Recently I was playing with Kubernetes and racked a substantial bill in AWS and Azure so I decided to bring the lab home. I needed a small but powerful PC that can run multiple test VMs and Kubernetes clusters. Kubernetes on a bare metal is different than EKS or AKS, especially when it comes to handling load balancers, ingress, IAM roles etc. Some of these things don’t exist on a bare metal machine.
I bought a NUC 13 small factor PC from Amazon and added Samsung NVMe 2TB SSD and Crucial 64GB RAM. After 2 months (these things are expensive!!!), I bought a Synology NAS with 2 x 8GB SATA disks. Next, is to upgrade the NAS with SSD that will act as cache, but I am not in a rush. Nevertheless…

Initial SSD, RAM setup

First thing you need to do is to CAREFULLY open the PC and make sure you don’t pull too hard and break the ribbon. Good thing is that the screws are not coming off and there is a spring mechanism so it’s super easy to open and close the bottom.

Add the NVMe SSD on the left side, but remove the screw first, bottom left. You’ll use it to tighten the SSD after.

Add the memory on the right side, you can add up to 64GB RAM hence 2 x 32GB modules. If you boot the PC even with a bootable USB stick, you’ll get an error saying “A bootable device has not been detected”.

Hit CTRL-ALT-DEL and then F2 to enter BIOS. From there, go to Boot menu, then Boot Priority.

Check Boot USB Devices First.

If you boot from ESXi 8 ISO now, most likely you’ll get an Fatal CPU mismatch on feature PSOD error. So, while still in the BIOS, go to Power, Performance and Cooling tab. Expand the first item External Ambient Temperature Tolerance and change the temperature setting to User Defined.

Now, you can enter the Performance menu which was grayed if the setting is not User Defined for the External Ambient Temperature Tolerance.

Once there, go to Processor.

Once there, change the number of Active Efficient Cores to 0.
In addition, when you install ESXi 8 and when you access the GUI, you’ll see a nagging warning that TPM cannot be contacted or something similar. No matter how many times you acknowledge this warning it keeps coming back. So, while you in the BIOS, go to Security tab, then Security Features and uncheck Intel Platform Trust Technology.
Save the settings with F10.

Install ESXi 8

At this point, reboot and boot from ESXi ISO USB. Check this guy for more info (link and link).
I have a VMUG Advantage subscription so I can freely download all VMWare software from here. As long as you pay the yearly fee, you can have the licenses and software indefinitely.
Choose where to install the ESXi (Samsung SSD).

Choose a root password.

Remove the USB stick and reboot when the installation is over and you’ll see this screen after.

This is my DHCP assigned address, so just change it to a static IP providing DNS and the default gateway. Then, change your FQDN as well. In my case I named my box as esxi1.homelab.local.

At this point you have a functioning ESXi server. Open up a browser, go to the ESXi IP and log with root and the password you specified.
If you have a license, add it now by going to Manage (upper left corner), then Licensing tab and click Assign license or skip this part and use the evaluation mode.

Optional: Click on Storage then datastore1, Actions from the menu and rename the datastore. In my case I’ll use ESX1-LOCAL.

Install vCenter 8.0 appliance

Now, we can install vCenter. Mount the vCenter ISO image, go to vcsa-ui-installer folder and choose the OS (win32, mac, lin64). Run the installer and click Install icon.

Click Next and Accept the legal terms. Then enter the IP address or FQDN if you have your DNS configured for the ESXi server you just installed. Specify the root password too.

Name the vCenter and specify the vCenter root password. This is not the password that you will use to log to vCenter. This is a password for the appliance itself. You’ll need this only if you have to troubleshoot the appliance or enable/disable SSH on the appliance.

Choose deployment size, for me the smallest size is acceptable. After all, I plan to use this primarily for Kubernetes.

Choose the datastore.

Configure network settings, IP, gateway, DNS, FQDN…

Confirm and click Finish. After some time, you’ll get a prompt to configure vCenter. I chose to use NTP and sync with some public NTP servers. Use whatever is closest to you.

I’ll create a new SSO domain and I’ll use the defaults. I just have to provide a password.

