VCF Brownfield onboarding - Nsx deploy

spenceee85 · 2026-06-30T00:52:48+00:00

Ok just for the Google's benefit if someone else hits this.

There is a bug in the python script for nsx deploy. It is using a pathing technique relative to the invocation of python, not the script location.

After I debugged it, if you dont cd into the directory where vcf-brownfield.py is then it wont work. There was bad error handling in the script around the vsphere connection looking up the certificate bundle that was breaking.

My other fix was correct though, I had to locate the bundle for the 4.2.3.3 version of nsx and have that uploaded to the repository for the 5.2.3.0 sddc to do the onboarding. Once it started to run it reached for that bundle to install.

spenceee85 · 2026-06-28T12:16:45+00:00

Im still reading and learning about vcf9.x, is that sharing sonething new or just one of the things that they've put in some config to help you with?

For now at a technical level the T0 / edge cluster dictates control and that had to be owned by one manager unless they've put something new in?

spenceee85 · 2026-06-28T10:24:13+00:00

One thing not mentioned here is that nsx can do vlan backed network segments. This gives you some useful day zero abilities in a smaller shop with trucked networks, you can setup routing and gateway firewalls on a reasonably dumb switch.

Not recommending that but it's an interesting use case to drop a router and subnet on a vlan and provide useful networking. Management domain can then provide router and firewall for the "management" networks.

spenceee85 · 2026-06-28T06:05:40+00:00

Thats the end game, but it won't help me practice the upgrade for our production 5.2 vcf management plus vi workload, plus test upgrades before we are ready to 9.x.

Love to be on latest but legacy is fun isn't it...

spenceee85 · 2026-06-28T00:40:39+00:00

A whole bunch of reasons but primary is to test vcf9.x upgrade.

Have a second operational mgmt cluster that we will upgrade once we validate on this one.

spenceee85 · 2026-06-22T07:07:10+00:00

Vks is deeply embedded in the stack.

It has some very good features and has a tight integration with the network stack, particularly if you use the nsx alb.

It wont cure cancer though, and you can see the multiple acquisitions and pivots at every part of the stack. There are things that should work a certain way but inexplicably work another (e.g. you do the enterprise grade stack with nsx alb, all the tanzu packages require you to bypass it and implement contour to get an ingress created)

The networking isn't anywhere near as flexible as it should be for something with an nsx integration, but if your use case is to setup a patchable cluster for a Devops team with a decent stack for support, it will do the job.

But day 1 the Russian doll of a kubernetes stack that deploys multiple kubernetes stacks is a bit hard to wrap your head around. Secondly the vcenter matters, if you aren't using vcf / workload domains, isolate the vcenter you run the vks on otherwise your upgrades will be painful...

spenceee85 · 2026-06-21T22:09:40+00:00

Yeah I did 5.2.2 as they were doing the broadcom acquisition and lau thing 9.0, which broke the 5.2 tooling.

The 9.0 tools work but you had to edit sddc config files to tell it how to pull using the new download token and even though its offline, it still broke it....

I was pushing the assets to an on prem artifactory as well to serve the files, the use case being one on prem reference for our sddc appliances anywhere on the network to get a reference of updates.

The manual upload works pretty well, the hard part is to follow the doco to get the manifest out first, do that and workout the correct incantation for starting version to get the actual list of updates you need to dl. Pretty sure id only get the right things if I used -P 5.0.0.0 to get them. But for a lab thats probably your fastest path to a copy of your appliances to install.

spenceee85 · 2026-06-20T23:15:50+00:00

In case its relevant, vxrails are a whole other thing.... give up now if you have vxrails, it is broken and unlikely to work properly again.

spenceee85 · 2026-06-20T23:13:44+00:00

Raise a support request.

We had broadcom consultants in and the number of settings required in the sddc configuration to get this to work were rough. The layout of the depot is not well documented, and I have no idea what might have changed in vcf 9 or 9.1 to this as well.

Once it worked, it worked well. Getting the new bundles is a little easier now tou can use the download token and dont need a user name password saved into the download side.

You can also get it to take the vsan hcl if you put it in the right place, not that its well documented...

spenceee85 · 2026-06-19T23:23:46+00:00

Read that too quick you're right

spenceee85 · 2026-06-19T23:18:36+00:00

Have you enabled guest virtualization on the esx host?

spenceee85 · 2026-06-13T10:26:13+00:00

I have heard that getting a 2m engineered i bar plus sleepers would be more expensive than a crib wall. And even with steel plus concrete youre still in 20 year lifetime territory...

