VMware Cloud Foundation on Dell EMC VxRail API Reference Guide

SDDC Manager APIs are secured using token-based authentication.
As a first step before invocation of any API, an access token has to be obtained.
Invoking the Token API returns a token pair - access token and refresh token.
To invoke an API, the access token has to be passed in the Authorization header as a Bearer token.

Prerequisites

The following data is required :-
- VCF Credentials
  - User created in SSO or AD domain and associated as an ADMIN or OPERATOR role in VCF
  - Username
  - Password

Note	For the sake of brevity, the Bearer tokens have been abbreviated in the code snippets throughout this document.

Note	To create a token pair with "apiKey", refer Obtain access token for a service user section.

Steps

Invoke the API with the right credentials.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/tokens' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -d '{
  "username" : "[email protected]",
  "password" : "VMware123!"
}'

HTTP Request

POST /v1/tokens HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 77
Host: sddc-manager.sfo01.rainpole.local

{
  "username" : "[email protected]",
  "password" : "VMware123!"
}

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 683

{
  "accessToken" : "eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIxNTFlZWI5Yy1mNWNmLTQ3N2UtYTJhYS0yMzg4ZmFmYzMwNDAiLCJpYXQiOjE1ODIxMzgzMzQsInN1YiI6ImFkbWluaXN0cmF0b3JAdnNwaGVyZS5sb2NhbCIsImlzcyI6InZjZi1hdXRoIiwiYXVkIjoic2RkYy1zZXJ2aWNlcyIsIm5iZiI6MTU4MjEzODMzNCwiZXhwIjoxNTgyMTQxOTM0LCJ1c2VyIjoiYWRtaW5pc3RyYXRvckB2c3BoZXJlLmxvY2FsIiwibmFtZSI6ImFkbWluaXN0cmF0b3JAdnNwaGVyZS5sb2NhbCIsInNjb3BlIjpbIkJBQ0tVUF9DT05GSUdfUkVBRCIsIkNSRURFTlRJQUxfUkVBRCIsIlVTRVJfV1JJVEUiLCJPVEhFUl9XUklURSIsIkJBQ0tVUF9DT05GSUdfV1JJVEUiLCJPVEhFUl9SRUFEIiwiVVNFUl9SRUFEIiwiQ1JFREVOVElBTF9XUklURSJdfQ.ylzrCyo4ymTKtSv1flmUrW-b8mxjRl7T2uV3a8sWWMA",
  "refreshToken" : {
    "id" : "3c6b3c30-3bf2-480b-9539-8483699ab911"
  }
}

2.1.2. Refresh an access token

Refresh token is a special type of token used to renew an access token when the access token expires.
A refresh token can be used any number of times to obtain an access token until it has not expired or been revoked.

Prerequisites

The following data is required
- Refresh token is obtained when token pair is generated

Steps

Invoke the API by passing the refresh token.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/tokens/access-token/refresh' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -d '"eb8d1a03-6644-4a76-b018-2c7b02c2a526"'

HTTP Request

PATCH /v1/tokens/access-token/refresh HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 38
Host: sddc-manager.sfo01.rainpole.local

"eb8d1a03-6644-4a76-b018-2c7b02c2a526"

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 583

eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIxNTFlZWI5Yy1mNWNmLTQ3N2UtYTJhYS0yMzg4ZmFmYzMwNDAiLCJpYXQiOjE1ODIxMzgzMzQsInN1YiI6ImFkbWluaXN0cmF0b3JAdnNwaGVyZS5sb2NhbCIsImlzcyI6InZjZi1hdXRoIiwiYXVkIjoic2RkYy1zZXJ2aWNlcyIsIm5iZiI6MTU4MjEzODMzNCwiZXhwIjoxNTgyMTQxOTM0LCJ1c2VyIjoiYWRtaW5pc3RyYXRvckB2c3BoZXJlLmxvY2FsIiwibmFtZSI6ImFkbWluaXN0cmF0b3JAdnNwaGVyZS5sb2NhbCIsInNjb3BlIjpbIkJBQ0tVUF9DT05GSUdfUkVBRCIsIkNSRURFTlRJQUxfUkVBRCIsIlVTRVJfV1JJVEUiLCJPVEhFUl9XUklURSIsIkJBQ0tVUF9DT05GSUdfV1JJVEUiLCJPVEhFUl9SRUFEIiwiVVNFUl9SRUFEIiwiQ1JFREVOVElBTF9XUklURSJdfQ.ylzrCyo4ymTKtSv1flmUrW-b8mxjRl7T2uV3a8sWWMA

2.1.3. Revoke a refresh token

As refresh tokens are generally issued with validity for longer durations, there is a possibility that they maybe compromised.
Revoking a refresh token means that an already issued refresh token cannot be used again to refresh an access token.

Prerequisites

The following data is required
- Refresh token

Steps

Invoke the API by passing the refresh token which is to be revoked.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/tokens/refresh-token' -i -X DELETE \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -d '"eb8d1a03-6644-4a76-b018-2c7b02c2a526"'

HTTP Request

DELETE /v1/tokens/refresh-token HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 38
Host: sddc-manager.sfo01.rainpole.local

"eb8d1a03-6644-4a76-b018-2c7b02c2a526"

HTTP Response

HTTP/1.1 204 No Content

2.2. User Management

2.2.1. Add users

This API is used to add users.

Prerequisites

The following data is required
- Name of the SSO or AD domain
- Username
- Type of the user. For types supported, refer to User
- Role ID

Steps

Fetch the role ID for the role.

Tip	Refer to Get the Roles

Invoke the API to add a user.

Note	For the sake of brevity, the Bearer tokens in the Authorization header has been abbreviated in the code snippets throughout this document.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/users' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '[ {
  "name" : "[email protected]",
  "domain" : "vsphere.local",
  "type" : "USER",
  "role" : {
    "id" : "ca968735-40d3-4853-affd-548b442947c0"
  }
}, {
  "name" : "[email protected]",
  "domain" : "vsphere.local",
  "type" : "USER",
  "role" : {
    "id" : "ca968735-40d3-4853-affd-548b442947c0"
  }
}, {
  "name" : "SERVICE_USER_1",
  "type" : "SERVICE",
  "role" : {
    "id" : "ca968735-40d3-4853-affd-548b442947c0"
  }
} ]'

HTTP Request

POST /v1/users HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 437
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

[ {
  "name" : "[email protected]",
  "domain" : "vsphere.local",
  "type" : "USER",
  "role" : {
    "id" : "ca968735-40d3-4853-affd-548b442947c0"
  }
}, {
  "name" : "[email protected]",
  "domain" : "vsphere.local",
  "type" : "USER",
  "role" : {
    "id" : "ca968735-40d3-4853-affd-548b442947c0"
  }
}, {
  "name" : "SERVICE_USER_1",
  "type" : "SERVICE",
  "role" : {
    "id" : "ca968735-40d3-4853-affd-548b442947c0"
  }
} ]

HTTP Response

HTTP/1.1 201 Created
Content-Type: application/json
Content-Length: 884

{
  "elements" : [ {
    "id" : "2f015af3-7cc4-4969-b4ce-0c1f47fa7147",
    "name" : "[email protected]",
    "domain" : "vsphere.local",
    "type" : "USER",
    "role" : {
      "id" : "ca968735-40d3-4853-affd-548b442947c0"
    },
    "creationTimestamp" : "2020-03-26T01:06:37.008Z"
  }, {
    "id" : "9a9916e9-b76c-4027-8dd7-cd4135d53bed",
    "name" : "[email protected]",
    "domain" : "vsphere.local",
    "type" : "USER",
    "role" : {
      "id" : "ca968735-40d3-4853-affd-548b442947c0"
    },
    "creationTimestamp" : "2020-03-26T01:06:37.008Z"
  }, {
    "id" : "97ee9d88-1c8c-4d7a-8e2c-e8700bf0f238",
    "name" : "SERVICE_USER_1",
    "domain" : "Nil",
    "type" : "SERVICE",
    "apiKey" : "18KCYp4Jr1NFJpyTssZ68YBp5vM30Wwp",
    "role" : {
      "id" : "ca968735-40d3-4853-affd-548b442947c0"
    },
    "creationTimestamp" : "2020-03-26T01:06:37.008Z"
  } ]
}

2.2.2. Add a service users

This API is used to add service users.

Prerequisites

The following data is required
- Username
- Type of the user. The type would be SERVICE for service users. For types supported, refer to User.
- Role ID

Steps

Fetch the role ID for the role.

Tip	Refer to Get the Roles

Invoke the API to create a service user.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/users' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '[ {
  "name" : "service_account_1",
  "type" : "SERVICE",
  "role" : {
    "id" : "3cf33a99-af3a-4069-81eb-c3f59e878b31"
  }
} ]'

HTTP Request

POST /v1/users HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 128
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

[ {
  "name" : "service_account_1",
  "type" : "SERVICE",
  "role" : {
    "id" : "3cf33a99-af3a-4069-81eb-c3f59e878b31"
  }
} ]

HTTP Response

HTTP/1.1 201 Created
Content-Type: application/json
Content-Length: 337

{
  "elements" : [ {
    "id" : "3973ae09-aace-43e9-ab95-47ba48fc1c12",
    "name" : "service_account_1",
    "domain" : "Nil",
    "type" : "SERVICE",
    "apiKey" : "OinmaemCXdt8gzsGWGACi9cXJeXB4C5o",
    "role" : {
      "id" : "3cf33a99-af3a-4069-81eb-c3f59e878b31"
    },
    "creationTimestamp" : "2020-03-26T01:06:35.136Z"
  } ]
}

The response of the API contains the apiKey. With the apiKey, the service user can login and obtain access token.

Obtain access token for a service user

Prerequisites

The following data is required
- API key

Steps

Invoke the API with the API key to generate an access token and refresh token.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/tokens' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -d '{
  "apiKey" : "6598S0SIQC04sGjEr0nIeDlZx18GYRoT"
}'

HTTP Request

POST /v1/tokens HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 51
Host: sddc-manager.sfo01.rainpole.local

{
  "apiKey" : "6598S0SIQC04sGjEr0nIeDlZx18GYRoT"
}

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 683

{
  "accessToken" : "eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIxNTFlZWI5Yy1mNWNmLTQ3N2UtYTJhYS0yMzg4ZmFmYzMwNDAiLCJpYXQiOjE1ODIxMzgzMzQsInN1YiI6ImFkbWluaXN0cmF0b3JAdnNwaGVyZS5sb2NhbCIsImlzcyI6InZjZi1hdXRoIiwiYXVkIjoic2RkYy1zZXJ2aWNlcyIsIm5iZiI6MTU4MjEzODMzNCwiZXhwIjoxNTgyMTQxOTM0LCJ1c2VyIjoiYWRtaW5pc3RyYXRvckB2c3BoZXJlLmxvY2FsIiwibmFtZSI6ImFkbWluaXN0cmF0b3JAdnNwaGVyZS5sb2NhbCIsInNjb3BlIjpbIkJBQ0tVUF9DT05GSUdfUkVBRCIsIkNSRURFTlRJQUxfUkVBRCIsIlVTRVJfV1JJVEUiLCJPVEhFUl9XUklURSIsIkJBQ0tVUF9DT05GSUdfV1JJVEUiLCJPVEhFUl9SRUFEIiwiVVNFUl9SRUFEIiwiQ1JFREVOVElBTF9XUklURSJdfQ.ylzrCyo4ymTKtSv1flmUrW-b8mxjRl7T2uV3a8sWWMA",
  "refreshToken" : {
    "id" : "3c6b3c30-3bf2-480b-9539-8483699ab911"
  }
}

2.2.3. Get the Users

This API is used to get all the users listed in the system.
This also gives other details associated with the user like domain, type of user and the role id.

Steps

Invoke the API to fetch all users.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/users' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/users HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 884

{
  "elements" : [ {
    "id" : "2f015af3-7cc4-4969-b4ce-0c1f47fa7147",
    "name" : "[email protected]",
    "domain" : "vsphere.local",
    "type" : "USER",
    "role" : {
      "id" : "ca968735-40d3-4853-affd-548b442947c0"
    },
    "creationTimestamp" : "2020-03-26T01:06:37.008Z"
  }, {
    "id" : "9a9916e9-b76c-4027-8dd7-cd4135d53bed",
    "name" : "[email protected]",
    "domain" : "vsphere.local",
    "type" : "USER",
    "role" : {
      "id" : "ca968735-40d3-4853-affd-548b442947c0"
    },
    "creationTimestamp" : "2020-03-26T01:06:37.008Z"
  }, {
    "id" : "97ee9d88-1c8c-4d7a-8e2c-e8700bf0f238",
    "name" : "SERVICE_USER_1",
    "domain" : "Nil",
    "type" : "SERVICE",
    "apiKey" : "18KCYp4Jr1NFJpyTssZ68YBp5vM30Wwp",
    "role" : {
      "id" : "ca968735-40d3-4853-affd-548b442947c0"
    },
    "creationTimestamp" : "2020-03-26T01:06:37.008Z"
  } ]
}

2.2.4. Delete an User

This API is used to delete an user.

Prerequisites

The following data is required
- User ID

Steps

Invoke the API with the "user ID" to be deleted.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/users/2f015af3-7cc4-4969-b4ce-0c1f47fa7147' -i -X DELETE \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

DELETE /v1/users/2f015af3-7cc4-4969-b4ce-0c1f47fa7147 HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 204 No Content

2.2.5. Get the Roles

This API is used to fetch all the roles supported by VCF.
Currently there are two roles that are supported - ADMIN and OPERATOR.

Steps

Invoke the API to fetch the roles and role IDs

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/roles' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/roles HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 251

{
  "elements" : [ {
    "id" : "46e2795b-18f5-4ff0-9356-5c09d91e92e9",
    "name" : "ADMIN",
    "description" : "Administrator"
  }, {
    "id" : "a04b2c65-e4d7-4a5c-a32d-46e73d67ca4f",
    "name" : "OPERATOR",
    "description" : "Operator"
  } ]
}

2.2.6. Get SSO Domain

This API is used to fetch the SSO domains known to the system.

Steps

Invoke the API by specifying the "SSO domain name".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sso-domains' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/sso-domains HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 38

{
  "elements" : [ "vsphere.local" ]
}

2.2.7. Get SSO Domain entities

This API is used to fetch all domain entities in a particular domain known to the system.
This includes users and subdomains.

Prerequisites

The following data is required
- SSO Domain name

Steps

Invoke the API by specifying the "SSO domain name".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sso-domains/vsphere.local/entities' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/sso-domains/vsphere.local/entities HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 697

{
  "elements" : [ {
    "id" : "[email protected]",
    "name" : "USER_1",
    "type" : "USER"
  }, {
    "id" : "[email protected]",
    "name" : "USER_2",
    "type" : "USER"
  }, {
    "id" : "[email protected]",
    "name" : "USER_3",
    "type" : "USER"
  }, {
    "id" : "[email protected]",
    "name" : "USER_4",
    "type" : "USER"
  }, {
    "id" : "vsphere.local\\\\group_1",
    "name" : "",
    "type" : "GROUP"
  }, {
    "id" : "vsphere.local\\\\group_2",
    "name" : "",
    "type" : "GROUP"
  }, {
    "id" : "vsphere.local\\\\group_3",
    "name" : "",
    "type" : "GROUP"
  }, {
    "id" : "vsphere.local\\\\group_4",
    "name" : "",
    "type" : "GROUP"
  } ]
}

2.3. Customer Experience Improvement Program

2.5. Hosts

2.5.3. Get the unmanaged hosts based on a Criterion

This API is used to get the unmanaged hosts from vCenter that meets a specific criterion.

Prerequisites

The cluster in a domain to which hosts are to be added must exist.
There must be a host already added to the cluster VCenter.

Get the unmanaged hosts from vCenter based on a criterion

Steps

Get the ID of the cluster to which hosts are going to be added
- TIP: Get the Clusters
- Filter the response by cluster name and get the respective ID

Invoke the Get Hosts Criteria API to list all the criteria supported.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/hosts/criteria' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/hosts/criteria HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160

{
  "elements" : [ {
    "name" : "UNMANAGED_HOSTS_IN_VCENTER",
    "description" : "All unmanaged hosts that are not in inventory but there in vcenter"
  } ]
}

Pick one of the criterion and post a query with its name attribute

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/hosts/queries' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "name" : "UNMANAGED_HOSTS_IN_VCENTER"
}'

HTTP Request

POST /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/hosts/queries HTTP/1.1
Content-Type: application/json
Content-Length: 43
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "name" : "UNMANAGED_HOSTS_IN_VCENTER"
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/hosts/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c
Content-Type: application/json
Content-Length: 168

{
  "queryInfo" : {
    "status" : "IN_PROGRESS",
    "processing" : true,
    "failure" : false,
    "completed" : false
  },
  "result" : {
    "elements" : [ ]
  }
}

Read the tracking URL returned as Location header in the previous step.

Poll the tracking URL until the "status" is not "IN_PROGRESS".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/hosts/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/hosts/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 345

{
  "queryInfo" : {
    "status" : "COMPLETED",
    "processing" : false,
    "failure" : false,
    "completed" : true
  },
  "result" : {
    "elements" : [ {
      "fqdn" : "esxi-1.vrack.vsphere.local",
      "ipAddresses" : [ {
        "ipAddress" : "10.0.0.100",
        "type" : "MANAGEMENT"
      } ],
      "hybrid" : false
    } ]
  }
}

2.6. License Keys

2.6.2. Get the License Keys

This API is used to get all the license keys.
This also gives the license key metrics like usage and validity of a license key.
License keys can be filtered based on product type and/or license key status.

Steps

Invoke the API by specifying the _"productType".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/license-keys?productType=VCENTER,ESXI' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/license-keys?productType=VCENTER,ESXI HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 471

{
  "elements" : [ {
    "id" : "72a4041e-6194-4e69-8ad9-04a4b6e78a2f",
    "key" : "XX0XX-XX0XX-XX0XX-XX0XX-XX0XX",
    "productType" : "VCENTER",
    "description" : "vCenter license key",
    "isUnlimited" : false,
    "licenseKeyUsage" : {
      "total" : 5,
      "remaining" : 4,
      "used" : 1,
      "licenseUnit" : "INSTANCE"
    },
    "licenseKeyValidity" : {
      "licenseKeyStatus" : "ACTIVE",
      "expiryDate" : "2029-05-23T16:12:53.001Z"
    }
  } ]
}

Get License Keys By Status Of The License Key

Steps

Invoke the API by specifying the _"licenseKeyStatus".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/license-keys?licenseKeyStatus=ACTIVE,NEVER_EXPIRES' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/license-keys?licenseKeyStatus=ACTIVE,NEVER_EXPIRES HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 471

{
  "elements" : [ {
    "id" : "12c62d1d-19bc-47fc-8ec3-367a1b797a67",
    "key" : "XX0XX-XX0XX-XX0XX-XX0XX-XX0XX",
    "productType" : "VCENTER",
    "description" : "vCenter license key",
    "isUnlimited" : false,
    "licenseKeyUsage" : {
      "total" : 5,
      "remaining" : 4,
      "used" : 1,
      "licenseUnit" : "INSTANCE"
    },
    "licenseKeyValidity" : {
      "licenseKeyStatus" : "ACTIVE",
      "expiryDate" : "2029-05-23T16:12:53.001Z"
    }
  } ]
}

2.6.3. Get a License Key

This API is used to get the license key metrics like usage and validity of a license key.
If the license key does not exist, you will get an error.

Prerequisites

The following data is required
- License key

Steps

Invoke the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/license-keys/XX0XX-XX0XX-XX0XX-XX0XX-XX0XX' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/license-keys/XX0XX-XX0XX-XX0XX-XX0XX-XX0XX HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 416

{
  "id" : "39b1e10b-f4d4-443e-bea7-be8fe995ac47",
  "key" : "XX0XX-XX0XX-XX0XX-XX0XX-XX0XX",
  "productType" : "VCENTER",
  "description" : "vCenter license key",
  "isUnlimited" : false,
  "licenseKeyUsage" : {
    "total" : 5,
    "remaining" : 4,
    "used" : 1,
    "licenseUnit" : "INSTANCE"
  },
  "licenseKeyValidity" : {
    "licenseKeyStatus" : "ACTIVE",
    "expiryDate" : "2029-05-23T16:12:53.001Z"
  }
}

2.6.4. Delete a License Key

This API is used to delete a license key.

Warning

Deleting a license key which is in use, will give an error.

Prerequisites

The following data is required
- License key

Steps

Invoke the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/license-keys/XX0XX-XX0XX-XX0XX-XX0XX-XX0XX' -i -X DELETE \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

DELETE /v1/license-keys/XX0XX-XX0XX-XX0XX-XX0XX-XX0XX HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 204 No Content

A workload domain is a policy based resource container with specific availability and performance attributes that combines compute (vSphere), storage (vSAN) and networking (NSX) into a single consumable entity.

2.7.1. Create a Domain

Create a Domain workflow automatically:

Deploys an additional vCenter Server Appliance for the new domain within the management domain.
By leveraging a separate vCenter Server instance per domain, software updates can be applied without impacting other domains. It also allows for each domain to have additional isolation as needed.

Prerequisites

The following data is required
- Name of the domain
- vCenter details
  - Name of the vCenter
  - Network details
    
    IP Address of the vCenter
    
    FQDN of the vCenter
    
    Gateway
    
    Subnet mask
  - Password for the root user (8-20 characters)

Steps

Validate the input specification

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "domainName" : "test",
  "vcenterSpec" : {
    "name" : "vcenter-1",
    "networkDetailsSpec" : {
      "ipAddress" : "10.0.0.43",
      "dnsName" : "vcenter-2.vrack.vsphere.local",
      "gateway" : "10.0.0.250",
      "subnetMask" : "255.255.255.0"
    },
    "rootPassword" : "VMware123!",
    "datacenterName" : "new-vi-1"
  }
}'

HTTP Request

POST /v1/domains/validations HTTP/1.1
Content-Type: application/json
Content-Length: 336
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "domainName" : "test",
  "vcenterSpec" : {
    "name" : "vcenter-1",
    "networkDetailsSpec" : {
      "ipAddress" : "10.0.0.43",
      "dnsName" : "vcenter-2.vrack.vsphere.local",
      "gateway" : "10.0.0.250",
      "subnetMask" : "255.255.255.0"
    },
    "rootPassword" : "VMware123!",
    "datacenterName" : "new-vi-1"
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/domains/validations/f0bd214d-a075-48d4-bd6b-d9a3243a4c66
Content-Type: application/json
Content-Length: 110

{
  "id" : "f0bd214d-a075-48d4-bd6b-d9a3243a4c66",
  "description" : "",
  "executionStatus" : "IN_PROGRESS"
}

Get Validation response of the domain specification using id obtained from previous spec validation call
cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/validations/f0bd214d-a075-48d4-bd6b-d9a3243a4c66' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/validations/f0bd214d-a075-48d4-bd6b-d9a3243a4c66 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 224

{
  "id" : "f0bd214d-a075-48d4-bd6b-d9a3243a4c66",
  "description" : "Validation result",
  "executionStatus" : "COMPLETED",
  "resultStatus" : "SUCCEEDED",
  "validationChecks" : [ {
    "resultStatus" : "SUCCEEDED"
  } ]
}

In case of no errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note
Make changes to the input specification and re-validate using a new API invocation.

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "domainName" : "test",
  "vcenterSpec" : {
    "name" : "vcenter-1",
    "networkDetailsSpec" : {
      "ipAddress" : "10.0.0.43",
      "dnsName" : "vcenter-2.vrack.vsphere.local",
      "gateway" : "10.0.0.250",
      "subnetMask" : "255.255.255.0"
    },
    "rootPassword" : "VMware123!",
    "datacenterName" : "new-vi-1"
  }
}'

HTTP Request

POST /v1/domains HTTP/1.1
Content-Type: application/json
Content-Length: 336
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "domainName" : "test",
  "vcenterSpec" : {
    "name" : "vcenter-1",
    "networkDetailsSpec" : {
      "ipAddress" : "10.0.0.43",
      "dnsName" : "vcenter-2.vrack.vsphere.local",
      "gateway" : "10.0.0.250",
      "subnetMask" : "255.255.255.0"
    },
    "rootPassword" : "VMware123!",
    "datacenterName" : "new-vi-1"
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/f0bd214d-a075-48d4-bd6b-d9a3243a4c66
Content-Length: 146

{
  "id" : "f0bd214d-a075-48d4-bd6b-d9a3243a4c66",
  "name" : "",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:24:38.065Z"
}

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

2.7.2. Update a Domain

Update a Domain workflow:

Import the primary cluster
- For the first NSX-T VI Domain in your environment, the workflow deploys a cluster of three NSX-T Managers in the management domain. The workflow also configures an anti-affinity rule between the managers to prevent them from being on the same host for High Availability. Each subsequent NSX-T Domains will either share this NSX-T Manager Cluster or create its own.
  - If required, the new domain can also share the NSX-T cluster with an existing workload domain. In this scenario, new NSX-T Managers will not be deployed, but will be shared with an existing NSX-T Cluster.
    
    For this, fetch the information of the NSX-T Managers that can be shared.
    
    TIP: Get the NSX-T Clusters
    
    From the list of NSX-T Clusters fetched, only the existing NSX-T clusters for which "isShared" is true, can be shared with the new domains being deployed.
    
    The precise information of the existing NSX-T Cluster fetched from above should be used in the "nsxTSpec" section of the input payload.
- Licenses integrate the deployed components with the appropriate pieces in the Cloud Foundation software stack.

Prerequisites

VxRail Domain should have already been created.
A DHCP server must be configured on the VLAN of the domain. When NSX creates VTEPs for the domain, they are assigned IP addresses from the DHCP server.

The following data is required

ID of the created domain
Host details
- For each host
  - IP address of the host
  - FQDN of the host
  - user name of the host
  - password of the host
Datastore details
- License for the vSAN datastore
VxRail Manager Details
- admin and root credentials
Network Details
- List of VDS (which should have a single element for VxRail)
  - For each VDS
    
    VDS name
    
    isUsedByNsxt set to true
    
    list of Port groups with its names and the corresponding transport type

NSX cluster Details

For NSX-T

VLAN ID of Geneve

{
  "nsxTClusterSpec" : {
    "geneveVlanId" : 2
  }
}

For NSX-T
- NSX Manager virtual machine details
  - Name of the NSX Manager virtual machine
  - Network details
    
    IP Address of the virtual machine
    
    Fully-qualified domain name
    
    Gateway
    
    Subnet mask
  - Virtual IP address which would act as proxy/alias for NSX-T managers
  - Fully-qualified domain name for VIP so that common SSL certificates can be installed across all managers
  - License key for NSX
  - NSX manager admin Password (basic authorization and SSH)

{
  "nsxManagerSpecs" : [ {
    "name" : "nsx-manager-2",
    "networkDetailsSpec" : {
      "ipAddress" : "10.0.0.44",
      "dnsName" : "nsx-manager-2.vrack.vsphere.local",
      "gateway" : "10.0.0.250",
      "subnetMask" : "255.255.255.0"
    }
  }, {
    "name" : "nsx-manager-3",
    "networkDetailsSpec" : {
      "ipAddress" : "10.0.0.44",
      "dnsName" : "nsx-manager-2.vrack.vsphere.local",
      "gateway" : "10.0.0.250",
      "subnetMask" : "255.255.255.0"
    }
  }, {
    "name" : "nsx-manager-4",
    "networkDetailsSpec" : {
      "ipAddress" : "10.0.0.44",
      "dnsName" : "nsx-manager-2.vrack.vsphere.local",
      "gateway" : "10.0.0.250",
      "subnetMask" : "255.255.255.0"
    }
  } ],
  "vip" : "10.0.0.166",
  "vipFqdn" : "vip-nsxmanager.vrack.vsphere.local",
  "licenseKey" : "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
  "nsxManagerAdminPassword" : "VMware123!"
}

Steps

Through VxRail UI, create a cluster in the VC, which was created as part of the previous invocation of the create domain

Get the ID of the created domain
- TIP: Get the Domains
- Filter the response by VxRail Domain name and get the respective ID

Get the list of unmanaged clusters with names in thus created vi domain, Invoke a call to get clusters to get the details.

Tip	Refer to: Get the unmanaged clusters by criterion

Choose the name of one cluster that needs to be imported. Invoke a call to get unmanaged cluster by selected cluster name to get the network and host details.

Tip	Refer to: Get an unmanaged cluster by criterion

Create a domain update spec
- With the cluster information from previous call:
  - For each host populate
    
    IP address of the host
    
    FQDN of the host
    
    user name of the host
    
    password of the host
  - Network Details
    
    For each VDS
    
    VDS name
    
    isUsedByNsxt set to true
    
    list of Port groups with its names and the corresponding transport type
- Choose to create a new NSX-T domain or select from the existing ones
  - TIP: For NSX-T clusters refer to Get the NSX-T Clusters
- Adding license key for NSXt and vSAN datastore
  - TIP: For license refer to Get a License Key

Validation of the domain specification though async call

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/1234/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterSpec" : {
    "name" : "Cluster1",
    "vxRailDetails" : {
      "rootCredentials" : {
        "credentialType" : "SSH",
        "username" : "admin",
        "password" : "VMware123!"
      },
      "adminCredentials" : {
        "credentialType" : "SSH",
        "username" : "admin",
        "password" : "VMware123!"
      }
    },
    "hostSpecs" : [ {
      "ipAddress" : "192.10.20.30",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    }, {
      "ipAddress" : "192.10.20.31",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    }, {
      "ipAddress" : "192.10.20.32",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    } ],
    "datastoreSpec" : {
      "vsanDatastoreSpec" : {
        "licenseKey" : "123"
      }
    },
    "networkSpec" : {
      "vdsSpecs" : [ {
        "name" : "SDDC-Dswitch-Private1",
        "isUsedByNsxt" : true,
        "portGroupSpecs" : [ {
          "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "MANAGEMENT"
        }, {
          "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VSAN"
        }, {
          "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VMOTION"
        } ]
      } ],
      "nsxClusterSpec" : {
        "nsxTClusterSpec" : {
          "geneveVlanId" : 3
        }
      }
    }
  },
  "nsxTSpec" : {
    "nsxManagerSpecs" : [ {
      "name" : "nsx-manager-2",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    }, {
      "name" : "nsx-manager-3",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    }, {
      "name" : "nsx-manager-4",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    } ],
    "vip" : "10.0.0.166",
    "vipFqdn" : "vip-nsxmanager.vrack.vsphere.local",
    "licenseKey" : "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
    "nsxManagerAdminPassword" : "VMware123!"
  }
}'

HTTP Request

POST /v1/domains/1234/validations HTTP/1.1
Content-Type: application/json
Content-Length: 2483
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterSpec" : {
    "name" : "Cluster1",
    "vxRailDetails" : {
      "rootCredentials" : {
        "credentialType" : "SSH",
        "username" : "admin",
        "password" : "VMware123!"
      },
      "adminCredentials" : {
        "credentialType" : "SSH",
        "username" : "admin",
        "password" : "VMware123!"
      }
    },
    "hostSpecs" : [ {
      "ipAddress" : "192.10.20.30",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    }, {
      "ipAddress" : "192.10.20.31",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    }, {
      "ipAddress" : "192.10.20.32",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    } ],
    "datastoreSpec" : {
      "vsanDatastoreSpec" : {
        "licenseKey" : "123"
      }
    },
    "networkSpec" : {
      "vdsSpecs" : [ {
        "name" : "SDDC-Dswitch-Private1",
        "isUsedByNsxt" : true,
        "portGroupSpecs" : [ {
          "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "MANAGEMENT"
        }, {
          "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VSAN"
        }, {
          "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VMOTION"
        } ]
      } ],
      "nsxClusterSpec" : {
        "nsxTClusterSpec" : {
          "geneveVlanId" : 3
        }
      }
    }
  },
  "nsxTSpec" : {
    "nsxManagerSpecs" : [ {
      "name" : "nsx-manager-2",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    }, {
      "name" : "nsx-manager-3",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    }, {
      "name" : "nsx-manager-4",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    } ],
    "vip" : "10.0.0.166",
    "vipFqdn" : "vip-nsxmanager.vrack.vsphere.local",
    "licenseKey" : "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
    "nsxManagerAdminPassword" : "VMware123!"
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/domains/validations/f0bd214d-a075-48d4-bd6b-d9a3243a4c66
Content-Type: application/json
Content-Length: 110

{
  "id" : "f0bd214d-a075-48d4-bd6b-d9a3243a4c66",
  "description" : "",
  "executionStatus" : "IN_PROGRESS"
}

Get Validation response of the import primary cluster specification
cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/validations/f0bd214d-a075-48d4-bd6b-d9a3243a4c66' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/validations/f0bd214d-a075-48d4-bd6b-d9a3243a4c66 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 224

{
  "id" : "f0bd214d-a075-48d4-bd6b-d9a3243a4c66",
  "description" : "Validation result",
  "executionStatus" : "COMPLETED",
  "resultStatus" : "SUCCEEDED",
  "validationChecks" : [ {
    "resultStatus" : "SUCCEEDED"
  } ]
}

In case of no errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note
Make changes to the input specification and re-validate using a new API invocation.

