Blah, Cloud.

Adventures in architectures

  • Twitter
  • GitHub
  • Home
  • Blog
  • Kubernetes on vSphere
  • Multi-tenant IaaS Networking
  • Me
    • About
    • CV
    • Contact
Home » Blog » Cloud Frameworks » vCloud Director console proxy and UI on a single interface

vCloud Director console proxy and UI on a single interface

20/08/2017 by Myles Gray 1 Comment

I was recently rebuilding part of my lab infrastructure, and as part of it, I wanted to migrate my vCD cells from two IPs each to a single IP (as this feature was added in vCD 8.10) for both the web UI and the console proxy.

It simplifies provisioning, potential routing problems, and load-balancer configuration by having a single IP but separate ports for each service. Adding both services to a single IP is not new, Tomas Fjota wrote about it here, however, there was some detail missing from his article to allow it to work behind a load-balancer.

So, first up I am going to assume you already have both your vCD cells up and operational as from the install guide. Now we are going to quiesce the cells and shut them down:

cd /opt/vmware/vcloud-director/bin/
./cell-management-tool -u administrator cell --quiesce true
./cell-management-tool -u administrator cell --shutdown

Now we need to edit the global.properties file:

nano /opt/vmware/vcloud-director/etc/global.properties

In here we will change the existing lines:

vcloud.cell.ip.primary = 10.0.3.229
consoleproxy.host.https = 10.0.3.231

To the same IP as each other:

vcloud.cell.ip.primary = 10.0.3.229
consoleproxy.host.https = 10.0.3.229

And add the following to the bottom of the file (insert your external load-balanced address for the last property):

consoleproxy.port.https = 8443
vcloud.http.port.standard = 80
vcloud.http.port.ssl = 443
consoleproxy.external.address = vcd-prx.mylesgray.io:8443

You might be wondering about the consoleproxy.external.address property, you can set the console address in the vCD UI – so why add it here, right? Because if you try to add it in the UI, you get this error:

vCD Console Proxy address error

However, if we add it in our global.properties file, then restart the cells we can avoid the UI based checks, the cell will start up and bind the console proxy to this port.

Startup the cells again:

service vmware-vcd start

You should see two ports bound to the same address if you run netstat:

[[email protected] ~]# netstat -tlpn | grep java | grep 443
tcp        0      0 ::ffff:10.0.3.229:8443      :::*                        LISTEN      16190/java
tcp        0      0 ::ffff:10.0.3.229:443       :::*                        LISTEN      16190/java

If you check in the UI, it will now list the console proxy address as what we put in global.properties, even though the UI would not let us do this:

vCD Console proxy address

Now, if you log in as a tenant and launch a console, then right click anywhere and hit “Inspect” you should see the console calls to the WebSocket on TCP/8443 as we configured:

vCD netstat output

A final note on load-balancer configuration across cells – I run a Kemp LB and have two separate virtual services running, one for each port. Both services were required to be in L7 SSL-offload/termination mode and were configured to re-encrypt traffic to the backend cells for console proxy sessions to establish successfully:

Kemp VS config

Also noteworthy, HTTP headers cannot be used for session persistence on the console proxy virtual service as these are raw TCP streams, not HTTPS/HTTP. Attempting to use HTTP headers for session persistence or traffic redirection will cause the TCP socket establishment to fail.

Why not follow @mylesagray on Twitter for more like this!

Show some love:

  • Reddit
  • Twitter
  • Pocket
  • LinkedIn
  • Email
  • Telegram

Similar things I've written

Filed Under: Cloud Frameworks, Infrastructure, Networks, Virtualisation Tagged With: load-balancing, vcloud director, vmware

About Myles Gray

Hi! I'm Myles, and I'm a Dev Advocate at VMware. Focused primarily on content generation, product enablement and feedback from customers and field to engineering.

Comments

  1. Mark Almeida-Cardy says

    06/02/2018 at 14:43

    Great article. Can you confirm if this is production configuration?

    Reply

Leave a Reply Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Myles Gray

Hi! I'm Myles, and I'm a Dev Advocate at VMware. Focused primarily on content generation, product enablement and feedback from customers and field to engineering. Read More…

Categories

Tags

active directory authentication CBT cisco datastore dell design esxi fortigate iscsi jumbo frame kubernetes lab linux load-balancing lun md3000i mtu networking NginX nic nsx openSUSE osx pxe readynas san sdelete serial teaming ubuntu vcenter vcloud director vcsa vexpert video VIRL vmdk vmfs vmware vsan vsphere vsphere 6 vsphere beta windows

Subscribe to Blog via Email

Copyright © 2021 · News Pro Theme on Genesis Framework · WordPress · Log in

loading Cancel
Post was not sent - check your email addresses!
Email check failed, please try again
Sorry, your blog cannot share posts by email.