forked from vmware-archive/vmware-pks-deploy
-
Notifications
You must be signed in to change notification settings - Fork 0
/
one-cloud-nsxt-param.yaml
431 lines (376 loc) · 20.9 KB
/
one-cloud-nsxt-param.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
enable_ansible_debug: false # set value to true for verbose output from ansible
# vCenter details to deploy the Mgmt OVAs (Mgr, Edge, Controller)
vcenter_host: 192.168.110.22 # EDIT - this is for deployment of the ovas for the mgmt plane
vcenter_usr: administrator@corp.local # EDIT - this is for deployment of the ovas for the mgmt plane
vcenter_pwd: VMware1! # EDIT - this is for deployment of the ovas for the mgmt plane
vcenter_datacenter: RegionA01 # EDIT
vcenter_datastore: RegionA01-ISCSI01-COMP01 # EDIT
vcenter_cluster: RegionA01-MGMT # EDIT
vcenter_manager: vcenter-1 # EDIT
# OVA general network settings
ntpservers: time.vmware.com # EDIT
mgmt_portgroup: 'ESXi-RegionA01-vDS-COMP' # EDIT
dnsserver: 192.168.110.10 # EDIT
dnsdomain: corp.local # EDIT
defaultgateway: 192.168.110.1 # EDIT
netmask: 255.255.255.0 # EDIT
# Download NSX-T 2.1 bits from
# https://my.vmware.com/group/vmware/details?downloadGroup=NSX-T-210&productId=673
# Host a Webserver to serve the ova images and ovftool
# Please edit the endpoint and the file names
nsx_image_webserver: http://192.168.100.120
nsx_mgr_ova: nsx-unified-appliance-2.1.0.0.0.7395503.ova
nsx_controller_ova: nsx-controller-2.1.0.0.0.7395493.ova
nsx_edge_ova: nsx-edge-2.1.0.0.0.7395502.ova
ovftool_image: VMware-ovftool-4.2.0-5965791-lin.x86_64.bundle
# The Esxi Hosts can be added to transport nodes in two ways:
# a) specify the esxi hosts individually - first checked for
# b) or use compute_vcenter_manager to add hosts under a specific vcenter as transport nodes
# Specify passwd of the esxi hosts that should be used for nsx-t
esxi_hosts_root_pwd: VMware1! # EDIT - Root password for the esxi hosts
# Specify FQDN, ip (and passwd if they are different) for each of the esxi hosts that s hould be used for nsx-t
esxi_hosts_config:
# esxi_hosts:
# - name: esxi-host1.corp.local.io
# ip: 10.13.12.10
# root_pwd: rootPasswd
# - name: esxi-host2.corp.local.io
# ip: 10.13.12.11
# root_pwd: rootPasswd
# Using compute manager to specify esxi hosts
# If filled, then comment off the esxi_hosts_config
compute_vcenter_manager: vcenter-01 # If filled, then comment off the esx i_hosts_config
compute_vcenter_host: 192.168.110.22 # for addition of Compute vCenter Esxi hosts as transport node
compute_vcenter_usr: administrator@corp.local # for addition of Compute vCenter Esxi h osts as transport node
compute_vcenter_pwd: VMware1! # for addition of Compute vCenter Esxi host s as transport node
compute_vcenter_cluster: RegionA01-K8s # for addition of Compute vCent er Esxi hosts as transport node
# Edit fololowing parameters
nsx_t_manager_host_name: nsx-mgr.corp.local # Set as FQDN, will be used also as certifi cate common name
nsx_t_manager_vm_name: 'NSX-T Mgr' # Can have spaces
nsx_t_manager_ip: 192.168.110.33
nsx_t_manager_admin_user: admin
nsx_t_manager_admin_pwd: VMware1! # Min 8 chars, upper, lower, number, special digit
nsx_t_manager_root_pwd: VMware1! # Min 8 chars, upper, lower, number, special digit
nsx_t_controller_host_prefix: nsx-t-ctl # Without spaces, Generated controller would be nsx-t-ctrl-1.corp.local.io,...