Trigger the domain update task using the validated input spec.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/1234' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterSpec" : {
    "name" : "Cluster1",
    "vxRailDetails" : {
      "rootCredentials" : {
        "credentialType" : "SSH",
        "username" : "admin",
        "password" : "VMware123!"
      },
      "adminCredentials" : {
        "credentialType" : "SSH",
        "username" : "admin",
        "password" : "VMware123!"
      }
    },
    "hostSpecs" : [ {
      "ipAddress" : "192.10.20.30",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    }, {
      "ipAddress" : "192.10.20.31",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    }, {
      "ipAddress" : "192.10.20.32",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    } ],
    "datastoreSpec" : {
      "vsanDatastoreSpec" : {
        "licenseKey" : "123"
      }
    },
    "networkSpec" : {
      "vdsSpecs" : [ {
        "name" : "SDDC-Dswitch-Private1",
        "isUsedByNsxt" : true,
        "portGroupSpecs" : [ {
          "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "MANAGEMENT"
        }, {
          "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VSAN"
        }, {
          "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VMOTION"
        } ]
      } ],
      "nsxClusterSpec" : {
        "nsxTClusterSpec" : {
          "geneveVlanId" : 3
        }
      }
    }
  },
  "nsxTSpec" : {
    "nsxManagerSpecs" : [ {
      "name" : "nsx-manager-2",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    }, {
      "name" : "nsx-manager-3",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    }, {
      "name" : "nsx-manager-4",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    } ],
    "vip" : "10.0.0.166",
    "vipFqdn" : "vip-nsxmanager.vrack.vsphere.local",
    "licenseKey" : "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
    "nsxManagerAdminPassword" : "VMware123!"
  }
}'

HTTP Request

PATCH /v1/domains/1234 HTTP/1.1
Content-Type: application/json
Content-Length: 2483
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterSpec" : {
    "name" : "Cluster1",
    "vxRailDetails" : {
      "rootCredentials" : {
        "credentialType" : "SSH",
        "username" : "admin",
        "password" : "VMware123!"
      },
      "adminCredentials" : {
        "credentialType" : "SSH",
        "username" : "admin",
        "password" : "VMware123!"
      }
    },
    "hostSpecs" : [ {
      "ipAddress" : "192.10.20.30",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    }, {
      "ipAddress" : "192.10.20.31",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    }, {
      "ipAddress" : "192.10.20.32",
      "hostName" : "abc.com",
      "username" : "root",
      "password" : "VMware123!"
    } ],
    "datastoreSpec" : {
      "vsanDatastoreSpec" : {
        "licenseKey" : "123"
      }
    },
    "networkSpec" : {
      "vdsSpecs" : [ {
        "name" : "SDDC-Dswitch-Private1",
        "isUsedByNsxt" : true,
        "portGroupSpecs" : [ {
          "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "MANAGEMENT"
        }, {
          "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VSAN"
        }, {
          "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VMOTION"
        } ]
      } ],
      "nsxClusterSpec" : {
        "nsxTClusterSpec" : {
          "geneveVlanId" : 3
        }
      }
    }
  },
  "nsxTSpec" : {
    "nsxManagerSpecs" : [ {
      "name" : "nsx-manager-2",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    }, {
      "name" : "nsx-manager-3",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    }, {
      "name" : "nsx-manager-4",
      "networkDetailsSpec" : {
        "ipAddress" : "10.0.0.44",
        "dnsName" : "nsx-manager-2.vrack.vsphere.local",
        "gateway" : "10.0.0.250",
        "subnetMask" : "255.255.255.0"
      }
    } ],
    "vip" : "10.0.0.166",
    "vipFqdn" : "vip-nsxmanager.vrack.vsphere.local",
    "licenseKey" : "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
    "nsxManagerAdminPassword" : "VMware123!"
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/f0bd214d-a075-48d4-bd6b-d9a3243a4c66
Content-Length: 146

{
  "id" : "f0bd214d-a075-48d4-bd6b-d9a3243a4c66",
  "name" : "",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:24:37.248Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

2.7.3. Get the Domains

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 567

{
  "elements" : [ {
    "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5",
    "name" : "VI-1",
    "vcenters" : [ {
      "id" : "c0703437-6756-470b-9e1c-f9d3bbc9b1c6"
    } ],
    "clusters" : [ {
      "id" : "8045e44e-974e-4f43-9862-7f0326782655"
    } ]
  }, {
    "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c1",
    "name" : "VDI-1",
    "vcenters" : [ {
      "id" : "c0703437-6846-470b-9e1c-f9d3bbc9b1c9"
    } ],
    "clusters" : [ {
      "id" : "8045e44e-974e-4f43-9862-7f0326782677"
    }, {
      "id" : "8045e44e-974e-4f43-9861-7f0326782633"
    } ]
  } ]
}

Related APIs

Get the Domains
Get a Domain

2.7.4. Get a Domain

Prerequisites

The following data is required
- ID of the domain

Steps

Invoke the API using the ID of the domain

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/c0703437-6746-470b-9e1c-f9d3bbc9b1c5' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/c0703437-6746-470b-9e1c-f9d3bbc9b1c5 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 222

{
  "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5",
  "name" : "VI-1",
  "vcenters" : [ {
    "id" : "c0703437-6756-470b-9e1c-f9d3bbc9b1c6"
  } ],
  "clusters" : [ {
    "id" : "8045e44e-974e-4f43-9862-7f0326782655"
  } ]
}

Related APIs

Get the Domains
Get a Domain

2.7.5. Get Domain Endpoints

Prerequisites

The following data is required
- ID of the domain

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/86ec4d1b-6049-4a4b-99aa-740e2ac9a8a4/endpoints' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/86ec4d1b-6049-4a4b-99aa-740e2ac9a8a4/endpoints HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 192

{
  "elements" : [ {
    "type" : "VCENTER",
    "url" : "https://vcenter-1.vrack.vsphere.local"
  }, {
    "type" : "NSX_MANAGER",
    "url" : "https://nsxManager.vrack.vsphere.local"
  } ]
}

2.7.6. Delete a Domain

When you delete a domain, the clusters within the domain are deleted.

Warning

Deleting a domain is an irreversible operation. All clusters and VMs within the domain are deleted and the underlying datastores are destroyed.

Prerequisites

The following data is required
- ID of the domain that has to be deleted.

Tip	Back up the data on the domain.

Tip	Migrate the VMs that you want to retain, to another domain.

Steps

Initialize the deletion.

Warning

It is not possible to delete a domain without having marked it for deletion. This 2-step deletion ensures that a domain is not deleted accidentally.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/f74c2d97-621a-4984-9ab6-5d84effde82f' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "markForDeletion" : true
}'

HTTP Request

PATCH /v1/domains/f74c2d97-621a-4984-9ab6-5d84effde82f HTTP/1.1
Content-Type: application/json
Content-Length: 30
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "markForDeletion" : true
}

HTTP Response

HTTP/1.1 200 OK

Trigger the deletion.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/f74c2d97-621a-4984-9ab6-5d84effde82f' -i -X DELETE \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

DELETE /v1/domains/f74c2d97-621a-4984-9ab6-5d84effde82f HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/1ef40ff0-3ffc-4a59-998d-9f94cb34c33e
Content-Length: 142

{
  "id" : "1ef40ff0-3ffc-4a59-998d-9f94cb34c33e",
  "name" : "",
  "status" : "UNKNOWN",
  "creationTimestamp" : "2020-04-10T06:24:36.496Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

2.8. Clusters

2.8.1. Create a Cluster

After you add the VxRail primary cluster, additional clusters can be added to expand the domain.

Prerequisites

The following data is required
- Domain Identifier in which the cluster is to be created
- Cluster details
  - Name of the new cluster that will be added to the specified workload domain
  - VxRail Manager Details
    
    admin and root credentials
  - VSAN license key
  - Host details
    
    Hostname of ESXi host which is part of the cluster
    
    IpAddress of the same ESXi host which is part of the cluster
    
    Password of ESXi host which is part of the cluster
  - List of VDS details
    
    For each VDS
    
    DVS name
    
    Flag to indicate whether this DVS is used by NSX-T
    
    Port group names and the corresponding transport type
  - NSX cluster Details
    
    For NSX-T
    
    VLAN ID of Geneve
{ "nsxTClusterSpec" : { "geneveVlanId" : 2 } }
Workload Domain must be provisioned.

Note	NSX-T Manager(s) are configured when domain is created.

Host configuration must have minimum two active vmNics.
A DHCP server must be configured for NSX-T VTEPS

Steps

Through VxRail UI, create a cluster in the VC, which was created as part of the previous invocation of the create domain

Get the ID of the created domain
- TIP: Get the Domains
- Filter the response by VxRail Domain name and get the respective ID

Get the list of unmanaged clusters with names in thus created vi domain, Invoke a call to get clusters to get the details.

Tip	Refer to: Get the unmanaged clusters by criterion

Choose the name of one cluster that needs to be imported. Invoke a call to get unmanaged cluster by selected cluster name to get the network and host details.

Tip	Refer to: Get an unmanaged cluster by criterion

Create a cluster spec as shown in the curl payload below using the information from previous call
Validate the input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "domainId" : "6f86021b-fb89-4254-a3bd-e59aa2afcfa9",
  "computeSpec" : {
    "clusterSpecs" : [ {
      "name" : "Cluster1",
      "vxRailDetails" : {
        "rootCredentials" : {
          "credentialType" : "SSH",
          "username" : "admin",
          "password" : "VMware123!"
        },
        "adminCredentials" : {
          "credentialType" : "SSH",
          "username" : "admin",
          "password" : "VMware123!"
        }
      },
      "hostSpecs" : [ {
        "ipAddress" : "10.0.0.104",
        "hostName" : "esxi-4.vrack.vsphere.local",
        "username" : "root",
        "password" : "XXXX-XXXX"
      } ],
      "datastoreSpec" : {
        "vsanDatastoreSpec" : {
          "licenseKey" : "XXXX-XXXX"
        }
      },
      "networkSpec" : {
        "vdsSpecs" : [ {
          "name" : "vRack-DSwitch",
          "isUsedByNsxt" : true,
          "portGroupSpecs" : [ {
            "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "MANAGEMENT"
          }, {
            "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "VSAN"
          }, {
            "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "VMOTION"
          } ]
        } ],
        "nsxClusterSpec" : {
          "nsxTClusterSpec" : {
            "geneveVlanId" : 1
          }
        }
      },
      "advancedOptions" : {
        "evcMode" : "",
        "highAvailability" : {
          "enabled" : false
        }
      }
    } ]
  }
}'

HTTP Request

POST /v1/clusters/validations HTTP/1.1
Content-Type: application/json
Content-Length: 1575
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "domainId" : "6f86021b-fb89-4254-a3bd-e59aa2afcfa9",
  "computeSpec" : {
    "clusterSpecs" : [ {
      "name" : "Cluster1",
      "vxRailDetails" : {
        "rootCredentials" : {
          "credentialType" : "SSH",
          "username" : "admin",
          "password" : "VMware123!"
        },
        "adminCredentials" : {
          "credentialType" : "SSH",
          "username" : "admin",
          "password" : "VMware123!"
        }
      },
      "hostSpecs" : [ {
        "ipAddress" : "10.0.0.104",
        "hostName" : "esxi-4.vrack.vsphere.local",
        "username" : "root",
        "password" : "XXXX-XXXX"
      } ],
      "datastoreSpec" : {
        "vsanDatastoreSpec" : {
          "licenseKey" : "XXXX-XXXX"
        }
      },
      "networkSpec" : {
        "vdsSpecs" : [ {
          "name" : "vRack-DSwitch",
          "isUsedByNsxt" : true,
          "portGroupSpecs" : [ {
            "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "MANAGEMENT"
          }, {
            "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "VSAN"
          }, {
            "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "VMOTION"
          } ]
        } ],
        "nsxClusterSpec" : {
          "nsxTClusterSpec" : {
            "geneveVlanId" : 1
          }
        }
      },
      "advancedOptions" : {
        "evcMode" : "",
        "highAvailability" : {
          "enabled" : false
        }
      }
    } ]
  }
}

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 142

{
  "id" : "7be5813a-3c2f-41fa-a7db-22f8bf773b65",
  "description" : "Validating Cluster Creation Spec",
  "executionStatus" : "IN_PROGRESS"
}

Get Validation response of the cluster specification with id obtained from previous spec validation call
cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/validations/53a5b0d6-aa9f-4451-9bdd-dcdff69ac433' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/clusters/validations/53a5b0d6-aa9f-4451-9bdd-dcdff69ac433 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 224

{
  "id" : "53a5b0d6-aa9f-4451-9bdd-dcdff69ac433",
  "description" : "Validation result",
  "executionStatus" : "COMPLETED",
  "resultStatus" : "SUCCEEDED",
  "validationChecks" : [ {
    "resultStatus" : "SUCCEEDED"
  } ]
}

In case of no errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note
Make changes to the input specification and re-validate using a new API invocation.
Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "domainId" : "0a9282cb-744e-4fc4-86e7-86c4d7bdb0a3",
  "computeSpec" : {
    "clusterSpecs" : [ {
      "name" : "Cluster1",
      "vxRailDetails" : {
        "rootCredentials" : {
          "credentialType" : "SSH",
          "username" : "admin",
          "password" : "VMware123!"
        },
        "adminCredentials" : {
          "credentialType" : "SSH",
          "username" : "admin",
          "password" : "VMware123!"
        }
      },
      "hostSpecs" : [ {
        "ipAddress" : "10.0.0.104",
        "hostName" : "esxi-4.vrack.vsphere.local",
        "username" : "root",
        "password" : "XXXX-XXXX"
      } ],
      "datastoreSpec" : {
        "vsanDatastoreSpec" : {
          "licenseKey" : "XXXX-XXXX"
        }
      },
      "networkSpec" : {
        "vdsSpecs" : [ {
          "name" : "vRack-DSwitch",
          "isUsedByNsxt" : true,
          "portGroupSpecs" : [ {
            "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "MANAGEMENT"
          }, {
            "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "VSAN"
          }, {
            "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "VMOTION"
          } ]
        } ],
        "nsxClusterSpec" : {
          "nsxTClusterSpec" : {
            "geneveVlanId" : 1
          }
        }
      },
      "advancedOptions" : {
        "evcMode" : "",
        "highAvailability" : {
          "enabled" : false
        }
      }
    } ]
  }
}'

HTTP Request

POST /v1/clusters HTTP/1.1
Content-Type: application/json
Content-Length: 1575
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "domainId" : "0a9282cb-744e-4fc4-86e7-86c4d7bdb0a3",
  "computeSpec" : {
    "clusterSpecs" : [ {
      "name" : "Cluster1",
      "vxRailDetails" : {
        "rootCredentials" : {
          "credentialType" : "SSH",
          "username" : "admin",
          "password" : "VMware123!"
        },
        "adminCredentials" : {
          "credentialType" : "SSH",
          "username" : "admin",
          "password" : "VMware123!"
        }
      },
      "hostSpecs" : [ {
        "ipAddress" : "10.0.0.104",
        "hostName" : "esxi-4.vrack.vsphere.local",
        "username" : "root",
        "password" : "XXXX-XXXX"
      } ],
      "datastoreSpec" : {
        "vsanDatastoreSpec" : {
          "licenseKey" : "XXXX-XXXX"
        }
      },
      "networkSpec" : {
        "vdsSpecs" : [ {
          "name" : "vRack-DSwitch",
          "isUsedByNsxt" : true,
          "portGroupSpecs" : [ {
            "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "MANAGEMENT"
          }, {
            "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "VSAN"
          }, {
            "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
            "transportType" : "VMOTION"
          } ]
        } ],
        "nsxClusterSpec" : {
          "nsxTClusterSpec" : {
            "geneveVlanId" : 1
          }
        }
      },
      "advancedOptions" : {
        "evcMode" : "",
        "highAvailability" : {
          "enabled" : false
        }
      }
    } ]
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/95312a64-5320-4c0d-8d22-2759afff5708
Content-Length: 166

{
  "id" : "95312a64-5320-4c0d-8d22-2759afff5708",
  "name" : "Add Cluster Workflow",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:23:50.350Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

2.8.2. Get the Clusters

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/clusters HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 703

{
  "elements" : [ {
    "id" : "8045e44e-974e-4f43-9862-7f0326782655",
    "name" : "sfo01-m01-mgmt01",
    "primaryDatastoreName" : "sfo01-m01-vsan01",
    "primaryDatastoreType" : "VSAN",
    "hosts" : [ {
      "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5"
    }, {
      "id" : "c0703431-6742-470b-9e1d-f9d3bbc9b1c9"
    } ],
    "isStretched" : false
  }, {
    "id" : "2345e44e-974e-4f43-9862-7f0326782898",
    "name" : "SDDC-Cluster1",
    "primaryDatastoreName" : "sfo01-m01-vsan01",
    "primaryDatastoreType" : "VSAN",
    "hosts" : [ {
      "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5"
    }, {
      "id" : "c0703431-6742-470b-9e1d-f9d3bbc9b1c9"
    } ],
    "isStretched" : true
  } ]
}

Get the Stretched Clusters

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters?isStretched=true' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/clusters?isStretched=true HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 363

{
  "elements" : [ {
    "id" : "2345e44e-974e-4f43-9862-7f0326782898",
    "name" : "sfo01-m01-mgmt01",
    "primaryDatastoreName" : "sfo01-m01-vsan01",
    "primaryDatastoreType" : "VSAN",
    "hosts" : [ {
      "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5"
    }, {
      "id" : "c0703431-6742-470b-9e1d-f9d3bbc9b1c9"
    } ],
    "isStretched" : true
  } ]
}

Get the Vanilla Clusters

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters?isStretched=false' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/clusters?isStretched=false HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 364

{
  "elements" : [ {
    "id" : "8045e44e-974e-4f43-9862-7f0326782655",
    "name" : "sfo01-m01-mgmt01",
    "primaryDatastoreName" : "sfo01-m01-vsan01",
    "primaryDatastoreType" : "VSAN",
    "hosts" : [ {
      "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5"
    }, {
      "id" : "c0703431-6742-470b-9e1d-f9d3bbc9b1c9"
    } ],
    "isStretched" : false
  } ]
}

Related APIs

Get the Clusters
Get a Cluster

2.8.3. Get the unmanaged clusters by criterion

This API is used to get the unmanaged clusters from vCenter that meets a specific criterion.

Prerequisites

Domain should already been created.
There must be a cluster already added to the VCenter.
The following data is required
- ID of the created domain

Get the unmanaged clusters from vCenter based on a criterion

Steps

Get the ID of the created domain
- TIP: Get the Domains
- Filter the response by VxRail Domain name and get the respective ID

Invoke the Get clusters Criteria API to list all the criteria supported.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/criteria' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/criteria HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 313

{
  "elements" : [ {
    "name" : "UNMANAGED_CLUSTERS_IN_VCENTER",
    "description" : "All unmanaged clusters that are not in inventory but there in vcenter"
  }, {
    "name" : "UNMANAGED_CLUSTER_IN_VCENTER",
    "description" : "Specific unmanaged cluster that is not in inventory but there in vcenter"
  } ]
}

Pick one of the criterion and post a query with its name attribute

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/queries' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "name" : "UNMANAGED_CLUSTERS_IN_VCENTER"
}'

HTTP Request

POST /v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/queries HTTP/1.1
Content-Type: application/json
Content-Length: 46
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "name" : "UNMANAGED_CLUSTERS_IN_VCENTER"
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c
Content-Type: application/json
Content-Length: 168

{
  "queryInfo" : {
    "status" : "IN_PROGRESS",
    "processing" : true,
    "failure" : false,
    "completed" : false
  },
  "result" : {
    "elements" : [ ]
  }
}

Read the tracking URL returned as Location header in the previous step.

Poll the tracking URL until the "status" is not "IN_PROGRESS".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 208

{
  "queryInfo" : {
    "status" : "COMPLETED",
    "processing" : false,
    "failure" : false,
    "completed" : true
  },
  "result" : {
    "elements" : [ {
      "name" : "VxRail-Cluster-1"
    } ]
  }
}

2.8.4. Get a Cluster

Prerequisites

The following data is required
- ID of the cluster

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/8045e44e-974e-4f43-9862-7f0326782655' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/clusters/8045e44e-974e-4f43-9862-7f0326782655 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 319

{
  "id" : "8045e44e-974e-4f43-9862-7f0326782655",
  "name" : "sfo01-m01-mgmt01",
  "primaryDatastoreName" : "sfo01-m01-vsan01",
  "primaryDatastoreType" : "VSAN",
  "hosts" : [ {
    "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5"
  }, {
    "id" : "c0703431-6742-470b-9e1d-f9d3bbc9b1c9"
  } ],
  "isStretched" : false
}

Related APIs

Get the Clusters
Get a Cluster

2.8.5. Get an unmanaged cluster by criterion

This API is used to get the unmanaged cluster by cluster name from vCenter that meets a specific criterion.

Prerequisites

Domain should already been created.
There must be a cluster already added to the VCenter.
The following data is required
- ID of the created domain
- List of unmanaged clusters with names

Tip	Refer to: Get the unmanaged clusters by criterion.

Choose one cluster name that need to be imported
Get the unmanaged cluster from vCenter for domain update based on a criterion*

Steps

Get the ID of the created domain
- TIP: Get the Domains
- Filter the response by VxRail Domain name and get the respective ID

Invoke the Get Clusters Criteria API to list all the criteria supported.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/criteria' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/criteria HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 313

{
  "elements" : [ {
    "name" : "UNMANAGED_CLUSTERS_IN_VCENTER",
    "description" : "All unmanaged clusters that are not in inventory but there in vcenter"
  }, {
    "name" : "UNMANAGED_CLUSTER_IN_VCENTER",
    "description" : "Specific unmanaged cluster that is not in inventory but there in vcenter"
  } ]
}

Pick one of the criterion and post a query with its name attribute

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/VxRail-Cluster-1/queries' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "name" : "UNMANAGED_CLUSTER_IN_VCENTER"
}'

HTTP Request

POST /v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/VxRail-Cluster-1/queries HTTP/1.1
Content-Type: application/json
Content-Length: 45
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "name" : "UNMANAGED_CLUSTER_IN_VCENTER"
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/VxRail-Cluster-1/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c
Content-Type: application/json
Content-Length: 168

{
  "queryInfo" : {
    "status" : "IN_PROGRESS",
    "processing" : true,
    "failure" : false,
    "completed" : false
  },
  "result" : {
    "elements" : [ ]
  }
}

Read the tracking URL returned as Location header in the previous step.

Poll the tracking URL until the "status" is not "IN_PROGRESS".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/VxRail-Cluster-1/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/2d54bb6c-637a-49a4-a94c-622671d0ab32/clusters/VxRail-Cluster-1/queries/622671d0ab32-2d54bb6c-637a-49a4-a94c HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 883

{
  "queryInfo" : {
    "status" : "COMPLETED",
    "processing" : false,
    "failure" : false,
    "completed" : true
  },
  "result" : {
    "elements" : [ {
      "name" : "VxRail-Cluster-1",
      "hosts" : [ {
        "ipAddress" : "10.0.0.100",
        "fqdn" : "esxi-1.vrack.vsphere.local"
      } ],
      "vdsSpecs" : [ {
        "name" : "SDDC-Dswitch-Private1",
        "isUsedByNsxt" : false,
        "portGroupSpecs" : [ {
          "name" : "Management Network-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "MANAGEMENT"
        }, {
          "name" : "Virtual SAN-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VSAN"
        }, {
          "name" : "vSphere vMotion-24777c60-af96-4ae1-9d98-9881c70a0f7d",
          "transportType" : "VMOTION"
        } ],
        "niocBandwidthAllocationSpecs" : null
      } ]
    } ]
  }
}

2.8.6. Expand a Cluster

Importing an individual host into a vcf cluster adds that host to the vcf cluster. You can import multiple hosts at a time to a cluster.

Prerequisites

The following data is required
- ID of the cluster
- For each host
  - ip address of the host
  - username of the host
  - password of the host
The cluster in a domain to which hosts are to be added must exist.
There must be a host already added to the cluster VCenter.
Ensure that the host you want to add is in an active state.
Prefer to use get unmanaged hosts calls to get the valid hosts ready for addition using query API

Tip	Refer to: Get the unmanaged hosts based on a Criterion.

Steps

Validate the input specification async.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterExpansionSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.0",
      "hostName" : "www.abc.com",
      "username" : "test",
      "password" : "pass"
    } ]
  }
}'

HTTP Request

POST /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/validations HTTP/1.1
Content-Type: application/json
Content-Length: 185
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterExpansionSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.0",
      "hostName" : "www.abc.com",
      "username" : "test",
      "password" : "pass"
    } ]
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/clusters/validations/30d33ca1-4791-4dd4-ada4-1d1a59cdacec
Content-Type: application/json
Content-Length: 143

{
  "id" : "30d33ca1-4791-4dd4-ada4-1d1a59cdacec",
  "description" : "Validating Cluster Expansion Spec",
  "executionStatus" : "IN_PROGRESS"
}

Get Validation response of the cluster expansion specification from id obtained from previous spec validation call
cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/validations/53a5b0d6-aa9f-4451-9bdd-dcdff69ac433' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/clusters/validations/53a5b0d6-aa9f-4451-9bdd-dcdff69ac433 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 224

{
  "id" : "53a5b0d6-aa9f-4451-9bdd-dcdff69ac433",
  "description" : "Validation result",
  "executionStatus" : "COMPLETED",
  "resultStatus" : "SUCCEEDED",
  "validationChecks" : [ {
    "resultStatus" : "SUCCEEDED"
  } ]
}

In case of no errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note
Make changes to the input specification and re-validate using a new API invocation.

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterExpansionSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.0",
      "hostName" : "www.abc.com",
      "username" : "test",
      "password" : "pass"
    } ]
  }
}'

HTTP Request

PATCH /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32 HTTP/1.1
Content-Type: application/json
Content-Length: 185
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterExpansionSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.0",
      "hostName" : "www.abc.com",
      "username" : "test",
      "password" : "pass"
    } ]
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/83db139b-0e03-484a-8cf0-fddb6967d2db
Content-Length: 166

{
  "id" : "83db139b-0e03-484a-8cf0-fddb6967d2db",
  "name" : "Add Cluster Workflow",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:23:53.917Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

2.8.7. Compact a Cluster

When a host is removed from a cluster in a domain, the vSAN members are reduced. Ensure that you have enough hosts remaining to facilitate the configured vSAN availability. Failure to do so might result in the datastore being marked as read-only or in data loss.
Note: Post removing the host from the cluster in SDDC, user would need to remove the host from the VxRail Cluster through the VxRail vCenter plugin.

Prerequisites

The following data is required
- For each host to be removed
  - ID of the host

Steps

Validate the input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterCompactionSpec" : {
    "hosts" : [ {
      "id" : "b8d4d3f1-4f45-487c-8ae6-144291eef475"
    } ]
  }
}'

HTTP Request

POST /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/validations HTTP/1.1
Content-Type: application/json
Content-Length: 115
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterCompactionSpec" : {
    "hosts" : [ {
      "id" : "b8d4d3f1-4f45-487c-8ae6-144291eef475"
    } ]
  }
}

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 296

{
  "id" : "b8c66680-a2ef-4a70-8c6d-e2bc19f6631e",
  "description" : "Validating Cluster Compaction Spec",
  "executionStatus" : "COMPLETED",
  "resultStatus" : "SUCCEEDED",
  "validationChecks" : [ {
    "description" : "ClusterCompactionSpecValidation",
    "resultStatus" : "SUCCEEDED"
  } ]
}

In case of no errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note
Make changes to the input specification and re-validate using a new API invocation.

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterCompactionSpec" : {
    "hosts" : [ {
      "id" : "708a6307-8e28-4270-b0a2-bbd1a10bf029"
    } ]
  }
}'

HTTP Request

PATCH /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32 HTTP/1.1
Content-Type: application/json
Content-Length: 115
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterCompactionSpec" : {
    "hosts" : [ {
      "id" : "708a6307-8e28-4270-b0a2-bbd1a10bf029"
    } ]
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/d64aaeb9-d6b9-4350-a143-fff4776a52a5
Content-Length: 166

{
  "id" : "d64aaeb9-d6b9-4350-a143-fff4776a52a5",
  "name" : "Add Cluster Workflow",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:23:53.752Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

Related APIs

2.8.8. Prepare for Stretch

Prepare a Standard VxRail vSAN cluster prior to converting it to a Stretched cluster. This will ensure that the VMs on the existing hosts (availability zone) of the cluster do not get migrated to the hosts (second availability zone) that get added to the cluster.

Prerequisites

The following data is required
- ID of the cluster
- Boolean indicating the cluster has been marked for prepare.
The cluster must exist and the id should be valid.
The cluster must not be stretched.

Steps

Trigger the Prepare for Stretch task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "prepareForStretch" : true
}'

HTTP Request

PATCH /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32 HTTP/1.1
Content-Type: application/json
Content-Length: 32
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "prepareForStretch" : true
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/b0e4c9a8-43af-4195-9de4-db0f049a5171
Content-Length: 174

{
  "id" : "b0e4c9a8-43af-4195-9de4-db0f049a5171",
  "name" : "Prepare for Stretch Workflow",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:23:48.313Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.
Track the task status using the "id" from the previous response.
- If the "status" is "IN_PROGRESS", the task is still in progress.
- If the "status" is "SUCCESSFUL", the task is completed successfully.
- If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

Related APIs

2.8.9. Stretch a Cluster

Convert a Standard VxRail vSAN cluster to a Stretched cluster

Prerequisites

The Witness VM is not managed by SDDC and should be added to the datacenter corresponding to the cluster provided. Please refer to the 'Deploying a vSAN Witness Appliance' section in the 'VMware Cloud Foundation Operations and Administration Guide'.
The vMotion, vSAN, and VXLAN networks require L3 routing between the availability zones. vSAN networks must also have L3 routing to the vSAN network of the witness host. Please refer to the 'Prerequisites for Stretching a Cluster' section in the 'VMware Cloud Foundation Operations and Administration Guide'.
Hosts in the second availability zone being used for stretch should not already be a part of SDDC and should be added to the given VxRail cluster through the VxRail cluster expansion flow in vCenter. For more information to expand a VxRail cluster, contact Dell EMC Support.
The 'Prepare for Stretch' API should be executed before starting with the Stretch workflow.
A valid 'Stretched Cluster' license should be applied to the VxRail vSAN Cluster before executing stretch.
The following data is required
- ID of the cluster
- For each host in the second availability zone which needs to be used for the stretch operation
  - IP Address of the host
  - Hostname (fqdn) of the host
  - SSH Username
  - SSH Password
- For the witness VM
  - vSAN IP
  - IP address or the fqdn
    
    If the witness is managed in vCenter by the fqdn, the the same needs to be provided, else the IP address.
  - vSAN subnet cidr
- For each availability zone
  - vSAN Gateway IP
  - vSAN subnet cidr
- Secondary availability zone vLAN ID
The cluster should not be stretched and the id provided should be valid.
You must have a valid ESXi license specified with adequate sockets available for the host to be added.
Ensure that the given host should be in active state.
Underlying physical network should have proper MTUs and vSAN/vMotion connectivity between availability zones and the witness.

Steps

Validate the input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterStretchSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.104",
      "hostName" : "esxi-4.vrack.vsphere.local",
      "username" : "root",
      "password" : "XXXX-XXXX"
    } ],
    "witnessSpec" : {
      "vsanIp" : "10.0.4.88",
      "fqdn" : "witness-vsan.vrack.vsphere.local",
      "vsanCidr" : "10.0.4.0/24"
    },
    "vsanNetworkSpecs" : [ {
      "vsanGatewayIP" : "10.0.8.1",
      "vsanCidr" : "10.0.8.0/24"
    }, {
      "vsanGatewayIP" : "10.0.12.1",
      "vsanCidr" : "10.0.12.0/24"
    } ],
    "secondaryAzOverlayVlanId" : 0
  }
}'

HTTP Request

POST /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/validations HTTP/1.1
Content-Type: application/json
Content-Length: 571
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterStretchSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.104",
      "hostName" : "esxi-4.vrack.vsphere.local",
      "username" : "root",
      "password" : "XXXX-XXXX"
    } ],
    "witnessSpec" : {
      "vsanIp" : "10.0.4.88",
      "fqdn" : "witness-vsan.vrack.vsphere.local",
      "vsanCidr" : "10.0.4.0/24"
    },
    "vsanNetworkSpecs" : [ {
      "vsanGatewayIP" : "10.0.8.1",
      "vsanCidr" : "10.0.8.0/24"
    }, {
      "vsanGatewayIP" : "10.0.12.1",
      "vsanCidr" : "10.0.12.0/24"
    } ],
    "secondaryAzOverlayVlanId" : 0
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/clusters/validations/f52ef7dc-982d-4d90-a4e8-a429184de7ea
Content-Type: application/json
Content-Length: 145

{
  "id" : "f52ef7dc-982d-4d90-a4e8-a429184de7ea",
  "description" : "Stretch Cluster Validation Workflow",
  "executionStatus" : "IN_PROGRESS"
}

If the "executionStatus" is "IN_PROGRESS", the spec validation task is still in progress.
In case of no errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note
Make changes to the input specification and re-validate using a new API invocation.

