Introduction to vSphere 7: Features and Technologies of Hybrid Cloud

vSphere 7 Description: hybrid cloud features and technology

2020 March 10, VMware made cloth vSphere 7 , I am pleased to finally be able to describe why it is really applicable to hybrid cloud technology!
Uploading... re-uploading cancel
vSphere with Kubernetes The first feature of vSphere 7 is vSphere with Kubernetes (formerly known as Project Pacific ). This is an important topic. We plan to have a lot of content and plan to study the transition method of vSphere in more depth to support both VMs and containers. As Krish mentioned, Tanzu Kubernetes Grid Service is how customers run fully compatible and consistent Kubernetes through vSphere. However, when full compatibility with open source projects is not required, vSphere Pod Service can provide optimized performance and higher security through VM-like isolation. Both options are available through VMware Cloud Foundation 4. The important point is that Kubernetes is now built into vSphere, which allows developers to continue to use the same industry standard tools and interfaces as they create modern applications. vSphere administrators can also benefit from it because they can use the same tools and skills developed around vSphere to help manage the Kubernetes infrastructure. To help set up these two worlds, we introduced a new vSphere structure called Namespaces, which allows vSphere Admins to create a set of logical resources, permissions and policies, centered on applications. Uploading... re-upload canceled
  
If you do not plan to use Kubernetes, we still have many new and improved features in this version. In fact, we have taken a big step for two of the most mature technologies: DRS and vMotion. In addition to namespaces, we have many other new features to discuss.

The improved Distributed Resource Scheduler (DRS) redesigned vSphere DRS to better serve containers and VMs. DRS has always focused on the cluster state in the past. When the algorithm is conducive to the balance of the entire cluster, the algorithm will recommend vMotion. This means that DRS used to achieve cluster balance by using a cluster-wide standard deviation model. Uploading... re-upload canceled. But what about a single VM? How does this vMotion affect the moving VM or old neighbors or new neighbors? The new DRS logic uses a very different approach to solve these problems. It calculates the VM DRS score on the host and moves the VM to the host that provides the highest VM DRS score. The biggest difference from the old version of DRS is that it no longer balances the host load. This means that DRS does not care much about ESXi host utilization and prioritizes virtual machine "happiness". The VM DRS score is also calculated every minute, which will lead to more refined optimization of resources. Distributable hardware
  
In vSphere 7, a new framework called Distributable Hardware has been developed, which can extend support for vSphere functions when customers use hardware accelerators. It introduces vSphere DRS (for initial placement of VMs in a cluster) and vSphere High Availability (HA) support for VMs equipped with pass-through PCIe devices or NVIDIA vGPU. Related to the allocatable hardware is the new Dynamic DirectPath I/O, which is a new method of configuring pass-through to expose PCIe devices directly to the VM. The hardware address of the PCIe device is no longer directly mapped to the configuration (vmx) file of the virtual machine. Instead, it is now exposed to the VM as a PCIe device function. Dynamic DirectPath I/O, NVIDIA vGPU and allocable hardware together form a powerful new combination that can release some outstanding new features. For example, let's look at a VM that requires an NVIDIA V100 GPU. Now, when the virtual machine is started (initial placement), the allocatable hardware will interact with the DRS to find an ESXi host with such a device available, claim ownership of the device, and then register the VM to the host. If a host fails and vSphere HA starts, the allocatable hardware also allows the VM to be restarted on a suitable host with the required hardware available.
vSphere Lifecycle Manager vSphere Lifecycle Manager has many new features of vSphere 7 and brings a series of features to make life cycle operations better. With the help of vSphere Lifecycle Manager, both vCenter Server and ESXi host configuration management have undergone a paradigm shift. Using the desired state configuration model, vSphere Administrators can create the configuration once, apply the configuration, and then continue to monitor the desired state through new tools called vCenter Server Profiles and Image Cluster Management. Through vCenter Server configuration files, administrators can standardize the configuration of all vCenter Servers and monitor them to prevent configuration drift.
Uploading... Re-uploading. Canceling 
cluster image management allows administrators to create images at the cluster level that indicate how to configure the hosts in the cluster. The cluster image can include the vSphere (ESXi) version, the vendor add-on (which is the delta between the golden ESXi image and the OEM ISO in VUM terminology), and the firmware add-on, which allows vSphere Lifecycle Manager to do the following: The firmware management tool (or hardware support manager) provided by the vendor (such as Dell OMIVV) for communication. Our partners in this release include Dell EMC and HPE. Uploading... re-uploading cancelled. Third, in vSphere Lifecycle Manager, we have vCenter Server Update Planner. vCenter Server Update Planner provides native tools to help successfully plan, discover, and upgrade customer environments. You will be notified when you upgrade directly in the vSphere Client. Then use Update Planner to easily monitor the interoperability matrix of VMware products to ensure that available upgrades are compatible with other VMware software in the environment. Before starting the upgrade, run a set of available pre-checks to help achieve version compatibility. Everything is fine? You will successfully upgrade, no surprise. It is important to note that vCenter Server Update Planner is only available for vSphere 7 and later. Therefore, Update Planner cannot help you plan the upgrade from vSphere 6.x to vSphere 7, but once you run vSphere 7, it will greatly simplify the upgrade. Refactored vMotion
  

