, ,

How to Set Up VCF Operations in VCF 9.1 (VCF 9.1 Deployment Series, Part 7)

A step by step guide to setting up VCF Operations in a VMware Cloud Foundation 9.1 fleet, from credentials and licensing to cloud proxy registration and vCenter collection.

VCF 9.1 Deployment · Part 7 of 17
Status: mandatory. VCF Operations is the fleet wide day 2 console for VMware Cloud Foundation 9.1, and it delivers monitoring, capacity, cost, and lifecycle actions for every VCF instance in the fleet. It depends on a management domain that is already built and on VCF Management Services and the license server, because the VCF Operations appliances are deployed by the VCF Installer during management domain bring up and draw their entitlement from the fleet license server.
TL;DR
  • VCF Operations is mandatory in every VCF 9.x deployment. Bring up deploys the analytics node, the fleet management appliance, and the Unified Cloud Proxy collector, so this part configures what bring up leaves for you.
  • Prerequisites: VCF Operations 9.1 online, SDDC Manager 9.1, the license server reachable, forward and reverse DNS, NTP, and an admin password of 15 characters or more.
  • Sizing: use Small only for a lab or proof of concept, and Medium or larger for production analytics nodes. A witness node for continuous availability needs 2 vCPU and 8 GB.
  • Key steps: confirm the passwords, sign in, apply the fleet license, register the Unified Cloud Proxy, add the management vCenter as a cloud account, and confirm the adapter is collecting.
  • Optional scale out: add a data node and activate high availability, then add a witness node for a continuous availability cluster across two zones.
  • Entry points: the VCF Operations UI for licensing and cloud accounts, and Build, then Lifecycle, then VCF Management, then Components for node scale out.

This part shows you how to set up VCF Operations in a VMware Cloud Foundation 9.1 fleet after the management domain is built. In VCF 9.1 the VCF Installer deploys the VCF Operations appliances for you as part of management domain bring up, so you do not run a separate OVA import for the primary analytics node. What remains is configuration. You set the passwords, apply the license held by the fleet license server, connect the Unified Cloud Proxy collector, and register the management vCenter so the platform starts collecting metrics. If you want background on what this product does before you configure it, read what VCF Operations is in VCF 9.

Before you begin, confirm that VCF Operations 9.1 is powered on and reachable by FQDN, that SDDC Manager 9.1 and the license server are online, and that both forward and reverse DNS records resolve for every appliance. Have the admin password ready at 15 characters or more, and decide now whether this fleet runs a single analytics node or a high availability cluster, because adding nodes later restarts the cluster. You configured the license authority in the previous part, VCF Management Services and the license server, and VCF Operations draws its entitlement from there.

Prerequisites

Confirm each item below before you sign in. VCF Operations validates DNS, reachability, and credentials as you connect data sources, so a missing reverse record or an unreachable proxy stops collection rather than the sign in itself.

RequirementValueNotes
VCF Operations9.1, onlineDeployed by bring up in the management domain cluster.
SDDC Manager9.1, onlineRequired for lifecycle and component actions.
License serverReachable by FQDNSingle license authority for the fleet.
Unified Cloud ProxyDeployed, resolves in DNSCollector that reaches vCenter, NSX, and SDDC Manager.
Forward and reverse DNSA and PTR recordsEvery appliance IP resolves back to its FQDN.
NTPSynced sourceClock skew breaks certificate and metric timing.
Admin password15 characters or moreShorter values are rejected by the platform.
Browser accessPort 443Chrome, Edge, or Firefox to the VCF Operations FQDN.

Pick a node size before you scale out. Small builds are for a lab or proof of concept, and production analytics nodes start at Medium. Log nodes and witness nodes have their own floors, shown below.

Node roleSizeWhen to use
Analytics nodeSmallLab or proof of concept only, not production.
Analytics nodeMedium or largerProduction baseline, scale by adding data nodes.
Witness node2 vCPU, 8 GBContinuous availability across two fault domains.
Log nodeMedium or largerEach large log node ingests up to 15000 events per second.
VCF Operations fleet componentsAnalytics nodemetrics and dashboardsFleet management appliancefleet lifecycleUnified Cloud Proxycollector on port 443Data sources in the management domainManagement vCenterNSX ManagerSDDC Manager

Step 1, confirm the VCF Operations credentials

Management domain bring up either sets the VCF Operations passwords from values you typed into the VCF Installer or auto generates them. Confirm you hold both the console root password and the UI admin password before you sign in.