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterStretchSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.104",
      "hostName" : "esxi-4.vrack.vsphere.local",
      "username" : "root",
      "password" : "XXXX-XXXX"
    } ],
    "witnessSpec" : {
      "vsanIp" : "10.0.4.88",
      "fqdn" : "witness-vsan.vrack.vsphere.local",
      "vsanCidr" : "10.0.4.0/24"
    },
    "vsanNetworkSpecs" : [ {
      "vsanGatewayIP" : "10.0.8.1",
      "vsanCidr" : "10.0.8.0/24"
    }, {
      "vsanGatewayIP" : "10.0.12.1",
      "vsanCidr" : "10.0.12.0/24"
    } ],
    "secondaryAzOverlayVlanId" : 0
  }
}'

HTTP Request

PATCH /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32 HTTP/1.1
Content-Type: application/json
Content-Length: 571
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterStretchSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.104",
      "hostName" : "esxi-4.vrack.vsphere.local",
      "username" : "root",
      "password" : "XXXX-XXXX"
    } ],
    "witnessSpec" : {
      "vsanIp" : "10.0.4.88",
      "fqdn" : "witness-vsan.vrack.vsphere.local",
      "vsanCidr" : "10.0.4.0/24"
    },
    "vsanNetworkSpecs" : [ {
      "vsanGatewayIP" : "10.0.8.1",
      "vsanCidr" : "10.0.8.0/24"
    }, {
      "vsanGatewayIP" : "10.0.12.1",
      "vsanCidr" : "10.0.12.0/24"
    } ],
    "secondaryAzOverlayVlanId" : 0
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/923b1795-568a-4b51-ab21-d7c3b8318454
Content-Length: 170

{
  "id" : "923b1795-568a-4b51-ab21-d7c3b8318454",
  "name" : "Stretch Cluster Workflow",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:23:48.546Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.
Track the task status using the "id" from the previous response.
- If the "status" is "IN_PROGRESS", the task is still in progress.
- If the "status" is "SUCCESSFUL", the task is completed successfully.
- If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

Related APIs

2.8.10. Expand a Stretched Cluster

The expansion workflow on a VxRail stretched cluster adds new hosts from a different availability zone to VCF. The hosts that are part of the expansion are already a part of the VxRail cluster.You can import multiple hosts at a time to a cluster.

Prerequisites

Hosts in the second availability zone being used for expansion should not already be a part of SDDC and should be added to the given VxRail cluster through the VxRail cluster expansion flow in vCenter. For more information to expand a VxRail cluster, contact Dell EMC Support. Please refer to the 'Cluster Spanning for VMware Cloud Foundation on VxRail' section in the 'VMware Cloud Foundation Operations and Administration Guide' for more information on expanding clusters that need cluster spanning.
The Witness VM is not managed by SDDC and should be added to the datacenter corresponding to the cluster provided. Please refer to the 'Deploying a vSAN Witness Appliance' section in the 'VMware Cloud Foundation Operations and Administration Guide'.
The vMotion, vSAN, and VXLAN networks require L3 routing between the availability zones. vSAN networks must also have L3 routing to the vSAN network of the witness host. Please refer to the 'Prerequisites for Stretching a Cluster' section in the 'VMware Cloud Foundation Operations and Administration Guide'.
The following data is required
- ID of the cluster
- For each host in the second availability zone which needs to be used for the expansion operation
  - IP Address of the host
  - Hostname (fqdn) of the host
  - SSH Username
  - SSH Password
  - Name of the availability zone which the new host belongs to
    
    The availability zone name can be fetched from the vCenter
- For the witness VM
  - vSAN IP
  - IP address or the fqdn
    
    If the witness is managed in vCenter by the fqdn, the the same needs to be provided, else the IP address.
  - vSAN subnet cidr
- For each availability zone
  - vSAN Gateway IP
  - vSAN subnet cidr
The cluster should be stretched and the id provided should be valid.
You must have a valid ESXi license specified with adequate sockets available for the host to be added.
Ensure that the given host should be in active state.
Underlying physical network should have proper MTUs and vSAN/vMotion connectivity between availability zones and the witness.

Steps

Validate the input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterExpansionSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.104",
      "hostName" : "esxi-4.vrack.vsphere.local",
      "username" : "root",
      "password" : "XXXX-XXXX",
      "azName" : "azName"
    } ],
    "vsanNetworkSpecs" : [ {
      "vsanGatewayIP" : "10.0.8.1",
      "vsanCidr" : "10.0.8.0/24"
    }, {
      "vsanGatewayIP" : "10.0.12.1",
      "vsanCidr" : "10.0.12.0/24"
    } ],
    "witnessSpec" : {
      "vsanIp" : "10.0.4.88",
      "fqdn" : "witness-vsan.vrack.vsphere.local",
      "vsanCidr" : "10.0.4.0/24"
    }
  }
}'

HTTP Request

POST /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32/validations HTTP/1.1
Content-Type: application/json
Content-Length: 564
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterExpansionSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.104",
      "hostName" : "esxi-4.vrack.vsphere.local",
      "username" : "root",
      "password" : "XXXX-XXXX",
      "azName" : "azName"
    } ],
    "vsanNetworkSpecs" : [ {
      "vsanGatewayIP" : "10.0.8.1",
      "vsanCidr" : "10.0.8.0/24"
    }, {
      "vsanGatewayIP" : "10.0.12.1",
      "vsanCidr" : "10.0.12.0/24"
    } ],
    "witnessSpec" : {
      "vsanIp" : "10.0.4.88",
      "fqdn" : "witness-vsan.vrack.vsphere.local",
      "vsanCidr" : "10.0.4.0/24"
    }
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/clusters/validations/19c84e10-0f90-473a-b5b4-7d19007ba594
Content-Type: application/json
Content-Length: 142

{
  "id" : "19c84e10-0f90-473a-b5b4-7d19007ba594",
  "description" : "Validate Expand Cluster Workflow",
  "executionStatus" : "IN_PROGRESS"
}

If the "executionStatus" is "IN_PROGRESS", the spec validation task is still in progress.
In case of no errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note
Make changes to the input specification and re-validate using a new API invocation.

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "clusterExpansionSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.104",
      "hostName" : "esxi-4.vrack.vsphere.local",
      "username" : "root",
      "password" : "XXXX-XXXX",
      "azName" : "azName"
    } ],
    "vsanNetworkSpecs" : [ {
      "vsanGatewayIP" : "10.0.8.1",
      "vsanCidr" : "10.0.8.0/24"
    }, {
      "vsanGatewayIP" : "10.0.12.1",
      "vsanCidr" : "10.0.12.0/24"
    } ],
    "witnessSpec" : {
      "vsanIp" : "10.0.4.88",
      "fqdn" : "witness-vsan.vrack.vsphere.local",
      "vsanCidr" : "10.0.4.0/24"
    }
  }
}'

HTTP Request

PATCH /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32 HTTP/1.1
Content-Type: application/json
Content-Length: 564
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "clusterExpansionSpec" : {
    "hostSpecs" : [ {
      "ipAddress" : "10.0.0.104",
      "hostName" : "esxi-4.vrack.vsphere.local",
      "username" : "root",
      "password" : "XXXX-XXXX",
      "azName" : "azName"
    } ],
    "vsanNetworkSpecs" : [ {
      "vsanGatewayIP" : "10.0.8.1",
      "vsanCidr" : "10.0.8.0/24"
    }, {
      "vsanGatewayIP" : "10.0.12.1",
      "vsanCidr" : "10.0.12.0/24"
    } ],
    "witnessSpec" : {
      "vsanIp" : "10.0.4.88",
      "fqdn" : "witness-vsan.vrack.vsphere.local",
      "vsanCidr" : "10.0.4.0/24"
    }
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/455cb8ae-1e51-4b73-8968-98f36920c44f
Content-Length: 169

{
  "id" : "455cb8ae-1e51-4b73-8968-98f36920c44f",
  "name" : "Expand Cluster Workflow",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:23:51.776Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.
Track the task status using the "id" from the previous response.
- If the "status" is "IN_PROGRESS", the task is still in progress.
- If the "status" is "SUCCESSFUL", the task is completed successfully.
- If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

Related APIs

2.8.11. Unstretch a Cluster

Convert a Stretched VxRail cluster to a Standard VxRail vSAN cluster. This operation is currently NOT SUPPORTED.

2.8.12. Delete a Cluster

Warning

Datastores on the ESXi hosts in the cluster that will be deleted are destroyed.

Note	You cannot delete the last cluster in a domain. Instead, the domain can be deleted.

Prerequisites

The following data is required
- ID of the cluster to be deleted
Ensure that a cluster with the given ID exists.
The cluster has been marked for deletion.
Migrate or backup the VMs and data on the data store associated with the cluster to another location.

Steps

Initialize the deletion.

Warning

It is not possible to delete a cluster without having marked it for deletion. This 2-step deletion ensures that a cluster is not deleted accidentally.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "markForDeletion" : true
}'

HTTP Request

PATCH /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32 HTTP/1.1
Content-Type: application/json
Content-Length: 30
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "markForDeletion" : true
}

HTTP Response

HTTP/1.1 200 OK

Trigger the deletion.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32' -i -X DELETE \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

DELETE /v1/clusters/2d54bb6c-637a-49a4-a94c-622671d0ab32 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/8f445c1b-606b-4297-92a5-43f4322eec7f
Content-Length: 166

{
  "id" : "8f445c1b-606b-4297-92a5-43f4322eec7f",
  "name" : "Add Cluster Workflow",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:23:50.720Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

2.9. Multi Site Management

2.9.1. Create a Multi Site Management Federation

A federation is a group of Cloud Foundation instances, such that each member can view information about the other Cloud Foundation instances in the group. The federation creator is granted the controller role by default.

You can create multiple federations within your organization, but global visibility is available only within a federation. Members can belong to only a single federation at a time.

Prerequisites

The following data is required
- Name of the federation
- Member Details
  - FQDN of the Member
  - Role of the Member (CONTROLLER)
  - Site Type (DATACENTER)
  - Site Name
  - City where the site is located
  - State where the site is located (Optional)
  - Country where the site is located
  - Location coordinates
    
    Longitude
    
    Latitude
Ensure, VCF Instance Role is set to NOT_JOINED.

Tip	Refer to: Get fact about a VMware Cloud Foundation

Steps

Trigger the Create Federation
cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWR....' \
    -d '{
  "federationName" : "New Federation",
  "memberJoinDetail" : {
    "role" : "CONTROLLER",
    "fqdn" : "sddc-manager-1.vrack.vsphere.local",
    "siteType" : "DATACENTER",
    "siteName" : "Palo Alto Epic Center",
    "country" : "USA",
    "state" : "California",
    "city" : "Palo Alto",
    "coordinate" : {
      "longitude" : -122.838,
      "latitude" : 37.286
    }
  }
}'

HTTP Request

PUT /v1/sddc-federation HTTP/1.1
Content-Type: application/json
Content-Length: 382
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

{
  "federationName" : "New Federation",
  "memberJoinDetail" : {
    "role" : "CONTROLLER",
    "fqdn" : "sddc-manager-1.vrack.vsphere.local",
    "siteType" : "DATACENTER",
    "siteName" : "Palo Alto Epic Center",
    "country" : "USA",
    "state" : "California",
    "city" : "Palo Alto",
    "coordinate" : {
      "longitude" : -122.838,
      "latitude" : 37.286
    }
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Content-Length: 246

{
  "status" : "SUCCEEDED",
  "operation" : null,
  "taskId" : "a62460cb-38ae-4668-9877-c86078798383",
  "remoteOperationTask" : null,
  "progressDetails" : null,
  "created" : null,
  "lastUpdated" : null,
  "errors" : null,
  "payload" : null
}

Create federation API returns a task object. Task object has the task id.
Poll for the status of the workflow using the task ID with request
TIP: Refer to: Get a Task
Validate the input specification.
- Validates if VCF instance Role is other than CONTROLLER
Initialize the fabric services
Initialize the topics
Initialize persistent store
Add member to federation
Update persistent store with new member details
- If the "status" is "SUCCEEDED", the task is completed successfully.
- If the "status" is "FAILED", the task can be re-executed.

2.9.2. Invite

You can invite Cloud Foundation instances to join a federation. They can be invited as a controller or a regular member.
In the InvitationSpec or http/curl request if inviteeRole is MEMBER, the vcf instance will have limited access and will not be able to view federation details.
Inorder to view federation details, use inviteeRole as CONTROLLER or MANAGER.
Since a federation can include a maximum of three controllers, you may want to assign the controller role to the primary data centers within the federation.

Prerequisites

Federation must be created.
You must have the controller role to invite a member to a federation.
Only one member can be invited at a time.
The following data is required
- Role of the Invitee
- FQDN of the Invitee

Steps

Trigger the task using the valid invite spec.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation/membership-tokens' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWR....' \
    -d '{
  "inviteeRole" : "MEMBER",
  "inviteeFqdn" : "sddc-manager-1.vrack.vsphere.local",
  "tokenExpiryHours" : 0.0
}'

HTTP Request

POST /v1/sddc-federation/membership-tokens HTTP/1.1
Content-Type: application/json
Content-Length: 114
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

{
  "inviteeRole" : "MEMBER",
  "inviteeFqdn" : "sddc-manager-1.vrack.vsphere.local",
  "tokenExpiryHours" : 0.0
}

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 229

{
  "controllerFqdn" : [ "sddc-manager-1.vrack.vsphere.local" ],
  "inviteeRole" : "MEMBER",
  "inviteeFqdn" : "sddc-manager-1.vrack.vsphere.local",
  "invitationToken" : "817e0e5f-066f-4c82-8a70-ac324906e7b4",
  "error" : null
}

This is a sync call, and on success should get a token, role and name.
If there is a failure, appropriate error is returned. Perform relevant corrective actions before retrying this API.

Related APIs

2.9.3. Join the Federation

You can join a federation as a controller/manager/member depending on the assigned role in the invitation.
Use the token you received as part of the invitation, to trigger a join API.

An invitation is valid for ten days. You must request a new invitation after this period.

Prerequisites

The following data is required
- Controller FQDN
  - You can provide any of the controllers FQDN to join the federation. However, it is preferred to provide
    the FQDN of the controller who sent out the invitation.
- Token
  - Token you received from the controller as part of the invitation.
- Member Details
  - Role of the invitee, this should match the role you provided during invite.
  - FQDN of the invitee
  - Type of the site, it will always be "DATACENTER" for 1.0 release
  - Name of the site
  - Country
  - State
  - City
  - Coordinate of the site
    
    Longitude
    
    Latitude

Steps

Provide above inputs and invoke the API.
If the request goes through successfully, we should see this new member on the world map.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation/members' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWR....' \
    -d '{
  "controllerFqdn" : "sddc-manager-1.vrack.vsphere.local",
  "joinToken" : "test",
  "commonName" : "sddcmgr-newyork.msm.local",
  "memberJoinDetail" : {
    "role" : "MEMBER",
    "fqdn" : "sddcmgr-newyork.msm.local",
    "siteType" : "DATACENTER",
    "siteName" : "New York Epic Center",
    "country" : "USA",
    "state" : "New York",
    "city" : "New York",
    "coordinate" : {
      "longitude" : -74.006,
      "latitude" : 40.712
    }
  }
}'

HTTP Request

POST /v1/sddc-federation/members HTTP/1.1
Content-Type: application/json
Content-Length: 454
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

{
  "controllerFqdn" : "sddc-manager-1.vrack.vsphere.local",
  "joinToken" : "test",
  "commonName" : "sddcmgr-newyork.msm.local",
  "memberJoinDetail" : {
    "role" : "MEMBER",
    "fqdn" : "sddcmgr-newyork.msm.local",
    "siteType" : "DATACENTER",
    "siteName" : "New York Epic Center",
    "country" : "USA",
    "state" : "New York",
    "city" : "New York",
    "coordinate" : {
      "longitude" : -74.006,
      "latitude" : 40.712
    }
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Content-Length: 246

{
  "status" : "SUCCEEDED",
  "operation" : null,
  "taskId" : "ef960ed5-12c5-4512-a020-5b53fb177ff6",
  "remoteOperationTask" : null,
  "progressDetails" : null,
  "created" : null,
  "lastUpdated" : null,
  "errors" : null,
  "payload" : null
}

2.9.4. Get progress

Use this API to get progress of long running operations in the system. When operations like bootstrap, join or teardown are triggered, as part of response
you receive a request ID. Use this request ID to track the status of the operation.

Prerequisites

Request ID

Steps

Provide a valid request ID and invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation/tasks/4421185a-469b-421c-868a-b3a3ce7d3de5' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWR....'

HTTP Request

GET /v1/sddc-federation/tasks/4421185a-469b-421c-868a-b3a3ce7d3de5 HTTP/1.1
Content-Type: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 212

{
  "status" : "SUCCEEDED",
  "operation" : null,
  "taskId" : null,
  "remoteOperationTask" : null,
  "progressDetails" : null,
  "created" : null,
  "lastUpdated" : null,
  "errors" : null,
  "payload" : null
}

2.9.5. Get Multi Site Management Federation Details

Prerequisites

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation' -i -X GET \
    -H 'Authorization: Bearer etYWR....'

HTTP Request

GET /v1/sddc-federation HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 3160

[ {
  "memberDetails" : {
    "role" : "CONTROLLER",
    "fqdn" : "sddc-manager-1.vrack.vsphere.local",
    "siteType" : "DATACENTER",
    "siteName" : "Palo Alto Epic Center",
    "country" : "USA",
    "state" : "California",
    "city" : "Palo Alto",
    "coordinate" : {
      "longitude" : -122.838,
      "latitude" : 37.286
    }
  },
  "memberInventory" : {
    "capacity" : {
      "summary" : {
        "domainCount" : 2,
        "aggregatedCapacity" : {
          "cpu" : {
            "free" : 58.795,
            "total" : 79.799,
            "used" : 21.00399,
            "unallocated" : 0.0,
            "unit" : "GHZ"
          },
          "hostCount" : {
            "total" : 10,
            "unallocated" : 4,
            "used" : 6
          },
          "datastores" : [ {
            "used" : 0.866,
            "datastoreName" : "vsanDatastore1",
            "datastoreType" : "VSAN",
            "freeSpace" : 5.839,
            "capacity" : 6.705,
            "unallocated" : 2.694,
            "unit" : "TB"
          }, {
            "used" : 0.866,
            "datastoreName" : "vsanDatastore2",
            "datastoreType" : "VSAN",
            "freeSpace" : 5.839,
            "capacity" : 6.705,
            "unallocated" : 2.694,
            "unit" : "TB"
          } ],
          "memory" : {
            "free" : 76.109,
            "total" : 375.0,
            "used" : 298.89,
            "unallocated" : 0.0,
            "unit" : "GB"
          }
        },
        "domainTypeInfo" : [ {
          "type" : null,
          "domainCount" : 2,
          "aggregatedCapacity" : {
            "cpu" : {
              "free" : 58.795,
              "total" : 79.799,
              "used" : 21.00399,
              "unallocated" : 0.0,
              "unit" : "GHZ"
            },
            "hostCount" : {
              "total" : 10,
              "unallocated" : 4,
              "used" : 6
            },
            "datastores" : [ {
              "used" : 0.866,
              "datastoreName" : "vsanDatastore1",
              "datastoreType" : "VSAN",
              "freeSpace" : 5.839,
              "capacity" : 6.705,
              "unallocated" : 2.694,
              "unit" : "TB"
            }, {
              "used" : 0.866,
              "datastoreName" : "vsanDatastore2",
              "datastoreType" : "VSAN",
              "freeSpace" : 5.839,
              "capacity" : 6.705,
              "unallocated" : 2.694,
              "unit" : "TB"
            } ],
            "memory" : {
              "free" : 76.109,
              "total" : 375.0,
              "used" : 298.89,
              "unallocated" : 0.0,
              "unit" : "GB"
            }
          }
        } ],
        "domainInfo" : null
      }
    },
    "inventoryInfo" : null,
    "softwareInfo" : {
      "pendingUpdates" : 1
    },
    "creationTime" : null
  },
  "memberLiveness" : {
    "livelinessCode" : "GREEN",
    "livelinessDetails" : [ "The vcf site Palo Alto Epic Centeris live" ]
  },
  "memberHealth" : {
    "healthCode" : "GREEN",
    "healthDetails" : [ "Category: CPU, usage: 60.0, and it is normal." ]
  }
} ]

This API can be used to get list of all VCF instances in the federation with details.
* VCF instance details
* VCF instance inventory
* VCF instance liveness
* VCF instance health

Related APIs

2.9.6. Get Members

Get the details of the members.

Prerequisites

Federation must be created.

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation/members' -i -X GET \
    -H 'Authorization: Bearer etYWR....'

HTTP Request

GET /v1/sddc-federation/members HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 426

{
  "memberDetail" : {
    "role" : "CONTROLLER",
    "fqdn" : "sddc-manager-1.vrack.vsphere.local",
    "siteType" : "DATACENTER",
    "siteName" : "Palo Alto Epic Center",
    "country" : "USA",
    "state" : "California",
    "city" : "Palo Alto",
    "coordinate" : {
      "longitude" : -122.838,
      "latitude" : 37.286
    }
  },
  "federationName" : "New Federation",
  "permissions" : [ "JOIN" ],
  "error" : null
}

Related APIs

2.9.7. Leave from the federation

Leaving a federation removes the Multi-Instance Management view from your SDDC Manager dashboard.

If you are a controller, you can leave a federation only if there is at least one more controller in the federation.
If you are the only controller member in a federation, you must dismantle a federation instead of leaving it.

Prerequisites

The following data is required
- ID (FQDN) of the member to be deleted, specified as a path variable.
  - If member ID is equal to the FQDN of invoking SDDC Manager, it is treated as leave.
  - Otherwise, it is treated as evicting the member (specified by ID) by invoking SDDC Manager. In this case the invoking SDDC Manager must be a Controller.
The Request param 'force' is optional
- If force is set to true, the leaving member will not contact controller, but shut down local system.
  Default value for force is false, in which case leaving member will issue REST request to a remote controller asking for leave.
If the invoking SDDC Manager is the only member in the federation, do not use leave, but teardown instead.

Steps

If ID is the same as FQDN of invoking SDDC Manager and force is false
- This member will issue rest request to a remote controller asking for leave, if the remote response
  is successful, it will then shut down its local system. Persistent store will be archived and cleaned up.
If ID is the same as FQDN of invoking SDDC Manager and force is true
- This member will not contact remote controller but shut down its local system directly. Persistent store will be archived and cleaned up.
If ID is the different from FQDN of invoking SDDC Manager
- The invoking SDDC Manager will evict the member (specified by ID) from federation and ask the evictee to clean its system.
  force variable in this case doesn’t matter.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation/members/sddcmgr-newyork.msm.local' -i -X DELETE \
    -H 'Authorization: Bearer etYWR....'

HTTP Request

DELETE /v1/sddc-federation/members/sddcmgr-newyork.msm.local HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

HTTP Response

HTTP/1.1 202 Accepted
Content-Disposition: inline;filename=f.txt
Content-Type: application/json
Content-Length: 246

{
  "status" : "SUCCEEDED",
  "operation" : null,
  "taskId" : "592d8232-a852-4af5-8dbd-ce17e1787fac",
  "remoteOperationTask" : null,
  "progressDetails" : null,
  "created" : null,
  "lastUpdated" : null,
  "errors" : null,
  "payload" : null
}

To Force remove the member use following:

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation/members/sddcmgr-newyork.msm.local?force=true' -i -X DELETE \
    -H 'Authorization: Bearer etYWR....'

HTTP Request

DELETE /v1/sddc-federation/members/sddcmgr-newyork.msm.local?force=true HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

HTTP Response

HTTP/1.1 202 Accepted
Content-Disposition: inline;filename=f.txt
Content-Type: application/json
Content-Length: 246

{
  "status" : "SUCCEEDED",
  "operation" : null,
  "taskId" : "d4abc487-e49f-4e06-aa3e-500d90459aef",
  "remoteOperationTask" : null,
  "progressDetails" : null,
  "created" : null,
  "lastUpdated" : null,
  "errors" : null,
  "payload" : null
}

Related APIs

Teardown a federation

2.9.8. Tear Down Federation

You can dismantle a federation if you are the last controller member in the federation.
Only members with the controller role can dismantle a federation.

Prerequisites

No request body is needed.
Invoking SDDC Manager must be of Controller role, and the only one in the federation.

Steps

When Teardown API is invoked, it does the following
- All fabric services previously set up will be shut down.
- Persistent store will be archived and cleaned up.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-federation' -i -X DELETE \
    -H 'Authorization: Bearer etYWR....'

HTTP Request

DELETE /v1/sddc-federation HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWR....

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Content-Length: 246

{
  "status" : "SUCCEEDED",
  "operation" : null,
  "taskId" : "39f2d3a4-db3a-4d2a-8515-f62ccad34726",
  "remoteOperationTask" : null,
  "progressDetails" : null,
  "created" : null,
  "lastUpdated" : null,
  "errors" : null,
  "payload" : null
}

2.10. AVNs

2.10.1. Get the AVNs

This API is used to fetch all configured AVNs

Prerequisites

None

Steps

Invoke the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/avns' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/avns HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 330

[ {
  "id" : "vcf-avn-regiona",
  "name" : "vcf-avn-regiona",
  "regionType" : "REGION_A",
  "subnet" : "192.168.20.0",
  "subnetMask" : "255.255.255.0",
  "gateway" : "192.168.20.1",
  "mtu" : 9000,
  "portGroupName" : "vcf-avn-regiona-portGroup",
  "domainName" : "vmware.vcf.corp",
  "routerName" : "vcf-avn-regiona-udlr01"
} ]

Related APIs

Get the AVNs
Get the AVNs by RegionType

2.10.2. Get the AVNs by RegionType

This API is used to fetch all configured AVNs for a given region type

Prerequisites

The following data is required
- RegionType of the AVN

Steps

Invoke the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/avns?regionType=X_REGION' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/avns?regionType=X_REGION HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 330

[ {
  "id" : "vcf-avn-regionx",
  "name" : "vcf-avn-regionx",
  "regionType" : "X_REGION",
  "subnet" : "192.168.30.0",
  "subnetMask" : "255.255.255.0",
  "gateway" : "192.168.30.1",
  "mtu" : 9000,
  "portGroupName" : "vcf-avn-regionx-portGroup",
  "domainName" : "vmware.vcf.corp",
  "routerName" : "vcf-avn-regionx-udlr01"
} ]

Related APIs

Get the AVNs
Get the AVNs by RegionType

2.11. vRealize Suite Lifecycle Manager

2.11.1. vRealize Suite Lifecycle Manager Deployment

To deploy and manage the vRealize Suite products after the initial greenfield deploy of VMware Cloud Foundation, you must first deploy vRealize Suite Lifecycle Manager. To guarantee the success of the vRealize Suite Lifecycle Manager deployment operation, you should pre-validate the deployment input.

Prerequisites

The following data is required:
- Application Virtual Networks are configured
- Unique vRealize Suite Lifecycle Manager hostname and corresponding IP address from the X-Region Application Virtual Network
- vRealize Suite Lifecycle Manager API and root passwords
Additional prerequisites:
- The vRealize Suite Lifecycle Manager bundle needs to be downloaded and applied on the SDDC Manager
- Application Virtual Network should have connectivity to the management VLAN

Note

vRealize Suite Lifecycle Manager deployment is not available if vRealize Suite Lifecycle Manager is successfully deployed as only one instance of it is allowed in the system. In this case, calling the API will produce an error and the user will be provided with information about the allowed HTTP methods for the given endpoint. This information can be found in the "allow" field from the response headers.

Steps

Assemble the vRealize Suite Lifecycle Manager deployment input specification.

Tip	Refer to VrslcmDeploymentSpec

Trigger the vRealize Suite Lifecycle Manager deployment input specification validations. For help using the vRealize Suite Lifecycle Manager validation API refer to: Get the status of the validations for vRealize Lifecycle Manager deployment

Warning

The triggered validations return a response containing a validation report ID. With that ID, poll the vRealize Suite Lifecycle Manager validations API. While the validations are running, the "executionStatus" is "IN_PROGRESS". You should poll the API until the "executionStatus" is "COMPLETED".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vrslcms/validations/77c17ee9-7fa6-455f-ace6-602e43c76887' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/vrslcms/validations/77c17ee9-7fa6-455f-ace6-602e43c76887 HTTP/1.1
Content-Type: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 170

{
  "id" : "9b56b98b-ba62-42cb-9ac1-f65e2d20ff9c",
  "description" : "Validating vRealize Suite Lifecycle Manager input parameters",
  "executionStatus" : "IN_PROGRESS"
}

Once the validations are completed, you can get the overall result of the validations and a detailed list with all checks that have been done and the corresponding status of each check.
- In case of no errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
- In case of only warnings in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED_WITH_WARNINGS".
- In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Tip

The validation checks have two severity levels - warning and error. If a failed validation check is marked as an error, the issue must be resolved before proceeding with the deployment. If the issue is marked as a warning, you are advised to look at it and do the best to fix it. You could ignore it and proceed on your own risk without fixing it, but this might affect the deployment and make it fail at a later stage.
NOTE: Make changes to the input specification and re-validate using a new API invocation

Once there are no errors and warnings in the validation response, you can proceed with the vRealize Suite Lifecycle Manager deployment. Although the warnings are not forced to be resolved, you should give the best to resolve the uncovered issues by the validations.
Trigger the vRealize Suite Lifecycle Manager deployment. This will start a long-running task whose details can be obtained form the HTTP response.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vrslcms' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "networkSpec" : {
    "vlanId" : "45",
    "subnetMask" : "255.255.252.0",
    "gateway" : "10.0.1.250"
  },
  "fqdn" : "vrslcm.vrack.vsphere.local",
  "sshPassword" : "VMware123!",
  "apiPassword" : "VMware123!"
}'

HTTP Request

POST /v1/vrslcms HTTP/1.1
Content-Type: application/json
Content-Length: 218
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "networkSpec" : {
    "vlanId" : "45",
    "subnetMask" : "255.255.252.0",
    "gateway" : "10.0.1.250"
  },
  "fqdn" : "vrslcm.vrack.vsphere.local",
  "sshPassword" : "VMware123!",
  "apiPassword" : "VMware123!"
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/9b56b98b-ba62-42cb-9ac1-f65e2d20ff9c
Allow: GET
Content-Type: application/json
Content-Length: 131

{
  "id" : "9b56b98b-ba62-42cb-9ac1-f65e2d20ff9c",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2019-05-10T11:13:22.551Z"
}

Track the task status using the "id" from the previous response. The GET URL is set in the header response and can be used directly. Refer to: Get a Task.
- If the "status" is "IN_PROGRESS", the task is still in progress.
- If the "status" is "SUCCESSFUL", the task is completed successfully.
- If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

If the workflow fails after trying to restart the task, perform the vRealize Suite Lifecycle Manager rollback

Tip	Refer to: vRealize Suite Lifecycle Manager Rollback.

2.11.2. vRealize Suite Lifecycle Manager Rollback

When vRealize Suite Lifecycle Manager deployment fails, you can perform rollback to get the environment in a clean state and start a fresh vRealize Suite Lifecycle Manager deployment.

Prerequisites

Failed vRealize Suite Lifecycle Manager deployment operation.

Note

vRealize Suite Lifecycle Manager rollback is not available if vRealize Suite Lifecycle Manager is successfully deployed. In this case, calling the API will produce an error and the user will be provided with information about the allowed HTTP methods for the given endpoint. This information can be found in the "allow" field from the response headers.

Steps

Trigger the vRealize Suite Lifecycle Manager rollback.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vrslcm' -i -X DELETE \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

DELETE /v1/vrslcm HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/9b56b98b-ba62-42cb-9ac1-f65e2d20ff9c
Content-Type: application/json
Content-Length: 131

{
  "id" : "9b56b98b-ba62-42cb-9ac1-f65e2d20ff9c",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2019-05-10T11:13:22.551Z"
}

Track the task status using the "id" from the previous response. The GET URL is set in the header response and can be used directly.

Tip	Refer to: Get a Task.

If the "status" is "IN_PROGRESS", the task is still in progress.
If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

2.11.3. vRealize Suite Lifecycle Manager Redeployment

If vRealize Suite Lifecycle Manager becomes corrupted or if you wish to get a fresh vRealize Suite Lifecycle Manager without losing the environment information stored, you can redeploy it.

Prerequisites

vRealize Suite Lifecycle Manager in active state in VMware Cloud Foundation inventory

Note

As part of the redeployment, all of the vRealize Suite Lifecycle Manager environments created by SDDC Manager will be imported into the new vRealize Suite Lifecycle Manager VM. However, all of the configurations/environments created manually through the vRealize Suite Lifecycle Manager User interface will be lost.

Steps

Trigger the vRealize Suite Lifecycle Manager redeploy.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vrslcm' -i -X PATCH \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

PATCH /v1/vrslcm HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/9b56b98b-ba62-42cb-9ac1-f65e2d20ff9c
Content-Type: application/json
Content-Length: 131

{
  "id" : "9b56b98b-ba62-42cb-9ac1-f65e2d20ff9c",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2019-05-10T11:13:22.551Z"
}

Track the task status using the "id" from the previous response. The GET URL is set in the header response and can be used directly.

Tip	Refer to: Get a Task.

If the "status" is "IN_PROGRESS", the task is still in progress.
If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

Once the vRealize Suite Lifecycle Manager redeployment succeeds, you can use it to deploy and manage the vRealize Suite products.

2.12. Backup and Restore

Back up and restore solution is provided to backup SDDC manager and configure NSX manager backup.

2.12.1. Configure backup of SDDC manager and NSX manager

It is essential to review the basic principles in a file-based solution for backup. In such a solution, the state of a product is periodically exported to a file that is stored in a domain different than the one where the product is running. If the product needs to be restored, the OVA is re-deployed and a selected backup-file is used to restore the state.