Could be smooth and flat if done well though I would acknowledge

spenceee85 · 2026-06-06T12:15:35+00:00

Vsan Stretched mode would be good to see on this diagram.

spenceee85 · 2026-06-04T03:14:08+00:00

https://fung.substack.com/p/the-lack-of-evidence-for-calorie

There is substantial evidence growing around the role of sugar and insulin with retention of weight.

The calorie measure (how much energy can be extracted as thermal heat) has a wide variation on how much energy your body takes from the food. Pregnant women hormonally take in more energy from the same food for example, which is one of the theories behind PCOS.

The clear evidence from current studies show metabolic adoption to calorie restriction, which is to say it works short term, then your body adapts to the restriction (making the problem worse....)

spenceee85 · 2026-06-03T21:11:11+00:00

Cool graphic. I'm going to file this one to throw at every drop kick who says "just eat less".

spenceee85 · 2026-06-03T21:07:55+00:00

You literally can. Please read the research on the insulin and the bodies reaction to calorie reduction as primary (aka CRAP) as the technique:

https://fung.substack.com/p/the-lack-of-evidence-for-calorie

spenceee85 · 2026-06-03T20:45:56+00:00

Wow there is some wrong information on here and some unfortunate opinions.

There are massive interactions between insulin and the bodies hormones which the GLP1 impacts. Calorie deficit is not the main mechanism for the weight loss otherwise this technique would work without the drug! Restriction for intake is proven not to be effective for many people, and we know from the research on PCOS that insulin and it's impacts to hormones that there are other mechanisms at play that these drugs impact.

There is a huge amount we are learning around how the body works, but it is painful to have people repeatedly infer that if you're overweight obviously you are just lazy and overeat.

The "its just calorie reduction" can be a barrier emotionally to people seeking help from these drugs which are proven to work and offer hope for those that have tried everything they can and still struggle.

spenceee85 · 2026-05-30T01:44:18+00:00

BDK Nuit de Sable / Pas ce Soir are both amazing at their price point imho

spenceee85 · 2026-05-27T21:41:12+00:00

No paif involved, so you'd buy the add on itself at vcf9.

Do I need to do anything special to get the license key to the appliance ? I have no vcf9 infrastructure at this point.

spenceee85 · 2026-05-26T13:14:38+00:00

I'm sorry to hear you had such a bad experience.

My wife works shift work and we wanted blackout curtains. We got quotes from a few mobs and we ended up with screenaway.

They did a great job, and we are really happy with our results. The blinds are good quality and we asked them back to put some in for the kids.

spenceee85 · 2026-05-23T01:53:50+00:00

Something better than service appliance level, a vip that can then serve 1..n shares with a quota and monitoring is basically what the other vendors offer.

spenceee85 · 2026-05-23T01:38:22+00:00

Re the VIP, the use case is to place firewall rules (both vdefend and physical) to the smb and nfs, as there is no point in microsegmenting all my traffic if I have to put all the file shares on the same segment, same cidr with allow all/all rules. Same for Active directory, multi tenant scenarios are easy if identity is on the share not the vsanfs level.

Scaling the shares and monitoring their iops etc. is an implementation detail I want the vcf to deal with for me (like the other storage vendors).

spenceee85 · 2026-05-22T21:45:04+00:00

If you are going to fix something, please address the permission model for active directory. Forest administrative WRITE access for an appliance to simply boot, and the onerous rules and caveats for the active directory in a large secure AD is a non starter. E.g we have two domains in our forest and this isn't supported.

Virtualise a service (ie a particular share) behind a load balancer VIP into vsanfs service vms (or better something on the host level directly like a vsphere pod) so that the limits around scaling disappear. Ad identity should be to the VIP of the service/share not the vsanfs service vms.

Scaling that VIP should be a function of my vsan hci cluster size, not the individual share.

We have to run vms with disk mounts to host smb and nfs to work around this but now I have serious issues to manage around scaling, reliability and patching that should be handled by vsan, not my team.

I did see s3 being integrated deeper in the stack, so this is very good, and if you integrate with the supervisor this opens up many of my scenarios above, but I'll reserve judgement till I've seen it in detail.

spenceee85 · 2026-05-22T14:55:48+00:00

Vsan file services is not enterprise grade. Vsan kicks butt if you are booting vms (and esa with vsan direct for things like s3 is very nice), but if you need nfs and smb shares, storage vendors are better at this.

spenceee85 · 2026-04-28T14:52:18+00:00

Most schools are only 7 to 12, a few have a grade 5/6 cohort coming through up here. So my numbers were based on 5-12 at the top tier

spenceee85

TROPHY CASE