Once vCenter is deployed go to the FQDN or the IP from a browser. Your username is no longer root, it’s administrator@vspehere.local and your password is the one you specified when you installed vCenter SSO in the previous step. Enter the license by going to Administration | Licenses from the left.

Once you enter the license from the Licenses tab, go to Assets tab and click Assign License.

Go to Inventory from the hamburger menu on the left, right-click the vCenter IP or FQDN and choose New Datacenter.

Then right-click on the newly created datacenter and choose New Cluster.
Same thing again, right-click the cluster and choose Add Hosts.

Specify the IP or FQDN and the root password when you installed ESXi initially.

Optional: iSCSI

Click on the ESXi hosts, then Configure tab, click Add Software Adapter and then Add iSCSI adapter.

In my case, I have to use static discovery so click on that tab and then Add.

Enter the iSCSI IP and the target name.

Finally, click on Rescan storagein the menu above. If you need to provide your initiator, this is where you can find it under iSCSI Name (iqn.1998—_.

To learn how you can install Kubernetes on your NUC and how to use k8s Load Balancing see the links from my blog here and here.

In my home lab, I run vCenter 6.7 with several ESXi hosts and since I built the lab I never did any backups.
Now that my VMs are not test VMs and they became fairly important, I’ve decided to take care of the backups.
Initially, I was thinking of using the Veeam Free Backup, but this program can’t do any schedules in the free version. Then I decided to play with OVF Tool, but I was having multiple issues with this tool and logging with a domain account. So, finally, I used PowerCLI and AWS CLI.
The idea is to create a OVA export of each VM and then upload it to an S3 bucket. The source is well commented, so you shouldn’t have any issues in the script’s logic.

######################################################################################################
# vCenter2AWS v0.1
# K.Andreev - 06/30/2018
# Description:  Creates an OVA backup of all or selected vCenter VMs 
#				and uploads them to a bucket in AWS (optional)
# Prerequisites: PowerCLI, AWS CLI (configured)
# NOTE: The VM being backed up will be shut down and powered up when the OVA file is complete
# 		If using PowerCLI 10.x execute this line once
# 			Set-PowerCLIConfiguration -InvalidCertificateAction Ignore
######################################################################################################
# Function for logging
Function LogWrite {
   Param ([string]$logstring)
   Add-content $LogFile -value ((Get-Date -format "[dd/MMM/yyyy:HH:mm:ss] ").ToString() + $logstring)
}
######################################################################################################
########## IMPORTANT PARAMETERS. DO NOT IGNORE. MODIFY TO SUIT YOUR NEEDS. ###########################
######################################################################################################
# vCenter hostname
$VCenter = "vcenter.domain.local"
# vCenter username
$Username = "myusername@domain.local"
# vCenter password
$Password = "SecretPassword"
# Destination for the OVA backup files, make sure you have trailing \ at the end of this string
$Destination = "D:\VMs\"
# Exclude the following VMs from backups
$Exclude = @("VMware vCenter Server Appliance")
# Name of the S3 bucket (make sure it exists, lower case only, starts with s3://)
$S3Bucket = "s3://vspherebackups"
# Do you want to upload to S3
$Upload = $true
# Specify if the OVA file contains a time stamp 
# e.g. vmname.YYYYMMDDHHmm.ova ($true) or vmname.ova ($fasle)
$TimeStamp = $true
# Do you want the OVA files to be deleted after upload to S3
$DeleteOVA = $true
# Log file path and name
$LogFile = "D:\VMs\vcenter2aws.log"
######################################################################################################
################### EXPORT VMs AS OVA FILES ##########################################################
######################################################################################################
# Connect to vCenter
$Server = Connect-VIServer $VCenter -User $Username -Password $Password
LogWrite ("Connected to " + $Server)
# Get all VMs
$VMs = Get-VM
# Loop through each of the VMs
Foreach ($VM in $VMs) {
# Get the name of each VMs	
$Name = $VM.Name
    # Skip the backup for the VMs that are in the array variable defined above
    if ($Exclude.Contains($Name)) {
        LogWrite ("Backup skipped for "+ $Name)
        Continue
    }
    # Stop the VM in order to take a backup
    Stop-VM -VM $Name -Confirm:$false
    LogWrite ("Stopping VM " + $Name)
    # Calculates the time stamp that will become part of the name
    if ($TimeStamp) {
        $TimeStampName = Get-Date -UFormat "%Y%m%d%H%M"
        $TimeStampName = "." + $TimeStampName
    } else
    # otherwise the time stamp will be blank
    {
        $TimeStampName = ""
    }
    LogWrite ("Backup starts for " + $Name)
    # Exports the VM as OVA file, overwrites if there is a same file at the destination
	Get-VM -Name $Name | Export-VApp -Destination ($Destination + $Name + $TimeStampName + ".ova") -Format Ova -Force:$true
    LogWrite ("Backup ends for " + $Name)
    # Once the export completes, power up the VM
	Start-VM -VM $Name -RunAsync
    LogWrite ("Starting VM " + $Name)
}
# Disconnect from vCenter
Disconnect-VIServer -Server $Server -Confirm:$false
LogWrite ("Disconnected from " + $Server)
######################################################################################################
################################ UPLOAD TO AWS #######################################################
######################################################################################################
# Exit if upload is not needed
if (!$Upload) {
    LogWrite "Upload to S3 skipped, exiting..."
    exit
}
LogWrite ("Upload to S3 bucket " + $S3Bucket + " starts")
# Use AWS CLI command to sync the destination folder and S3. 
aws s3 sync $Destination $S3Bucket
LogWrite ("Upload to S3 bucket " + $S3Bucket + " ends")
######################################################################################################
################################ DELETE THE OVA FILES ################################################
######################################################################################################
# Exit if delete is not needed
if (!$DeleteOVA) {
    LogWrite "Deleting OVA files skipped, exiting..."
    exit
}
Get-ChildItem $Destination -Include *.ova -Recurse | Foreach ($_) {Remove-Item $_.Fullname}
LogWrite ("Deleting OVA files from " + $Destination)
LogWrite "Script completed...Have a nice day!"