NSX Manager files are backed up by default in the SDDC Manager VM which also has to be backed up. You can configure an external SFTP server as a backup location which is the recommended solution. NSX Manager is backed up every 1 hour

This section provides the steps to configure NSX backup location and the SDDC Manager backup location to an external SFTP server along with encryption configuration for both SDDC Manager and NSX Manager backup.

Backup of SDDC manager can be scheduled by setting the schedule for SDDC Manager in the configuration.

Prerequisites

The following data is required
- Encryption
  - Twelve or more characters.
  - At least one upper-case letter.
  - At least two digits.
  - At least one special character.

Note	SDDC Manager does not store previously-used passphrases. You must store the passphrase in a secure location separate from the backup files and from the Cloud Foundation environment you are protecting.

FTP server details to save the backup file :
- IP of the server
- port
- protocol, which is SFTP
- username
- password
- ssh fingerprint
- directory path to save the backup file
SDDC manager schedule details :
- Frequency of the schedule
- Schedule details
The user credentials should have the role of an ADMIN

Tip	To get fingerprint execute the below command

ssh-keygen -lf <(ssh-keyscan -t ssh-rsa -p <port-number> <server-IP-address> 2>/dev/null)

Note	Fingerprint should be SHA-256 RSA key.

Steps

Trigger the task using the valid input specification.

Note	To trigger the API, the user should have a role of an ADMIN in VCF.

Note	Resource Type allowed for scheduling backup is SDDC_MANAGER.

Note	Only absolute path is accepted for directory path

Note	Scheduling frequency WEEKLY takes the fields daysOfTheWeek, hoursOfTheDay and minuteOfTheHour . Scheduling frequency HOURLY takes the fields hoursOfTheDay and minuteOfTheHour .

Tip	Refer to Security section to set the role as ADMIN for the user.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/backup-configuration' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "encryption" : {
    "passphrase" : "VMwareBackup@1"
  },
  "backupLocations" : [ {
    "server" : "10.92.33.23",
    "port" : 22,
    "protocol" : "SFTP",
    "username" : "backup",
    "password" : "FTPServer@1",
    "directoryPath" : "/vmware/backup",
    "sshFingerprint" : "SHA256:w2NgXhG2XXXXXXXX"
  } ],
  "backupSchedules" : [ {
    "frequency" : "WEEKLY",
    "daysOfWeek" : [ "SUNDAY", "THURSDAY" ],
    "hourOfDay" : 12,
    "minuteOfHour" : 34
  } ]
}'

Request Body

PUT /v1/system/backup-configuration HTTP/1.1
Content-Type: application/json
Content-Length: 467
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "encryption" : {
    "passphrase" : "VMwareBackup@1"
  },
  "backupLocations" : [ {
    "server" : "10.92.33.23",
    "port" : 22,
    "protocol" : "SFTP",
    "username" : "backup",
    "password" : "FTPServer@1",
    "directoryPath" : "/vmware/backup",
    "sshFingerprint" : "SHA256:w2NgXhG2XXXXXXXX"
  } ],
  "backupSchedules" : [ {
    "frequency" : "WEEKLY",
    "daysOfWeek" : [ "SUNDAY", "THURSDAY" ],
    "hourOfDay" : 12,
    "minuteOfHour" : 34
  } ]
}

Response Body

HTTP/1.1 202 Accepted
Location: /v1/tasks/604b691b-cc05-450c-8373-5610d91a7a73
Content-Type: application/json
Content-Length: 210

{
  "id" : "604b691b-cc05-450c-8373-5610d91a7a73",
  "name" : "Configure backup on VCF Components and register backup locations",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2019-05-10T11:13:22.551Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Note	The SFTP server credentials are saved before configuring any NSX managers. In case configuring the NSX manager failed, an attempt is still made to configure as many NSX managers as possible before failing the task.

Tip	Refer to: Retry a Task.

Related APIs

Get a Task
Retry a Task

2.12.2. Edit the Backup Configuration

Prerequisites

The following data is required
- The configuration which has to be edited (Backup location or Encryption or Backup schedules or all).
- User credentials with role as an ADMIN in VCF.

Note

In case you are editing the passphrase, you must store the passphrase in a secure location separate from the backup files and from the Cloud Foundation environment. The encryption passphrase is mapped to the backup file. Editing the passphrase will not update the configured passphrase for previously backed up file.

Note	In case you are editing the backup location, previously collected NSX backups must be manually migrated to the new location. All the parameters of backup location have to be given as input while editing the backup location.

Note	Editing backup configuration updates all the NSX manager’s backup configuration.

Steps

Invoke the API

Tip	To get the current backup configuration Refer to: Get the Backup Configuration

The example shown is to edit only the backup location whereas encryption and backup schedule is unchanged.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/backup-configuration' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "backupLocations" : [ {
    "server" : "10.92.33.24",
    "port" : 22,
    "protocol" : "SFTP",
    "username" : "backup",
    "password" : "FTPServer@2",
    "directoryPath" : "/vmware/backup",
    "sshFingerprint" : "SHA256:w2NgXhG2XXXXXXXX"
  } ]
}'

Request Body

PATCH /v1/system/backup-configuration HTTP/1.1
Content-Type: application/json
Content-Length: 255
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "backupLocations" : [ {
    "server" : "10.92.33.24",
    "port" : 22,
    "protocol" : "SFTP",
    "username" : "backup",
    "password" : "FTPServer@2",
    "directoryPath" : "/vmware/backup",
    "sshFingerprint" : "SHA256:w2NgXhG2XXXXXXXX"
  } ]
}

Response Body

HTTP/1.1 202 Accepted
Location: /v1/tasks/2c78d42b-1cd9-4ed1-93a6-fc156c25232c
Content-Type: application/json
Content-Length: 210

{
  "id" : "2c78d42b-1cd9-4ed1-93a6-fc156c25232c",
  "name" : "Configure backup on VCF Components and register backup locations",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2019-05-10T11:13:22.551Z"
}

The example shown is to edit only the backup schedule whereas backup location and encryption is unchanged.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/backup-configuration' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "backupSchedules" : [ {
    "resourceType" : "SDDC_MANAGER",
    "frequency" : "WEEKLY",
    "daysOfWeek" : [ "MONDAY" ],
    "hourOfDay" : 12,
    "minuteOfHour" : 23
  } ]
}'

Request Body

PATCH /v1/system/backup-configuration HTTP/1.1
Content-Type: application/json
Content-Length: 179
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "backupSchedules" : [ {
    "resourceType" : "SDDC_MANAGER",
    "frequency" : "WEEKLY",
    "daysOfWeek" : [ "MONDAY" ],
    "hourOfDay" : 12,
    "minuteOfHour" : 23
  } ]
}

Response Body

HTTP/1.1 202 Accepted
Location: /v1/tasks/f5b69afd-b416-46bb-92eb-80f116611c25
Content-Type: application/json
Content-Length: 209

{
  "id" : "f5b69afd-b416-46bb-92eb-80f116611c25",
  "name" : "Configure backup on VCF Components and register backup schedule",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2019-05-10T11:13:22.551Z"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

2.12.3. Get the Backup Configuration

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/backup-configuration' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/system/backup-configuration HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 225

{
  "backupLocations" : [ {
    "server" : "10.92.33.24",
    "port" : 22,
    "protocol" : "SFTP",
    "username" : "backup",
    "directoryPath" : "/vmware/backup"
  } ],
  "backupSchedules" : [ ],
  "isConfigured" : true
}

Note	"isConfigured" notifies if the backup has been configured.

Note	Encryption details which was configured is not returned due to security reasons.

2.12.4. Initiate Backup of SDDC Manager

Back up the SDDC Manager VM regularly to avoid downtime and data loss in case of a system failure. If the SDDC Manager VM does fail, you can restore VM to the last backup

In case you need to restore the SDDC Manager VM, you select the backup file to restore and download the appropriate OVA file. You can deploy this OVA either through vCenter Server or the OVF tool. You then load the state on the newly deployed SDDC Manager VM.

Prerequisites

The following action needs to be performed
- Backup must be configured
Computer that runs the backup automation script (or where you manually run the APIs). This computer may also be used to coordinate and support a restore operation. It can also host the FTP server required to protect the NSX Manager instances.
Reliable and secure storage volume on which the backup files are stored. The computer and the storage need to be in a different fault domain.

Note	Only resourceType:SDDC_MANAGER is supported currently.

Tip	Refer to: Configure backup of SDDC manager and NSX manager

Steps

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/backups/tasks' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "elements" : [ {
    "resourceType" : "SDDC_MANAGER"
  } ]
}'

HTTP Request

POST /v1/backups/tasks HTTP/1.1
Content-Type: application/json
Content-Length: 64
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "elements" : [ {
    "resourceType" : "SDDC_MANAGER"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: 3b48ffc5-fafd-46e5-88ee-ce3ccc4d7a93
Content-Type: application/json
Content-Length: 252

{
  "id" : "3b48ffc5-fafd-46e5-88ee-ce3ccc4d7a93",
  "name" : "SDDC Manager Backup Operation",
  "status" : "IN_PROGRESS",
  "resources" : [ {
    "type" : "BACKUP",
    "name" : "vcf-backup-sddc-manager-vrack-vsphere-local-2019-07-29-12-02-46"
  } ]
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

The backup files are saved in the /nfs/vmware/vcf/nfs-mount/sddc-manager-backup directory on the SDDC Manager VM.
In this example, the full filename of the backup file will be vcf-backup-sddc-manager-vrack-vsphere-local-2019-07-29-12-02-46.tar.gz

Tip	To inspect the contents of a backup tar file, use the decrypt command described in Initiate Restore of SDDC Manager

Note	Make sure to copy the backup file to a known location along with the corresponding passphrases.

Related APIs

Get a Task
Retry a Task

2.12.5. Initiate Restore of SDDC Manager

In case of a failure, you can restore SDDC Manager from a saved backup.

Prerequisites

The following data is required
- Backup file name and location of the backup file
- Encryption passphrase used to encrypt the backup file

Note	Only resourceType:SDDC_MANAGER is supported currently

Steps

Power off the original SDDC Manager VM.
Rename the VM to something like sddc-manager-original using the management domain vCenter Server.
Identify the backup file to be used for the restore operation.

Tip	In most cases, you should select the most recently taken backup.

The backup file contains sensitive data about your Cloud Foundation instance, including passwords in plain text. It is recommended you control access to the decrypted files and securely delete them when you are done with the restore operation.
Using a computer that has access to the secure secondary storage where the backup files are stored, navigate to the backup file and extract the contents of the encrypted tar file using the following command.

openssl enc -d -aes256 -in filename-of-selected-file | tar -xz

At the prompt, enter the passphrase that you configured before backing up SDDC Manager.
In order to restore SDDC Manager, you need to deploy the SDDC Manager OVA.
The link to download the OVA is found in the metadata.json file in the backup file.
Download the SDDC Manager OVA from the link provided.
Deploy SDDC Manager VM from vCenter Server or with the OVF Tool.
- Deploy SDDC Manager VM from vCenter server
  - Log in to the management domain vCenter Server using a web browser that is running on a system that has access to the downloaded SDDC Manager OVA.
  - In the vSphere Client, expand SDDC-Datacenter > SDDC-Cluster1.
  - Right-click on Mgmt-ResourcePool and select Deploy OVF Template.
  - The Deploy OVF Template wizard appears.
  - Use the local file option and choose the downloaded SDDC Manager OVA
  - Specify the VM name as sddc-manager.
  - Select the location of the SDDC Manager VM as SDDC-Datacenter > Management VMs and click Next.
  - Specify the compute resource destination. See the metadata.json file for the name of the pool and click Next.
  - Verify the template details and click Next.
  - Read the license terms and click the checkbox at the bottom of the page to accept the license agreements.
  - On the storage page, keep the vSAN datastore selection. The datastore name is in the metadata.json file and click Next.
  - On the networks page:
    
    Do not change the default setting for Source Network.
    
    In Destination Network, select the port group that is listed in the metadata.json file.
    
    Do not change the default setting for IP allocation and IP protocol.
  - Click Next.
  - For the fields on the Customize template page, refer to the metadata.json file. Note the following:
    
    Specify the backup user password from the security_password_vault.jsonfile.
    
    For the other root, vcf, and admin user accounts, you can re-use the passwords for the original
    ***SDDC Manager or assign new ones. For password considerations, refer to the About the
    
    Deployment Parameter Sheet section in the VMware Cloud Foundation Architecture and
    
    Deployment Guide.
    
    Leave the DNS and NTP fields empty
    
    Ignore the Brownfield Settings section.
  - Click Next.
  - Review the OVF details and click Finish. The OVF deployment begins. You can view the details in the Tasks pane.
  - Power on the newly deployed SDDC Manager VM and wait for the vCenter Server UI to report its IP address has been assigned.
  - SSH in to the SDDC Manager and log in as the vcf user.
- Deploy SDDC Manager VM with the OVF tool
  - Install the OVF tool on a system that has access to the SDDC Manager OVA that you downloaded.
  - Prerequisites
    
    Download the OVF tool and install it on a system that has access to the SDDC Manager OVA that you downloaded
    
    Retrieve the DNS name or IP address of a host from the management domain.
    
    Log into the management domain vCenter Server
    
    navigate to the management domain cluster
    
    select an active host that is not reporting any vSAN errors
    
    Retrieve the rRoot password for the selected host. Search for the host’s DNS name in the security_password_vault.json, which displays the root password.
  - Run the following command with information from the metadata.json file.
    
    ovftool --noSSLVerify --skipManifestCheck --powerOn --diskMode=thin --acceptAllEulas -- allowExtraConfig --ipProtocol=IPv4 --ipAllocationPolicy=fixedPolicy --datastore=datastoreName -- name=sddc-manager --X:injectOvfEnv --X:waitForIp --prop:ROOT_PASSWORD=Password -- prop:VCF_PASSWORD=Password --prop:BASIC_AUTH_PASSWORD=Password --prop:BACKUP_PASSWORD=Password --prop:vami.gateway.SDDC-Manager=gatewayIP --prop:vami.ip0.SDDC-Manager=SDDC_Manager_IP -- prop:vami.netmask0.SDDC-Manager=networkMask --prop:vami.hostname=hostName -- prop:vami.searchpath.SDDC-Manager=searchPath --prop:vami.domain.SDDC-Manager=domain -- network=portGroupName --X:logFile=./ovftool.log --X:logLevel=verbose OVA_filename vi:// root:password_for_selected_host>@host_DNS_name_or_ IP
  OUTPUT: Opening OVA source: VCF-SDDC-Manager-Appliance-3.7.2.0-13774914_OVF10.ova The manifest does not validate Opening VI target: vi://[email protected]:443/ Deploying to VI: vi://[email protected]:443/ Transfer Completed Powering on VM: sddc-manager Task Completed Received IP address: 10.0.0.4 Completed successfully
  - Navigate to the management domain vCenter Server.
  - Move the sddc-manager VM into the Management VM folder.
  - Move the sddc-manager VM into the Management Resource Pool. The name of this pool is available in the metadata.json file.
  - To confirm that SDDC Manager has been deployed correctly, ssh in to the VM as the vcf user.
Take a snapshot of the SDDC Manager VM.
Copy the encrypted backup file to the /tmp directory on the SDDC Manager VM.
Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/restores/tasks' -i -u 'admin:VMwareInfra@1' -X POST \
    -H 'Content-Type: application/json' \
    -d '{
  "elements" : [ {
    "resourceType" : "SDDC_MANAGER"
  } ],
  "backupFile" : "/tmp/backup.tar.gz",
  "encryption" : {
    "passphrase" : "VMwareBackup@1"
  }
}'

HTTP Request

POST /v1/restores/tasks HTTP/1.1
Content-Type: application/json
Content-Length: 163
Host: sddc-manager.sfo01.rainpole.local
Authorization: Basic YWRtaW46Vk13YXJlSW5mcmFAMQ==

{
  "elements" : [ {
    "resourceType" : "SDDC_MANAGER"
  } ],
  "backupFile" : "/tmp/backup.tar.gz",
  "encryption" : {
    "passphrase" : "VMwareBackup@1"
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Location: 4b5d3731-899c-4ef5-987a-859e5abe6a60
Content-Type: application/json
Content-Length: 79

{
  "id" : "4b5d3731-899c-4ef5-987a-859e5abe6a60",
  "status" : "IN_PROGRESS"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED" , perform the following steps to retry.
- Copy the contents of /var/log/vmware/vcf/sddc-support/ to a filesystem that is external to SDDC Manager. This preserves the restore log file.
- Revert the SDDC Manager VM to the snapshot taken in step 12.
- Take a new snapshot.
- Perform steps 13 - 16.
- If this attempt fails, contact VSDDC ManagerMware Support.

Verify SDDC Manager VM operations after restore:
- SSH in to the SDDC Manager as the vcf user.
- Run the following command:
  sudo /opt/vmware/sddc-support/sos --health-check
- When prompted, enter the vcf user password.
- A green status indicates that the health is normal, yellow provides a warning that attention might be required, and red indicates that the component needs immediate attention. Possible reasons for yellow or red status are that you used an SDDC Manager backup with unresolved workflows, you used a backup taken before a workflow was completed successfully, you restored other products in addition to SDDC Manager, or some components are not operational. Call VMware Support if you need help with resolving the yellow or red status
- If the status was green,
  - Download the applicable install and upgrade bundles.
  - Download the upgrade bundles applicable to your environment.

Related APIs

Get a Task
Retry a Task

2.13. Depot Settings

2.13.1. Get Depot Settings

Online:

Get Depot Settings API is used to retrieve the existing My VMware and Dell EMC Support Accounts' information.

Offline:

Get Depot Settings API returns account information.

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/settings/depot' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/system/settings/depot HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 364

{
  "vmwareAccount" : {
    "username" : "acmeuser",
    "password" : "acmepassword",
    "status" : "DEPOT_CONNECTION_SUCCESSFUL",
    "message" : "Depot Status: Success"
  },
  "dellEmcSupportAccount" : {
    "username" : "vxrailUser",
    "password" : "vxrailPassword",
    "status" : "DEPOT_CONNECTION_SUCCESSFUL",
    "message" : "Depot Status: Success"
  }
}

2.13.2. Update Depot Settings

Online:

Update Depot Settings API is used to update SDDC Manager with the My VMware and Dell EMC Support Account. This account is used for Downloading Upgrade/Install Bundles(Please refer to Update Bundle for Downloading).

Offline:

Use the Bundle Transfer Utility tool(Please refer to the VMware Cloud Foundation documentation for more information) to manually download the bundles from the depot on your local computer and then copy them to SDDC Manager. Once the bundles are available in the SDDC Manager. Use the Upload a Bundle API to upload it to SDDC Manager.

Prerequisites

The following data is required for updating My VMware Account information:

Username of My VMware Account.
Password of My VMware Account.

The following data is required for updating Dell EMC Support Account information:

Username of Dell EMC Support Account.
Password of Dell EMC Support Account.

Tip	Refer to: DepotSettings and DepotAccount.

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/settings/depot' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "vmwareAccount" : {
    "username" : "acmeuser",
    "password" : "acmepassword"
  },
  "dellEmcSupportAccount" : {
    "username" : "dellEmcUser",
    "password" : "dellEmcPassword"
  }
}'

HTTP Request

PUT /v1/system/settings/depot HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 192
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "vmwareAccount" : {
    "username" : "acmeuser",
    "password" : "acmepassword"
  },
  "dellEmcSupportAccount" : {
    "username" : "dellEmcUser",
    "password" : "dellEmcPassword"
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Content-Length: 364

{
  "vmwareAccount" : {
    "username" : "acmeuser",
    "password" : "acmepassword",
    "status" : "DEPOT_CONNECTION_SUCCESSFUL",
    "message" : "Depot Status: Success"
  },
  "dellEmcSupportAccount" : {
    "username" : "vxrailUser",
    "password" : "vxrailPassword",
    "status" : "DEPOT_CONNECTION_SUCCESSFUL",
    "message" : "Depot Status: Success"
  }
}

2.14. Prechecks

2.14.1. Perform System Precheck

Precheck System API is used to perform the required system level health checks and upgrade pre-checks for an upgrade to be successful. Make sure to run these checks before performing any upgrade.

Tip	Refer to: Get the Upgradables to query for the list of upgradables which can be used for performing Domain, Cluster level checks.

Prerequisites

The following data is required:

Resource ID. Ex: Domain ID, Cluster ID.
Resource Type. Ex: DOMAIN, CLUSTER.

Tip	Refer to: PrecheckSpec and Resource.

Note	Supported Resource Type’s are DOMAIN, CLUSTER. For Cluster level checks, the Cluster ID’s can be retrieved based on the Host’s that are available for upgrade, Refer to: Get the Hosts and Get the Clusters API’s.

Steps

Invoke the API. This API returns a precheck task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/prechecks' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "resources" : [ {
    "resourceId" : "bbd38966-8537-46f1-9a54-06fbfe7079c6",
    "type" : "DOMAIN"
  } ]
}'

HTTP Request

POST /v1/system/prechecks HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 110
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "resources" : [ {
    "resourceId" : "bbd38966-8537-46f1-9a54-06fbfe7079c6",
    "type" : "DOMAIN"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/system/prechecks/tasks/a595ed23-ec8f-42d3-88fb-1dcfe830337e
Content-Length: 667

{
  "id" : "a595ed23-ec8f-42d3-88fb-1dcfe830337e",
  "name" : "Precheck Task",
  "type" : "PRECHECK",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:18.684Z",
  "completionTimestamp" : "2020-04-10T06:25:18.684Z",
  "subTasks" : [ {
    "name" : "Upgrade - DOMAIN ",
    "description" : "Upgrade - DOMAIN ",
    "status" : "PENDING",
    "creationTimestamp" : "2020-04-10T06:25:18.684Z",
    "resources" : [ {
      "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
      "type" : "DOMAIN"
    } ]
  } ],
  "resources" : [ {
    "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
    "type" : "DOMAIN"
  } ],
  "isCancellable" : false
}

Poll the status of the task using the precheck task API with the ID from the response of the previous API.

Tip	Refer to: Get System Precheck Task.

2.14.2. Get System Precheck Task

Get Precheck Task by ID API is used to retrieve a precheck task.

Prerequisites

The following data is required
- ID of the precheck task

Steps

Invoke the API. This API returns a precheck task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/prechecks/tasks/a595ed23-ec8f-42d3-88fb-1dcfe830337e' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 667

{
  "id" : "a595ed23-ec8f-42d3-88fb-1dcfe830337e",
  "name" : "Precheck Task",
  "type" : "PRECHECK",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:19.144Z",
  "completionTimestamp" : "2020-04-10T06:25:19.144Z",
  "subTasks" : [ {
    "name" : "Upgrade - DOMAIN ",
    "description" : "Upgrade - DOMAIN ",
    "status" : "PENDING",
    "creationTimestamp" : "2020-04-10T06:25:19.145Z",
    "resources" : [ {
      "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
      "type" : "DOMAIN"
    } ]
  } ],
  "resources" : [ {
    "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
    "type" : "DOMAIN"
  } ],
  "isCancellable" : false
}

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 667

{
  "id" : "a595ed23-ec8f-42d3-88fb-1dcfe830337e",
  "name" : "Precheck Task",
  "type" : "PRECHECK",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:19.144Z",
  "completionTimestamp" : "2020-04-10T06:25:19.144Z",
  "subTasks" : [ {
    "name" : "Upgrade - DOMAIN ",
    "description" : "Upgrade - DOMAIN ",
    "status" : "PENDING",
    "creationTimestamp" : "2020-04-10T06:25:19.145Z",
    "resources" : [ {
      "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
      "type" : "DOMAIN"
    } ]
  } ],
  "resources" : [ {
    "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
    "type" : "DOMAIN"
  } ],
  "isCancellable" : false
}

2.15. Bundles

2.15.1. Upload a Bundle

Offline:

Upload a Bundle API is used to upload Bundles which are downloaded using Bundle Transfer Utility tool.

Tip	Please refer to the VMware Cloud Foundation documentation for more information on the Bundle Transfer Utility tool.

Prerequisites

The following data is required:

Bundle file path.
Bundle manifest file path.
Bundle manifest signature file path.

Tip	Refer to: BundleUploadSpec.

Steps

Invoke the API. This API returns a task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/bundles' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "bundleFilePath" : "/home/vcf/bundles/bundle-11237.tar",
  "manifestFilePath" : "/home/vcf/bundles/bundle-11237.manifest",
  "signatureFilePath" : "/home/vcf/bundles/bundle-11237.manifest.sig"
}'

HTTP Request

POST /v1/bundles HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 198
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "bundleFilePath" : "/home/vcf/bundles/bundle-11237.tar",
  "manifestFilePath" : "/home/vcf/bundles/bundle-11237.manifest",
  "signatureFilePath" : "/home/vcf/bundles/bundle-11237.manifest.sig"
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/fdd90582-cc96-4752-b670-b36110802d5b
Content-Length: 366

{
  "id" : "fdd90582-cc96-4752-b670-b36110802d5b",
  "name" : "Upload BUNDLE - PSC:6.7.0-13010631 VCENTER:6.7.0-13010631",
  "type" : "BUNDLE_UPLOAD",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:20.055Z",
  "resources" : [ {
    "resourceId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
    "type" : "BUNDLE"
  } ],
  "isCancellable" : false
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task.

2.15.2. Upload a Partner Bundle

Offline:

Upload a Bundle API is used to upload partner Bundles.

Tip	Please refer to the VMware Cloud Foundation documentation for more information.

Prerequisites

The following data is required:

Partner bundle version.
Partner bundle metadata file path.
Software compatibility sets file path.

Tip	Refer to: BundleUploadSpec.

Steps

Invoke the API. This API returns a task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/bundles' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "compatibilitySetsFilePath" : "/home/vcf/bundles/softwareCompatibilitySets.json",
  "partnerExtensionSpec" : {
    "partnerBundleVersion" : "4.7.410-26262335",
    "partnerBundleMetadataFilePath" : "/home/vcf/bundles/partnerBundleMetadata.json"
  }
}'

HTTP Request

POST /v1/bundles HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 254
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "compatibilitySetsFilePath" : "/home/vcf/bundles/softwareCompatibilitySets.json",
  "partnerExtensionSpec" : {
    "partnerBundleVersion" : "4.7.410-26262335",
    "partnerBundleMetadataFilePath" : "/home/vcf/bundles/partnerBundleMetadata.json"
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/fdd90582-cc96-4752-b670-b36110802d5b
Content-Length: 346

{
  "id" : "fdd90582-cc96-4752-b670-b36110802d5b",
  "name" : "Upload BUNDLE - VXRAIL:6.7.0-13006603",
  "type" : "BUNDLE_UPLOAD",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:19.247Z",
  "resources" : [ {
    "resourceId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
    "type" : "BUNDLE"
  } ],
  "isCancellable" : false
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task.

2.15.3. Update Software compatibility sets

Offline:

Update software compatibility sets for Bundles API is used to update software compatibility sets for Bundles.

Tip	Please refer to the VMware Cloud Foundation documentation for more information.

Prerequisites

The following data is required:

Software compatibility sets file path.

Tip	Refer to: BundleUpdateSpec.

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/bundles/' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "compatibilitySetsFilePath" : "/home/vcf/bundles/softwareCompatibilitySets.json"
}'

HTTP Request

PATCH /v1/bundles/ HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 86
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "compatibilitySetsFilePath" : "/home/vcf/bundles/softwareCompatibilitySets.json"
}

HTTP Response

HTTP/1.1 202 Accepted

2.15.4. Get the Bundles

Get the Bundles API is used to get all the bundles.

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/bundles' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/bundles HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1840

{
  "elements" : [ {
    "id" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
    "type" : "VMWARE_SOFTWARE",
    "description" : "ESX update bundle -  13004448(67EP7)==>13010696 (vsphere67U2)",
    "version" : "253.0.0-111959",
    "severity" : null,
    "vendor" : "VMware",
    "releasedDate" : "2019-05-10T10:29:10.645Z",
    "isCumulative" : false,
    "isCompliant" : null,
    "sizeMB" : 453.0,
    "downloadStatus" : "SUCCESSFUL",
    "components" : [ {
      "description" : "ESX_HOST Update Bundle",
      "vendor" : "VMware",
      "releasedDate" : "2019-05-10T10:29:10.645Z",
      "toVersion" : "6.7.0-13006603",
      "fromVersion" : "6.7.0-13004448",
      "imageType" : "PATCH",
      "id" : "a65d9d83-88b9-475f-a2ba-ee5d9be34f8d",
      "type" : "HOST"
    } ]
  }, {
    "id" : "fc733693-6ec1-4959-8ed4-615f1ec93dd1",
    "type" : "VMWARE_SOFTWARE",
    "description" : "PSC-VC -67U2-Update bundle ( 11726888 ==> 13010631)",
    "version" : "253.0.0-111959",
    "severity" : null,
    "vendor" : "VMware",
    "releasedDate" : "2019-05-10T10:29:10.645Z",
    "isCumulative" : false,
    "isCompliant" : null,
    "sizeMB" : 453.0,
    "downloadStatus" : "SUCCESSFUL",
    "components" : [ {
      "description" : "PSC Update Bundle",
      "vendor" : "VMware",
      "releasedDate" : "2019-05-10T10:29:10.645Z",
      "toVersion" : "6.7.0-13010631",
      "fromVersion" : "6.7.0-11726888",
      "imageType" : "PATCH",
      "id" : "690cbe9e-241b-4086-bbf3-719b40499d6f",
      "type" : "PSC"
    }, {
      "description" : "VCENTER Update Bundle",
      "vendor" : "VMware",
      "releasedDate" : "2019-05-10T10:29:10.645Z",
      "toVersion" : "6.7.0-13010631",
      "fromVersion" : "6.7.0-11726888",
      "imageType" : "PATCH",
      "id" : "690cbe9e-241b-4086-bbf3-719b40499d6f",
      "type" : "VCENTER"
    } ]
  } ]
}

2.15.5. Get a Bundle

Get a Bundle API is used to get a specific bundle.

Prerequisites

The following data is required:
- ID of the Bundle

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/bundles/fd655436-ec3c-4f10-baed-3a3dde5a6bc6' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/bundles/fd655436-ec3c-4f10-baed-3a3dde5a6bc6 HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 997

{
  "id" : "fc733693-6ec1-4959-8ed4-615f1ec93dd1",
  "type" : "VMWARE_SOFTWARE",
  "description" : "PSC-VC -67U2-Update bundle ( 11726888 ==> 13010631)",
  "version" : "253.0.0-111959",
  "severity" : null,
  "vendor" : "VMware",
  "releasedDate" : "2019-05-10T10:29:10.645Z",
  "isCumulative" : false,
  "isCompliant" : null,
  "sizeMB" : 453.0,
  "downloadStatus" : "SUCCESSFUL",
  "components" : [ {
    "description" : "PSC Update Bundle",
    "vendor" : "VMware",
    "releasedDate" : "2019-05-10T10:29:10.645Z",
    "toVersion" : "6.7.0-13010631",
    "fromVersion" : "6.7.0-11726888",
    "imageType" : "PATCH",
    "id" : "690cbe9e-241b-4086-bbf3-719b40499d6f",
    "type" : "PSC"
  }, {
    "description" : "VCENTER Update Bundle",
    "vendor" : "VMware",
    "releasedDate" : "2019-05-10T10:29:10.645Z",
    "toVersion" : "6.7.0-13010631",
    "fromVersion" : "6.7.0-11726888",
    "imageType" : "PATCH",
    "id" : "690cbe9e-241b-4086-bbf3-719b40499d6f",
    "type" : "VCENTER"
  } ]
}

2.15.6. Update Bundle for Downloading

Online:

Update a Bundle for downloading from depot API is used to Download Bundles from the depot.

Tip	Refer to: Update Depot Settings to configure My VMware and Dell EMC Support Account in SDDC Manager.

Prerequisites

The following data is required
- ID of the bundle to be downloaded.

Tip	Refer to: BundleUpdateSpec and BundleDownloadSpec.

Steps

Invoke the API. This API returns a task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/bundles/fd655436-ec3c-4f10-baed-3a3dde5a6bc6' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "bundleDownloadSpec" : {
    "downloadNow" : true
  }
}'

HTTP Request

PATCH /v1/bundles/fd655436-ec3c-4f10-baed-3a3dde5a6bc6 HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 59
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "bundleDownloadSpec" : {
    "downloadNow" : true
  }
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/a4c15be0-448a-446c-9a83-8df70c5ef035
Content-Length: 370

{
  "id" : "a4c15be0-448a-446c-9a83-8df70c5ef035",
  "name" : "Download BUNDLE - PSC:6.7.0-13010631 VCENTER:6.7.0-13010631",
  "type" : "BUNDLE_DOWNLOAD",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:18.916Z",
  "resources" : [ {
    "resourceId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
    "type" : "BUNDLE"
  } ],
  "isCancellable" : false
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task.

2.16. Upgradables

2.16.1. Get the Upgradables

Get the Upgradables API provides the list of upgradables in the system. Each upgradable provides information about the bundle, resource and its associated software components that can be prechecked and upgraded. The upgradables can be of different types ex: AVAILABLE, PENDING, SCHEDULED etc.

Note	The Get the Upgradables DOES NOT provide the unassigned hosts which can be upgraded. Refer to: Unassigned Host Upgrade.