  1. Open the VCF Installer UI that you used for management domain bring up.
  2. Go to the deployment summary and open the credentials panel for the fleet.
  3. Copy the admin password for VCF Operations and store it in your password vault.
  4. If you deployed a node manually instead, open the vSphere Client, right click the VCF Operations virtual machine, and select Launch Web Console.
  5. Sign in to the console as root, then set a root password of 15 characters or more when prompted, because SSH is disabled by default on a new appliance.
  6. Confirm the admin password meets the 15 character minimum, since VCF Operations rejects anything shorter.
Note
Console root and UI admin are two separate accounts with two separate passwords. Record both, because the console root account is your only recovery path if the UI admin password is lost.

Step 2, sign in to the VCF Operations UI

You drive licensing, cloud accounts, and adapters from the VCF Operations user interface.

  1. Browse to https://your-vcf-operations-fqdn in Chrome, Edge, or Firefox.
  2. Select Local Users on the sign in page.
  3. Enter admin as the user name and the admin password you confirmed in Step 1.
  4. Click Login.
  5. Accept the end user license agreement if it appears on first sign in.
  6. Confirm the home page loads and the top navigation shows Build, Operate, and Configure.

Step 3, apply the fleet license

VCF Operations must carry a valid VCF 9.1 license, and in a fleet the license server is the single authority that holds it.

  1. In the VCF Operations UI, open Configure, then Licensing.
  2. Click Add.
  3. Select the VMware Cloud Foundation 9.1 license type.
  4. Confirm the license key that the fleet license server supplies, or paste the key if prompted.
  5. Click Validate and wait for a green check on the key.
  6. Click Save to bind the license to the fleet.
  7. Confirm the licensing page lists the applied license with a future expiry date and the correct core count.

Step 4, register the Unified Cloud Proxy

The Unified Cloud Proxy is the collector that reaches vCenter, NSX, and SDDC Manager on behalf of VCF Operations. Register it before you add any cloud account.

  1. In the VCF Operations UI, open Configure, then Cloud Proxies.
  2. Click New Cloud Proxy to generate a registration key, or copy the key shown for the proxy deployed during bring up.
  3. Confirm the Unified Cloud Proxy appliance is powered on and resolves in DNS by short and long FQDN.
  4. Confirm the proxy can reach the VCF Operations nodes over port 443.
  5. Wait for the cloud proxy to appear in the list with a Collecting or Online state.
  6. Note the collector or group name, because you select it when you add the vCenter account.

Step 5, add the management vCenter account

Adding the management vCenter as a cloud account is what starts metric collection for the management domain. Validation runs from the cloud proxy, not from your browser, so the FQDN you enter must resolve and route from the proxy.

  1. In the VCF Operations UI, open Configure, then Accounts, then Add Account.
  2. Select the vCenter account type.
  3. In the Name field, enter a label such as mgmt-vcenter.
  4. In the vCenter Server field, enter the FQDN of the management vCenter, for example vcenter-mgmt.example.com.
  5. In the Collector or Group field, select the Unified Cloud Proxy you registered in Step 4.
  6. Under Credential, click the add icon and enter a service account and its password.
  7. Click Validate Connection and accept the vCenter certificate thumbprint when prompted.
  8. Click Add to save the account.
  9. Confirm the account status changes to Collecting within a few minutes.
FieldExample valueNotes
Namemgmt-vcenterFree text label shown in the account list.
vCenter Servervcenter-mgmt.example.comMust resolve and route from the cloud proxy.
Collector or GroupUnified Cloud ProxyThe proxy registered in Step 4.
Credentialsvc-vcfops accountA service account with read access to the vCenter.
CertificateAccepted thumbprintCompare against the vCenter certificate before you accept.

Step 6, verify adapters are collecting

Collection can take several minutes to populate. Confirm objects and metrics appear before you move on. For adapter and cloud proxy detail beyond this step, see deploying and connecting VCF Operations.

  1. Open Environment, then vSphere Hosts and Clusters.
  2. Confirm the management vCenter, its cluster, and each ESX host appear as objects.
  3. Open a host object and check the Metrics tab shows recent data points with current timestamps.
  4. Open Administration, then Cloud Accounts, and confirm the vCenter account shows a green Collecting status with zero collection errors.
  5. Open Administration, then Inventory, and confirm the object count matches the hosts and virtual machines in the management domain.

