VMware has deprecated the topology model of the vCenter Server with an external PSC with embedded topology with the release of vSphere 6.7 Update 1. External PSC is used to take advantage of features such as Enhanced Linked Mode (ELM) or PSC HA. With the removal of the External PSC, vSphere 6.7 Update 1 onwards supports ELM also in an embedded topology. VMware has provided a Converge Tool to be able to migrate from an External Deployment to an Embedded deployment. The Converge Tool does require you to be on vSphere 6.5 Update 2d or greater or vSphere 6.7 Update 1 or greater and be running the vCenter Server Appliance (VCSA).
The Converge Tool can be executed in Windows, Linux and Mac OSs. In the vCSA 6.7 Update 1 .ISO file, the vCSA-converge-cli folder includes three sub-folders (lin64, mac and win32) containing the tool for the supported operating systems.
Planning your Convergence
Before starting with the use Convergence Tool, keep in mind the following
- Convergence Tool require you to be on vSphere 6.5 Update 2d or greater or vSphere 6.7 Update 1 or greater and be running the vCenter Server Appliance (VCSA), Windows-based vCenter Server must be migrated to appliance first.
- vCenter Server High Availability (VCHA) and Distributed Resource Scheduler (DRS) must be disabled before starting the migration
- Analyze our current SSO domain to understand the solutions and servers we are dealing with. We need to review our SSO environment and identify which solutions are registered with the SSO Lookup Service, such as NSX and Site Recovery Manager (SRM). These and other solutions need to be manually repointed to the embedded vCenter Server once convergence is complete. Also, if you are unsure which Platform Services Controller your vCenter Server is pointed to—you have two ways to check. The first option is utilizing the vSphere Client and review the Advanced Settings. Navigate to your vCenter Server and choose the Configuration tab. Proceed to Advanced Settings and search for config.vpxd.sso.admin.url and this will show your connected PSC.
https://kb.vmware.com/kb/2043509
If you prefer to go the CLI route, you can run the following command to identify the connected PSC.
#/usr/lib/vmware-vmafd/bin/vmafd-cli get-ls-location —server-name localhost
If your PSC and vCSA appliances run a different vSphere version than supported, both appliances must be upgraded to the correct version before running the Converge Tool. Keep in mind the PSC appliance must be upgraded first to avoid issues. Before proceeding make also sure the upgrade path is supported. Check out the VMware Product Interoperability matrices to ensure your upgrade path is supported.
vCenter Server 6.7 Update 2 has been announced and with this release there have been enhancements made to the vCenter Server Converge Tool. VMware has now provided a topology overview of your Platform Services Controllers (PSCs) and vCenter Servers in the System Configuration view. Previously available only through the CLI, the vCenter Server Converge Tool is now available to use through the vSphere Client.
vCenter Server 6.7 Update 2 includes a brand-new System Configuration interface. Within this updated view you are now able to see information on nodes that are within your vCenter Server Single-Sign On (SSO) Domain. You can see information such as the Load Balancers, External PSCs and vCenter Servers. Information about your environment such as the health, type, version, uptime and replication partners are also available within this updated section.
Alongside the new table view there is also a new topology view. This view allows you to see the nodes within your SSO domain in a graphical representation. This is useful when you need to understand which vCenter Server is pointing to which Platform Services Controller or to see which replication agreements are in use.
Executing the Converge Tool
In vCenter Server 6.7 Update 2 within the table view you will see two new buttons, the ability to Converge to Embedded and Decommission PSC. You no longer are required to utilize the CLI and JSON templates to run the vCenter Server Converge Tool. One additional benefit when running the Converge Tool through the vSphere Client, is that if you have internet access, we will automatically download any needed components from the VMware Online Repository. This is great for customers or partners who wish for a simplistic and foolproof method to migrate their External vCenter Server Deployment to an Embedded vCenter Server Deployment.
The vSphere Client will guide you through convergence asking you for information specific to your environment and notifying you if any downtime will occur.
Once you have successfully converged your vCenter Servers, you now can decommission your PSC through the vSphere Client as well. When running this task your External PSC will be shut down and unregistered from the SSO domain.
After the converge and decommission process is complete, you are now able to see your simplified vCenter Server deployment within the topology view.
If your platform is older than vCenter Server 6.7 Update 2, to run the Converge Tool you must download and mount the VCSA iso, and first prepare your JSON templates. You will have one template to run the Converge Tool to migrate from an External to Embedded PSC and there will be a second template used to decommission the external PSC which will shut it down and remove it from the SSO domain.
First up is the converge template, within this template there are four sections:
- Information about the Managing vCenter or ESXi Host.
- Information about the vCenter Server you wish to Converge to Embedded.
