Tech Zone VCF Platform

VMware Cloud Foundation Offline Depot Introduction

With the release of VMware Cloud Foundation (VCF) 5.2, a new version of the Offline Bundle Transfer Utility (OBTU) is now available, enabling administrators to create a secure, offline repository of software bundles within their own firewall, providing greater control and flexibility in managing software updates and deployments.

By default, VCF deployments connect to the VMware online depot, which is accessed via the Internet and requires Broadcom Support Portal credentials for authentication. However, in situations where SDDC Manager cannot access the internet directly, administrators need an alternative way to obtain patches and updates for VCF infrastructure. Until now, administrators had to use the OBTU to download software bundles, copy them to each SDDC Manager instance, and then run an import command to update the infrastructure. With the new offline depot architecture, administrators can download bundles to an internal web server and configure each SDDC Manager to pull patches and updates from that server directly, eliminating the need for additional copying or importing steps.

This article provides technical details on setting up an offline depot and configuring SDDC Manager instances to use it.

Setting Up an Offline Depot

An offline depot is a self-managed web server that will act as an internal mirror of the official VMware online depot. You use OBTU to download software bundles to this system and a standard web server to serve the content to internal SDDC Manager instances that do not have access to the Internet. This web server should be configured with HTTPS certificates and protected with a basic auth username and password.

To get started, deploy a new web server VM of your choice with adequate disk space provisioned, such as 1TB, for the software bundle repository. This guide will be based on Rocky Linux 9.3, which is a popular free enterprise Linux distribution. You will also need to have valid credentials for the Broadcom Support Portal – use them to log in to the Portal and download the latest version of of OBTU.

Set up OBTU on the offline depot system

Configure Apache HTTPD with HTTPS and Basic Auth

You can generate an SSL cert and key pair using your enterprise PKI infrastructure or you can use a self-signed certificate for test and proof-of-concepts purposes. The following script shows what generally needs to be done to configure the web server.

$ cat offline_depot_httpd.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName replace_with_fqdn
DocumentRoot /var/www/offline_depot/

SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/offline_depot.crt
SSLCertificateKeyFile /etc/pki/tls/private/offline_depot.key

<Directory /var/www/offline_depot/>
AuthType Basic
AuthName “Restricted Content”
AuthUserFile /etc/httpd/.htpasswd
Require valid-user
</Directory>

Alias /products/v1/bundles/lastupdatedtime /var/www/offline_depot/PROD2/vsan/hcl/lastupdatedtime.json
Alias /products/v1/bundles/all /var/www/offline_depot/PROD2/vsan/hcl/all.json
Alias /Compatibility/VxrailCompatibilityData.json /var/www/offline_depot/PROD2/evo/vmw/Compatibility/VxrailCompatibilityData.json

</VirtualHost>
</IfModule>

Download appropriate software bundles

Execute the utility, adjusting the parameters according to your current VCF deployments.

Configure Trusted Certificate

In order for SDDC Manager to access the offline depot web server over HTTPS, the certificate must be trusted. If using a self-signed certificate, upload it using the Developer Center in SDDC Manager. The following command will generate the necessary format for use.

Verify the offline depot is working before attempting to configure SDDC Manager to use it.

Configure VCF 5.1 SDDC Manager to use the Offline Depot

You can configure VCF 5.1 to use an offline depot, but there is no graphical configuration to do so. Instead, a command-line tool that is part of the OBTU distribution must be used. Install OBTU on the SDDC Manager and then run the depot_config.py script, providing the FQDN of the new offline depot server.

Once that configuration takes effect, log into the SDDC Manager user interface and configure the depot credentials with your offline depot username and password. This is the same interface that the default online depot uses, but after the above reconfiguration step, it now applies to the offline depot instead.

Configure VCF 5.2 SDDC Manager to use the Offline Depot

SDDC Manager in VCF 5.2 has an updated user interface that allows administrators to choose between an online or offline depot. Once the offline depot is ready to go, simply log in and enter the FQDN, port, and credentials.

Demo Video

Takeaway

The new offline depot capability launched with VMware Cloud Foundation 5.2 provides a significant enhancement for administrators, allowing them to set up a mirror of software bundles needed for patching and updating VCF infrastructure. With this new model, administrators can reduce the time and effort required for patching and updating, and can also help scale deployments by eliminating the need for redundant downloads of large files from the Internet. To get started with setting up an offline depot, follow the steps outlined in this guide and discover the benefits of streamlined patching and updating for your VCF infrastructure.