Like DRS, we need to review the vMotion process and carefully study how to improve vMotion to support today's workloads. VMs with large memory and CPU footprints such as SAP HANA and Oracle database backends face the challenge of using vMotion for real-time migration. The impact of the vMotion process on performance and the switchover phase may require a long stun time, which means that customers are not accustomed to using vMotion for these large workloads. With the help of vSphere 7, we have greatly improved the vMotion logic, so that the function is restored. At a high level, vMotion consists of multiple processes. For most VMs, these processes can execute very quickly, usually fast enough without being noticed. For VMs with a large number of CPU and memory allocations, these processes may become obvious, and even last long enough for the application running in the VM to think that there is a problem. Therefore, some of these processes have been improved to alleviate the vMotion problem of larger VMs. One such process uses a page tracker, where vMotion tracks memory paging activity during migration. Before vSphere 7, page tracking occurred on all vCPUs in the VM, which may cause the VM and its workload to be limited by the resources of the migration itself. Another improved process with vSphere 7 is memory replication. Before vSphere 7, memory was transferred between hosts in 4k pages . vSphere 7 now uses 1 GB pages and some other optimization features to make data transfer more efficient. To ensure that the stun time stays within the 1-second target (the time to switch between hosts), bitmaps of the VM status and memory pages will be transmitted. This stun time is very important. For a very large VM, it becomes difficult to transmit the bitmap in less than 1 second. Therefore, only the required pages are transferred instead of the entire bitmap (for a large VM, the size of the bitmap may be hundreds of megabytes). Most pages have actually been on the target host since the original transfer, so we can reduce the transfer time from a few seconds to a few milliseconds. As with all topics in this article, more detailed information about this new process (such as a follow-up article here) will be available. The key end result is that vMotion can now even be used for the largest VMs.
One of the biggest ways that intrinsically safe customers can improve security is through a good password policy, and one of the easiest ways is to implement multi-factor authentication (MFA). Therefore, the problem is that there are too many ways to implement MFA, and it is almost impossible to extend vCenter Server with all these methods. In addition, even if VMware implements some of these features, we are still copying the features that many customers already have in their corporate identity management systems, which is inconsistent with our desire to improve the lives of users (vSphere Admins). The solution to re-upload cancellation after unloading fails is to use open authentication and authorization standards (such as OAUTH2 and OIDC) for alliances. With the help of vSphere 7 and Identity Federation, vCenter Server can talk to corporate identity providers, thereby separating vSphere Admins and vCenter Server from the process. This simplifies the work of vSphere Admin and reduces the work that helps reduce the scope of compliance audits. It also opens the door to many different MFA methods because they already know how to plug in things like Active Directory Federation Services (ADFS). With vSphere 7, we will immediately support ADFS and will provide support to more providers over time. Failed to export, re-upload canceled 

  
We will also introduce vSphere Trust Authority (vTA) to help you more easily build trust across the entire stack-from bare metal all the way to workloads. The vSphere Trust Authority uses a small, individually managed cluster of ESXi hosts to create a trusted hardware root, which is responsible for performing authentication tasks. Host certification is a UEFI secure boot process. The trusted platform module (TPM) of the server and external services use a password for verification to verify whether the host is running genuine software with the correct configuration. In vSphere 7, vTA allows trusted hosts to take over communication with the key management system (KMS), thereby enabling certification to enforce rules. This simplifies the connection to KMS, simplifies risk audits, and ensures that hosts that prove to fail will not access secrets. Without these secrets, the host will not be able to run the encrypted VM, which is good. We don't want to install protected VMs on untrusted servers. By reducing the number of certificates to be managed and introducing a new certificate import wizard, certificate management will continue to be improved. The solution no longer needs to manage user certificates, and it also simplifies ESXi so that its services use common certificates. Finally, there is also a REST API for operations, such as renewing certificates from VMware Certificate Authority (VMCA), making the process easier to automate.
Other improvementsThis blog post is not intended to be exhaustive, but I want to mention some other vSphere 7 features. First, we continue to simplify the vCenter Server architecture. With vSphere 7, it is no longer possible to deploy an external Platform Services Controller (PSC) or vCenter Server for Windows. If you have these two types of deployments, the vCenter Server 7 installer will automatically migrate the vCenter Server instance to a vCenter Server appliance with an embedded PSC. There is no multi-step process involving multiple tools. This is an integrated seamless experience. It also adds support for multiple NICs of the vCenter Server device, new CLI tools, and an improved Developer Center in the vSphere Client. There is a new VM hardware version 17, which has more new features such as precision clock for PTP support, vSGX and virtual watchdog for monitoring cluster applications. In the next few weeks, we will publish a detailed blog about all these vSphere 7 features and more. Please keep up to date with the links and information posted in the footer below. Conclusion As you may have learned by now, vSphere 7 is indeed a substantial, game-changing version. People have always paid great attention to improving the lives of customers through life cycle and safety improvements. Thanks to our strong partnership and customers, we will continue to strive to surpass everything. Moreover, with the addition of Kubernetes, we will not slow down anytime soon. vSphere 7 is a technology for hybrid cloud.