- (Optional) Active Directory Information if you wish to join the Embedded vCenter to AD.
- (Optional) Replication Partner Information. If this vCenter Server is the first converged node within the SSO domain you will leave this blank, but if it is not the first you will need to fill it out for additional nodes.
{
"__version": "2.11.0",
"__comments": "Template for VCSA with external Platform Services Controller converge",
"vcenter": {
"description": {
"__comments": [
"This section describes the vCenter appliance which you want to",
"converge and the ESXi host on which the appliance is running. "
]
},
"managing_esxi_or_vc": {
"hostname": "<FQDN or IP address of the ESXi or vCenter on which the vCenter Server Appliance resides.>",
"username": "<Username of a user with administrative privilege on the ESXi host or vCenter Server. For example 'root' for ESXi and 'administrator@<SSO domain name>' for vCenter >",
"password": "<Password of the administrative user on the ESXi host or vCenter Server. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>"
},
"vc_appliance": {
"hostname": "<FQDN or IP address of the vCenter Server Appliance>",
"username": "administrator@<SSO domain name>",
"password": "<vCenter Single Sign-On administrator password. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>",
"root_password": "<Appliance root password. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>"
},
"ad_domain_info": {
"__comments": [
"Important Note: This section is needed only when PSC (Platform Services Controller) appliance is joined to a domain.",
"Remove this section if PSC appliance is not joined to a domain.",
"Keeping this section without valid values results in JSON validation errors."
],
"domain_name": "<Domain name of the Platform Services Controller appliance's AD domain>",
"username": "<AD domain username with privileges to join any machine to the provided domain>",
"password": "<AD domain password with privileges to join any machine to the provided domain>",
"dns_ip": "<DNS IP which resolves AD domain name. This is an optional field and is required only when the provided AD domain cannot be resolved by the existing DNS setting of the VCSA node.>"
}
},
"replication": {
"description": {
"__comments": [
"Important Note: Make sure you provide the information in this section very carefully, as this changes the replication topology.",
"Refer to the documentation for complete details. Remove this section if this is first converge operation in your setup.",
"This section provides details of the PSC node which will be set up as a replicated node for a new PSC on the target VCSA node."
]
},
"partner": {
"hostname": "<FQDN or IP address of the target VCSA PSC node>"
}
}
}Now that we understand what the JSON template fields do, let’s review what a prepared converge template looks like. In this example my first external deployment was not joined to Active Directory and it is the first one I am converging in my SSO domain, so I only have two sections to fill out.
{
"__version": "2.11.0",
"__comments": "Template for VCSA with external Platform Services Controller converge",
"vcenter": {
"description": {
"__comments": [
"This section describes the vCenter appliance which you want to",
"converge and the ESXi host on which the appliance is running. "
]
},
"managing_esxi_or_vc": {
"hostname": "mco-vcsa-01.cpbu.lab",
"username": "[email protected]",
"password": "VMware1!"
},
"vc_appliance": {
"hostname": "mco-vcsa-01.cpbu.lab",
"username": "[email protected]",
"password": "VMware1!",
"root_password": "VMware1!"
}
}
}My second external deployment was also not joined to Active Directory and since I already have one Embedded vCenter Server I must point to it as the replication partner. If I choose to leave this blank, it would automatically create a replication back to its External PSC and when we go to decommission those, we would’ve created two separate SSO domains because of the lack of replication.
{
"__version": "2.11.0",
"__comments": "Template for VCSA with external Platform Services Controller converge",
"vcenter": {
"description": {
"__comments": [
"This section describes the vCenter appliance which you want to",
"converge and the ESXi host on which the appliance is running. "
]
},
"managing_esxi_or_vc": {
"hostname": "mco-vcsa-02.cpbu.lab",
"username": "[email protected]",
"password": "VMware1!"
},
"vc_appliance": {
"hostname": "mco-vcsa-02.cpbu.lab",
"username": "[email protected]",
"password": "VMware1!",
"root_password": "VMware1!"
}
},
"replication": {
"description": {
"__comments": [
"Important Note: Make sure you provide the information in this section very carefully, as this changes the replication topology.",
"Refer to the documentation for complete details. Remove this section if this is first converge operation in your setup.",
"This section provides details of the PSC node which will be set up as a replicated node for a new PSC on the target VCSA node."
]
},
"partner": {
"hostname": "mco-vcsa-01.cpbu.lab"
}
}
}Now, that we have our JSON templates filled out properly, we can proceed to executing them. We will run the Converge Tool against our first vCenter Server and proceed until all vCenter Servers within the SSO domain are complete. You will be unable to decommission an external PSC until all remaining vCenter Servers in the SSO domain are converged to Embedded.
