Configure vSphere Supervisor in VCF 9
Configure vSphere Supervisor in VCF 9 with VPC networking. Follow lab activation steps, content library setup and the Supervisor update workflow.
Overview
This walkthrough configures vSphere Supervisor in VCF 9 with NSX VPC networking on my workload domain. I cover the lab prerequisites, activation, content library and Supervisor update workflow.
Availability and trust boundaries
The single control-plane VM and relaxed host failover settings in this walkthrough are lab capacity choices. Host HA admission control and Supervisor Control Plane HA are different settings. Disabling one does not provide the redundancy of the other.
- For a resilient deployment, plan the supported host capacity, storage policy and control-plane HA topology for the selected release. Review the compatibility report before proceeding.
- A degraded-mode warning is not explained simply by assuming that there is only one VM. Read the detailed precheck, resolve unknown causes and retain the report.
- Before trusting a content-library certificate, verify the publisher URL and certificate chain/name or compare its fingerprint with a trusted, independently obtained value. Cancel if it does not match.
Broadcom documents a specific VCF 9.0.1 deployment race condition where a single-node retry can be followed by enabling Control Plane HA. That is a scoped workaround, not general permission to leave HA disabled: Supervisor deployment KB.
More Kubernetes, Less Waiting: Upgrade vSphere Supervisor Without updating vCenter
Prerequisites
In order to complete this configuration you will need the following requirements to be met:
- VCF 9.0 environment deployed
- NSX VPC configured with Centralized Transit Gateway
- 5 consecutive IP addresses for the vSphere Supervisor Control Plane VM
- If you are using vSAN, ensure no alerts are present
- The reduced-capacity lab can encounter HA admission failures. Do not bypass these in a supported deployment: resolve capacity and topology requirements and preserve the required failover protection.
Activate vSphere Supervisor
Login to your vCenter server web interface.
Right click on the vSphere cluster and select Activate Supervisor.
Then click on the Advanced Topologies link in the pop-up
We are going to use VCF Networking with VPC for the network stack, that is pre-selected so click Next to continue.
If you have multiple vCenters linked together, ensure you have the correct vCenter selected in the dropdown for your cluster.
Click on Cluster Deployment.
You should see your cluster show up under compatible clusters, click the radio button next to that cluster. Then provide a name for the supervisor along with a name for the vSphere zone. Click Next.
Choose a storage policy for the control plane and click Next.
At the Network Management screen, pick the network method and network you want to use. I am going to use static so I can manually assign the IPs I want to use, then enter the necessary information for your environment. Once all the information is entered, click Next.
The Workload Network should automatically detect the NSX VPC connections and provide that information for you, fill in the DNS and NTP server information for your environment and click Next.
Select the desired vSphere Supervisor Control Plane vm size and a DNS name if you want an easier way for accessing the vSphere Supervisor endpoint. This will resolve to the first IP address that was provided at the Management Network screen. Click Next.
***There is a checkbox to export the configuration as well if you want to store this information***
Click Finish to complete the setup.
The vSphere Supervisor will begin deployment.
If you want to follow the progress, click the View link next to Configuring.
You will get a pop-up then showing the progress.
Create and assign the content library
While the vSphere Supervisor is deploying, we need to create a content library for the supervisor enablement and upgrades. Click the 3 horizontal lines in the top left and select Content Libraries.
Click Create.
Give the new content library a name and ensure you have the vCenter selected where your vSphere Supervisor is located. Click Next.
Click the radio button next to Subscribed content library and enter in the following URL: https://wp-content.vmware.com/supervisor/v1/latest/lib.json. Click Next
If a Security Alert appears, inspect the certificate and verify its identity through a trusted channel before accepting it. Cancel on an unexplained mismatch.
Assign a security policy for this content library if you want to, I don’t have any created. Click Next.
Click the radio button next to the storage location where you want this content library stored and click Next.
Click Finish to complete the content library creation.
Click the 3 horizontal lines and select Supervisor Management.
Click on Content Distribution > Assign. If you have multiple vCenters linked together, ensure you have the vCenter where the supervisor is located selected
Select the content library we just created and click Assign.
You will receive a confirmation message and the assigned library will change.
It will take some time for the vSphere Supervisor to deploy and configure the workload domain but should complete within an hour depending upon the hardware you have running in your environment.
Update the Supervisor
Once your supervisor service is running, click on the Updates tab.
If you see any updates available, it would be a good time to apply them and have the latest version available. I have an update available for my supervisor.
Click the radio button next to the supervisor name and click Apply Updates.
Click Proceed in the Upgrade Impact pop-up
The Pre-Checks screen will come up and begin preparing for the upgrade. Click Next to continue the upgrade.
My single-control-plane lab reported Supervisor VM and degraded-mode compatibility warnings. I did not establish the exact cause of every warning. Review their details and the supported Control Plane HA configuration; do not treat all such warnings as harmless.
If warnings remain, investigate and document their impact before proceeding. Do not continue past an unexplained compatibility or availability warning.
Click Finish to start the upgrade.
If you want to follow along with the upgrade, click on the Supervisors tab and click the View link next to Configuring.
It took about an hour for this update to complete and it resulted in a new supervisor being deployed.
Next steps
Now that we have that deployed we can start configuring Kubernetes and VCF Automation to use this workload domain, I will configure these in future posts.
Follow along with my VCF 9 Lab journey.