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/upgradables' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/system/upgradables HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 369

{
  "elements" : [ {
    "bundleId" : "a7855372-bbf1-4db3-99b8-c4a0458d8317",
    "bundleType" : "VXRAIL",
    "resource" : {
      "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
      "type" : "DOMAIN"
    },
    "softwareComponents" : [ {
      "id" : "995a74bb-6b32-4bcb-868f-08ba9d379dfd",
      "type" : "VXRAIL"
    } ],
    "status" : "AVAILABLE"
  } ]
}

2.17. Version Aliases

2.17.1. Get Version Aliases

Get Version Alias Configuration API is used to get version alias configuration.

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/settings/version-aliases' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/system/settings/version-aliases HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 177

{
  "elements" : [ {
    "bundleComponentType" : "VCENTER",
    "versionAliases" : [ {
      "version" : "6.7.0-14765156",
      "aliases" : [ "6.7.0-14765268" ]
    } ]
  } ]
}

2.17.2. Update Version Aliases

Update Version Alias Configurations
* Update Version Alias Configurations API is used to update multiple version alias configurations.

Prerequisites

The following data is required
- Bundle component type
- One or more version aliases

Tip	Refer to: VersionAliasesForBundleComponentTypeSpec

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/settings/version-aliases' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "versionAliasesForBundleComponentTypes" : [ {
    "bundleComponentType" : "VCENTER",
    "versionAliases" : [ {
      "version" : "6.7.0-14765156",
      "aliases" : [ "6.7.0-14765268" ]
    } ]
  } ],
  "forceUpdate" : true
}'

HTTP Request

PUT /v1/system/settings/version-aliases HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 230
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "versionAliasesForBundleComponentTypes" : [ {
    "bundleComponentType" : "VCENTER",
    "versionAliases" : [ {
      "version" : "6.7.0-14765156",
      "aliases" : [ "6.7.0-14765268" ]
    } ]
  } ],
  "forceUpdate" : true
}

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 177

{
  "elements" : [ {
    "bundleComponentType" : "VCENTER",
    "versionAliases" : [ {
      "version" : "6.7.0-14765156",
      "aliases" : [ "6.7.0-14765268" ]
    } ]
  } ]
}

Update Version Alias Configuration
* Update Version Alias Configuration API is used to update a specific version alias configuration.

Prerequisites

The following data is required
- Bundle component type
- Version
- Alias specification

Tip	Refer to: AliasSpec

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/settings/version-aliases/VCENTER/6.7.0-14765156' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "aliases" : [ "6.7.0-14765268" ],
  "forceUpdate" : true
}'

HTTP Request

PUT /v1/system/settings/version-aliases/VCENTER/6.7.0-14765156 HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 62
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "aliases" : [ "6.7.0-14765268" ],
  "forceUpdate" : true
}

HTTP Response

HTTP/1.1 200 OK
Content-Disposition: inline;filename=f.txt
Content-Type: application/json
Content-Length: 177

{
  "elements" : [ {
    "bundleComponentType" : "VCENTER",
    "versionAliases" : [ {
      "version" : "6.7.0-14765156",
      "aliases" : [ "6.7.0-14765268" ]
    } ]
  } ]
}

2.17.3. Delete Version Aliases

Delete Version Aliases
* Delete Version Alias Configuration API is used to delete version alias configurations by bundle component type, version and alias version.

Prerequisites

The following data is required
- Bundle component type
- Bundle component version
- One or more alias versions to be removed

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/settings/version-aliases/VCENTER/6.7.0-14765156' -i -X DELETE \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '[ "6.7.0-14765268" ]'

HTTP Request

DELETE /v1/system/settings/version-aliases/VCENTER/6.7.0-14765156 HTTP/1.1
Content-Type: application/json
Content-Length: 20
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

[ "6.7.0-14765268" ]

HTTP Response

HTTP/1.1 204 No Content

Delete Version Alias by Type and Version
* Delete Version Alias Configuration API is used to delete a version alias configuration by bundle component type and version.

Prerequisites

The following data is required
- Bundle component type
- Bundle component version

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/settings/version-aliases/VCENTER/6.7.0-14765156' -i -X DELETE \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

DELETE /v1/system/settings/version-aliases/VCENTER/6.7.0-14765156 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 204 No Content

Delete Version Alias by Type
* Delete Version Alias for a bundle component type API is used to delete a version alias configuration by bundle component type.

Prerequisites

The following data is required
- Bundle component type

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/settings/version-aliases/VCENTER' -i -X DELETE \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

DELETE /v1/system/settings/version-aliases/VCENTER HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 204 No Content

2.18. Upgrades

2.18.1. Perform Upgrade

Perform Upgrade API is used to perform upgrades. Upgrades are sequential. So in order to upgrade to a release, your environment must be on the version before that release. Upgrades are applied on a workload domain basis. The management domain contains the core infrastructure, so you must upgrade the management domain before upgrading the other workload domains. You must upgrade all required components to keep your system in an optimum state.

Note	Performing upgrades are supported on VMware Cloud Foundation 3.5 BOM resources and above.

Domain Upgrade

Use the Get the Upgradables to query for the list of upgradables(bundle and resource details) which can be used for performing Domain upgrades.

Prerequisites

The following data is required:

Bundle ID.
Resource Type. Ex: DOMAIN.
One or more Resource upgrade specifications.
Each Resource upgrade specification should contain.
- Resource ID. Ex: Domain ID.
- Upgrade scheduled time or Upgrade now option.

Tip	Refer to: UpgradeSpec and ResourceUpgradeSpec.

Steps

Invoke the API. This API returns a task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/upgrades' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "bundleId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
  "resourceType" : "DOMAIN",
  "resourceUpgradeSpecs" : [ {
    "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
    "scheduledTimestamp" : "2020-04-10T06:25:17.471Z",
    "upgradeNow" : false
  } ]
}'

HTTP Request

POST /v1/upgrades HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 263
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "bundleId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
  "resourceType" : "DOMAIN",
  "resourceUpgradeSpecs" : [ {
    "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
    "scheduledTimestamp" : "2020-04-10T06:25:17.471Z",
    "upgradeNow" : false
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/fbf94ee3-dddd-49d4-b4b4-04a51fdf4fbb
Content-Length: 478

{
  "id" : "fbf94ee3-dddd-49d4-b4b4-04a51fdf4fbb",
  "name" : "Upgrade DOMAIN - [acme-domain] using BUNDLE - PSC:6.7.0-13010631 VCENTER:6.7.0-13010631",
  "type" : "UPGRADE",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:17.470Z",
  "resources" : [ {
    "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
    "type" : "DOMAIN"
  }, {
    "resourceId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
    "type" : "BUNDLE"
  } ],
  "isCancellable" : false
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task.

Cluster Upgrade

Use the Get the Upgradables to query for the list of upgradables(bundle and resource details) which can be used for performing Cluster level upgrades.

Note	For Cluster level upgrades, the Cluster ID’s can be retrieved based on the Host’s that are available for upgrade, Refer to: Get the Hosts and Get the Clusters API’s.

Prerequisites

The following data is required:

Bundle ID.
Resource Type. Ex: CLUSTER.
One or more Resource upgrade specifications.
Each Resource upgrade specification should contain.
- Resource ID. Ex: Cluster ID.
- Upgrade scheduled time or Upgrade now option.

Tip	Refer to: UpgradeSpec and ResourceUpgradeSpec.

Steps

Invoke the API. This API returns a task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/upgrades' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "bundleId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
  "resourceType" : "CLUSTER",
  "resourceUpgradeSpecs" : [ {
    "resourceId" : "fada8a63-4b07-4369-8c74-779cf993f41c",
    "scheduledTimestamp" : "2020-04-10T06:25:19.716Z",
    "upgradeNow" : false
  } ]
}'

HTTP Request

POST /v1/upgrades HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 264
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "bundleId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
  "resourceType" : "CLUSTER",
  "resourceUpgradeSpecs" : [ {
    "resourceId" : "fada8a63-4b07-4369-8c74-779cf993f41c",
    "scheduledTimestamp" : "2020-04-10T06:25:19.716Z",
    "upgradeNow" : false
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/fbf94ee3-dddd-49d4-b4b4-04a51fdf4fbb
Content-Length: 456

{
  "id" : "fbf94ee3-dddd-49d4-b4b4-04a51fdf4fbb",
  "name" : "Upgrade DOMAIN - [acme-domain] using BUNDLE - HOST:6.7.0-13006603",
  "type" : "UPGRADE",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:19.716Z",
  "resources" : [ {
    "resourceId" : "a282507a-7e2c-4335-98b8-1cc66687d5b5",
    "type" : "DOMAIN"
  }, {
    "resourceId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
    "type" : "BUNDLE"
  } ],
  "isCancellable" : false
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task.

Unassigned Host Upgrade

The Get the Upgradables DOES NOT provide the unassigned hosts which can be upgraded. These unassigned host details(current version, host ID) needs to be queried using Get the Hosts and Get the Clusters API’s.

Prerequisites

The following data is required:

Resource Type. Ex: UNASSIGNED_HOST.
One or more Resource upgrade specifications.
Each Resource upgrade specification should contain.
- Resource ID. Ex: UnAssigned Host ID.
- Upgrade scheduled time or Upgrade now option.
- Flag denoting whether the VM’s should be shutdown.
- The version to which the Host should be upgraded to.

Tip	Refer to: UpgradeSpec and ResourceUpgradeSpec.

Steps

Invoke the API. This API returns a task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/upgrades' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "bundleId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
  "resourceType" : "UNASSIGNED_HOST",
  "resourceUpgradeSpecs" : [ {
    "resourceId" : "ecbfdb93-d3c1-41a9-9336-1ae22cfbaf70",
    "shutdownVms" : true,
    "toVersion" : "6.7.0-13006603",
    "upgradeNow" : true
  } ]
}'

HTTP Request

POST /v1/upgrades HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 278
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "bundleId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
  "resourceType" : "UNASSIGNED_HOST",
  "resourceUpgradeSpecs" : [ {
    "resourceId" : "ecbfdb93-d3c1-41a9-9336-1ae22cfbaf70",
    "shutdownVms" : true,
    "toVersion" : "6.7.0-13006603",
    "upgradeNow" : true
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/d103dc85-c223-461b-a974-c6401615b705
Content-Length: 451

{
  "id" : "d103dc85-c223-461b-a974-c6401615b705",
  "name" : "Upgrade HOST - [10.0.0.100] using BUNDLE - HOST:6.7.0-13006603",
  "type" : "UPGRADE",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:25:18.524Z",
  "resources" : [ {
    "resourceId" : "ecbfdb93-d3c1-41a9-9336-1ae22cfbaf70",
    "type" : "HOST"
  }, {
    "resourceId" : "fd655436-ec3c-4f10-baed-3a3dde5a6bc6",
    "type" : "BUNDLE"
  } ],
  "isCancellable" : false
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task.

2.19. Credentials

2.19.1. Get the Credentials

This API is used to fetch all credentials known to the system.

Prerequisites

The following data is required
- Resource type, name, IP address or the domain name associated with the resource is required to filter the results. For allowable resource type values

Tip	Refer to: Get the Credentials

Get All Credentials

Steps

Invoke the API.

Tip	For a scaled environment, it is always recommended to provide "resourceType" filter for avoiding timeouts.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 2021

{
  "elements" : [ {
    "id" : "87af835c-3640-4e21-afa7-1cb241de1480",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:58.678Z",
    "modificationTimestamp" : "2020-04-10T06:20:58.678Z",
    "resource" : {
      "resourceId" : "3cf68f54-72b8-4e1b-aaf7-a0abb5434504",
      "resourceName" : "sfo01m01esx01.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.100",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "00d942ce-8243-41ae-b8cb-8b9709a0ff69",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:58.678Z",
    "modificationTimestamp" : "2020-04-10T06:20:58.678Z",
    "resource" : {
      "resourceId" : "68248506-5b46-4efe-9863-26cda95145c4",
      "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.101",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "90fb5d8c-fc9d-4c73-887c-19685d315bf9",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:58.678Z",
    "modificationTimestamp" : "2020-04-10T06:20:58.678Z",
    "resource" : {
      "resourceId" : "b8f8cac3-532b-4b0c-9d78-cd118ec14ac5",
      "resourceName" : "sfo01m01esx03.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.102",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "a1ccaf54-7a4e-45e0-964c-d0c2c5bc19df",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:58.678Z",
    "modificationTimestamp" : "2020-04-10T06:20:58.678Z",
    "resource" : {
      "resourceId" : "29372d8f-b204-4acb-bd0f-65f49ff05ce4",
      "resourceName" : "sfo01m01esx04.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.103",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  } ]
}

Get Credentials by "resourceName"

This API can be used to fetch the credentials associated with a resource with a specific name.

Steps

Invoke the API by specifying the "resourceName".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials?resourceName=sfo01m01esx02.sfo01.rainpole.local' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials?resourceName=sfo01m01esx02.sfo01.rainpole.local HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 521

{
  "elements" : [ {
    "id" : "00d942ce-8243-41ae-b8cb-8b9709a0ff69",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.147Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.147Z",
    "resource" : {
      "resourceId" : "68248506-5b46-4efe-9863-26cda95145c4",
      "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.101",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  } ]
}

Get Credentials by "resourceIP"

This API can be used to fetch the credentials associated with a resource with a specific IP address.

Steps

Invoke the API by specifying the "resourceIP".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials?resourceIP=10.0.0.101' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials?resourceIP=10.0.0.101 HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 521

{
  "elements" : [ {
    "id" : "00d942ce-8243-41ae-b8cb-8b9709a0ff69",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:59.025Z",
    "modificationTimestamp" : "2020-04-10T06:20:59.025Z",
    "resource" : {
      "resourceId" : "68248506-5b46-4efe-9863-26cda95145c4",
      "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.101",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  } ]
}

Get Credentials by "resourceType"

This API can be used to fetch the credentials associated with all the resources with a specific resource type.

Steps

Invoke the API by specifying the "resourceType".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials?resourceType=ESXI' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials?resourceType=ESXI HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 2021

{
  "elements" : [ {
    "id" : "82e1260d-d021-45ef-b288-ed188998338a",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:58.556Z",
    "modificationTimestamp" : "2020-04-10T06:20:58.556Z",
    "resource" : {
      "resourceId" : "114ab7cc-872d-46ea-b6d3-844beb9e7972",
      "resourceName" : "sfo01m01esx01.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.100",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "00d942ce-8243-41ae-b8cb-8b9709a0ff69",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:58.556Z",
    "modificationTimestamp" : "2020-04-10T06:20:58.556Z",
    "resource" : {
      "resourceId" : "68248506-5b46-4efe-9863-26cda95145c4",
      "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.101",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "c991c32d-a391-46db-899f-c9635846fb30",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:58.556Z",
    "modificationTimestamp" : "2020-04-10T06:20:58.556Z",
    "resource" : {
      "resourceId" : "b158c318-31d9-4876-afe6-247f0ff6da72",
      "resourceName" : "sfo01m01esx03.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.102",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "41f2f950-ece2-431b-8ce8-e3d2acf5e8f7",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:20:58.556Z",
    "modificationTimestamp" : "2020-04-10T06:20:58.556Z",
    "resource" : {
      "resourceId" : "d4db94ad-15f2-43eb-8e3f-5add22b16c2e",
      "resourceName" : "sfo01m01esx04.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.103",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  } ]
}

Get Credentials by "domainName"

This API can be used to fetch the credentials associated with all the resources belonging to a specific domain.

Steps

Invoke the API by specifying the "domainName".

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials?domainName=MGMT' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials?domainName=MGMT HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 7526

{
  "elements" : [ {
    "id" : "79f8ff01-8ba9-42a7-bf81-c032f65a5e0b",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "1c975d36-2b80-4bcd-806d-894c5dfe15cb",
      "resourceName" : "sfo01m01esx01.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.100",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "00d942ce-8243-41ae-b8cb-8b9709a0ff69",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "68248506-5b46-4efe-9863-26cda95145c4",
      "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.101",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "b8a1b31b-0970-4632-b81b-b9426d6ee8bc",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "42f312db-f72a-4a0a-b71a-26dd4fc163ca",
      "resourceName" : "sfo01m01esx03.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.102",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "e20d6467-5205-45f6-a922-7148dbb1d105",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "c479eeed-6c88-4193-8e47-9e0658a23d34",
      "resourceName" : "sfo01m01esx04.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.103",
      "resourceType" : "ESXI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "d948f165-4cd7-47b6-add0-6423615a9d3a",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "84a3a69c-8b38-4fb5-9cad-1e952a6e2d62",
      "resourceName" : "sfo01m01vcenter01.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.6",
      "resourceType" : "VCENTER",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "af8c67e9-cbc1-46de-bf76-a1d53c6f2e68",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "7f0f8c53-4165-4b03-92d6-e3cf47514a27",
      "resourceName" : "sfo01m01psc01.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.5",
      "resourceType" : "PSC",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "338ef3e8-746e-4c6e-8ea7-5120adc75224",
    "credentialType" : "SSO",
    "username" : "[email protected]",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "5bdce09a-62e8-4bf7-99ea-a8eca3d043d3",
      "resourceName" : "sfo01m01psc01.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.5",
      "resourceType" : "PSC",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "41ce5437-4efd-4d32-b060-df1325979b1c",
    "credentialType" : "API",
    "username" : "admin",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "13321bea-f3b1-416a-811d-d743dfd62be4",
      "resourceName" : "sfo01m01nsx01.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.9",
      "resourceType" : "NSX_MANAGER",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "80caf97e-92b1-4f2a-a2d2-2979bb029613",
    "credentialType" : "API",
    "username" : "admin",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "113a26e1-d48c-41d1-8485-b6f5d69691d3",
      "resourceName" : "sfo01m01nsxc01",
      "resourceIp" : "10.0.0.42",
      "resourceType" : "NSX_CONTROLLER",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "04d20abf-9498-404c-88fd-dbddcfa691c3",
    "credentialType" : "API",
    "username" : "admin",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "1a815d79-c57d-4891-8faf-12b63149b659",
      "resourceName" : "sfo01vrli01.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.15",
      "resourceType" : "VRLI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "da03a82c-bcfc-4267-ba36-1db69886df84",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "8eb1dbaa-b746-4849-9075-25d80f989b18",
      "resourceName" : "sfo01vrli01b.sfo01.rainpole.local",
      "resourceIp" : "10.0.0.16",
      "resourceType" : "VRLI",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "d21b3ca4-43df-40a6-b6d4-1313de968890",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "29857146-c99a-4edb-9ff0-6becd8d3734b",
      "resourceName" : "vrops01svr01a.rainpole.local",
      "resourceIp" : "10.0.1.33",
      "resourceType" : "VROPS",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "a8aca43c-d3ad-4be6-9ffb-20909f9a37a4",
    "credentialType" : "API",
    "username" : "admin",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "3c0154ac-eb0d-4db5-932d-a00f75ea6ef0",
      "resourceName" : "vrops01svr01.rainpole.local",
      "resourceIp" : "10.0.0.31",
      "resourceType" : "VROPS",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "06680d3e-80f4-45da-aa60-266d13a63374",
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "5a3ed4af-81bc-4e74-95ae-453e5e175625",
      "resourceName" : "vrslcm01svr01a.rainpole.local",
      "resourceIp" : "10.0.0.32",
      "resourceType" : "VRSLCM",
      "domainName" : "MGMT"
    }
  }, {
    "id" : "5cf65e32-6258-4c36-9031-bb0ad5510d12",
    "credentialType" : "API",
    "username" : "admin@localhost",
    "password" : "VMwareInfra@1",
    "creationTimestamp" : "2020-04-10T06:21:00.020Z",
    "modificationTimestamp" : "2020-04-10T06:21:00.020Z",
    "resource" : {
      "resourceId" : "6dd4a730-b057-4440-840e-3bb43974c893",
      "resourceName" : "vrslcm01svr01a.rainpole.local",
      "resourceIp" : "10.0.0.32",
      "resourceType" : "VRSLCM",
      "domainName" : "MGMT"
    }
  } ]
}

2.19.2. Get a Credential

This API is used to fetch credential for an ID.

Prerequisites

The following data is required
- ID of the credential

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials/00d942ce-8243-41ae-b8cb-8b9709a0ff69' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials/00d942ce-8243-41ae-b8cb-8b9709a0ff69 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 470

{
  "id" : "00d942ce-8243-41ae-b8cb-8b9709a0ff69",
  "credentialType" : "SSH",
  "username" : "root",
  "password" : "VMwareInfra@1",
  "creationTimestamp" : "2020-04-10T06:20:59.913Z",
  "modificationTimestamp" : "2020-04-10T06:20:59.913Z",
  "resource" : {
    "resourceId" : "68248506-5b46-4efe-9863-26cda95145c4",
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceIp" : "10.0.0.101",
    "resourceType" : "ESXI",
    "domainName" : "MGMT"
  }
}

2.19.3. Update the Passwords

This API is used to update passwords for list of resources by supplying new passwords.

Prerequisites

The following data is required
- Name or ID of the resource
- Type of the resource
- Credential type of the resource
- Username of the resource

Tip	Refer to: Get the Credentials to get the credential type, username, name, ID and type of the resource.

New password must be in compliance with these password policies.

Password requirements:
- Length: 8-20 characters
- Allowed special characters: ! @ # $ ^ *
- At least 1 small letter, capital letter, number and special character should be present
- Cannot include: Three same consecutive characters

Steps

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "operationType" : "UPDATE",
  "elements" : [ {
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceType" : "ESXI",
    "credentials" : [ {
      "credentialType" : "SSH",
      "username" : "root",
      "password" : "VMwareInfra@1"
    } ]
  } ]
}'

HTTP Request

PATCH /v1/credentials HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 272
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "operationType" : "UPDATE",
  "elements" : [ {
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceType" : "ESXI",
    "credentials" : [ {
      "credentialType" : "SSH",
      "username" : "root",
      "password" : "VMwareInfra@1"
    } ]
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/dbc53b1b-4ee7-4d61-b5a1-b6f5f1fb7bca
Content-Type: application/json
Content-Length: 100

{
  "id" : "dbc53b1b-4ee7-4d61-b5a1-b6f5f1fb7bca",
  "name" : "UPDATE",
  "status" : "IN_PROGRESS"
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task or Get a Credentials Task.

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry the Update Passwords Task.

Warning

The password once updated cannot be rolled back.

Note	The password is updated in the order of the input.

Note	The passwords of the dependent resources of the requested resources will also get updated.

2.19.4. Rotate the Passwords

This API is used to rotate passwords for list of resources using system generated passwords.

Prerequisites

The following data is required
- Name or ID of the resource
- Type of the resource
- Credential type of the resource
- Username of the resource

Tip	Refer to: Get the Credentials to get the credential type, username, name, ID and type of the resource.

Steps

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "operationType" : "ROTATE",
  "elements" : [ {
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceType" : "ESXI",
    "credentials" : [ {
      "credentialType" : "SSH",
      "username" : "root"
    } ]
  } ]
}'

HTTP Request

PATCH /v1/credentials HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 236
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "operationType" : "ROTATE",
  "elements" : [ {
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceType" : "ESXI",
    "credentials" : [ {
      "credentialType" : "SSH",
      "username" : "root"
    } ]
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/b3fba3e1-9dbe-4a6d-a3c9-56700b9edc2f
Content-Type: application/json
Content-Length: 100

{
  "id" : "b3fba3e1-9dbe-4a6d-a3c9-56700b9edc2f",
  "name" : "ROTATE",
  "status" : "IN_PROGRESS"
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task or Get a Credentials Task.

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry the Rotate Passwords Task.

Warning

The password once rotated cannot be rolled back.

Note	The password is rotated in the order of the input.

Note	The generated password adheres to the password compliance. Refer to: Password Compliance Guide.

Note	The passwords of the dependent resources of the requested resources will also get rotated.

Related APIs

2.19.5. Retry the Update Passwords Task

This API is used to retry a failed update passwords task.

Prerequisites

The following data is required
- ID of the last triggered failed update passwords task
- Name or ID of the resource
- Type of the resource
- Credential type of the resource
- Username of the resource

Tip	Refer to: Get the Credentials to get the credential type, username, name, ID and type of the resource and ID of the failed task.

New password must be in compliance with the password policies.

Tip	Refer to: Password Compliance Guide.

Steps

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials/tasks/43017ca9-54d5-489f-9569-bac96f435191' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "operationType" : "UPDATE",
  "elements" : [ {
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceType" : "ESXI",
    "credentials" : [ {
      "credentialType" : "SSH",
      "username" : "root",
      "password" : "VMwareInfra@1"
    } ]
  } ]
}'

HTTP Request

PATCH /v1/credentials/tasks/43017ca9-54d5-489f-9569-bac96f435191 HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 272
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "operationType" : "UPDATE",
  "elements" : [ {
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceType" : "ESXI",
    "credentials" : [ {
      "credentialType" : "SSH",
      "username" : "root",
      "password" : "VMwareInfra@1"
    } ]
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/43017ca9-54d5-489f-9569-bac96f435191
Content-Type: application/json
Content-Length: 100

{
  "id" : "43017ca9-54d5-489f-9569-bac96f435191",
  "name" : "UPDATE",
  "status" : "IN_PROGRESS"
}

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task or Get a Credentials Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed by providing previous credentials rotate specification or by amending the credentials rotate specification for FAILED resources.

Tip	Refer to: Retry the Update Passwords Task.

The failed task can be cancelled.

Tip	Refer to: Cancel the Update/Rotate Passwords Task.

Warning

The password once updated cannot be rolled back.

Note	The password is updated in the order of the input.

Note	Retry should be performed if updating passwords task has failed.

Note	Retry should be performed on the same list of resources as in the failed operation specification.

Tip	Refer to: Get the Resource Credentials for Credentials Task for the list of resources in the failed task.

Note	The passwords of the dependent resources of the requested resources will also get updated.

2.19.6. Retry the Rotate Passwords Task

This API is used to retry a failed rotate passwords task.

Prerequisites

The following data is required
- ID of the last triggered failed rotate passwords task
- Name or ID of the resource
- Type of the resource
- Credential type of the resource
- Username of the resource

Tip	Refer to: Get the Credentials to get the credential type, username, name, ID and type of the resource and ID of the failed task.

Steps

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials/tasks/a22346ef-8e64-493b-8b22-a69bd0cb5a44' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "operationType" : "ROTATE",
  "elements" : [ {
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceType" : "ESXI",
    "credentials" : [ {
      "credentialType" : "SSH",
      "username" : "root"
    } ]
  } ]
}'

HTTP Request

PATCH /v1/credentials/tasks/a22346ef-8e64-493b-8b22-a69bd0cb5a44 HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 236
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "operationType" : "ROTATE",
  "elements" : [ {
    "resourceName" : "sfo01m01esx02.sfo01.rainpole.local",
    "resourceType" : "ESXI",
    "credentials" : [ {
      "credentialType" : "SSH",
      "username" : "root"
    } ]
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/a22346ef-8e64-493b-8b22-a69bd0cb5a44
Content-Type: application/json
Content-Length: 100

{
  "id" : "a22346ef-8e64-493b-8b22-a69bd0cb5a44",
  "name" : "ROTATE",
  "status" : "IN_PROGRESS"
}

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task or Get a Credentials Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed by providing previous credentials rotate specification or by amending the credentials rotate specification for FAILED resources.

Tip	Refer to: Retry the Rotate Passwords Task.

The failed task can be cancelled.

Tip	Refer to: Cancel the Update/Rotate Passwords Task.

Warning

The password once rotated cannot be rolled back.

Note	The password is rotated in the order of the input.

Note	The generated password adheres to the password compliance. Refer to: Password Compliance Guide.

Note	Retry should be performed if some password rotation task has failed.

Note	Retry should be performed on the same list of resources as in the failed operation specification.

Tip	Refer to: Get the Resource Credentials for Credentials Task for the list of resources in the failed task.

Note	The passwords of the dependent resources of the requested resources will also get rotated.

Related APIs

2.19.7. Cancel the Update/Rotate Passwords Task

This API is used to cancel a failed update or rotate passwords task.

Prerequisites

The following data is required
- ID of the last triggered failed update/rotate passwords task

Tip	Refer to: Get the Credentials Tasks section to get the ID of the failed task.

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials/tasks/234f7a60-924b-4ddf-8a4e-881abd4b1377' -i -X DELETE \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

DELETE /v1/credentials/tasks/234f7a60-924b-4ddf-8a4e-881abd4b1377 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 204 No Content
Content-Type: application/json
Content-Length: 103

{
  "id" : "234f7a60-924b-4ddf-8a4e-881abd4b1377",
  "name" : "USER CANCELLED",
  "status" : "FAILED"
}

Warning

The password once updated or rotated cannot be rolled back.

Note	The password is updated or rotated in the order of the input.

Note	Cancel should be performed to release the internal global lock held at VCF instance level if some password updation or rotation task has failed after several retries.

2.19.8. Get the Credentials Tasks

This API is used to fetch all credentials tasks in reverse chronological order.

Prerequisites

None

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials/tasks' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials/tasks HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1162

{
  "elements" : [ {
    "id" : "186d891f-aac3-4501-ae52-afb89eb7e32f",
    "name" : "Credentials rotate operation",
    "type" : "ROTATE",
    "creationTimestamp" : "2018-11-05T05:15:32.864Z",
    "status" : "SUCCESSFUL",
    "subTasks" : [ {
      "name" : "vracafe3.rainpole.local:SSH",
      "creationTimestamp" : "2018-11-05T05:15:32.864Z",
      "status" : "SUCCESSFUL",
      "oldPassword" : "EvoSDDC2019!",
      "newPassword" : "EvoSDDC2020!",
      "entityType" : "VRA",
      "username" : "root",
      "credentialType" : "SSH"
    }, {
      "name" : "vracafe2.rainpole.local:SSH",
      "creationTimestamp" : "2018-11-05T05:15:32.864Z",
      "status" : "SUCCESSFUL",
      "oldPassword" : "EvoSDDC2017!",
      "newPassword" : "EvoSDDC2018!",
      "entityType" : "VRA",
      "username" : "root",
      "credentialType" : "SSH"
    }, {
      "name" : "vracafe1.rainpole.local:SSH",
      "creationTimestamp" : "2018-11-05T05:15:32.864Z",
      "status" : "SUCCESSFUL",
      "oldPassword" : "EvoSDDC2016!",
      "newPassword" : "EvoSDDC2017!",
      "entityType" : "VRA",
      "username" : "root",
      "credentialType" : "SSH"
    } ]
  } ]
}

2.19.9. Get a Credentials Task

This API is used to fetch a credentials task for an ID.

Prerequisites

The following data is required
- ID of the credentials task

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials/tasks/186d891f-aac3-4501-ae52-afb89eb7e32f' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials/tasks/186d891f-aac3-4501-ae52-afb89eb7e32f HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1071

{
  "id" : "186d891f-aac3-4501-ae52-afb89eb7e32f",
  "name" : "Credentials rotate operation",
  "type" : "ROTATE",
  "creationTimestamp" : "2018-11-05T05:15:32.864Z",
  "status" : "SUCCESSFUL",
  "subTasks" : [ {
    "name" : "vracafe3.rainpole.local:SSH",
    "creationTimestamp" : "2018-11-05T05:15:32.864Z",
    "status" : "SUCCESSFUL",
    "oldPassword" : "EvoSDDC2019!",
    "newPassword" : "EvoSDDC2020!",
    "entityType" : "VRA",
    "username" : "root",
    "credentialType" : "SSH"
  }, {
    "name" : "vracafe2.rainpole.local:SSH",
    "creationTimestamp" : "2018-11-05T05:15:32.864Z",
    "status" : "SUCCESSFUL",
    "oldPassword" : "EvoSDDC2017!",
    "newPassword" : "EvoSDDC2018!",
    "entityType" : "VRA",
    "username" : "root",
    "credentialType" : "SSH"
  }, {
    "name" : "vracafe1.rainpole.local:SSH",
    "creationTimestamp" : "2018-11-05T05:15:32.864Z",
    "status" : "SUCCESSFUL",
    "oldPassword" : "EvoSDDC2016!",
    "newPassword" : "EvoSDDC2017!",
    "entityType" : "VRA",
    "username" : "root",
    "credentialType" : "SSH"
  } ]
}

2.19.10. Get the Resource Credentials for Credentials Task

This API is used to fetch resource credentials for a credentials task ID.

Prerequisites

The following data is required
- ID of the credentials task

Tip	Refer to: Get the Credentials Tasks to get the ID of credentials tasks.

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/credentials/tasks/186d891f-aac3-4501-ae52-afb89eb7e32f/resource-credentials' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/credentials/tasks/186d891f-aac3-4501-ae52-afb89eb7e32f/resource-credentials HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 578

[ {
  "resourceName" : "vracafe3.rainpole.local",
  "resourceType" : "VRA",
  "credentials" : [ {
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "EvoSDDC2020!"
  } ]
}, {
  "resourceName" : "vracafe2.rainpole.local",
  "resourceType" : "VRA",
  "credentials" : [ {
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "EvoSDDC2018!"
  } ]
}, {
  "resourceName" : "vracafe1.rainpole.local",
  "resourceType" : "VRA",
  "credentials" : [ {
    "credentialType" : "SSH",
    "username" : "root",
    "password" : "EvoSDDC2017!"
  } ]
} ]

2.20. Certificates

2.20.1. Install Certificates By Online Mode

The following steps have to be followed to install certificates signed by VCF supporting certificate authorities (Microsoft CA and OpenSSL CA).