nsx_t_controller_vm_name_prefix: 'NSX-T Controller' # Generated edge host name would be "NSX-T Controller-1"
nsx_t_controller_ips: 192.168.110.34,192.168.110.35,192.168.110.36 # Should be 1 or 3 i ps to maintain quorum for Controller Cluster
nsx_t_controller_root_pwd: VMware1! # Min 8 chars, upper, lower, number, special digit
nsx_t_controller_cluster_pwd: VMware1! # Min 8 chars, upper, lower, number, special digit
nsx_t_edge_host_prefix: nsx-t-edge # Without spaces, generated edge would be nsx -t-edge-1.corp.local.io,...
nsx_t_edge_vm_name_prefix: 'NSX-T Edge' # Generated edge host name would be "NSX-T Ed ge-1"
nsx_t_edge_ips: 192.168.110.37,192.168.110.38 # comma separated ips, requires min 2 f or HA
nsx_t_edge_root_pwd: VMware1!
nsx_t_edge_portgroup_ext: ESXi-RegionA01-vDS-COMP # For external routing
nsx_t_edge_portgroup_transport: VM-RegionA01-vDS-COMP # For TEP/overlay
# If ova deployment succeeded but controller membership failed or edges didnt get to jo in for any reason
# enable rerun of the configure controllers
rerun_configure_controllers: false # set it to true if you want to rerun the configure controllers
