a running virtual machine.

For a VI workload domain that uses vSphere Lifecycle Manager images, the two-host exception applies to NFS, VMFS on FC, and vVols principal storage. vSAN requires at least three ESXi hosts, while iSCSI and VMFS on local disk are not supported principal-storage options for this configuration.

A least-privilege configuration uses a custom role containing only the privileges the backup tool requires, rather than the built-in Administrator role. The custom role must be created and populated with those necessary privileges. Assigning that role to srvbackup01 on the Production VM folder with propagation enabled extends the permission to the folder’s child objects, including the virtual machines that must be backed up.

Data Services Manager automates security patching and database updates, encrypts communications and supports data protection at rest and in transit, and uses role-based access control to limit database-service access and management to authorized users. Together, these capabilities reduce exposure to known vulnerabilities, protect data confidentiality, and enforce least-privilege access.