Recently, I wrote a blog post about migrating VMs from VMware vCenter to AWS using basic export OVA/OVF files. Amazon made a connector that ties your vCenter to AWS so the export is kind of simplified, but the configuration is not. While using the export as OVA/OVF requires you to change the NIC from vmxnet* to e1000 and changing the static IP of your server to DHCP, with AWS Connector you can leave everything as is. Also, the export as OVA/OVF requires your VM to be powered off, while with AWS Connector you can migrate your VMs while they are powered on (using snaps). I also found that AWS Connector is slower than plain export as OVA/OVF. In this post I’ll show you how to configure the AWS Connector.

AWS Connector is not just about VM migrations. It has some other useful functions. Check this web page for more information and this PDF for the install/user guide. So, head to this page first and scroll all the way down to the bottom.

Step 1, Download the AWS Connector. Step 2, click on Setup AWS Management Portal for vCenter. Log in with your AWS account. Click on Get Started Now.

I will use the first option and most likely you’ll do. Option 2 is if you have a SSO (Single Sign-On) to AWS.

Make sure you have some IAM users defined, otherwise you’ll receive this error. As a matter of fact, you’ll want a separate IAM user for this. This user acts as a proxy between AWS and your vCenter.

In my case, I’ve created a new IAM user called vCenter. Check Programmatic Access.

On the next screen, click on the Attach existing policies directly and in the Filter: Policy type, start typing AWSConnector. This is an AWS managed policy. Click on the check mark and proceed.

Make sure you download your credentials for this IAM user. They’ll be saved as credentials.csv file on your computer.

Go back to your first tab (or the initial URL) and hit refresh. Type the username vCenter and click on the check mark that you agree.

The next step tells you to add the admins for AWS Management Portal. Make sure that these accounts are admins in vCenter. In my case, my vCenter is joined to the domain and I am using my own domain account to manage vCenter. You can create a separate user for this, but make sure it’s a vCenter admin.

Now, this part is very important. I’ve spent hours troubleshooting this. It was right in front of my eyes, but I didn’t pay attention.

The easiest way is to open a command prompt from your desktop and type:

set | find "USERDOMAIN"

My domain is not andreev. It is actually ANDREEV, so I had to correct the entry.