# (as part of base ova install job) even as ova dep loyment succeeded
# Edge network interfaces
# Network1 and Network4 are for mgmt and not used for uplink
# Network2 is for external uplink
# Network3 is for overlay
# Change only if necessary
nsx_t_edge_overlay_interface: fp-eth1 # Wired to Network3
nsx_t_edge_uplink_interface: fp-eth0 # Wired to Network2
# Tunnel endpoint network ip pool - change pool_end based on # of members in the tep po ol
nsx_t_tep_pool_name: tep-ip-pool
nsx_t_tep_pool_cidr: 192.168.213.0/24
nsx_t_tep_pool_gateway: 192.168.213.1
nsx_t_tep_pool_start: 192.168.213.10
nsx_t_tep_pool_end: 192.168.213.200
nsx_t_tep_pool_nameserver: 192.168.110.10
# Memory reservation is turned ON by default with the NSX-T OVAs.
# This would mean a deployment of an edge or a mgr would reserve full memory
# leading to memory constraints
# if nsx_t_keep_reservation to true - would keep reservation ON, recommended for produ ction setups.
# if nsx_t_keep_reservation to false - would turn reservation OFF, recommended for POCs , smaller setups.
nsx_t_keep_reservation: false # for Prod setup
# Default Sizing of NSX-T VMs
# Manager Sizing
# small : 2 vCPU, 8GB RAM
# medium : 4 vCPU, 16GB RAM - default with OVA
# large : 8 vCPU, 32GB RAM
# Controller Sizing
# default: 4 vCPU, 16GB RAM
# Edge Instance Sizing
# small : 2 vCPU, 4GB RAM - Too small - dont use
# medium : 4 vCPU, 8GB RAM - default with OVA
# large : 8 vCPU, 16GB RAM
# Controller is fixed to the 4 vCPU and 16 GB RAM
# Change default size for deployment for edge and mgr
# Size of the edge determines size of loadbalancers and # of lbrs.
# So, choose the size of edge based on requirements
nsx_t_mgr_deploy_size: small # Recommended for real barebones demo, smallest setup
#nsx_t_edge_deploy_size: medium # Recommended for POCs, smaller setup (# of lbrs very l imited)
nsx_t_edge_deploy_size: large # Recommended when 4 small lbrs are required
# More control over memory and vcpu to use
# Not exposed and support removed
# nsx_t_sizing_spec: |
# nsx_t_sizing:
# mgr:
# cpu: 2
# memory: 8192 # in MB, needs to be multiples of 1024
# controller:
# # Controller would be resized from 4vCPU/16GB to 2vCPU/8GB
# cpu: 2
# memory: 8192 # in MB, needs to be multiples of 1024
# edge:
# cpu: 2
# memory: 8192 # in MB, needs to be multiples of 1024
nsx_t_overlay_hostswitch: hostswitch2
nsx_t_vlan_hostswitch: hostswitch1
# For Edge External uplink
nsx_t_transport_vlan: 0
nsx_t_vlan_transport_zone: vlan-tz
nsx_t_overlay_transport_zone: overlay-tz
nsx_t_pas_ncp_cluster_tag: pas1
nsx_t_edge_cluster: 'Edge Cluster'
# For outbound uplink connection used by Edge
nsx_t_single_uplink_profile_name: "single-uplink-profile"
nsx_t_single_uplink_profile_mtu: 1600 # Min 1600
nsx_t_single_uplink_profile_vlan: 0 # Default
# For internal overlay connection used by Esxi hosts
nsx_t_overlay_profile_name: "host-overlay-profile"
nsx_t_overlay_profile_mtu: 1600 # Min 1600
nsx_t_overlay_profile_vlan: 0
# Specify an unused vmnic on esxi host to be used for nsx-t
# can be multiple vmnics separated by comma
nsx_t_esxi_vmnics: vmnic1 # vmnic1,vmnic2...
# Configs for T0Router (only one per run), T1Routers, Logical switches and tags...
# Make sure the ncp/cluster tag matches the one defined at the top level.
# Expects to use atleast 2 edge instances for HA
nsx_t_t0router_spec: |
t0_router:
name: DefaultT0Router
edge_index: nsx-t-edge-01
ha_mode: 'ACTIVE_STANDBY'
ip1: 192.168.100.4/24
ip2: 192.168.100.5/24
vip: 192.168.100.3/24
vlan_uplink: 0
static_route:
next_hop: 192.168.100.1
network: 0.0.0.0/0
admin_distance: 1
tags:
ncp/cluster: 'pas1' # Should match the top level ncp/cluster tag value
testtag: 'testpas1'
# T1 Logical Router with associated logical switches
# Add additional or comment off unnecessary t1 routers and switches as needed
# Can have 3 different setups:
# 1: One shared mgmt T1 Router and infra logical switch for both PKS & PAS
# 2: One mgmt T1 Router and infra logical switch for either PKS or PAS..
# Comment off the T1 router not required
# 3: Separate mgmt T1 Router and infra logical switch for each PKS and PAS..
# Add additional T1Router-Mgmt2 as needed with its infra logical switch
# Name the routers and logical switches and cidrs differently to avoid conflict
nsx_t_t1router_logical_switches_spec: |