Step 7, scale out to a high availability cluster

A single analytics node is fine for a lab, but production fleets add data nodes for high availability. This step is optional for a proof of concept and recommended for production. Adding nodes restarts the cluster, so schedule a maintenance window first.

  1. In the VCF Operations UI, open Build, then Lifecycle, then VCF Management, then Components.
  2. Click the VCF Operations component.
  3. Click Actions, then Add Data Node.
  4. Enter the FQDN, IP address, and node size for the new data node, using Medium or larger for production.
  5. Set the node password to 15 characters or more.
  6. Click Add and wait for the node to reach a Running state.
  7. To activate high availability, select one data node to become the replica of the primary node.
  8. Click Enable High Availability and confirm the cluster restart when prompted.
  9. For a continuous availability design, add a witness node sized at 2 vCPU and 8 GB in a third fault domain.

Step 8, connect VCF Operations for Logs

VCF Operations for Logs collects syslog and appliance logs for the fleet and belongs to the same platform. Connect it so the management domain sends its logs to one place.

  1. Open Configure, then Log Management inside VCF Operations.
  2. Confirm the VCF Operations for Logs cluster is deployed and reachable.
  3. Point the management domain appliances at the log cluster over syslog on port 514, or the secure port 1514.
  4. Size log nodes at Medium or larger, since each large node ingests up to 15000 events per second.
  5. Confirm log events appear in the log search view with current timestamps.
flowchart TD
  A[Confirm credentials] --> B[Sign in to VCF Operations]
  B --> C[Apply fleet license]
  C --> D[Register Unified Cloud Proxy]
  D --> E[Add management vCenter account]
  E --> F[Verify adapter collecting]
  F --> G{Production fleet}
  G -->|Yes| H[Add data node and enable HA]
  G -->|No| I[Single node ready]
  H --> J[Connect VCF Operations for Logs]
  I --> J

Verify the deployment

Confirm four things before you hand the fleet to operations: the license is applied, the cluster is online, the cloud proxy is collecting, and the management vCenter reports objects with current metrics. From an administrator workstation, you can also query the node status through the Suite API to confirm every node is online.

curl -k -u admin https://your-vcf-operations-fqdn/suite-api/api/deployment/node/status
  1. Open Configure, then Licensing, and confirm the VCF 9.1 license is applied with a future expiry.
  2. Open Administration, then Cluster Management, and confirm every node reports Online.
  3. Open Configure, then Cloud Proxies, and confirm the Unified Cloud Proxy reports Collecting.
  4. Open Environment and confirm the management vCenter tree shows hosts and virtual machines with metrics no older than the last collection cycle.

Common errors and fixes

Most setup failures trace back to DNS, the cloud proxy, or the admin password. Work through the four below before you open a support case.

SymptomCauseFix
Cloud proxy registration validation failedThe proxy cannot authenticate to the VCF Operations nodes.Confirm the proxy resolves the short and long FQDNs, open port 443 outbound, then regenerate the key and register again.
vCenter not reachable from the cloud proxyAccount validation runs from the proxy, not your browser.From the proxy, confirm DNS resolves the vCenter FQDN and that a firewall rule allows port 443, then click Validate Connection again.
Reverse DNS record missingVCF Operations checks reverse lookups for its nodes and vCenter.Add the PTR records so every appliance IP resolves back to its FQDN, then retry the account.
Admin password rejectedThe value is shorter than 15 characters.Set an admin password of 15 characters or more, which is the platform minimum.

Questions that come up

Is VCF Operations optional if I run only one VCF instance?

No. VCF Operations is mandatory in every VCF 9.x deployment, and bring up deploys it whether your fleet has one instance or many.

Do I import the VCF Operations OVA myself in 9.1?

No. The VCF Installer deploys the analytics node, the fleet management appliance, and the Unified Cloud Proxy during management domain bring up, so your job is configuration rather than import.

Can I start with one node and add high availability later?

Yes. Adding a data node and activating high availability restarts the cluster, so plan a maintenance window when you scale out.

Where does VCF Operations get its license in a fleet?

From the fleet license server you deployed with VCF Management Services. That server is the single license authority for every product in the fleet.

References

About The Author


Discover more from Journal of Intelligent Infrastructure

Subscribe to get the latest posts sent to your email.

Leave a Reply

Your email address will not be published. Required fields are marked *

Architect’s Toolkit

About the Author

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

Discover more from Journal of Intelligent Infrastructure

Subscribe now to keep reading and get access to the full archive.

Continue reading