The last entry will ask you to create an AMP-Connector Key. Just type some name.

At the end, you’ll have to download the configuration file. It’s a text file with some key text in it.
So, you have two files now, one with the credentials for the proxy user and one with the configuration key. After you are done with this, you’ll land up on this page. You can expand the settings and make sure everything looks OK. You can ignore the Configure Instance Export menu. That’s for S3 exports.

Now, you will need another proxy user, but this time on the vCenter side. It can be a local vCenter user or in my case, I prefer to have an AD account. So, I’ve created an AD account called awsconnector. No special rights needed and don’t add this account to vCenter. Just create a plain AD account as a Domain User.

At this point, you should be OK on the AWS side. Head back to your vCenter and deploy the OVA file that you’ve downloaded.

Once the appliance is provisioned, power it up. If you have a DHCP on your network and you are fine with the DHCP assigned IP on this VM, you don’t have to do anything. But, I prefer to have a static IP so open the console of this VM and log as ec2-user with ec2pass as a password. Type sudo setup.rb. Type ec2pass for password. You should see this menu. Choose option 2 to assign a static IP if you need. If you are OK with a DHCP, it’s fine. It’s up to you.

Once you have the AWS Connector on the network go to https://aws_connector_IP address. Make sure to use https. Use your vCenter admin to log in.

Click Trust when you get a certificate warning.

You’ll be prompted to change the web front-end password. There is no user name for this next time you log to your AWS Connector.

Once you log in, this will pop up.

Click Upload the configuration file, select the file that you’ve downloaded from AWS. It’s called AMP_Setup_Configuration.txt and click Next. Again, log with your vCenter admin account.

Click Trust.

Now, enter that AD account that you’ve just created.

Use the credentials from credentials.csv file to enter the username and password. The Trust Role ARN field should be automatically populated.

Click on I agree to install the vCenter SSL certificates… otherwise you won’t be able to proceed and click Register.

You should get this pop-up which means you are good.

Open the vCenter client and from the Plug-ins menu click Manage Plug-ins…The AWS Connector should be enabled.

In the web client it should look like this.

Now, it’s time to get some action. Pick a VM that you want to migrate to AWS. Did I say that you need RDP/SSH enabled?
Right-click on this VM and choose Migrate to EC2.

You’ll get this error. AWS Connector is not yet configured.

All right, so go to Home -> AWS Management Portal in vCenter and add the preferred region.

Click on Create an environment.

Select your VPC and choose all subnets.

Go back to your VM and try to migrate it to EC2.

Oh, snap!

Go to vCenter roles, and follow up the instructions from above.

Then again, go back to your VM, right-click and choose Migrate to EC2. You’ll get this warning. It pretty much tells you that while migrating the VM will be slow.

Once the migration starts you’ll see this.

Do that. Go to Home -> AWS Management Portal -> Dashboard in vCenter. You’ll see the progress. If you scroll to the right you can actually see how much is uploaded. AWS is uploading the snap, so my VM has a 30GB disk (thick provisioned), but it was a plain vanilla OS with nothing installed except a text file on the desktop. So the actual size for upload is 4GB.


Once your migration completes, you can find your instance/VM under IMAGES | AMIs in AWS console.


Right-click on the AMI, choose Launch, follow the prompts and you should be all set. You’ll have to specify a key, but you can use your local admin credentials to log in.

I needed to move some VMs from my home lab (vCenter 5.5) to my Amazon AWS cloud account. This is what I did.
First, you have to prepare the VM. If you have any vmxnet* network card, you have to delete it from the properties of the VM in vCenter. Second, make sure that you have RDP or SSH enabled on the VM and third, uninstall the VMware tools. Shut down the VM, add an E1000 NIC and power it up again. Make sure that the TCP/IP and DNS settings for the new NIC are set for DHCP. Verify that all these requirements apply and then shut down the VM again.
In vCenter, select the VM for export, click on File | Export and then Export OVF template. Choose Single file (OVA).

Once the export is completed, you have to upload the OVA file to a S3 bucket. I created a new bucket for this, called uploadvmstuff with the default settings. You’ll have to pick a unique name for the bucket, but you probably know that. Upload your OVA file to S3. It might take a while depending how big the file is.