t1_routers:
# Add additional T1 Routers or collapse switches into same T1 Router as needed
# Comment off the following T1 Routers if there is no PAS
- name: T1-Router-PAS-Infra
switches:
- name: PAS-Infra
logical_switch_gw: 192.168.10.1 # Last octet should be 1 rather than 0
subnet_mask: 24
- name: T1-Router-PAS-ERT
switches:
- name: PAS-ERT
logical_switch_gw: 192.168.24.1 # Last octet should be 1 rather than 0
subnet_mask: 24
- name: T1-Router-PAS-Services
switches:
- name: PAS-Services
logical_switch_gw: 192.168.28.1 # Last octet should be 1 rather than 0
subnet_mask: 24
- name: T1-Router-PAS-DynamicServices
switches:
- name: PAS-DynamicServices
logical_switch_gw: 192.168.30.1 # Last octet should be 1 rather than 0
subnet_mask: 24
# Comment off the following T1 Routers if there is no PKS
- name: T1-Router-PKS-Infra
switches:
- name: PKS-Deployment
logical_switch_gw: 192.168.20.1 # Last octet should be 1 rather than 0
subnet_mask: 24
- name: T1Router-PKS-Clusters
switches:
- name: PKS-PKS-Clusters
logical_switch_gw: 192.168.40.1 # Last octet should be 1 rather than 0
subnet_mask: 24
# Make sure the ncp/cluster tag matches the one defined on the T0 Router
# Additional the ncp/ha tag should be set for HA Spoof guard profile
nsx_t_ha_switching_profile_spec: |
ha_switching_profiles:
- name: HASwitchingProfile
tags:
ncp/cluster: 'pas1' # Should match the top level ncp/cluster tag value
ncp/ha: 'true' # Required for HA
testtag: 'testpas1'
# Make sure the ncp/cluster tag matches the one defined on the T0 Router
# Add additional container ip blocks as needed
nsx_t_container_ip_block_spec: |
container_ip_blocks:
- name: container-ip-block
cidr: 10.4.0.0/16
tags:
ncp/cluster: 'pas1' # Should match the top level ncp/cluster tag value
testtag: 'testpas1'
# Make sure the ncp/cluster tag matches the one defined on the T0 Router for PAS
# Make sure the ncp/shared tag is set to true for PKS
# Additional the ncp/external tag should be set for external facing ip pool
# Add additional exernal ip pools as needed
nsx_t_external_ip_pool_spec: |
external_ip_pools:
- name: snat-vip-pool-for-pas
cidr: 10.208.40.0/24
gateway: 10.208.40.1
start: 10.208.40.10 # Should not include gateway
end: 10.208.40.200 # Should not include gateway
tags:
ncp/cluster: 'pas1' # Should match the top level ncp/cluster tag value for PAS
ncp/external: 'true' # Required for external facing ips
testtag: 'testpas1'
- name: snat-vip-pool-for-pks
cidr: 10.208.50.0/24
gateway: 10.208.50.1
start: 10.208.50.10 # Should not include gateway
end: 10.208.50.200 # Should not include gateway
tags:
# Needs to have atleast one tag entry
ncp/external: 'true' # Required for external facing ips
ncp/shared: 'true' # Required for PKS
# Specify NAT rules
# Provide matching dnat and snat rule for specific vms by using ips for destination_net work and translated_network that need to be exposed like Ops Mgr
# Provide snat rules for outbound from either container or a vm by specifying the sourc e_network (cidr) and translated network ip
nsx_t_nat_rules_spec: |
nat_rules:
# Sample entry for allowing inbound to PAS Ops manager
- t0_router: DefaultT0Router
nat_type: dnat
destination_network: 10.208.40.2 # External IP address for PAS opsmanager
translated_network: 192.168.10.2 # Internal IP of PAS Ops manager
rule_priority: 1024 # Higher priority
# Sample entry for allowing outbound from PAS Ops Mgr to external
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.10.2 # Internal IP of PAS opsmanager
translated_network: 10.208.40.2 # External IP address for PAS opsmanager
rule_priority: 1024 # Higher priority
# Sample entry for PAS Infra network SNAT
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.10.0/24 # PAS Infra network cidr
translated_network: 10.208.40.3 # SNAT External Address for PAS networks
rule_priority: 8000 # Lower priority
# Sample entry for PAS ERT network SNAT
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.24.0/24 # PAS ERT network cidr