To understand all the parameters available with the Converge Tool we can run the following command to learn more.
#.\vcsa-converge-cli\win32\vcsa-util.exe converge –help
To execute the Converge Tool against our vCenter Server we will run the following command.
#.\vcsa-converge-cli\win32\vcsa-util.exe converge --no-ssl-certificate-verification --backup-taken C:\pathtofile.json
At this point our external solutions are now registered properly, and we can move forward with decommissioning our External PSC’s.
Note: You will be unable to decommission your external PSC’s until all vCenter Servers within your SSO domain have been migrated to Embedded Deployments
Next up we will review the decommission template. Within this template there are four sections:
- Information about the Managing vCenter or ESXi Host of the External PSC.
- Information about the Platform Services Controller you wish to Decommission.
- Information about the Managing vCenter or ESXi Host of an Embedded vCenter in the SSO Domain.
- Information about the Embedded vCenter in the SSO Domain.
{
"__comments": "Template for decommissioning PSC node with converge CLI tool.",
"__version": "2.11.0",
"psc": {
"description": {
"__comments": [
"This section describes the PSC appliance which you want to",
"decommission and the ESXi host on which the appliance is running. "
]
},
"managing_esxi_or_vc": {
"hostname": "<FQDN or IP address of the ESXi or vCenter on which the Platform Services Controller appliance resides.>",
"username": "<Username of a user with administrative privilege on the ESXi host or vCenter Server. For example 'root' for ESXi and 'administrator@<SSO domain name>' for vCenter >",
"password": "<Password of the administrative user on the ESXi host or vCenter Server. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>",
"port": "This section may be removed, if default port is 443. If not, custom port have to be specified"
},
"psc_appliance": {
"hostname": "<FQDN or IP address of the Platform Services Controller appliance>",
"username": "administrator@<SSO domain name>",
"password": "<vCenter Single Sign-On administrator password. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>",
"root_password": "<Appliance root password. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>"
}
},
"vcenter": {
"description": {
"__comments": [
"This section describes the embedded vCenter appliance which is in ",
"replication with the provided PSC"
]
},
"managing_esxi_or_vc": {
"hostname": "<FQDN or IP address of the ESXi or vCenter on which the vCenter Server Appliance resides.>",
"username": "<Username of a user with administrative privilege on the ESXi host or vCenter Server. For example 'root' for ESXi and 'administrator@<SSO domain name>' for vCenter >",
"password": "<Password of the administrative user on the ESXi host or vCenter Server. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>",
"port": "This section may be removed, if default port is 443. If not, custom port have to be specified"
},
"vc_appliance": {
"hostname": "<FQDN or IP address of the vCenter Server Appliance>",
"username": "administrator@<SSO domain name>",
"password": "<vCenter Single Sign-On administrator password. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>",
"root_password": "<Appliance root password. If left blank, or omitted, you will be prompted to enter it at the command console during template verification.>"
}
}
}Here is an example of our prepared JSON template for decommission.
{
"__comments": "Template for decommissioning PSC node with converge CLI tool.",
"__version": "2.11.0",
"psc": {
"description": {
"__comments": [
"This section describes the PSC appliance which you want to",
"decommission and the ESXi host on which the appliance is running. "
]
},
"managing_esxi_or_vc": {
"hostname": "mco-vcsa-01.cpbu.lab",
"username": "[email protected]",
"password": "VMware1!"
},
"psc_appliance": {
"hostname": "mco-psc-01.cpbu.lab",
"username": "[email protected]",
"password": "VMware1!",
"root_password": "VMware1!"
}
},
"vcenter": {
"description": {
"__comments": [
"This section describes the embedded vCenter appliance which is in ",
"replication with the provided PSC"
]
},
"managing_esxi_or_vc": {
"hostname": "mco-vcsa-01.cpbu.lab",
"username": "[email protected]",
"password": "VMware1!"
},
"vc_appliance": {
"hostname": "mco-vcsa-01.cpbu.lab",
"username": "[email protected]",
"password": "VMware1!",
"root_password": "VMware1!"
}
}
}We will run the Converge Tool using the decommission option to remove our External PSC’s, repeating for each remaining node.
#.\vcsa-converge-cli\win32\vcsa-util.exe decommission --no-ssl-certificate-verification C:\pathtofile.json
At this point we have now successfully run the Converge Tool to migrate all External PSC’s to Embedded PSC’s and decommissioned our External PSC’s
Please refer below VMware KBs for more details
https://kb.vmware.com/kb/59907
https://kb.vmware.com/kb/65129
https://kb.vmware.com/kb/59508
Thanks,
If you have any comments, please drop me a line.
I hope this article was informative, and don’t forget to buy me a coffee if you found this worth reading.
Leave a Reply