I am using my admin account in AWS to import the VM, but I still have to assign some policies. So, when the upload is complete, go to the command prompt or PowerShell on your desktop. Make sure you have AWS CLI installed. You can check my other blog post on how to do this. Very simple.

Create these three files in Notepad and save them on the desktop. The first file is called trust-policy.json. See this link for more info.

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": { "Service": "vmie.amazonaws.com" },
         "Action": "sts:AssumeRole",
         "Condition": {
            "StringEquals":{
               "sts:Externalid": "vmimport"
            }
         }
      }
   ]
}

Execute this command from the command prompt. Make sure that you are in the same folder in the command prompt where you saved your files, e.g. cd c:\users\whatever\desktop.

aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json

Create the 2nd file called role-policy.json so it looks like this. Replace the two occurrences of disk-image-file-bucket with your bucket name, in my case it was uploadvmstuff.

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource": [
            "arn:aws:s3:::disk-image-file-bucket"
         ]
      },
      {
         "Effect": "Allow",
         "Action": [
            "s3:GetObject"
         ],
         "Resource": [
            "arn:aws:s3:::disk-image-file-bucket/*"
         ]
      },
      {
         "Effect": "Allow",
         "Action":[
            "ec2:ModifySnapshotAttribute",
            "ec2:CopySnapshot",
            "ec2:RegisterImage",
            "ec2:Describe*"
         ],
         "Resource": "*"
      }
   ]
}

Execute this command from the command prompt.

aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json

The third file is called containers.json and it looks like this. Change the lines so it matches your settings. For Description use whatever you want, change the S3Bucket line and the S3Key. The S3Key is the name of the ova file that you’ve exported from vCenter.

[
  {
    "Description": "Windows 2008R2 Import",
    "Format": "ova",
    "UserBucket": {
        "S3Bucket": "uploadvmstuff",
        "S3Key": "nvm.ova"
    }
}]

Now, you are ready to import the file from S3 to EC2. Execute this line from the command prompt.

aws ec2 import-image --description "Windows 2008R2 VMDKs" --license-type BYOL --disk-containers file://containers.json

You should get your prompt back after 2-3 seconds. But, this means that the import started, not that it finished. To check the status, execute this line.

aws ec2 describe-import-image-tasks

It takes some time, for my OVA file that was created from a 40GB disk and 3.7GB OVA file it took about 20-25 mins. You will see the Status change to completed once everything is OK. Make sure that your AWS CLI is configured to do the output in JSON so it’s easy to see.

Once completed, you will see your import in the AMI section of EC2. Go to EC2 section, click Launch New Instance and choose the AMI that you just created. Follow the standard prompts for the type of the instance, security groups, volumes, etc… and once your instance is launched you can RDP to it. You will use the same admin password as before to RDP.

Recently, we moved to CommVault for backing up VMs. We use a CommVault solution that interacts with NetApp for taking snaps. Once the backup runs, it time-stamps the VM with the last backup taken. If you don’t need an e-mail in HTML format with the report, remove the lines from 103 to 113. Finally, remove the comment line # from line 57 if you want the report on the screen.

Based on this info, I made a script that loops through all clusters and VMs and dumps the report in a mail. You can remove lines 5 to 14 if you don’t want the script scheduled.

# PowerCLI script that lists all VMs under clusters that start with USCORPROD*
# and prints the Last Backup attribute from CommVault
# If the difference between the run time of the script and the last backup is
# more than $HoursDifference, write the output with red color
Add-PSSnapin VMware.VimAutomation.Core
Add-PSSnapin VMware.VimAutomation.Vds
if(get-item HKLM:\SOFTWARE\Microsoft\PowerShell\1\PowerShellSnapIns\VMware.VimAutomation.Core){
	. ((get-item HKLM:\SOFTWARE\Microsoft\PowerShell\1\PowerShellSnapIns\VMware.VimAutomation.Core).GetValue("ApplicationBase")+"\Scripts\Initialize-PowerCLIEnvironment.ps1")
}
else
{
	write-warning "PowerCLI Path not found in registry, please set path to Initialize-PowerCLIEnvironment.ps1 manually. Is PowerCli aleady installed?"
	. "D:\Programs (x86)\VMware\Infrastructure\vSphere PowerCLI\Scripts\Initialize-PowerCLIEnvironment.ps1"
}