translated_network: 10.208.40.3 # SNAT External Address for PAS networks
rule_priority: 8000 # Lower priority
# Sample entry for PAS Services network SNAT
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.28.0/24 # PAS Services network cidr
translated_network: 10.208.40.3 # SNAT External Address for PAS networks
rule_priority: 8001 # Lower priority
# Sample entry for PAS Dynamic Services network SNAT
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.30.0/24 # PAS Dynamic Services network cidr
translated_network: 10.208.40.3 # SNAT External Address for PAS networks
rule_priority: 8001 # Lower priority
# Sample entry for PKS PKS-clusters network
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.40.0/24 # PKS Clusters network cidr
translated_network: 10.208.50.3 # SNAT External Address for PKS networks
rule_priority: 8001 # Lower priority
# Sample entry for PKS PKS-Infra network
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.20.0/24 # PKS Infra network cidr
translated_network: 10.208.50.3 # SNAT External Address for PKS networks
rule_priority: 8001 # Lower priority
# Sample entry for allowing inbound to PKS Ops manager
- t0_router: DefaultT0Router
nat_type: dnat
destination_network: 10.208.50.2 # External IP address for PKS opsmanager
translated_network: 192.168.20.2 # Internal IP of PKS Ops manager
rule_priority: 1024 # Higher priority
# Sample entry for allowing outbound from PKS Ops Mgr to external
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.20.2 # Internal IP of PAS opsmanager
translated_network: 10.208.50.2 # External IP address for PAS opsmanager
rule_priority: 1024 # Higher priority
# Sample entry for allowing inbound to PKS Controller
- t0_router: DefaultT0Router
nat_type: dnat
destination_network: 10.208.50.4 # External IP address for PKS opsmanager
translated_network: 192.168.20.4 # Internal IP of PKS Ops Controller
rule_priority: 1024 # Higher priority
# Sample entry for allowing outbound from PKS Controller to external
- t0_router: DefaultT0Router
nat_type: snat
source_network: 192.168.20.4 # Internal IP of PKS controller
translated_network: 10.208.50.4 # External IP address for PKS controller
rule_priority: 1024 # Higher priority
nsx_t_csr_request_spec: |
csr_request:
#common_name not required - would use nsx_t_manager_host_name
org_name: Company # EDIT
org_unit: net-integ # EDIT
country: US # EDIT
state: CA # EDIT
city: SF # EDIT
key_size: 2048 # Valid values: 2048 or 3072
algorithm: RSA # Valid values: RSA or DSA
# LBR definition
# By default, all the server pools would use Layer 4 - TCP pass through
# No ssl termination or handling, uses default tcp active monitor & auto map for virtua l server
# Auto Map mode uses LB interface IP and ephemeral port.
# In scenarios where both Clients and Pool Members are attached to the same Logical Rou ter,
# SNAT (Auto Map or IP List) must be used.
# LBR Sizing guide
# LB Size | Virtual Servers | Pool Members
# small | 10 | 30
# medium | 100 | 300
# large | 1000 | 3000
# No. of LBs per edge based on size of edge
# Edge Size | Small LBs| Medium LBs| Large LBs
#
# small | 0 | 0 | 0
# medium | 1 | 0 | 0 # Recommended for running only PAS or PKS
# large | 4 | 1 | 1 # Recommended for running PAS + PKS
# Bare metal - not handled here
nsx_t_lbr_spec: |
loadbalancers:
# Sample entry for creating LBR for PAS ERT
- name: PAS-ERT-LBR
t1_router: T1-Router-PAS-ERT # Should match a previously declared T1 Router
size: small # Allowed sizes: small, medium, large
virtual_servers:
- name: goRouter443 # Name that signifies function being exposed
vip: 10.208.40.4 # Exposed VIP for LBR to listen on
port: 443
members:
- ip: 192.168.24.11 # Internal ip of GoRouter instance 1
port: 443
- name: goRouter80
vip: 10.208.40.4
port: 80
members:
- ip: 192.168.24.31 # Internal ip of GoRouter instance 1
port: 80
- ip: 192.168.24.32 # Internal ip of GoRouter instance 2
port: 80
- name: sshProxy # SSH Proxy exposed to outside
vip: 10.208.40.5
port: 2222 # Port 2222 for ssh proxy
members:
- ip: 192.168.24.41 # Internal ip of Diego Brain where ssh proxy runs
port: 2222