Prerequisites

VCF environment.

Steps

Check if certificate authority is configured or not by invoking the API. If certificate authority is configured, proceed directly to step-3.

Note	Operations are performed on domain named MGMT.

Note	The following returns the list of all configured cerificate authorities.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/certificate-authorities' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/certificate-authorities HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 383

{
  "elements" : [ {
    "id" : "OpenSSL",
    "commonName" : "test.openssl.eng.vmware.com",
    "country" : "India",
    "state" : "Karnataka",
    "locality" : "Bengaluru",
    "organization" : "VMware",
    "organizationUnit" : "ISBU"
  }, {
    "id" : "Microsoft",
    "username" : "Admin",
    "serverUrl" : "https://192.168.110.200/certsrv",
    "templateName" : "Vcms"
  } ]
}

Tip	Refer to: Get certificate authorities information

Configure certificate authority if it is not configured by invoking the API

Configure "Microsoft" certificate authority

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/certificate-authorities' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "microsoftCertificateAuthoritySpec" : {
    "username" : "Admin",
    "secret" : "VMwareInfra@1",
    "serverUrl" : "https://192.168.110.200/certsrv",
    "templateName" : "Vcms"
  }
}'

HTTP Request

PUT /v1/certificate-authorities HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 188
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "microsoftCertificateAuthoritySpec" : {
    "username" : "Admin",
    "secret" : "VMwareInfra@1",
    "serverUrl" : "https://192.168.110.200/certsrv",
    "templateName" : "Vcms"
  }
}

HTTP Response

HTTP/1.1 200 OK

Configure "OpenSSL" certificate authority

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/certificate-authorities' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "openSSLCertificateAuthoritySpec" : {
    "commonName" : "test.openssl.eng.vmware.com",
    "country" : "India",
    "state" : "Karnataka",
    "locality" : "Bengaluru",
    "organization" : "VMware",
    "organizationUnit" : "ISBU"
  }
}'

HTTP Request

PUT /v1/certificate-authorities HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 242
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "openSSLCertificateAuthoritySpec" : {
    "commonName" : "test.openssl.eng.vmware.com",
    "country" : "India",
    "state" : "Karnataka",
    "locality" : "Bengaluru",
    "organization" : "VMware",
    "organizationUnit" : "ISBU"
  }
}

HTTP Response

HTTP/1.1 200 OK

Tip	Refer to: Create a certificate authority

Reconfigure the certificate authority if required by invoking the API

Reconfigure "Microsoft" certificate authority

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/certificate-authorities' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "microsoftCertificateAuthoritySpec" : {
    "templateName" : "Vcms1"
  }
}'

HTTP Request

PATCH /v1/certificate-authorities HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 78
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "microsoftCertificateAuthoritySpec" : {
    "templateName" : "Vcms1"
  }
}

HTTP Response

HTTP/1.1 200 OK

Reconfigure "OpenSSL" certificate authority

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/certificate-authorities' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "openSSLCertificateAuthoritySpec" : {
    "commonName" : "test1.openssl.eng.vmware.com"
  }
}'

HTTP Request

PATCH /v1/certificate-authorities HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 97
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "openSSLCertificateAuthoritySpec" : {
    "commonName" : "test1.openssl.eng.vmware.com"
  }
}

HTTP Response

HTTP/1.1 200 OK

Tip	Refer to: Configure existing certificate authority

Verify that the certificate authority is successfully configured by invoking the API with type of CA as the ID

Verify configuration for "Microsoft" certificate authority

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/certificate-authorities/Microsoft' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/certificate-authorities/Microsoft HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 126

{
  "id" : "Microsoft",
  "username" : "Admin",
  "serverUrl" : "https://192.168.110.200/certsrv",
  "templateName" : "Vcms"
}

Verify configuration for "OpenSSL" certificate authority

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/certificate-authorities/OpenSSL' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/certificate-authorities/OpenSSL HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 206

{
  "id" : "OpenSSL",
  "commonName" : "test.openssl.eng.vmware.com",
  "country" : "India",
  "state" : "Karnataka",
  "locality" : "Bengaluru",
  "organization" : "VMware",
  "organizationUnit" : "ISBU"
}

Tip	Refer to: Get certificate authority information

After the successful certificate authority configuration, generate CSR by invoking the API

Tip	If "resources" field is not given then operations are performed on all the resources in the domain.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/csrs' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "csrGenerationSpec" : {
    "country" : "India",
    "state" : "Karnataka",
    "locality" : "Bengaluru",
    "organization" : "VMware",
    "organizationUnit" : "ISBU",
    "email" : "[email protected]",
    "keySize" : "2048",
    "keyAlgorithm" : "RSA"
  },
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}'

HTTP Request

PUT /v1/domains/MGMT/csrs HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 369
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "csrGenerationSpec" : {
    "country" : "India",
    "state" : "Karnataka",
    "locality" : "Bengaluru",
    "organization" : "VMware",
    "organizationUnit" : "ISBU",
    "email" : "[email protected]",
    "keySize" : "2048",
    "keyAlgorithm" : "RSA"
  },
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/7ed5ff10-9e8c-42fa-8d38-ad11e70d3ff2
Content-Type: application/json
Content-Length: 79

{
  "id" : "7ed5ff10-9e8c-42fa-8d38-ad11e70d3ff2",
  "status" : "IN_PROGRESS"
}

Tip	Refer to: Generate CSR(s)

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", execute the generate CSR request again.

If the generation of CSR is successful, fetch the contents of the CSR to check for which resources CSR is generated by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/csrs' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/MGMT/csrs HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1163

{
  "elements" : [ {
    "csrEncodedContent" : "-----BEGIN CERTIFICATE REQUEST-----\nMIICtDCCAZwCAQAwbzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMQswCQYDVQQH\nEwJQQTEMMAoGA1UECxMDVkNGMQ8wDQYDVQQKEwZWTXdhcmUxJzAlBgNVBAMTHm5z\neE1hbmFnZXIudnJhY2sudnNwaGVyZS5sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQAD\nggEPADCCAQoCggEBAKtumknTB1do77E5rCXGRgqT6iqTgW0moiDZS6USGkeTQMvj\nR5JnQjq11xJl0y1meSdA6ufft8xndOr1b8alRs4+FreuJLl/8HBIVLRECrfkfIn0\nImwZzGFih2wwrCD/evb/7paNcdt97+KF2nwqB5ADysyFkjYs0uiJxxE5i8HsST1L\n+AStKeAV0lOk/2n/qgHPUcnjH7KchJAet9DFuKBWUW7QIryQffuiQrdAFqcEPHJC\nubHyqnoBPktosD3SXs1UickNiTyXIRC1NGHK/w7VTTJfBxkXxIdejazVGjCAW8w0\n/N4iW3rCaxSpnggWLGYFbGEkhikgtkpj8zIRjk8CAwEAAaAAMA0GCSqGSIb3DQEB\nCwUAA4IBAQBkxJTuymqggHLhWbtnvtA3mU4freKzF2XDUUP+K5kz43j2IXNbsCJI\nWDpY9OCVj9NHZ+uFTvQLvCb3E+6h0vE4Dw2PVUuOpz/Ag1qmgYIxtC5vzN4gLKih\nUNROG5wYryYKO8YL4MB3XIQdx9b8y8Fxyh3ZHIvdghhUPBooWzeCUXVPD8Le4p52\nD8yMGREtSQL4avLughd+SFd0fvKQq+/K42WOFn7PYVfgLBqdW1YCjEIfAdsG+bhG\n3CIBan84uV3cKFSM4NtxCvHZnuRZmx6+0Frtt1w9sndjKvHrA6ozoHO9O1gl/E9D\nY1rzOB7KFzGiZHAMT2Cf/x/xGo8rTGFZ\n-----END CERTIFICATE REQUEST-----",
    "resource" : {
      "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local"
    }
  } ]
}

Tip	Refer to: Get available CSR(s) in json format

After successful CSR generation, generate the certificates signed by supported certificates authorities (either OpenSSL or Microsoft) by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/certificates' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "caType" : "Microsoft",
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}'

HTTP Request

PUT /v1/domains/MGMT/certificates HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 133
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "caType" : "Microsoft",
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/5b51e5f4-730c-412d-8fd1-8cee0fbdf610
Content-Type: application/json
Content-Length: 79

{
  "id" : "5b51e5f4-730c-412d-8fd1-8cee0fbdf610",
  "status" : "IN_PROGRESS"
}

Tip	Refer to: Generate certificate(s) for the selected resource(s) in a domain

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", execute the generate certificate request again.

If the generation of certificates is successful, fetch the contents of the generated certificates to check for which resources certificates are generated by invoking the API

Note	The following will display the list of generated as well as already installed certificates.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/certificates' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/MGMT/certificates HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 8566

{
  "elements" : [ {
    "isInstalled" : true,
    "version" : "V3",
    "serialNumber" : "ca:0b:5d:6d:07:4e:db:41",
    "issuedTo" : "sfo01m01vcenter01.sfo01.rainpole.local",
    "issuedBy" : "OU=VMware Engineering, O=sfo01m01psc01.sfo01.rainpole.local, ST=California, C=US, DC=local, DC=vsphere, CN=CA",
    "notBefore" : "2019-07-11T10:16:05.000Z",
    "notAfter" : "2029-07-06T08:17:24.000Z",
    "signatureAlgorithm" : "SHA256withRSA",
    "subject" : "C=US, CN=sfo01m01vcenter01.sfo01.rainpole.local",
    "subjectAlternativeName" : [ "sfo01m01vcenter01.sfo01.rainpole.local" ],
    "publicKey" : "BA:16:16:DF:00:B2:88:C9:F9:E0:7F:72:B6:DC:83:1F:87:46:C3:C4:4B:8B:EB:C0:AD:B9:A2:FB:31:75:0A:89:12:25:58:B6:42:B1:78:A3:7F:19:B0:03:19:35:AD:51:5D:08:36:CB:C3:6E:63:B2:CE:89:2D:24:AD:EA:DD:BD:73:0A:06:84:4E:4D:83:AF:B8:EC:F9:E1:98:9F:35:9F:83:11:DD:71:61:5E:CF:DE:9A:BF:0D:A7:8A:64:F2:94:26:5D:A7:E0:20:B9:C2:01:BB:62:F2:7D:C3:A9:9B:91:DE:49:1E:97:B7:E8:CA:38:1C:E9:92:76:07:A8:26:95:5D:C1:89:E7:EA:27:03:57:BE:D2:76:B5:E4:AC:89:10:67:7F:42:DA:5D:52:5C:9F:65:59:A4:42:0B:81:F8:77:B5:F8:2D:18:DA:9B:1A:F4:BD:BD:F2:33:97:7A:EA:64:1B:CE:58:CF:9C:E7:18:60:94:CE:66:C9:57:7E:62:A2:AD:47:3D:29:D2:F8:DB:AB:D7:8F:D1:7D:8A:9A:FC:68:37:48:3C:AD:38:A5:76:D8:4C:E2:64:AE:87:B7:DA:78:3E:EB:2B:C8:70:43:4D:CB:4E:72:80:43:CB:D2:43:A7:71:16:22:27:0F:A1:DB:0A:83:88:2C:09:49:0A:35:8C:76:76:55:E2:3A:1C:7C:74:F0:91:60:A2:45:7F:6C:7A:2B:A5:51:87:25:D0:DB:9C:E0:B8:32:27:83:D6:3F:70:C5:7A:1B:92:09:E7:77:39:3A:C2:28:B1:5C:8A:3F:42:FE:D6:6A:7D:F6:E5:D6:FB:B0:DB:AB:D9:65:29:BE:75:DA:07:E8:38:B2:A0:75:9F:45:8E:FF:6B:AF:27:DB:FA:2E:AB:80:51:09:88:7D:7B:AC:A4:B7:15:41:30:A0:E1:0F:C7:DD:D1:F4:84:7D:D3:F8:B1:B0:F9:55:8F:A6:DC:44:E0:E6:0F:C5:DF:32:93:51:8D:7D:BA:79:4A:3E:72:CA:CB:9A:2E:8B:E6:A0:63:57:C8:CD:92:F8:70:0A:1E:6D:CA:DF:35:D4:91:45:E7:DB:7F:86:32:E9:8C:A3:D2:D0:35:15:70:A9:DA:39:DF:FA:76:9C:EF:5D:B6:A4:58:49:EE:A0:B1:74:33:D2:41:97:F6:FE:0C:07:66:DE:56:5F:3E:15:03:70:3D:56:80:5E:F6:CB:C3:FA:78:CE:14:0C:D7:E1:53:48:8B:5A:61:C0:04:BA:DD:ED:B3:E4:F1:76:AD:FD:03:27:C9:FB:EC:5A:75:0B:22:8F:6A:E8:35:47:FB:04:B7:A7:5F:51:FA:46:EF:00:64:03:27:1C:FB",
    "publicKeyAlgorithm" : "RSA",
    "keySize" : "2048",
    "thumbprintAlgorithm" : "SHA-256",
    "thumbprint" : "35:4B:A5:11:A9:3D:39:0D:B7:95:9B:4D:07:5C:73:40:D0:DF:63:D4:68:97:6E:1B:20:70:87:AE:40:3F:7E:AD",
    "numberOfDaysToExpire" : 3644,
    "expirationStatus" : "ACTIVE",
    "pemEncoded" : "-----BEGIN CERTIFICATE-----MIIFRDCCBCygAwIBAgIJAOx9cA2cGcUUMA0GCSqGSIb3DQEBCwUAMIGgMQswCQYDVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExIjAgBgNVBAoMGXBzYy0xLnZyYWNrLnZzcGhlcmUubG9jYWwxGzAZBgNVBAsMElZNd2FyZSBFbmdpbmVlcmluZzAeFw0xODA3MDIxNDE1NTJaFw0yODA2MjcxMjIyMzlaMIGwMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJUGFsbyBBbHRvMQ8wDQYDVQQKEwZWTXdhcmUxGzAZBgNVBAsTElZNd2FyZSBFbmdpbmVlcmluZzEqMCgGA1UEAxMhbG9hZC1iYWxhbmNlci52cmFjay52c3BoZXJlLmxvY2FsMR4wHAYJKoZIhvcNAQkBFg92bWNhQHZtd2FyZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC6FhbfALKIyfngf3K23IMfh0bDxEuL68CtuaL7MXUKiRIlWLZCsXijfxmwAxk1rVFdCDbLw25jss6JLSSt6t29cwoGhE5Ng6+47PnhmJ81n4MR3XFhXs/emr8Np4pk8pQmXafgILnCAbti8n3DqZuR3kkel7foyjgc6ZJ2B6gmlV3BiefqJwNXvtJ2teSsiRBnf0LaXVJcn2VZpEILgfh3tfgtGNqbGvS9vfIzl3rqZBvOWM+c5xhglM5myVd+YqKtRz0p0vjbq9eP0X2KmvxoN0g8rTildthM4mSuh7faeD7rK8hwQ03LTnKAQ8vSQ6dxFiInD6HbCoOILAlJCjWMdnZV4jocfHTwkWCiRX9seiulUYcl0Nuc4LgyJ4PWP3DFehuSCed3OTrCKLFcij9C/tZqffbl1vuw26vZZSm+ddoH6DiyoHWfRY7/a68n2/ouq4BRCYh9e6yktxVBMKDhD8fd0fSEfdP4sbD5VY+m3ETg5g/F3zKTUY19unlKPnLKy5oui+agY1fIzZL4cAoebcrfNdSRRefbf4Yy6Yyj0tA1FXCp2jnf+nac7122pFhJ7qCxdDPSQZf2/gwHZt5WXz4VA3A9VoBe9svD+njOFAzX4VNIi1phwAS63e2z5PF2rf0DJ8n77Fp1CyKPaug1R/sEt6dfUfpG7wBkAycc+wIDAQABo28wbTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAyBgNVHREEKzApgiFsb2FkLWJhbGFuY2VyLnZyYWNrLnZzcGhlcmUubG9jYWyHBAoAAA8wHwYDVR0jBBgwFoAUauWGErq+/JHwQ3qju9Ch8V2097MwDQYJKoZIhvcNAQELBQADggEBAMCvNCQ3KsvncoYK9fI0cfcBYEpFuToB+duK7yztklf8P6PLRSWdU39KaG+xv5768K+xe90riOYs0Mhcs0IuUQW2F6kCnlW3ff2R3pvTeM3kGqXclk4KGKRNnhhsF3Ze8QW3drH0dzD3vNcumdLr+GvG6vF2O/Pl3+Nn9dwE72ZVl7Ai970jJM5CVjI+wST19ZQPpq1E3aad3Bk+AQcQCIGputBGkHFZUGX4T6jPH0uDOcSRjH7v6TXhF2Cury7zme0zpWYwC4RMH/AxqK4z6DlmAwu2zycN097TMM/ZUXePmvgY7JSB5BIiY4ZxlnNbJy4756XDSBt41AaHxqWNcfs=-----END CERTIFICATE-----"
  }, {
    "isInstalled" : false,
    "version" : "V3",
    "serialNumber" : "f4:80:33:5f:e5:77:2a:f7",
    "issuedTo" : "sfo01m01nsx01.sfo01.rainpole.local",
    "issuedBy" : "OU=ISBU, O=VMware, L= Bangalore, ST=Karnataka, C=IN, CN=test1.openssl.eng.vmware.com",
    "notBefore" : "2019-07-25T07:38:55.000Z",
    "notAfter" : "2020-07-24T07:38:55.000Z",
    "signatureAlgorithm" : "SHA256withRSA",
    "subject" : "C=US, CN=sfo01m01nsx01.sfo01.rainpole.local",
    "subjectAlternativeName" : [ "sfo01m01nsx01.sfo01.rainpole.local" ],
    "publicKey" : "BA:16:16:DF:00:B2:88:C9:F9:E0:7F:72:B6:DC:83:1F:87:46:C3:C4:4B:8B:EB:C0:AD:B9:A2:FB:31:75:0A:89:12:25:58:B6:42:B1:78:A3:7F:19:B0:03:19:35:AD:51:5D:08:36:CB:C3:6E:63:B2:CE:89:2D:24:AD:EA:DD:BD:73:0A:06:84:4E:4D:83:AF:B8:EC:F9:E1:98:9F:35:9F:83:11:DD:71:61:5E:CF:DE:9A:BF:0D:A7:8A:64:F2:94:26:5D:A7:E0:20:B9:C2:01:BB:62:F2:7D:C3:A9:9B:91:DE:49:1E:97:B7:E8:CA:38:1C:E9:92:76:07:A8:26:95:5D:C1:89:E7:EA:27:03:57:BE:D2:76:B5:E4:AC:89:10:67:7F:42:DA:5D:52:5C:9F:65:59:A4:42:0B:81:F8:77:B5:F8:2D:18:DA:9B:1A:F4:BD:BD:F2:33:97:7A:EA:64:1B:CE:58:CF:9C:E7:18:60:94:CE:66:C9:57:7E:62:A2:AD:47:3D:29:D2:F8:DB:AB:D7:8F:D1:7D:8A:9A:FC:68:37:48:3C:AD:38:A5:76:D8:4C:E2:64:AE:87:B7:DA:78:3E:EB:2B:C8:70:43:4D:CB:4E:72:80:43:CB:D2:43:A7:71:16:22:27:0F:A1:DB:0A:83:88:2C:09:49:0A:35:8C:76:76:55:E2:3A:1C:7C:74:F0:91:60:A2:45:7F:6C:7A:2B:A5:51:87:25:D0:DB:9C:E0:B8:32:27:83:D6:3F:70:C5:7A:1B:92:09:E7:77:39:3A:C2:28:B1:5C:8A:3F:42:FE:D6:6A:7D:F6:E5:D6:FB:B0:DB:AB:D9:65:29:BE:75:DA:07:E8:38:B2:A0:75:9F:45:8E:FF:6B:AF:27:DB:FA:2E:AB:80:51:09:88:7D:7B:AC:A4:B7:15:41:30:A0:E1:0F:C7:DD:D1:F4:84:7D:D3:F8:B1:B0:F9:55:8F:A6:DC:44:E0:E6:0F:C5:DF:32:93:51:8D:7D:BA:79:4A:3E:72:CA:CB:9A:2E:8B:E6:A0:63:57:C8:CD:92:F8:70:0A:1E:6D:CA:DF:35:D4:91:45:E7:DB:7F:86:32:E9:8C:A3:D2:D0:35:15:70:A9:DA:39:DF:FA:76:9C:EF:5D:B6:A4:58:49:EE:A0:B1:74:33:D2:41:97:F6:FE:0C:07:66:DE:56:5F:3E:15:03:70:3D:56:80:5E:F6:CB:C3:FA:78:CE:14:0C:D7:E1:53:48:8B:5A:61:C0:04:BA:DD:ED:B3:E4:F1:76:AD:FD:03:27:C9:FB:EC:5A:75:0B:22:8F:6A:E8:35:47:FB:04:B7:A7:5F:51:FA:46:EF:00:64:03:27:1C:FB",
    "publicKeyAlgorithm" : "RSA",
    "keySize" : "2048",
    "thumbprintAlgorithm" : "SHA-256",
    "thumbprint" : "02:B1:D1:01:18:9F:07:39:E1:7C:94:BC:50:07:64:E8:45:8C:F8:73:3E:A9:23:BC:D2:BD:B1:17:E9:B3:C0:11",
    "numberOfDaysToExpire" : 365,
    "expirationStatus" : "ACTIVE",
    "pemEncoded" : "-----BEGIN CERTIFICATE-----MIIFRDCCBCygAwIBAgIJAOx9cA2cGcUUMA0GCSqGSIb3DQEBCwUAMIGgMQswCQYDVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExIjAgBgNVBAoMGXBzYy0xLnZyYWNrLnZzcGhlcmUubG9jYWwxGzAZBgNVBAsMElZNd2FyZSBFbmdpbmVlcmluZzAeFw0xODA3MDIxNDE1NTJaFw0yODA2MjcxMjIyMzlaMIGwMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJUGFsbyBBbHRvMQ8wDQYDVQQKEwZWTXdhcmUxGzAZBgNVBAsTElZNd2FyZSBFbmdpbmVlcmluZzEqMCgGA1UEAxMhbG9hZC1iYWxhbmNlci52cmFjay52c3BoZXJlLmxvY2FsMR4wHAYJKoZIhvcNAQkBFg92bWNhQHZtd2FyZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC6FhbfALKIyfngf3K23IMfh0bDxEuL68CtuaL7MXUKiRIlWLZCsXijfxmwAxk1rVFdCDbLw25jss6JLSSt6t29cwoGhE5Ng6+47PnhmJ81n4MR3XFhXs/emr8Np4pk8pQmXafgILnCAbti8n3DqZuR3kkel7foyjgc6ZJ2B6gmlV3BiefqJwNXvtJ2teSsiRBnf0LaXVJcn2VZpEILgfh3tfgtGNqbGvS9vfIzl3rqZBvOWM+c5xhglM5myVd+YqKtRz0p0vjbq9eP0X2KmvxoN0g8rTildthM4mSuh7faeD7rK8hwQ03LTnKAQ8vSQ6dxFiInD6HbCoOILAlJCjWMdnZV4jocfHTwkWCiRX9seiulUYcl0Nuc4LgyJ4PWP3DFehuSCed3OTrCKLFcij9C/tZqffbl1vuw26vZZSm+ddoH6DiyoHWfRY7/a68n2/ouq4BRCYh9e6yktxVBMKDhD8fd0fSEfdP4sbD5VY+m3ETg5g/F3zKTUY19unlKPnLKy5oui+agY1fIzZL4cAoebcrfNdSRRefbf4Yy6Yyj0tA1FXCp2jnf+nac7122pFhJ7qCxdDPSQZf2/gwHZt5WXz4VA3A9VoBe9svD+njOFAzX4VNIi1phwAS63e2z5PF2rf0DJ8n77Fp1CyKPaug1R/sEt6dfUfpG7wBkAycc+wIDAQABo28wbTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAyBgNVHREEKzApgiFsb2FkLWJhbGFuY2VyLnZyYWNrLnZzcGhlcmUubG9jYWyHBAoAAA8wHwYDVR0jBBgwFoAUauWGErq+/JHwQ3qju9Ch8V2097MwDQYJKoZIhvcNAQELBQADggEBAMCvNCQ3KsvncoYK9fI0cfcBYEpFuToB+duK7yztklf8P6PLRSWdU39KaG+xv5768K+xe90riOYs0Mhcs0IuUQW2F6kCnlW3ff2R3pvTeM3kGqXclk4KGKRNnhhsF3Ze8QW3drH0dzD3vNcumdLr+GvG6vF2O/Pl3+Nn9dwE72ZVl7Ai970jJM5CVjI+wST19ZQPpq1E3aad3Bk+AQcQCIGputBGkHFZUGX4T6jPH0uDOcSRjH7v6TXhF2Cury7zme0zpWYwC4RMH/AxqK4z6DlmAwu2zycN097TMM/ZUXePmvgY7JSB5BIiY4ZxlnNbJy4756XDSBt41AaHxqWNcfs=-----END CERTIFICATE-----"
  } ]
}

Tip	Refer to: Get latest generated certificate(s) in a domain.

After successful certificate generation, install the signed certificates on remote resources by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/certificates' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "operationType" : "INSTALL",
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}'

HTTP Request

PATCH /v1/domains/MGMT/certificates HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 138
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "operationType" : "INSTALL",
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/7a621085-4114-4c27-b983-eac64500094c
Content-Type: application/json
Content-Length: 79

{
  "id" : "7a621085-4114-4c27-b983-eac64500094c",
  "status" : "IN_PROGRESS"
}

Tip	Refer to: Replace certificate(s) for the selected resource(s) in a domain

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task

Restart all the services as follows:
- Using SSH, log in to the SDDC Manager VM with the following credentials:
  - Username: vcf
  - Password: use the password specified in the deployment parameter sheet
- Enter su to switch to the root user.
- Execute the following command:
  - sh /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh

Fetch the installed certificates by invoking the API

Note	The following will display the list of installed certificates.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/resource-certificates' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/MGMT/resource-certificates HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 8513