# Specify the vCenter server
$server = "vcenter"
# Specify the difference in hours to compare
$HoursDifferenceCompare = 24
# Cluster filter
$ClusterFilter = "*"
# Connect to vCenter
Connect-VIServer -Server $server -user domain\username -password vcpassword
# Initalize the main HTML content
$midHTML=""
# Get each cluster that starts with $ClusterFilter and sort them. 
# Make sure only unique values are returned
ForEach ($Cluster in Get-Cluster $ClusterFilter | Sort -unique)
{
	# Get all the VMs per cluster
	$VMs = Get-Cluster $Cluster | Get-VM 
	# Loop each VM
	ForEach ($VM in $VMs)
	{
		# Get the last backup attribute
		$LastBackup = Get-VM $VM | Get-Annotation -CustomAttribute "Last Backup"
		# Parse the output, trinm the string
		$LastBackupTimeStamp = $LastBackup -replace "Last Backup:"
		# Get the date/time when the script started
		$StartDate=(Get-Date)
		# The end date is the Last Backup time for the VM
		# If the VM was never backed up, assume 01/01/70
		if ($LastBackupTimeStamp -eq '') {
			$EndDate = [datetime]'January 1, 1970'
			$LastBackupTimeStamp = "NEVER"}
		else {
			$EndDate = [datetime]$LastBackupTimeStamp 
			}
		# Calculate the difference
		$TimeSpan = New-TimeSpan -Start $StartDate -End $EndDate
		# It's a negative value, so get the absolute
		$DaysDifference = [math]::abs($TimeSpan.Days)
		$HoursDifference = [math]::abs($TimeSpan.Hours) + ($DaysDifference * 24)
		# Print the output
		if ($HoursDifference -gt $HoursDifferenceCompare) {
			# Remove for debugging if needed
			#Write-Host $Cluster " " $VM " " $LastBackupTimeStamp
			# Build the HTML
			$midHTML = $midHTML + '<font color="red">'
			$midHTML = $midHTML + "<p>" + $Cluster + " " + $VM.Name.PadRight(30,"-") + " " + $LastBackupTimeStamp + "</p>"
			$midHTML = $midHTML + "</font>"
		} else {
			$midHTML = $midHTML + "<p>" + $Cluster + " " + $VM.Name.PadRight(30,"-") + " " + $LastBackupTimeStamp + "</p>"
		}
	}	
}

# Top HTML header
$topHTML = @"
<!DOCTYPE html>
<html>
<body>
<font face="Courier New, Courier, monospace">
<style>
p
{
  margin:0;
  padding:0;
  font-size:12px;
    line-height:12px;
}
div
{
  margin:0;
  padding:0;
}
</style>
<div>
<p>&#160;&#160;&#160;CLUSTER NAME&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;SERVER NAME&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DATE OF LAST BACKUP</p>
<p>-----------------------------------------------------------------------</p>
"@

# Bottom HTML footer
$bottomHTML = @"
<p>-----------------------------------------------------------------------</p>
<p>Script by K.Andreev - 20160630</p>
</div>
</font>
</body>
</html>
"@

# e-mail setup
$EmailFrom ="sender@domain.com"
$EmailTo ="receiver@domain.com"
$msg = New-Object System.Net.Mail.MailMessage ($EmailFrom,$EmailTo)
$msg.subject = "CommVault Report " + $StartDate
$msg.IsBodyHtml = $true;
$msg.Body =$topHTML + $midHTML + $bottomHTML
$smtpClient = New-Object System.Net.Mail.SmtpClient
$smtpClient.Host = "smtp.server.com"
$smtpClient.EnableSsl = $false
$smtpClient.Send($msg)

# Disconnect from vCenter
Disconnect-VIServer -Server $Server -Confirm:$false

In my previous post, I’ve explained how to install vCenter 5.0. In this post, I’ll explain how to upgrade from 5.0 to 5.1. This version brings a new authentication Single Sign On mechanism and a new web client. Check the VMware web site for more information about these new products and features.

