Private Cloud Automation for VMware Cloud Foundation

Decision: /008); NSX cloud account via service account; Orchestrator-to-vCenter integration with dedicated service accounts.

Rationale: Password ManagementRoot password rotated via SDDC Manager UI/API (managed by SDDC Manager, not Aria Suite Lifecycle in VCF mode).

Implication: CertificatesCA-signed cert with all cluster FQDNs + VIP in SAN; SHA-2+; Orchestrator imports CA root cert to trust vCenter/NSX/Operations.

Component: VAA

Decision: Deploy Aria Automation as 3-node cluster in default mgmt vSphere cluster.

Rationale: Manages multiple VCF instances from one implementation; can also manage VMC/public cloud.

Implication: WS1 Access cluster must be medium to support scale; maintain within concurrency maximums.

Component: VAA

Decision: Deploy Aria Automation in Aria Suite Lifecycle logical environment in VCF mode.

Rationale: Cluster added to SDDC Manager inventory for LCM; SDDC Manager automates NSX LB on dedicated Tier-1 gateway.

Implication: Must deploy as cluster; only one Aria Automation deployment can be in VCF mode; NSX LB required.

Component: VAA

Decision: Protect cluster VMs with vSphere HA.

Rationale: Availability objective.

Implication: No significant trade-offs identified for this decision.

Component: VAA

Decision: DRS anti-affinity rules for cluster VMs.

Rationale: Prevent co-location.

Implication: Additional config; 4-host cluster limits maintenance to 1 host at a time.

Component: VAA

Decision: VM group for cluster VMs + VM rule: restart WS1 Access before Aria Automation.

Rationale: Dependency startup order during HA events.

Implication: Manage VM group/rules.

Component: VAA

Decision: Place in dedicated VM folder.

Rationale: Organization.

Implication: Create folder.

Component: VAA

Decision: Deploy cluster nodes as Medium or larger.

Rationale: Typically sufficient; scale up for more workload.

Implication: 36 vCPU / 126 GB in mgmt cluster; 8 cores/socket minimum; scale up via Aria Suite Lifecycle.

Component: VAA

Decision: Place cluster on cross-instance NSX segment.

Rationale: Multi-instance DR support.

Implication: Requires NSX.

Component: VAA

Decision: Static IPs for cluster + LB VIP.

Rationale: Stability, simpler tracking.

Implication: IP address management discipline.

Component: VAA

Decision: Forward/reverse DNS and redundant DNS servers.

Rationale: FQDN accessibility; HA.

Implication: Firewall must allow DNS; maintain records.

Component: VAA

Decision: Use small NSX LB on dedicated Tier-1 gateway in mgmt domain (shared with WS1 Access).

Rationale: Required for cluster deployment; SDDC Manager automates.

Implication: Must use SDDC Manager-configured LB.

Component: VAA

Decision: NTP on each node; same timezone across integrations.

Rationale: Time sync prerequisite.

Implication: NTP HA; firewall allow NTP.

Component: VAA

Decision: Use Aria Suite Lifecycle and SDDC Manager for LCM.

Rationale: Shared lifecycle.

Implication: Follow interoperability matrix.

Component: VAA

Decision: Establish tagging strategy and taxonomy.

Rationale: Capability/constraint tags drive placement.

Implication: Account for external vSphere/NSX tags + internal user-defined tags.

Component: CA

Decision: Apply constraint tags in cloud template YAML.

Rationale: Capabilities matched with constraints at provisioning.

Implication: Manage capability tags on cloud resources.

Component: CA

Decision: Add vCenter cloud account per VI workload domain per VCF instance.

Rationale: Enables provisioning.

Implication: Manage credentials and service accounts; manage capability tags.

Component: CA

Decision: Add NSX cloud account per VI workload domain NSX Manager cluster.

Rationale: Enables NSX-based provisioning.

Implication: Manage credentials; max 199 concurrent API sessions per NSX Manager cluster; external LB needed for higher concurrency; manage capability tags.

Component: CA

Decision: Use default POLICY mode for each NSX cloud account.

Rationale: All NSX entities use Policy API; no migration from MANAGER mode.

Implication: No significant trade-offs identified for this decision.

Component: CA

Decision: Create cloud zone per workload domain; add capability tags to zones, vSphere clusters, default workload folder.