{
  "elements" : [ {
    "version" : "V3",
    "serialNumber" : "ca:0b:5d:6d:07:4e:db:41",
    "issuedTo" : "sfo01m01vcenter01.sfo01.rainpole.local",
    "issuedBy" : "OU=VMware Engineering, O=sfo01m01psc01.sfo01.rainpole.local, ST=California, C=US, DC=local, DC=vsphere, CN=CA",
    "notBefore" : "2019-07-11T10:16:05.000Z",
    "notAfter" : "2029-07-06T08:17:24.000Z",
    "signatureAlgorithm" : "SHA256withRSA",
    "subject" : "C=US, CN=sfo01m01vcenter01.sfo01.rainpole.local",
    "subjectAlternativeName" : [ "sfo01m01vcenter01.sfo01.rainpole.local" ],
    "publicKey" : "BA:16:16:DF:00:B2:88:C9:F9:E0:7F:72:B6:DC:83:1F:87:46:C3:C4:4B:8B:EB:C0:AD:B9:A2:FB:31:75:0A:89:12:25:58:B6:42:B1:78:A3:7F:19:B0:03:19:35:AD:51:5D:08:36:CB:C3:6E:63:B2:CE:89:2D:24:AD:EA:DD:BD:73:0A:06:84:4E:4D:83:AF:B8:EC:F9:E1:98:9F:35:9F:83:11:DD:71:61:5E:CF:DE:9A:BF:0D:A7:8A:64:F2:94:26:5D:A7:E0:20:B9:C2:01:BB:62:F2:7D:C3:A9:9B:91:DE:49:1E:97:B7:E8:CA:38:1C:E9:92:76:07:A8:26:95:5D:C1:89:E7:EA:27:03:57:BE:D2:76:B5:E4:AC:89:10:67:7F:42:DA:5D:52:5C:9F:65:59:A4:42:0B:81:F8:77:B5:F8:2D:18:DA:9B:1A:F4:BD:BD:F2:33:97:7A:EA:64:1B:CE:58:CF:9C:E7:18:60:94:CE:66:C9:57:7E:62:A2:AD:47:3D:29:D2:F8:DB:AB:D7:8F:D1:7D:8A:9A:FC:68:37:48:3C:AD:38:A5:76:D8:4C:E2:64:AE:87:B7:DA:78:3E:EB:2B:C8:70:43:4D:CB:4E:72:80:43:CB:D2:43:A7:71:16:22:27:0F:A1:DB:0A:83:88:2C:09:49:0A:35:8C:76:76:55:E2:3A:1C:7C:74:F0:91:60:A2:45:7F:6C:7A:2B:A5:51:87:25:D0:DB:9C:E0:B8:32:27:83:D6:3F:70:C5:7A:1B:92:09:E7:77:39:3A:C2:28:B1:5C:8A:3F:42:FE:D6:6A:7D:F6:E5:D6:FB:B0:DB:AB:D9:65:29:BE:75:DA:07:E8:38:B2:A0:75:9F:45:8E:FF:6B:AF:27:DB:FA:2E:AB:80:51:09:88:7D:7B:AC:A4:B7:15:41:30:A0:E1:0F:C7:DD:D1:F4:84:7D:D3:F8:B1:B0:F9:55:8F:A6:DC:44:E0:E6:0F:C5:DF:32:93:51:8D:7D:BA:79:4A:3E:72:CA:CB:9A:2E:8B:E6:A0:63:57:C8:CD:92:F8:70:0A:1E:6D:CA:DF:35:D4:91:45:E7:DB:7F:86:32:E9:8C:A3:D2:D0:35:15:70:A9:DA:39:DF:FA:76:9C:EF:5D:B6:A4:58:49:EE:A0:B1:74:33:D2:41:97:F6:FE:0C:07:66:DE:56:5F:3E:15:03:70:3D:56:80:5E:F6:CB:C3:FA:78:CE:14:0C:D7:E1:53:48:8B:5A:61:C0:04:BA:DD:ED:B3:E4:F1:76:AD:FD:03:27:C9:FB:EC:5A:75:0B:22:8F:6A:E8:35:47:FB:04:B7:A7:5F:51:FA:46:EF:00:64:03:27:1C:FB",
    "publicKeyAlgorithm" : "RSA",
    "keySize" : "2048",
    "thumbprintAlgorithm" : "SHA-256",
    "thumbprint" : "35:4B:A5:11:A9:3D:39:0D:B7:95:9B:4D:07:5C:73:40:D0:DF:63:D4:68:97:6E:1B:20:70:87:AE:40:3F:7E:AD",
    "numberOfDaysToExpire" : 3644,
    "expirationStatus" : "ACTIVE",
    "pemEncoded" : "-----BEGIN CERTIFICATE-----MIIFRDCCBCygAwIBAgIJAOx9cA2cGcUUMA0GCSqGSIb3DQEBCwUAMIGgMQswCQYDVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExIjAgBgNVBAoMGXBzYy0xLnZyYWNrLnZzcGhlcmUubG9jYWwxGzAZBgNVBAsMElZNd2FyZSBFbmdpbmVlcmluZzAeFw0xODA3MDIxNDE1NTJaFw0yODA2MjcxMjIyMzlaMIGwMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJUGFsbyBBbHRvMQ8wDQYDVQQKEwZWTXdhcmUxGzAZBgNVBAsTElZNd2FyZSBFbmdpbmVlcmluZzEqMCgGA1UEAxMhbG9hZC1iYWxhbmNlci52cmFjay52c3BoZXJlLmxvY2FsMR4wHAYJKoZIhvcNAQkBFg92bWNhQHZtd2FyZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC6FhbfALKIyfngf3K23IMfh0bDxEuL68CtuaL7MXUKiRIlWLZCsXijfxmwAxk1rVFdCDbLw25jss6JLSSt6t29cwoGhE5Ng6+47PnhmJ81n4MR3XFhXs/emr8Np4pk8pQmXafgILnCAbti8n3DqZuR3kkel7foyjgc6ZJ2B6gmlV3BiefqJwNXvtJ2teSsiRBnf0LaXVJcn2VZpEILgfh3tfgtGNqbGvS9vfIzl3rqZBvOWM+c5xhglM5myVd+YqKtRz0p0vjbq9eP0X2KmvxoN0g8rTildthM4mSuh7faeD7rK8hwQ03LTnKAQ8vSQ6dxFiInD6HbCoOILAlJCjWMdnZV4jocfHTwkWCiRX9seiulUYcl0Nuc4LgyJ4PWP3DFehuSCed3OTrCKLFcij9C/tZqffbl1vuw26vZZSm+ddoH6DiyoHWfRY7/a68n2/ouq4BRCYh9e6yktxVBMKDhD8fd0fSEfdP4sbD5VY+m3ETg5g/F3zKTUY19unlKPnLKy5oui+agY1fIzZL4cAoebcrfNdSRRefbf4Yy6Yyj0tA1FXCp2jnf+nac7122pFhJ7qCxdDPSQZf2/gwHZt5WXz4VA3A9VoBe9svD+njOFAzX4VNIi1phwAS63e2z5PF2rf0DJ8n77Fp1CyKPaug1R/sEt6dfUfpG7wBkAycc+wIDAQABo28wbTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAyBgNVHREEKzApgiFsb2FkLWJhbGFuY2VyLnZyYWNrLnZzcGhlcmUubG9jYWyHBAoAAA8wHwYDVR0jBBgwFoAUauWGErq+/JHwQ3qju9Ch8V2097MwDQYJKoZIhvcNAQELBQADggEBAMCvNCQ3KsvncoYK9fI0cfcBYEpFuToB+duK7yztklf8P6PLRSWdU39KaG+xv5768K+xe90riOYs0Mhcs0IuUQW2F6kCnlW3ff2R3pvTeM3kGqXclk4KGKRNnhhsF3Ze8QW3drH0dzD3vNcumdLr+GvG6vF2O/Pl3+Nn9dwE72ZVl7Ai970jJM5CVjI+wST19ZQPpq1E3aad3Bk+AQcQCIGputBGkHFZUGX4T6jPH0uDOcSRjH7v6TXhF2Cury7zme0zpWYwC4RMH/AxqK4z6DlmAwu2zycN097TMM/ZUXePmvgY7JSB5BIiY4ZxlnNbJy4756XDSBt41AaHxqWNcfs=-----END CERTIFICATE-----"
  }, {
    "version" : "V3",
    "serialNumber" : "f4:80:33:5f:e5:77:2a:f7",
    "issuedTo" : "sfo01m01nsx01.sfo01.rainpole.local",
    "issuedBy" : "OU=ISBU, O=VMware, L= Bangalore, ST=Karnataka, C=IN, CN=test1.openssl.eng.vmware.com",
    "notBefore" : "2019-07-25T07:38:55.000Z",
    "notAfter" : "2020-07-24T07:38:55.000Z",
    "signatureAlgorithm" : "SHA256withRSA",
    "subject" : "C=US, CN=sfo01m01nsx01.sfo01.rainpole.local",
    "subjectAlternativeName" : [ "sfo01m01nsx01.sfo01.rainpole.local" ],
    "publicKey" : "BA:16:16:DF:00:B2:88:C9:F9:E0:7F:72:B6:DC:83:1F:87:46:C3:C4:4B:8B:EB:C0:AD:B9:A2:FB:31:75:0A:89:12:25:58:B6:42:B1:78:A3:7F:19:B0:03:19:35:AD:51:5D:08:36:CB:C3:6E:63:B2:CE:89:2D:24:AD:EA:DD:BD:73:0A:06:84:4E:4D:83:AF:B8:EC:F9:E1:98:9F:35:9F:83:11:DD:71:61:5E:CF:DE:9A:BF:0D:A7:8A:64:F2:94:26:5D:A7:E0:20:B9:C2:01:BB:62:F2:7D:C3:A9:9B:91:DE:49:1E:97:B7:E8:CA:38:1C:E9:92:76:07:A8:26:95:5D:C1:89:E7:EA:27:03:57:BE:D2:76:B5:E4:AC:89:10:67:7F:42:DA:5D:52:5C:9F:65:59:A4:42:0B:81:F8:77:B5:F8:2D:18:DA:9B:1A:F4:BD:BD:F2:33:97:7A:EA:64:1B:CE:58:CF:9C:E7:18:60:94:CE:66:C9:57:7E:62:A2:AD:47:3D:29:D2:F8:DB:AB:D7:8F:D1:7D:8A:9A:FC:68:37:48:3C:AD:38:A5:76:D8:4C:E2:64:AE:87:B7:DA:78:3E:EB:2B:C8:70:43:4D:CB:4E:72:80:43:CB:D2:43:A7:71:16:22:27:0F:A1:DB:0A:83:88:2C:09:49:0A:35:8C:76:76:55:E2:3A:1C:7C:74:F0:91:60:A2:45:7F:6C:7A:2B:A5:51:87:25:D0:DB:9C:E0:B8:32:27:83:D6:3F:70:C5:7A:1B:92:09:E7:77:39:3A:C2:28:B1:5C:8A:3F:42:FE:D6:6A:7D:F6:E5:D6:FB:B0:DB:AB:D9:65:29:BE:75:DA:07:E8:38:B2:A0:75:9F:45:8E:FF:6B:AF:27:DB:FA:2E:AB:80:51:09:88:7D:7B:AC:A4:B7:15:41:30:A0:E1:0F:C7:DD:D1:F4:84:7D:D3:F8:B1:B0:F9:55:8F:A6:DC:44:E0:E6:0F:C5:DF:32:93:51:8D:7D:BA:79:4A:3E:72:CA:CB:9A:2E:8B:E6:A0:63:57:C8:CD:92:F8:70:0A:1E:6D:CA:DF:35:D4:91:45:E7:DB:7F:86:32:E9:8C:A3:D2:D0:35:15:70:A9:DA:39:DF:FA:76:9C:EF:5D:B6:A4:58:49:EE:A0:B1:74:33:D2:41:97:F6:FE:0C:07:66:DE:56:5F:3E:15:03:70:3D:56:80:5E:F6:CB:C3:FA:78:CE:14:0C:D7:E1:53:48:8B:5A:61:C0:04:BA:DD:ED:B3:E4:F1:76:AD:FD:03:27:C9:FB:EC:5A:75:0B:22:8F:6A:E8:35:47:FB:04:B7:A7:5F:51:FA:46:EF:00:64:03:27:1C:FB",
    "publicKeyAlgorithm" : "RSA",
    "keySize" : "2048",
    "thumbprintAlgorithm" : "SHA-256",
    "thumbprint" : "02:B1:D1:01:18:9F:07:39:E1:7C:94:BC:50:07:64:E8:45:8C:F8:73:3E:A9:23:BC:D2:BD:B1:17:E9:B3:C0:11",
    "numberOfDaysToExpire" : 365,
    "expirationStatus" : "ACTIVE",
    "pemEncoded" : "-----BEGIN CERTIFICATE-----MIIFRDCCBCygAwIBAgIJAOx9cA2cGcUUMA0GCSqGSIb3DQEBCwUAMIGgMQswCQYDVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExIjAgBgNVBAoMGXBzYy0xLnZyYWNrLnZzcGhlcmUubG9jYWwxGzAZBgNVBAsMElZNd2FyZSBFbmdpbmVlcmluZzAeFw0xODA3MDIxNDE1NTJaFw0yODA2MjcxMjIyMzlaMIGwMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJUGFsbyBBbHRvMQ8wDQYDVQQKEwZWTXdhcmUxGzAZBgNVBAsTElZNd2FyZSBFbmdpbmVlcmluZzEqMCgGA1UEAxMhbG9hZC1iYWxhbmNlci52cmFjay52c3BoZXJlLmxvY2FsMR4wHAYJKoZIhvcNAQkBFg92bWNhQHZtd2FyZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC6FhbfALKIyfngf3K23IMfh0bDxEuL68CtuaL7MXUKiRIlWLZCsXijfxmwAxk1rVFdCDbLw25jss6JLSSt6t29cwoGhE5Ng6+47PnhmJ81n4MR3XFhXs/emr8Np4pk8pQmXafgILnCAbti8n3DqZuR3kkel7foyjgc6ZJ2B6gmlV3BiefqJwNXvtJ2teSsiRBnf0LaXVJcn2VZpEILgfh3tfgtGNqbGvS9vfIzl3rqZBvOWM+c5xhglM5myVd+YqKtRz0p0vjbq9eP0X2KmvxoN0g8rTildthM4mSuh7faeD7rK8hwQ03LTnKAQ8vSQ6dxFiInD6HbCoOILAlJCjWMdnZV4jocfHTwkWCiRX9seiulUYcl0Nuc4LgyJ4PWP3DFehuSCed3OTrCKLFcij9C/tZqffbl1vuw26vZZSm+ddoH6DiyoHWfRY7/a68n2/ouq4BRCYh9e6yktxVBMKDhD8fd0fSEfdP4sbD5VY+m3ETg5g/F3zKTUY19unlKPnLKy5oui+agY1fIzZL4cAoebcrfNdSRRefbf4Yy6Yyj0tA1FXCp2jnf+nac7122pFhJ7qCxdDPSQZf2/gwHZt5WXz4VA3A9VoBe9svD+njOFAzX4VNIi1phwAS63e2z5PF2rf0DJ8n77Fp1CyKPaug1R/sEt6dfUfpG7wBkAycc+wIDAQABo28wbTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAyBgNVHREEKzApgiFsb2FkLWJhbGFuY2VyLnZyYWNrLnZzcGhlcmUubG9jYWyHBAoAAA8wHwYDVR0jBBgwFoAUauWGErq+/JHwQ3qju9Ch8V2097MwDQYJKoZIhvcNAQELBQADggEBAMCvNCQ3KsvncoYK9fI0cfcBYEpFuToB+duK7yztklf8P6PLRSWdU39KaG+xv5768K+xe90riOYs0Mhcs0IuUQW2F6kCnlW3ff2R3pvTeM3kGqXclk4KGKRNnhhsF3Ze8QW3drH0dzD3vNcumdLr+GvG6vF2O/Pl3+Nn9dwE72ZVl7Ai970jJM5CVjI+wST19ZQPpq1E3aad3Bk+AQcQCIGputBGkHFZUGX4T6jPH0uDOcSRjH7v6TXhF2Cury7zme0zpWYwC4RMH/AxqK4z6DlmAwu2zycN097TMM/ZUXePmvgY7JSB5BIiY4ZxlnNbJy4756XDSBt41AaHxqWNcfs=-----END CERTIFICATE-----"
  } ]
}

Tip	Refer to: View certificate of all the resources in a domain

Warning

Certificate installation will replace the already installed certificates.

Note	The CSRs cannot be fetched after successful certificate installation.

Note	Only singleton object of a particular certificate authority will exist at any point of time in the VCF environment.

Note	Only the latest generated CSRs will exist in the VCF environment after a series of generate CSR operation.

Note	Only the latest generated certificates will exist in the VCF environment after a series of generate certificate operation.

2.20.2. Install Certificates By Offline Mode

The following steps have to be followed to install certificates signed by external third party certificate authorities.

Prerequisites

VCF environment.

Steps

Generate CSR by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/csrs' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "csrGenerationSpec" : {
    "country" : "India",
    "state" : "Karnataka",
    "locality" : "Bengaluru",
    "organization" : "VMware",
    "organizationUnit" : "ISBU",
    "email" : "[email protected]",
    "keySize" : "2048",
    "keyAlgorithm" : "RSA"
  },
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}'

HTTP Request

PUT /v1/domains/MGMT/csrs HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 369
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "csrGenerationSpec" : {
    "country" : "India",
    "state" : "Karnataka",
    "locality" : "Bengaluru",
    "organization" : "VMware",
    "organizationUnit" : "ISBU",
    "email" : "[email protected]",
    "keySize" : "2048",
    "keyAlgorithm" : "RSA"
  },
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/7ed5ff10-9e8c-42fa-8d38-ad11e70d3ff2
Content-Type: application/json
Content-Length: 79

{
  "id" : "7ed5ff10-9e8c-42fa-8d38-ad11e70d3ff2",
  "status" : "IN_PROGRESS"
}

Tip	Refer to: Generate CSR(s)

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", execute the generate CSR request again.

If the generation of CSR is successful, fetch the contents of the CSR to check for which resources CSR is generated by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/csrs' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/MGMT/csrs HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1163

{
  "elements" : [ {
    "csrEncodedContent" : "-----BEGIN CERTIFICATE REQUEST-----\nMIICtDCCAZwCAQAwbzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMQswCQYDVQQH\nEwJQQTEMMAoGA1UECxMDVkNGMQ8wDQYDVQQKEwZWTXdhcmUxJzAlBgNVBAMTHm5z\neE1hbmFnZXIudnJhY2sudnNwaGVyZS5sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQAD\nggEPADCCAQoCggEBAKtumknTB1do77E5rCXGRgqT6iqTgW0moiDZS6USGkeTQMvj\nR5JnQjq11xJl0y1meSdA6ufft8xndOr1b8alRs4+FreuJLl/8HBIVLRECrfkfIn0\nImwZzGFih2wwrCD/evb/7paNcdt97+KF2nwqB5ADysyFkjYs0uiJxxE5i8HsST1L\n+AStKeAV0lOk/2n/qgHPUcnjH7KchJAet9DFuKBWUW7QIryQffuiQrdAFqcEPHJC\nubHyqnoBPktosD3SXs1UickNiTyXIRC1NGHK/w7VTTJfBxkXxIdejazVGjCAW8w0\n/N4iW3rCaxSpnggWLGYFbGEkhikgtkpj8zIRjk8CAwEAAaAAMA0GCSqGSIb3DQEB\nCwUAA4IBAQBkxJTuymqggHLhWbtnvtA3mU4freKzF2XDUUP+K5kz43j2IXNbsCJI\nWDpY9OCVj9NHZ+uFTvQLvCb3E+6h0vE4Dw2PVUuOpz/Ag1qmgYIxtC5vzN4gLKih\nUNROG5wYryYKO8YL4MB3XIQdx9b8y8Fxyh3ZHIvdghhUPBooWzeCUXVPD8Le4p52\nD8yMGREtSQL4avLughd+SFd0fvKQq+/K42WOFn7PYVfgLBqdW1YCjEIfAdsG+bhG\n3CIBan84uV3cKFSM4NtxCvHZnuRZmx6+0Frtt1w9sndjKvHrA6ozoHO9O1gl/E9D\nY1rzOB7KFzGiZHAMT2Cf/x/xGo8rTGFZ\n-----END CERTIFICATE REQUEST-----",
    "resource" : {
      "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local"
    }
  } ]
}

Tip	Refer to: Get available CSR(s) in json format

After successful CSR generation, download CSR in ".tar.gz" format by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/csrs/downloads' -i -X GET \
    -H 'Accept: application/octet-stream' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/MGMT/csrs/downloads HTTP/1.1
Accept: application/octet-stream
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1012
Content-Disposition: attachment; filename="csrString.txt"
Accept-Ranges: bytes

-----BEGIN CERTIFICATE REQUEST-----
MIICtDCCAZwCAQAwbzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMQswCQYDVQQH
EwJQQTEMMAoGA1UECxMDVkNGMQ8wDQYDVQQKEwZWTXdhcmUxJzAlBgNVBAMTHm5z
eE1hbmFnZXIudnJhY2sudnNwaGVyZS5sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAKtumknTB1do77E5rCXGRgqT6iqTgW0moiDZS6USGkeTQMvj
R5JnQjq11xJl0y1meSdA6ufft8xndOr1b8alRs4+FreuJLl/8HBIVLRECrfkfIn0
ImwZzGFih2wwrCD/evb/7paNcdt97+KF2nwqB5ADysyFkjYs0uiJxxE5i8HsST1L
+AStKeAV0lOk/2n/qgHPUcnjH7KchJAet9DFuKBWUW7QIryQffuiQrdAFqcEPHJC
ubHyqnoBPktosD3SXs1UickNiTyXIRC1NGHK/w7VTTJfBxkXxIdejazVGjCAW8w0
/N4iW3rCaxSpnggWLGYFbGEkhikgtkpj8zIRjk8CAwEAAaAAMA0GCSqGSIb3DQEB
CwUAA4IBAQBkxJTuymqggHLhWbtnvtA3mU4freKzF2XDUUP+K5kz43j2IXNbsCJI
WDpY9OCVj9NHZ+uFTvQLvCb3E+6h0vE4Dw2PVUuOpz/Ag1qmgYIxtC5vzN4gLKih
UNROG5wYryYKO8YL4MB3XIQdx9b8y8Fxyh3ZHIvdghhUPBooWzeCUXVPD8Le4p52
D8yMGREtSQL4avLughd+SFd0fvKQq+/K42WOFn7PYVfgLBqdW1YCjEIfAdsG+bhG
3CIBan84uV3cKFSM4NtxCvHZnuRZmx6+0Frtt1w9sndjKvHrA6ozoHO9O1gl/E9D
Y1rzOB7KFzGiZHAMT2Cf/x/xGo8rTGFZ
-----END CERTIFICATE REQUEST-----

Tip	Refer to: Download available CSR(s) in tar.gz format

Use the downloaded CSRs to have it manually signed by external certificate authorities.

Verify that the certificate authority configuration files have been configured and packaged in the form of
a ".tar.gz" file with the following conditions
- The name of the top-level directory must exactly match the name of the domain to which certificates are to be installed.
- The PEM-encoded root CA certificate chain file (rootca.crt) must reside inside this top-level directory.
- This directory must contain one sub-directory for each component resource and the name of each sub-directory must exactly match the resource fqdn.
- Each sub-directory must contain a corresponding ".csr" file, whose name must exactly match the
  resource fqdn followed by ".csr" extension.
- Each sub-directory must contain a corresponding ".crt" file, whose name must exactly match the
  resource fqdn followed by ".crt" extension.

Upload the packaged signed certificates by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/certificates/uploads' -i -X PUT \
    -H 'Content-Type: multipart/form-data' \
    -H 'Authorization: Bearer etYWRta....' \
    -F '[email protected];type=multipart/form-data'

HTTP Request

PUT /v1/domains/MGMT/certificates/uploads HTTP/1.1
Content-Type: multipart/form-data; boundary=6o2knFse3p53ty9dmcQvWAIx1zInP11uCfbm
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

--6o2knFse3p53ty9dmcQvWAIx1zInP11uCfbm
Content-Disposition: form-data; name=file; filename=MGMT.tar.gz
Content-Type: multipart/form-data

-----BEGIN CERTIFICATE-----
MIIC2zCCAcMCAQAwgZUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRIwEAYDVQQHEwlQYWxvIEFsdG8xHjAcBgNVBAsTFVZNd2FyZSBJVCAgZGVwYXJ0
bWVudDEUMBIGA1UEChMLVk1XYXJlIEluYy4xJzAlBgNVBAMTHm5zeE1hbmFnZXIu
dnJhY2sudnNwaGVyZS5sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAPgggMHrSsbcC9JYjGQCDiSTsG0LPGjMcTKgEaUi6zcVKWAv7ccpvW7cwFtc
2FqtM4zlETOK0tHZmS17uUg/tsJSWq+nr2VQ541XifvZOVINcIlKnzGJO32d4qxO
3xY3lr8Pj7xZe0xZK3iP+TBiUdtHggSYJ6uWYHoZAJ74Jqp4pVdwQgjm1sINldYm
e1x+txQINQB7MFG2tflQ7iXRaiLGZKXR86xDvw/T1OcPPjtSnwFjYfeHtE2KjuT9
RiCXl4cUuH+pjQTsWSSByK0LyC8U9/tqDGnMiERxBl1g9rBKQMOoZmTCF3gr7hhx
PZ16JlYqU9hbAjPxVkGO0NkI9PsCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAq
vqrtJ4nQepjbwOmJor2ZHOUaoqwImE3OJaa6PxaikD1c14maMXJ4XQm+ONJooCPx
CL6TVs2DSydxVzRFHj5dyAz7MJ8XIkqijvarxb+gLjhim4+O+MuS7hHaCnVU9KMg
i3QhWFc1SwDuhiHL3RXbf04gOzrbEhIPa9rBKQMOoZmTCF3gr7JiuSqBvKtG3cus
3DjxA1z9CGUgIrYBlOm2/xPDp91AIMGeP9YXh8ue/NVPZ+tlZOCgKGiS05CTK5Wr
cHaC7yQqIyZdKP9EQhv3yhxL4ho9e1xL9f4puv3CBE5VmCb8LZ/5CRIKOHEsIV70
XGKY78p5LoKf4ro2LLQ+
-----END CERTIFICATE-----
--6o2knFse3p53ty9dmcQvWAIx1zInP11uCfbm--

HTTP Response

HTTP/1.1 200 OK

Tip	Refer to: Upload certificates to the certificate store

After successful upload operation, install the signed certificates on remote resources by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/certificates' -i -X PATCH \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "operationType" : "INSTALL",
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}'

HTTP Request

PATCH /v1/domains/MGMT/certificates HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 138
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "operationType" : "INSTALL",
  "resources" : [ {
    "fqdn" : "sfo01m01nsx01.sfo01.rainpole.local",
    "type" : "NSX_MANAGER"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/7a621085-4114-4c27-b983-eac64500094c
Content-Type: application/json
Content-Length: 79

{
  "id" : "7a621085-4114-4c27-b983-eac64500094c",
  "status" : "IN_PROGRESS"
}

Tip	Refer to: Replace certificate(s) for the selected resource(s) in a domain

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task

Poll the task until "status" is not "IN_PROGRESS" with the ID from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task

Restart all the services as follows:
- Using SSH, log in to the SDDC Manager VM with the following credentials:
  - Username: vcf
  - Password: use the password specified in the deployment parameter sheet
- Enter su to switch to the root user.
- Execute the following command:
  - sh /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh

Fetch the installed certificates by invoking the API

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/domains/MGMT/resource-certificates' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/domains/MGMT/resource-certificates HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 8513

{
  "elements" : [ {
    "version" : "V3",
    "serialNumber" : "ca:0b:5d:6d:07:4e:db:41",
    "issuedTo" : "sfo01m01vcenter01.sfo01.rainpole.local",
    "issuedBy" : "OU=VMware Engineering, O=sfo01m01psc01.sfo01.rainpole.local, ST=California, C=US, DC=local, DC=vsphere, CN=CA",
    "notBefore" : "2019-07-11T10:16:05.000Z",
    "notAfter" : "2029-07-06T08:17:24.000Z",
    "signatureAlgorithm" : "SHA256withRSA",
    "subject" : "C=US, CN=sfo01m01vcenter01.sfo01.rainpole.local",
    "subjectAlternativeName" : [ "sfo01m01vcenter01.sfo01.rainpole.local" ],
    "publicKey" : "BA:16:16:DF:00:B2:88:C9:F9:E0:7F:72:B6:DC:83:1F:87:46:C3:C4:4B:8B:EB:C0:AD:B9:A2:FB:31:75:0A:89:12:25:58:B6:42:B1:78:A3:7F:19:B0:03:19:35:AD:51:5D:08:36:CB:C3:6E:63:B2:CE:89:2D:24:AD:EA:DD:BD:73:0A:06:84:4E:4D:83:AF:B8:EC:F9:E1:98:9F:35:9F:83:11:DD:71:61:5E:CF:DE:9A:BF:0D:A7:8A:64:F2:94:26:5D:A7:E0:20:B9:C2:01:BB:62:F2:7D:C3:A9:9B:91:DE:49:1E:97:B7:E8:CA:38:1C:E9:92:76:07:A8:26:95:5D:C1:89:E7:EA:27:03:57:BE:D2:76:B5:E4:AC:89:10:67:7F:42:DA:5D:52:5C:9F:65:59:A4:42:0B:81:F8:77:B5:F8:2D:18:DA:9B:1A:F4:BD:BD:F2:33:97:7A:EA:64:1B:CE:58:CF:9C:E7:18:60:94:CE:66:C9:57:7E:62:A2:AD:47:3D:29:D2:F8:DB:AB:D7:8F:D1:7D:8A:9A:FC:68:37:48:3C:AD:38:A5:76:D8:4C:E2:64:AE:87:B7:DA:78:3E:EB:2B:C8:70:43:4D:CB:4E:72:80:43:CB:D2:43:A7:71:16:22:27:0F:A1:DB:0A:83:88:2C:09:49:0A:35:8C:76:76:55:E2:3A:1C:7C:74:F0:91:60:A2:45:7F:6C:7A:2B:A5:51:87:25:D0:DB:9C:E0:B8:32:27:83:D6:3F:70:C5:7A:1B:92:09:E7:77:39:3A:C2:28:B1:5C:8A:3F:42:FE:D6:6A:7D:F6:E5:D6:FB:B0:DB:AB:D9:65:29:BE:75:DA:07:E8:38:B2:A0:75:9F:45:8E:FF:6B:AF:27:DB:FA:2E:AB:80:51:09:88:7D:7B:AC:A4:B7:15:41:30:A0:E1:0F:C7:DD:D1:F4:84:7D:D3:F8:B1:B0:F9:55:8F:A6:DC:44:E0:E6:0F:C5:DF:32:93:51:8D:7D:BA:79:4A:3E:72:CA:CB:9A:2E:8B:E6:A0:63:57:C8:CD:92:F8:70:0A:1E:6D:CA:DF:35:D4:91:45:E7:DB:7F:86:32:E9:8C:A3:D2:D0:35:15:70:A9:DA:39:DF:FA:76:9C:EF:5D:B6:A4:58:49:EE:A0:B1:74:33:D2:41:97:F6:FE:0C:07:66:DE:56:5F:3E:15:03:70:3D:56:80:5E:F6:CB:C3:FA:78:CE:14:0C:D7:E1:53:48:8B:5A:61:C0:04:BA:DD:ED:B3:E4:F1:76:AD:FD:03:27:C9:FB:EC:5A:75:0B:22:8F:6A:E8:35:47:FB:04:B7:A7:5F:51:FA:46:EF:00:64:03:27:1C:FB",
    "publicKeyAlgorithm" : "RSA",
    "keySize" : "2048",
    "thumbprintAlgorithm" : "SHA-256",
    "thumbprint" : "35:4B:A5:11:A9:3D:39:0D:B7:95:9B:4D:07:5C:73:40:D0:DF:63:D4:68:97:6E:1B:20:70:87:AE:40:3F:7E:AD",
    "numberOfDaysToExpire" : 3644,
    "expirationStatus" : "ACTIVE",
    "pemEncoded" : "-----BEGIN CERTIFICATE-----MIIFRDCCBCygAwIBAgIJAOx9cA2cGcUUMA0GCSqGSIb3DQEBCwUAMIGgMQswCQYDVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExIjAgBgNVBAoMGXBzYy0xLnZyYWNrLnZzcGhlcmUubG9jYWwxGzAZBgNVBAsMElZNd2FyZSBFbmdpbmVlcmluZzAeFw0xODA3MDIxNDE1NTJaFw0yODA2MjcxMjIyMzlaMIGwMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJUGFsbyBBbHRvMQ8wDQYDVQQKEwZWTXdhcmUxGzAZBgNVBAsTElZNd2FyZSBFbmdpbmVlcmluZzEqMCgGA1UEAxMhbG9hZC1iYWxhbmNlci52cmFjay52c3BoZXJlLmxvY2FsMR4wHAYJKoZIhvcNAQkBFg92bWNhQHZtd2FyZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC6FhbfALKIyfngf3K23IMfh0bDxEuL68CtuaL7MXUKiRIlWLZCsXijfxmwAxk1rVFdCDbLw25jss6JLSSt6t29cwoGhE5Ng6+47PnhmJ81n4MR3XFhXs/emr8Np4pk8pQmXafgILnCAbti8n3DqZuR3kkel7foyjgc6ZJ2B6gmlV3BiefqJwNXvtJ2teSsiRBnf0LaXVJcn2VZpEILgfh3tfgtGNqbGvS9vfIzl3rqZBvOWM+c5xhglM5myVd+YqKtRz0p0vjbq9eP0X2KmvxoN0g8rTildthM4mSuh7faeD7rK8hwQ03LTnKAQ8vSQ6dxFiInD6HbCoOILAlJCjWMdnZV4jocfHTwkWCiRX9seiulUYcl0Nuc4LgyJ4PWP3DFehuSCed3OTrCKLFcij9C/tZqffbl1vuw26vZZSm+ddoH6DiyoHWfRY7/a68n2/ouq4BRCYh9e6yktxVBMKDhD8fd0fSEfdP4sbD5VY+m3ETg5g/F3zKTUY19unlKPnLKy5oui+agY1fIzZL4cAoebcrfNdSRRefbf4Yy6Yyj0tA1FXCp2jnf+nac7122pFhJ7qCxdDPSQZf2/gwHZt5WXz4VA3A9VoBe9svD+njOFAzX4VNIi1phwAS63e2z5PF2rf0DJ8n77Fp1CyKPaug1R/sEt6dfUfpG7wBkAycc+wIDAQABo28wbTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAyBgNVHREEKzApgiFsb2FkLWJhbGFuY2VyLnZyYWNrLnZzcGhlcmUubG9jYWyHBAoAAA8wHwYDVR0jBBgwFoAUauWGErq+/JHwQ3qju9Ch8V2097MwDQYJKoZIhvcNAQELBQADggEBAMCvNCQ3KsvncoYK9fI0cfcBYEpFuToB+duK7yztklf8P6PLRSWdU39KaG+xv5768K+xe90riOYs0Mhcs0IuUQW2F6kCnlW3ff2R3pvTeM3kGqXclk4KGKRNnhhsF3Ze8QW3drH0dzD3vNcumdLr+GvG6vF2O/Pl3+Nn9dwE72ZVl7Ai970jJM5CVjI+wST19ZQPpq1E3aad3Bk+AQcQCIGputBGkHFZUGX4T6jPH0uDOcSRjH7v6TXhF2Cury7zme0zpWYwC4RMH/AxqK4z6DlmAwu2zycN097TMM/ZUXePmvgY7JSB5BIiY4ZxlnNbJy4756XDSBt41AaHxqWNcfs=-----END CERTIFICATE-----"
  }, {
    "version" : "V3",
    "serialNumber" : "f4:80:33:5f:e5:77:2a:f7",
    "issuedTo" : "sfo01m01nsx01.sfo01.rainpole.local",
    "issuedBy" : "OU=ISBU, O=VMware, L= Bangalore, ST=Karnataka, C=IN, CN=test1.openssl.eng.vmware.com",
    "notBefore" : "2019-07-25T07:38:55.000Z",
    "notAfter" : "2020-07-24T07:38:55.000Z",
    "signatureAlgorithm" : "SHA256withRSA",
    "subject" : "C=US, CN=sfo01m01nsx01.sfo01.rainpole.local",
    "subjectAlternativeName" : [ "sfo01m01nsx01.sfo01.rainpole.local" ],
    "publicKey" : "BA:16:16:DF:00:B2:88:C9:F9:E0:7F:72:B6:DC:83:1F:87:46:C3:C4:4B:8B:EB:C0:AD:B9:A2:FB:31:75:0A:89:12:25:58:B6:42:B1:78:A3:7F:19:B0:03:19:35:AD:51:5D:08:36:CB:C3:6E:63:B2:CE:89:2D:24:AD:EA:DD:BD:73:0A:06:84:4E:4D:83:AF:B8:EC:F9:E1:98:9F:35:9F:83:11:DD:71:61:5E:CF:DE:9A:BF:0D:A7:8A:64:F2:94:26:5D:A7:E0:20:B9:C2:01:BB:62:F2:7D:C3:A9:9B:91:DE:49:1E:97:B7:E8:CA:38:1C:E9:92:76:07:A8:26:95:5D:C1:89:E7:EA:27:03:57:BE:D2:76:B5:E4:AC:89:10:67:7F:42:DA:5D:52:5C:9F:65:59:A4:42:0B:81:F8:77:B5:F8:2D:18:DA:9B:1A:F4:BD:BD:F2:33:97:7A:EA:64:1B:CE:58:CF:9C:E7:18:60:94:CE:66:C9:57:7E:62:A2:AD:47:3D:29:D2:F8:DB:AB:D7:8F:D1:7D:8A:9A:FC:68:37:48:3C:AD:38:A5:76:D8:4C:E2:64:AE:87:B7:DA:78:3E:EB:2B:C8:70:43:4D:CB:4E:72:80:43:CB:D2:43:A7:71:16:22:27:0F:A1:DB:0A:83:88:2C:09:49:0A:35:8C:76:76:55:E2:3A:1C:7C:74:F0:91:60:A2:45:7F:6C:7A:2B:A5:51:87:25:D0:DB:9C:E0:B8:32:27:83:D6:3F:70:C5:7A:1B:92:09:E7:77:39:3A:C2:28:B1:5C:8A:3F:42:FE:D6:6A:7D:F6:E5:D6:FB:B0:DB:AB:D9:65:29:BE:75:DA:07:E8:38:B2:A0:75:9F:45:8E:FF:6B:AF:27:DB:FA:2E:AB:80:51:09:88:7D:7B:AC:A4:B7:15:41:30:A0:E1:0F:C7:DD:D1:F4:84:7D:D3:F8:B1:B0:F9:55:8F:A6:DC:44:E0:E6:0F:C5:DF:32:93:51:8D:7D:BA:79:4A:3E:72:CA:CB:9A:2E:8B:E6:A0:63:57:C8:CD:92:F8:70:0A:1E:6D:CA:DF:35:D4:91:45:E7:DB:7F:86:32:E9:8C:A3:D2:D0:35:15:70:A9:DA:39:DF:FA:76:9C:EF:5D:B6:A4:58:49:EE:A0:B1:74:33:D2:41:97:F6:FE:0C:07:66:DE:56:5F:3E:15:03:70:3D:56:80:5E:F6:CB:C3:FA:78:CE:14:0C:D7:E1:53:48:8B:5A:61:C0:04:BA:DD:ED:B3:E4:F1:76:AD:FD:03:27:C9:FB:EC:5A:75:0B:22:8F:6A:E8:35:47:FB:04:B7:A7:5F:51:FA:46:EF:00:64:03:27:1C:FB",
    "publicKeyAlgorithm" : "RSA",
    "keySize" : "2048",
    "thumbprintAlgorithm" : "SHA-256",
    "thumbprint" : "02:B1:D1:01:18:9F:07:39:E1:7C:94:BC:50:07:64:E8:45:8C:F8:73:3E:A9:23:BC:D2:BD:B1:17:E9:B3:C0:11",
    "numberOfDaysToExpire" : 365,
    "expirationStatus" : "ACTIVE",
    "pemEncoded" : "-----BEGIN CERTIFICATE-----MIIFRDCCBCygAwIBAgIJAOx9cA2cGcUUMA0GCSqGSIb3DQEBCwUAMIGgMQswCQYDVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExIjAgBgNVBAoMGXBzYy0xLnZyYWNrLnZzcGhlcmUubG9jYWwxGzAZBgNVBAsMElZNd2FyZSBFbmdpbmVlcmluZzAeFw0xODA3MDIxNDE1NTJaFw0yODA2MjcxMjIyMzlaMIGwMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJUGFsbyBBbHRvMQ8wDQYDVQQKEwZWTXdhcmUxGzAZBgNVBAsTElZNd2FyZSBFbmdpbmVlcmluZzEqMCgGA1UEAxMhbG9hZC1iYWxhbmNlci52cmFjay52c3BoZXJlLmxvY2FsMR4wHAYJKoZIhvcNAQkBFg92bWNhQHZtd2FyZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC6FhbfALKIyfngf3K23IMfh0bDxEuL68CtuaL7MXUKiRIlWLZCsXijfxmwAxk1rVFdCDbLw25jss6JLSSt6t29cwoGhE5Ng6+47PnhmJ81n4MR3XFhXs/emr8Np4pk8pQmXafgILnCAbti8n3DqZuR3kkel7foyjgc6ZJ2B6gmlV3BiefqJwNXvtJ2teSsiRBnf0LaXVJcn2VZpEILgfh3tfgtGNqbGvS9vfIzl3rqZBvOWM+c5xhglM5myVd+YqKtRz0p0vjbq9eP0X2KmvxoN0g8rTildthM4mSuh7faeD7rK8hwQ03LTnKAQ8vSQ6dxFiInD6HbCoOILAlJCjWMdnZV4jocfHTwkWCiRX9seiulUYcl0Nuc4LgyJ4PWP3DFehuSCed3OTrCKLFcij9C/tZqffbl1vuw26vZZSm+ddoH6DiyoHWfRY7/a68n2/ouq4BRCYh9e6yktxVBMKDhD8fd0fSEfdP4sbD5VY+m3ETg5g/F3zKTUY19unlKPnLKy5oui+agY1fIzZL4cAoebcrfNdSRRefbf4Yy6Yyj0tA1FXCp2jnf+nac7122pFhJ7qCxdDPSQZf2/gwHZt5WXz4VA3A9VoBe9svD+njOFAzX4VNIi1phwAS63e2z5PF2rf0DJ8n77Fp1CyKPaug1R/sEt6dfUfpG7wBkAycc+wIDAQABo28wbTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAyBgNVHREEKzApgiFsb2FkLWJhbGFuY2VyLnZyYWNrLnZzcGhlcmUubG9jYWyHBAoAAA8wHwYDVR0jBBgwFoAUauWGErq+/JHwQ3qju9Ch8V2097MwDQYJKoZIhvcNAQELBQADggEBAMCvNCQ3KsvncoYK9fI0cfcBYEpFuToB+duK7yztklf8P6PLRSWdU39KaG+xv5768K+xe90riOYs0Mhcs0IuUQW2F6kCnlW3ff2R3pvTeM3kGqXclk4KGKRNnhhsF3Ze8QW3drH0dzD3vNcumdLr+GvG6vF2O/Pl3+Nn9dwE72ZVl7Ai970jJM5CVjI+wST19ZQPpq1E3aad3Bk+AQcQCIGputBGkHFZUGX4T6jPH0uDOcSRjH7v6TXhF2Cury7zme0zpWYwC4RMH/AxqK4z6DlmAwu2zycN097TMM/ZUXePmvgY7JSB5BIiY4ZxlnNbJy4756XDSBt41AaHxqWNcfs=-----END CERTIFICATE-----"
  } ]
}

Tip	Refer to: View certificate of all the resources in a domain

Warning

Certificate installation will replace the already installed certificates.