First, start SQL Server Management Studio and open the sql script that comes on the vCenter installation media. Single Sign On requires a separate database.

Open rsaIMSLiteMSSQLSetupTablespaces and change the file paths to suit your needs. There are three occurrences of this file path. I used C:\DATA in my case. Click Execute and make sure you get a message that the commands completed successfully.

Click on Security, then Logins and double-click the vpxuser. This is the same user that has full db_owner rights on the vCenter and Update Manager databases. Select User Mapping, RSA (Single Sign On database) and click db_owner.

Now start the vCenter installer and select vCenter Single Sign On.

Click Next.

Create the primary node.

Select the first option.

Enter a password for the admin@System-Domain user.

Select the second option.

Type RSA for the database name, the hostname of the SQL server, vpxuser for the database user and its password.

Confirm that your vCenter server is listed here.

Use the defaults.

Change or accept the defaults.

Change or accept the defaults.

Click Finish.

Next, we’ll have to upgrade vCenter Inventory Service. From the same menu where we launched the Single Sign On install, click on vCenter Inventory Service.

Choose the first option.

Verify that you have the vCenter server name correct.

Change or accept the defaults.

Change or accept the defaults.

Enter the password for the admin@System-Domain user.

Click Install certificates.

Click Finish.

Next, upgrade vCenter.

Enter the password for the vpxuser.

Upgrade the database.

Select the first option.

Choose if you want to use a domain account, local account or system account.

Change or accept the defaults.

Enter the password for the Single Sign On admin user.

Use this log file if you have any issues later.

Click Finish.

Next, we’ll upgrade the Update Manager. Start the installation.

Accept the default option.

Enter the credentials that were used to run the Update Manager service.

Enter the credentials for the vpxuser.

Upgrade the dabase.

Change or accept the defaults. Make sure the vCenter server correctly appears. Click Finish at the end.

Finally, let’s update the web client. You can run the installer from the media or you can just double-click the old client and this message will show up, prompting you to run or save the installer. Just click Run.

Change or accept the defaults.

Enter the password for the Single Sign On admin user.

If you try to use your Windows domain credentials, you’ll have to download the Client Integration Plug-In first. And, that’s it.

In this post I’ll describe how I installed vCenter 5.0 on Windows 2008 R2 server using SQL 2008 R2 database. I’ve used two servers in my lab, one for the vCenter and the other one for the SQL. I won’t explain how to install SQL server, it’s fairly straightforward.

First thing to do is to create the SQL database. VMware provides a SQL script that you can execute to create the database. The script is on the vCenter installation DVD/ISO under source\vCenter-Server\dbschema folder where source is some drive letter (D:\ or E:\). This script does not work right, so we’ll use a modified version. By default, vCenter requires full db_owner rights so it can create some scheduled jobs. If your environment doesn’t allow this type of access, see the installation guide for vCenter. In this post, we’ll grant full db_owner rights for the sql user (vpxuser) to both vCenter database (VCDB) and the msdb system database. Once vCenter is up and running, you can remove the full db_owner rights from the msdb.

Start the SQL Server Management Studio, log as the sa user or some domain user with full SQL admin rights, and click New Query.

Copy and paste the following script, but change the file path where you want your database to reside. In my case it is C:\DATA. Also, change the password for the vpxuser that we will create.

use [master]
go
CREATE DATABASE [VCDB] ON PRIMARY
(NAME = N'vcdb', FILENAME = N'C:\DATA\VCDB.mdf', SIZE = 2000KB, FILEGROWTH = 10% )
LOG ON
(NAME = N'vcdb_log', FILENAME = N'C:\DATA\VCDB.ldf', SIZE = 1000KB, FILEGROWTH = 10%)
COLLATE SQL_Latin1_General_CP1_CI_AS
go
use VCDB
go
sp_addlogin @loginame=[vpxuser], @passwd=N'vpxuserpassword', @defdb='VCDB',
@deflanguage='us_english'
go
ALTER LOGIN [vpxuser] WITH CHECK_POLICY = OFF
go
CREATE USER [vpxuser] for LOGIN [vpxuser]
go

While in SQL Server Management Studio, expand the Security, then Logins. Double-click on the vpxuser and choose User Mapping. Select the VCDB database and put a check mark for db_owner. Put a check mark on the msdb database and do the same (check mark on db_owner).