Rationale: Enables targeted provisioning.

Implication: Manage tags as clusters are added; include constraint tags in cloud template YAML; must create workload folder; destination folder must pre-exist.

Component: CA

Decision: Use DEFAULT placement policy for each cloud zone.

Rationale: DRS handles placement within cluster; ADVANCED requires Aria Operations integration.

Implication: No cross-zone advanced placement.

Component: CA

Decision: Use default integration to embedded Orchestrator.

Rationale: Cluster mode, faster, fewer appliances, no external DB.

Implication: Centralized cluster runs workflows for multi-instance.

Component: CA

Decision: Per project: add cloud zones; set provisioning priority; set limits; specify constraints; add custom properties; add custom naming template.

Rationale: Governance and quota control.

Implication: Project constraints override cloud template constraints; project custom properties override cloud template custom properties.

Component: CA

Decision: Create standardized flavor mappings and add all applicable account regions per mapping.

Rationale: Natural language naming for deployment sizes.

Implication: Publish/communicate to template authors.

Component: CA

Decision: Use vSphere Content Library to synchronize machine images across VI workload domains and VCF instances.

Rationale: Built-in, supports OVF/VM templates; Packer-built images supported.

Implication: Global permissions for content library user; storage space; HTTPS between all VI workload domain vCenters; OVF deploy slower than native template clones; potential host maintenance i

Component: CA

Decision: Standardized image mappings.

Rationale: Simple taxonomy.

Implication: Communicate to template authors.

Component: CA

Decision: Add constraint tag per machine image if applicable.

Rationale: Refine selection.

Implication: Manage multiple images per region.

Component: CA

Decision: Add network profiles with capability tags per region/account.

Rationale: Enable workload network placement.

Implication: Manage tags.

Component: CA

Decision: Add storage profiles with capability tags (tier:platinum, tier:silver).

Rationale: Enable workload storage placement by tier.

Implication: Manage storage profiles.

Component: CA

Decision: Use embedded on-prem FaaS for action-based extensibility.

Rationale: Lightweight actions without public cloud provider.

Implication: Requires outbound Internet to pull container images or HTTP proxy via vracli proxy.

Component: CA

Decision: Register each VI workload domain vCenter with embedded Orchestrator; do NOT use per-session auth.

Rationale: vCenter doesn't accept Aria Automation tokens.

Implication: Update plug-in when workload domains are added/removed; run Update workflow when password changes.

Component: VAAO

Decision: Limit local accounts; least privilege; AD security groups; default or custom roles; WS1 Access integration.

Rationale: Auditability and defense-in-depth.

Implication: Maintain AD groups outside SDDC; WS1 Access cluster must support scale.

Component: VAA

Decision: AD user as service account for vCenter cloud account per VCF instance.

Rationale: Least privilege; auditability.

Implication: Maintain service account lifecycle; can separate per workload domain for smaller fault domain.

Component: VAA

Decision: Configure password expiration, complexity, and account lockout policies on Aria Automation appliances.

Rationale: Align with organization/compliance.

Implication: Applies only to local users; manage via console or SSH.

Component: VAA

Decision: Rotate Aria Automation root via SDDC Manager UI/API.

Rationale: SDDC Manager manages root in VCF mode.

Implication: Organizational rotation schedule.

Component: VAA

Decision: CA-signed cert with FQDNs + VIP in SAN.

Rationale: Encrypt external/internal communications.

Implication: Manage via Aria Suite Lifecycle; multi-tenancy on-boarding disrupts tenants during replacement.

Component: VAA

Decision: SHA-2 or higher.

Rationale: SHA-1 deprecated.

Implication: Not all CAs support SHA-2+.

Component: VAA

Decision: Import CA root cert to embedded Orchestrator.

Rationale: Trust vCenter, NSX, Operations certs.

Implication: Re-import if CA is reissued.

Component: VAA

Decision: Use VAOL content pack; default Fluentd to VAOL cfapi port 9000 (supports DR); install Orchestrator content pack manually; dedicated Photon OS agent group.

Rationale: Granular monitoring; DR support.

Implication: Default unencrypted; to encrypt, update via vracli vrli set https://<vaol>:9543.

Component: VAA