Next thing to do is to install the SQL Server Native Client on the vCenter server. It’s a free download from Microsoft. Once installed, go to Administrative Tools | Data Sources (ODBC). Click on System DSN tab and then click Add. You should see a SQL Server Native Client 10.0 driver there. Do not use SQL Server driver. It won’t work.

Enter the name for the ODBC connection, a description and type the hostname for the SQL server. In my case, I’ll use vCenter, vCenter Database and sql.

Next, choose SQL authentication and type the SQL user that we just created with the script (vpxuser and its password).

Click the first check mark and select the VCDB database.

Leave the defaults and click Finish.

Click the Test Data Source button and make sure that it says that the connection completed successfully.

Now, it’s time to install vCenter. Insert the DVD or mount the ISO image and the installer will start.

Click the first option vCenter server and go thru the Next, Accept cycle. Once you reach the Database Options, select the second radio button and choose the ODBC connection that we just created.

If you get this error, make sure you start the SQL Server Agent on the SQL server. By default this service is disabled. You can stop this service once the installation completes.

Enter the SQL username and password that we just created.

If you receive the following error, it means that you are not a db_owner on the VCDB database.

You won’t be able to continue until you fix this. When you reach this screen vCenter Server Service, stop. You have an option to run the vCenter Server service as a local server account or you can choose a domain account. If you use a domain account, it should be a local admin on the server.

Change or accept the defaults for the vCenter program.

Select the first option.

Change or accept the default ports. If you install vCenter on a shared server with IIS installed, you’ll have port conflicts here.

Change or accept the default ports for the Inventory Service.

Estimate how many VMs you’ll have.

Click Install.

After couple of minutes, click Finish to complete the install. Your vCenter Server should be up and running, but we are not over yet.

We will install the Update Manager now. This part of vCenter is used to patch the vCenter and ESXi hosts. Log back to the SQL server and in SQL Server Management Studio, execute this script that will create a new database for the Update Manager. Make sure you change the file path for the database. In my case is C:\DATA. We’ll use the same vpxuser user for the Update Manager database.

CREATE DATABASE [VCUM] ON PRIMARY
(NAME = N'vcum', FILENAME = N'C:\DATA\VCUM.mdf', SIZE = 2000KB, FILEGROWTH = 10% )
LOG ON
(NAME = N'vcum_log', FILENAME = N'C:\DATA\VCUM.ldf', SIZE = 1000KB, FILEGROWTH = 10%)
COLLATE SQL_Latin1_General_CP1_CI_AS
go
use VCUM
go

On vCenter server, go to C:\Windows\SysWOW64 folder and run odbcacd32.exe. The Update Manager is using a 32-bit ODBC and by default, if you go to Administrative Tools and start the ODBC manager, you’ll execute the 64-bit version.

Pick a name and description for this ODBC connection and specify your SQL server hostname.

Select the VCUM database that we just created and similarly to the previous ODBC creation, finish the rest of the steps.

Start the Update Manager install.

Accept the defaults.

Create a domain user that will run the Update Manager service. In my case I use svc_vcenter.

Specify the 32-bit ODBC connection that we just created.

Enter the same vpxuser and password.

Specify if any proxy servers need to be specified. Update Manager requires Internet connection.

Change or accept the defaults.

The rest of the steps a re just plain Next, Next, Finish.

Once installed, go back and install the vCenter client. I won’t explain how to do this. It’s trivial. Log to the vCenter with a local admin password or with a domain account (if you run vCenter service under a domain account).

Select the top left vCenter server name and then click on Permissions.

Click Add.

Type your domain, enter a user that you want to grant full admin rights and click Check Names. If everything is OK, the dialog box will just blink.

Back in the previous dialog, select Administrator and click OK. We made svc_vcenter an admin vCenter user.

From the vCenter client menu, select Plug-Ins and select the Update Manager plug-in.

Click Run.

Create a new datacenter, add the ESXi hosts and you are all set.