Note	The CSRs cannot be fetched or downloaded after successful certificate installation.

Note	Only the latest generated CSRs will exist in the VCF environment after a series of generate CSR operation.

Note	Only the latest uploaded certificates will exist in the VCF environment after a series of upload certificate operation.

The following data is required
- ID of the vCenter

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vcenters/c0703437-6756-470b-9e1c-f9d3bbc9b1c6' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/vcenters/c0703437-6756-470b-9e1c-f9d3bbc9b1c6 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 196

{
  "id" : "c0703437-6756-470b-9e1c-f9d3bbc9b1c6",
  "fqdn" : "vi-1-vcenter.vrack.vsphere.local",
  "ipAddress" : "10.0.0.6",
  "domain" : {
    "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5"
  }
}

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vcenters' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/vcenters HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 447

{
  "elements" : [ {
    "id" : "c0703437-6756-470b-9e1c-f9d3bbc9b1c6",
    "fqdn" : "vi-1-vcenter.vrack.vsphere.local",
    "ipAddress" : "10.0.0.6",
    "domain" : {
      "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5"
    }
  }, {
    "id" : "c0703437-6846-470b-9e1c-f9d3bbc9b1c9",
    "fqdn" : "vdi-1-vcenter.vrack.vsphere.local",
    "ipAddress" : "10.0.0.20",
    "domain" : {
      "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c1"
    }
  } ]
}

The following data is required
- ID of the Domain

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vcenters?domainId=c0703437-6746-470b-9e1c-f9d3bbc9b1c5' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/vcenters?domainId=c0703437-6746-470b-9e1c-f9d3bbc9b1c5 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 233

{
  "elements" : [ {
    "id" : "c0703437-6756-470b-9e1c-f9d3bbc9b1c6",
    "fqdn" : "vi-1-vcenter.vrack.vsphere.local",
    "ipAddress" : "10.0.0.6",
    "domain" : {
      "id" : "c0703437-6746-470b-9e1c-f9d3bbc9b1c5"
    }
  } ]
}

The following data is required
- ID of the NSX-T Cluster

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/nsxt-clusters/d77231ad-bf61-4331-88f3-b52534d564ba' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/nsxt-clusters/d77231ad-bf61-4331-88f3-b52534d564ba HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 698

{
  "id" : "d77231ad-bf61-4331-88f3-b52534d564ba",
  "vipFqdn" : "vip-nsxt-vi-01.sfo01.rainpole.local",
  "vip" : "172.19.10.81",
  "domains" : [ {
    "id" : "5c6e4716-b069-4481-aa6e-4eca8bf5596a",
    "name" : "nsxt-vi-01"
  } ],
  "nodes" : [ {
    "fqdn" : "nsx-mgr1-nsxt-vi-01.sfo01.rainpole.local",
    "ipAddress" : "172.19.10.84",
    "name" : "nsx-mgr1-nsxt-vi-01"
  }, {
    "fqdn" : "nsx-mgr2-nsxt-vi-01.sfo01.rainpole.local",
    "ipAddress" : "172.19.10.83",
    "name" : "nsx-mgr2-nsxt-vi-01"
  }, {
    "fqdn" : "nsx-mgr3-nsxt-vi-01.sfo01.rainpole.local",
    "ipAddress" : "172.19.10.82",
    "name" : "nsx-mgr3-nsxt-vi-01"
  } ],
  "isShared" : true,
  "isVlcmCompatible" : false
}

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/nsxt-clusters' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/nsxt-clusters HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 771

{
  "elements" : [ [ {
    "id" : "d77231ad-bf61-4331-88f3-b52534d564ba",
    "vipFqdn" : "vip-nsxt-vi-01.sfo01.rainpole.local",
    "vip" : "172.19.10.81",
    "domains" : [ {
      "id" : "5c6e4716-b069-4481-aa6e-4eca8bf5596a",
      "name" : "nsxt-vi-01"
    } ],
    "nodes" : [ {
      "fqdn" : "nsx-mgr1-nsxt-vi-01.sfo01.rainpole.local",
      "ipAddress" : "172.19.10.84",
      "name" : "nsx-mgr1-nsxt-vi-01"
    }, {
      "fqdn" : "nsx-mgr2-nsxt-vi-01.sfo01.rainpole.local",
      "ipAddress" : "172.19.10.83",
      "name" : "nsx-mgr2-nsxt-vi-01"
    }, {
      "fqdn" : "nsx-mgr3-nsxt-vi-01.sfo01.rainpole.local",
      "ipAddress" : "172.19.10.82",
      "name" : "nsx-mgr3-nsxt-vi-01"
    } ],
    "isShared" : true,
    "isVlcmCompatible" : false
  } ] ]
}

The following data is required
- ID of the Sddc Manager

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-managers/ebb0944f-3b86-4872-9afa-2e80ce814c8f' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/sddc-managers/ebb0944f-3b86-4872-9afa-2e80ce814c8f HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 230

{
  "id" : "ebb0944f-3b86-4872-9afa-2e80ce814c8f",
  "fqdn" : "sddc-manager.vrack.vsphere.local",
  "version" : "3.9.0.0-14713675",
  "ipAddress" : "10.0.0.4",
  "domain" : {
    "id" : "d1f91ef5-dfa2-48e7-adde-cd37b0aa7911"
  }
}

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/sddc-managers' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/sddc-managers HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 269

{
  "elements" : [ {
    "id" : "ebb0944f-3b86-4872-9afa-2e80ce814c8f",
    "fqdn" : "sddc-manager.vrack.vsphere.local",
    "version" : "3.9.0.0-14713675",
    "ipAddress" : "10.0.0.4",
    "domain" : {
      "id" : "d1f91ef5-dfa2-48e7-adde-cd37b0aa7911"
    }
  } ]
}

The following data is required
- ID of the VCF Service

Steps

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vcf-services/bc0debfe-bd38-453a-822d-fdd012fbd0b2' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/vcf-services/bc0debfe-bd38-453a-822d-fdd012fbd0b2 HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 112

{
  "id" : "bc0debfe-bd38-453a-822d-fdd012fbd0b2",
  "name" : "COMMON_SERVICES",
  "version" : "3.8.2-RELEASE"
}

Invoke the API.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/vcf-services' -i -X GET \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/vcf-services HTTP/1.1
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 744

{
  "elements" : [ {
    "id" : "bc0debfe-bd38-453a-822d-fdd012fbd0b2",
    "name" : "COMMON_SERVICES",
    "version" : "3.8.2-RELEASE"
  }, {
    "id" : "174ca011-0f17-48ec-a4cb-8fc3d35149bd",
    "name" : "DOMAIN_MANAGER",
    "version" : "3.8.2-RELEASE"
  }, {
    "id" : "8c64a3f9-fa12-4d00-ba19-9fe747e2bda",
    "name" : "OPERATIONS_MANAGER",
    "version" : "3.8.2-RELEASE"
  }, {
    "id" : "8bd696dc-958a-482a-9747-4f4e172a3005",
    "name" : "LCM",
    "version" : "3.8.2-RELEASE"
  }, {
    "id" : "9294a99d-8755-4298-9fb6-a255ab6a12f4",
    "name" : "SDDC_MANAGER_UI",
    "version" : "3.8.2-RELEASE"
  }, {
    "id" : "20f1f50f-8e50-4f19-9fd0-3472330b0fb2",
    "name" : "SOLUTIONS_MANAGER",
    "version" : "3.8.2-RELEASE"
  } ]
}

The new DNS server to be configured should be reachable from SDDC components.
DNS resolution (forward and reverse lookup) for all management VMs and ESXi hosts in place
All SDDC components should be reachable from SDDC manager.
All SDDC components state should be "ACTIVE" in VCF inventory.

Steps

Validate the DnsConfiguration input before configuration.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/dns-configuration/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "dnsServers" : [ {
    "ipAddress" : "10.0.0.250",
    "isPrimary" : true
  } ]
}'

HTTP Request

POST /v1/system/dns-configuration/validations HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 85
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "dnsServers" : [ {
    "ipAddress" : "10.0.0.250",
    "isPrimary" : true
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/system/dns-servers/validations/71653367-2ea8-49f2-bf72-0e0e1fa57dcd
Content-Type: application/json
Content-Length: 407

{
  "id" : "71653367-2ea8-49f2-bf72-0e0e1fa57dcd",
  "description" : "Validate input specification as new NtpConfiguration to VMware Cloud Foundations",
  "executionStatus" : "IN_PROGRESS",
  "validationChecks" : [ {
    "description" : "Validating NTP input specification",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Validating NTP server 10.0.0.250",
    "resultStatus" : "UNKNOWN"
  } ]
}

Poll until "executionStatus" is not "IN_PROGRESS" using the "id" from the previous response.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/dns-configuration/validations/71653367-2ea8-49f2-bf72-0e0e1fa57dcd' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/system/dns-configuration/validations/71653367-2ea8-49f2-bf72-0e0e1fa57dcd HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 407

{
  "id" : "71653367-2ea8-49f2-bf72-0e0e1fa57dcd",
  "description" : "Validate input specification as new NtpConfiguration to VMware Cloud Foundations",
  "executionStatus" : "IN_PROGRESS",
  "validationChecks" : [ {
    "description" : "Validating NTP input specification",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Validating NTP server 10.0.0.250",
    "resultStatus" : "UNKNOWN"
  } ]
}

In case of no errors in the validation , the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".
In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note	Make changes to the input specification and re-validate using a new API invocation.

Trigger the task using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/dns-configuration' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "dnsServers" : [ {
    "ipAddress" : "10.0.0.250",
    "isPrimary" : true
  } ]
}'

HTTP Request

PUT /v1/system/dns-configuration HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 85
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "dnsServers" : [ {
    "ipAddress" : "10.0.0.250",
    "isPrimary" : true
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/f0da79cd-6f5c-4118-95cc-e56af204e4cd
Content-Type: application/json
Content-Length: 131

{
  "id" : "f0da79cd-6f5c-4118-95cc-e56af204e4cd",
  "name" : "Configuring DNS servers on VCF system",
  "status" : "IN_PROGRESS"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

Get the DnsConfiguration state.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/dns-configuration' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/system/dns-configuration HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 85

{
  "dnsServers" : [ {
    "ipAddress" : "10.0.0.250",
    "isPrimary" : true
  } ]
}

The new NTP server(s) to be configured should be reachable from SDDC components.
The new NTP server(s) should be able to do NTP sync from SDDC Manager.
All SDDC components should be reachable from SDDC manager.
All SDDC components state should be active as per SDDC Manager.
The new server should be NTP synced from the SDDC Manager.

Steps

Perform the validation step for the desired NTP configuration before applying the same.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/ntp-configuration/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "ntpServers" : [ {
    "ipAddress" : "10.0.0.250"
  } ]
}'

HTTP Request

POST /v1/system/ntp-configuration/validations HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 61
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "ntpServers" : [ {
    "ipAddress" : "10.0.0.250"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/system/ntp-servers/validations/71653367-2ea8-49f2-bf72-0e0e1fa57dcd
Content-Type: application/json
Content-Length: 407

{
  "id" : "71653367-2ea8-49f2-bf72-0e0e1fa57dcd",
  "description" : "Validate input specification as new NtpConfiguration to VMware Cloud Foundations",
  "executionStatus" : "IN_PROGRESS",
  "validationChecks" : [ {
    "description" : "Validating NTP input specification",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Validating NTP server 10.0.0.250",
    "resultStatus" : "UNKNOWN"
  } ]
}

Poll until "executionStatus" is not "IN_PROGRESS" using the "id" from the previous response.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/ntp-configuration/validations/71653367-2ea8-49f2-bf72-0e0e1fa57dcd' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/system/ntp-configuration/validations/71653367-2ea8-49f2-bf72-0e0e1fa57dcd HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 407

{
  "id" : "71653367-2ea8-49f2-bf72-0e0e1fa57dcd",
  "description" : "Validate input specification as new NtpConfiguration to VMware Cloud Foundations",
  "executionStatus" : "IN_PROGRESS",
  "validationChecks" : [ {
    "description" : "Validating NTP input specification",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Validating NTP server 10.0.0.250",
    "resultStatus" : "UNKNOWN"
  } ]
}

In case of no errors in the validation , the "executionStatus" is "COMPLETED" and "resultStatus" is "SUCCEEDED".

In case of errors in the input specification, the "executionStatus" is "COMPLETED" and "resultStatus" is "FAILED".

Note	Make changes to the input specification and re-validate using a new API invocation.

As the Validation is complete now, perform the NTP configuration using the valid input specification.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/ntp-configuration' -i -X PUT \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "ntpServers" : [ {
    "ipAddress" : "10.0.0.250"
  } ]
}'

HTTP Request

PUT /v1/system/ntp-configuration HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 61
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "ntpServers" : [ {
    "ipAddress" : "10.0.0.250"
  } ]
}

HTTP Response

HTTP/1.1 202 Accepted
Location: /v1/tasks/28d3f5ae-8072-4b83-ac99-b18d465485bc
Content-Type: application/json
Content-Length: 131

{
  "id" : "28d3f5ae-8072-4b83-ac99-b18d465485bc",
  "name" : "Configuring NTP servers on VCF system",
  "status" : "IN_PROGRESS"
}

Poll the task until "status" is not "IN_PROGRESS" using the "id" from the previous response.

Tip	Refer to: Get a Task.

If the "status" is "SUCCESSFUL", the task is completed successfully.
If the "status" is "FAILED", the task can be re-executed.

Tip	Refer to: Retry a Task.

Get the DnsConfiguration state

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/system/ntp-configuration' -i -X GET \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/system/ntp-configuration HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 61

{
  "ntpServers" : [ {
    "ipAddress" : "10.0.0.250"
  } ]
}

Are Separate VLANs and subnets available to be used for Host VTEP VLAN and Edge VTEP VLAN.
Host VTEP VLAN and Edge VTEP VLAN need to be routed.
If dynamic routing is desired, set up two BGP Peers (on TORs or infra ESG) with an interface IP, ASN and BGP password.
Reserve an ASN to use for the NSX-T Edge cluster’s T0 interfaces.
DNS entries for NSX-T Edge components should be populated in customer managed DNS server.
The vSphere clusters hosting the edge clusters should be contained in a Rack.

The following data is required for the Validate an Edge Cluster spec:

Edge Cluster name
Maximum transmission unit
ASN to be used for the edge cluster
Edge Cluster profile type. Ex: DEFAULT, CUSTOM
Edge Cluster type. Ex: NSX-T, NSX-V
Edge Cluster form factor. Ex: LARGE, MEDIUM, SMALL
Edge Cluster profile spec. Refer to: NsxTEdgeClusterProfileSpec
Edge Node specs. Refer to: NsxTEdgeNodeSpec
Name for the T0.
Tier 0 Routing type. Ex: EBGP, STATIC
High-availability Mode for Tier-0. Ex: ACTIVE_ACTIVE, ACTIVE_STANDBY
Name for the T1.

Tip	Refer to: EdgeClusterCreationSpec.

Steps

Validate the input specification using Validate an Edge Cluster spec.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/edge-clusters/validations' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "edgeClusterName" : "acme-edge-cluster",
  "edgeClusterType" : "NSX-T",
  "edgeRootPassword" : "Acme123!Acme123!",
  "edgeAdminPassword" : "Acme123!Acme123!",
  "edgeAuditPassword" : "Acme123!Acme123!",
  "edgeFormFactor" : "MEDIUM",
  "tier0ServicesHighAvailability" : "ACTIVE_ACTIVE",
  "mtu" : 9000,
  "asn" : 65003,
  "edgeNodeSpecs" : [ {
    "edgeNodeName" : "nsxt-edge-node-1.vrack.vsphere.local",
    "managementIP" : "10.0.0.50/24",
    "managementGateway" : "10.0.0.250",
    "edgeTepGateway" : "192.168.52.1",
    "edgeTep1IP" : "192.168.52.10/24",
    "edgeTep2IP" : "192.168.52.11/24",
    "edgeTepVlan" : 1252,
    "clusterId" : "d1052c9c-6973-4e32-8034-06e7fa71e83c",
    "interRackCluster" : false,
    "uplinkNetwork" : [ {
      "uplinkVlan" : 2081,
      "uplinkInterfaceIP" : "192.168.16.2/24",
      "peerIP" : "192.168.16.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    }, {
      "uplinkVlan" : 2082,
      "uplinkInterfaceIP" : "192.168.17.2/24",
      "peerIP" : "192.168.17.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    } ]
  }, {
    "edgeNodeName" : "nsxt-edge-node-2.vrack.vsphere.local",
    "managementIP" : "10.0.0.51/24",
    "managementGateway" : "10.0.0.250",
    "edgeTepGateway" : "192.168.52.1",
    "edgeTep1IP" : "192.168.52.12/24",
    "edgeTep2IP" : "192.168.52.13/24",
    "edgeTepVlan" : 1252,
    "clusterId" : "d1052c9c-6973-4e32-8034-06e7fa71e83c",
    "interRackCluster" : false,
    "uplinkNetwork" : [ {
      "uplinkVlan" : 2081,
      "uplinkInterfaceIP" : "192.168.16.3/24",
      "peerIP" : "192.168.16.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    }, {
      "uplinkVlan" : 2082,
      "uplinkInterfaceIP" : "192.168.17.3/24",
      "peerIP" : "192.168.17.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    } ]
  } ],
  "tier0RoutingType" : "EBGP",
  "tier0Name" : "Acme-Tier0",
  "tier1Name" : "Acme-Tier1",
  "edgeClusterProfileType" : "DEFAULT"
}'

HTTP Request

POST /v1/edge-clusters/validations HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 2005
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "edgeClusterName" : "acme-edge-cluster",
  "edgeClusterType" : "NSX-T",
  "edgeRootPassword" : "Acme123!Acme123!",
  "edgeAdminPassword" : "Acme123!Acme123!",
  "edgeAuditPassword" : "Acme123!Acme123!",
  "edgeFormFactor" : "MEDIUM",
  "tier0ServicesHighAvailability" : "ACTIVE_ACTIVE",
  "mtu" : 9000,
  "asn" : 65003,
  "edgeNodeSpecs" : [ {
    "edgeNodeName" : "nsxt-edge-node-1.vrack.vsphere.local",
    "managementIP" : "10.0.0.50/24",
    "managementGateway" : "10.0.0.250",
    "edgeTepGateway" : "192.168.52.1",
    "edgeTep1IP" : "192.168.52.10/24",
    "edgeTep2IP" : "192.168.52.11/24",
    "edgeTepVlan" : 1252,
    "clusterId" : "d1052c9c-6973-4e32-8034-06e7fa71e83c",
    "interRackCluster" : false,
    "uplinkNetwork" : [ {
      "uplinkVlan" : 2081,
      "uplinkInterfaceIP" : "192.168.16.2/24",
      "peerIP" : "192.168.16.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    }, {
      "uplinkVlan" : 2082,
      "uplinkInterfaceIP" : "192.168.17.2/24",
      "peerIP" : "192.168.17.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    } ]
  }, {
    "edgeNodeName" : "nsxt-edge-node-2.vrack.vsphere.local",
    "managementIP" : "10.0.0.51/24",
    "managementGateway" : "10.0.0.250",
    "edgeTepGateway" : "192.168.52.1",
    "edgeTep1IP" : "192.168.52.12/24",
    "edgeTep2IP" : "192.168.52.13/24",
    "edgeTepVlan" : 1252,
    "clusterId" : "d1052c9c-6973-4e32-8034-06e7fa71e83c",
    "interRackCluster" : false,
    "uplinkNetwork" : [ {
      "uplinkVlan" : 2081,
      "uplinkInterfaceIP" : "192.168.16.3/24",
      "peerIP" : "192.168.16.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    }, {
      "uplinkVlan" : 2082,
      "uplinkInterfaceIP" : "192.168.17.3/24",
      "peerIP" : "192.168.17.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    } ]
  } ],
  "tier0RoutingType" : "EBGP",
  "tier0Name" : "Acme-Tier0",
  "tier1Name" : "Acme-Tier1",
  "edgeClusterProfileType" : "DEFAULT"
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Content-Length: 1947

{
  "id" : "4e6904b4-8b64-4bb5-98e0-1d7e906f2911",
  "description" : "Validating NSX-T Edge Cluster Creation Spec",
  "executionStatus" : "IN_PROGRESS",
  "resultStatus" : "UNKNOWN",
  "validationChecks" : [ {
    "description" : "Distinct edge TEP IPs for edge nodes.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Validate that IPs are in same subnet.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check for edge management IP to edge node FQDN resolution.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check for duplicates : duplicate edge cluster name.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Capacity check for hosting vsphere cluster/s.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check for L2 non-uniform and L3 cluster.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Two distinct uplink interfaces per edge node.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check that Edge cluster with the same name does not exist in NSX-T manager.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "The vSphere cluster/s hosting the edge cluster belong to the same workload domain.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Edge cluster password/s is not meeting Nsxt paswword policy standard.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Compliance of edge cluster size with tier0 HA mode.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check for IP conflict for edge management IP, edge TEP IPs, Tier0 uplink interface IPs.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check that Uplink VLANs are valid.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check that T0 with the same name does not exist.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check that T1 with the same name does not exist.",
    "resultStatus" : "UNKNOWN"
  } ]
}

Poll the status of the validation using the validation API with the ID from the response of the previous API.

Tip	Refer to: Validate Edge Cluster.

ID of the Edge Cluster Validation

Steps

Invoke the Get the Edge Cluster spec validation.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/edge-clusters/validations/3b57b387-9e60-4377-8a08-4c5fbfd62307' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/edge-clusters/validations/3b57b387-9e60-4377-8a08-4c5fbfd62307 HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1947

{
  "id" : "3b57b387-9e60-4377-8a08-4c5fbfd62307",
  "description" : "Validating NSX-T Edge Cluster Creation Spec",
  "executionStatus" : "IN_PROGRESS",
  "resultStatus" : "UNKNOWN",
  "validationChecks" : [ {
    "description" : "Distinct edge TEP IPs for edge nodes.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Validate that IPs are in same subnet.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check for edge management IP to edge node FQDN resolution.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check for duplicates : duplicate edge cluster name.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Capacity check for hosting vsphere cluster/s.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check for L2 non-uniform and L3 cluster.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Two distinct uplink interfaces per edge node.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check that Edge cluster with the same name does not exist in NSX-T manager.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "The vSphere cluster/s hosting the edge cluster belong to the same workload domain.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Edge cluster password/s is not meeting Nsxt paswword policy standard.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Compliance of edge cluster size with tier0 HA mode.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check for IP conflict for edge management IP, edge TEP IPs, Tier0 uplink interface IPs.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check that Uplink VLANs are valid.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check that T0 with the same name does not exist.",
    "resultStatus" : "UNKNOWN"
  }, {
    "description" : "Check that T1 with the same name does not exist.",
    "resultStatus" : "UNKNOWN"
  } ]
}

Are Separate VLANs and subnets available to be used for Host VTEP VLAN and Edge VTEP VLAN.
Host VTEP VLAN and Edge VTEP VLAN need to be routed.
If dynamic routing is desired, set up two BGP Peers (on TORs or infra ESG) with an interface IP, ASN and BGP password.
Reserve an ASN to use for the NSX-T Edge cluster’s T0 interfaces.
DNS entries for NSX-T Edge components should be populated in customer managed DNS server.
The vSphere clusters hosting the edge clusters should be contained in a Rack.

The following data is required for the Create an Edge Cluster:

Edge Cluster name
Maximum transmission unit
ASN to be used for the edge cluster
Edge Cluster profile type. Ex: DEFAULT, CUSTOM
Edge Cluster type. Ex: NSX-T, NSX-V
Edge Cluster form factor. Ex: LARGE, MEDIUM, SMALL
Edge Cluster profile spec. Refer to: NsxTEdgeClusterProfileSpec
Edge Node specs. Refer to: NsxTEdgeNodeSpec
Name for the T0.
Tier 0 Routing type. Ex: EBGP, STATIC
High-availability Mode for Tier-0. Ex: ACTIVE_ACTIVE, ACTIVE_STANDBY
Name for the T1.

Tip	Refer to: EdgeClusterCreationSpec.

Steps

Invoke the Create an Edge Cluster. This API returns a task which can be polled and monitored.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/edge-clusters' -i -X POST \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....' \
    -d '{
  "edgeClusterName" : "acme-edge-cluster",
  "edgeClusterType" : "NSX-T",
  "edgeRootPassword" : "Acme123!Acme123!",
  "edgeAdminPassword" : "Acme123!Acme123!",
  "edgeAuditPassword" : "Acme123!Acme123!",
  "edgeFormFactor" : "MEDIUM",
  "tier0ServicesHighAvailability" : "ACTIVE_ACTIVE",
  "mtu" : 9000,
  "asn" : 65003,
  "edgeNodeSpecs" : [ {
    "edgeNodeName" : "nsxt-edge-node-1.vrack.vsphere.local",
    "managementIP" : "10.0.0.50/24",
    "managementGateway" : "10.0.0.250",
    "edgeTepGateway" : "192.168.52.1",
    "edgeTep1IP" : "192.168.52.10/24",
    "edgeTep2IP" : "192.168.52.11/24",
    "edgeTepVlan" : 1252,
    "clusterId" : "d1052c9c-6973-4e32-8034-06e7fa71e83c",
    "interRackCluster" : false,
    "uplinkNetwork" : [ {
      "uplinkVlan" : 2081,
      "uplinkInterfaceIP" : "192.168.16.2/24",
      "peerIP" : "192.168.16.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    }, {
      "uplinkVlan" : 2082,
      "uplinkInterfaceIP" : "192.168.17.2/24",
      "peerIP" : "192.168.17.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    } ]
  }, {
    "edgeNodeName" : "nsxt-edge-node-2.vrack.vsphere.local",
    "managementIP" : "10.0.0.51/24",
    "managementGateway" : "10.0.0.250",
    "edgeTepGateway" : "192.168.52.1",
    "edgeTep1IP" : "192.168.52.12/24",
    "edgeTep2IP" : "192.168.52.13/24",
    "edgeTepVlan" : 1252,
    "clusterId" : "d1052c9c-6973-4e32-8034-06e7fa71e83c",
    "interRackCluster" : false,
    "uplinkNetwork" : [ {
      "uplinkVlan" : 2081,
      "uplinkInterfaceIP" : "192.168.16.3/24",
      "peerIP" : "192.168.16.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    }, {
      "uplinkVlan" : 2082,
      "uplinkInterfaceIP" : "192.168.17.3/24",
      "peerIP" : "192.168.17.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    } ]
  } ],
  "tier0RoutingType" : "EBGP",
  "tier0Name" : "Acme-Tier0",
  "tier1Name" : "Acme-Tier1",
  "edgeClusterProfileType" : "DEFAULT"
}'

HTTP Request

POST /v1/edge-clusters HTTP/1.1
Content-Type: application/json
Accept: application/json
Content-Length: 2005
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

{
  "edgeClusterName" : "acme-edge-cluster",
  "edgeClusterType" : "NSX-T",
  "edgeRootPassword" : "Acme123!Acme123!",
  "edgeAdminPassword" : "Acme123!Acme123!",
  "edgeAuditPassword" : "Acme123!Acme123!",
  "edgeFormFactor" : "MEDIUM",
  "tier0ServicesHighAvailability" : "ACTIVE_ACTIVE",
  "mtu" : 9000,
  "asn" : 65003,
  "edgeNodeSpecs" : [ {
    "edgeNodeName" : "nsxt-edge-node-1.vrack.vsphere.local",
    "managementIP" : "10.0.0.50/24",
    "managementGateway" : "10.0.0.250",
    "edgeTepGateway" : "192.168.52.1",
    "edgeTep1IP" : "192.168.52.10/24",
    "edgeTep2IP" : "192.168.52.11/24",
    "edgeTepVlan" : 1252,
    "clusterId" : "d1052c9c-6973-4e32-8034-06e7fa71e83c",
    "interRackCluster" : false,
    "uplinkNetwork" : [ {
      "uplinkVlan" : 2081,
      "uplinkInterfaceIP" : "192.168.16.2/24",
      "peerIP" : "192.168.16.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    }, {
      "uplinkVlan" : 2082,
      "uplinkInterfaceIP" : "192.168.17.2/24",
      "peerIP" : "192.168.17.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    } ]
  }, {
    "edgeNodeName" : "nsxt-edge-node-2.vrack.vsphere.local",
    "managementIP" : "10.0.0.51/24",
    "managementGateway" : "10.0.0.250",
    "edgeTepGateway" : "192.168.52.1",
    "edgeTep1IP" : "192.168.52.12/24",
    "edgeTep2IP" : "192.168.52.13/24",
    "edgeTepVlan" : 1252,
    "clusterId" : "d1052c9c-6973-4e32-8034-06e7fa71e83c",
    "interRackCluster" : false,
    "uplinkNetwork" : [ {
      "uplinkVlan" : 2081,
      "uplinkInterfaceIP" : "192.168.16.3/24",
      "peerIP" : "192.168.16.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    }, {
      "uplinkVlan" : 2082,
      "uplinkInterfaceIP" : "192.168.17.3/24",
      "peerIP" : "192.168.17.10/24",
      "asnPeer" : 65001,
      "bgpPeerPassword" : "Acme1!"
    } ]
  } ],
  "tier0RoutingType" : "EBGP",
  "tier0Name" : "Acme-Tier0",
  "tier1Name" : "Acme-Tier1",
  "edgeClusterProfileType" : "DEFAULT"
}

HTTP Response

HTTP/1.1 202 Accepted
Content-Type: application/json
Location: /v1/tasks/93405dfc-59ea-425f-99fe-0af2c796a626
Content-Length: 170

{
  "id" : "93405dfc-59ea-425f-99fe-0af2c796a626",
  "name" : "Add a NSX-T edge cluster",
  "status" : "IN_PROGRESS",
  "creationTimestamp" : "2020-04-10T06:33:47.721Z"
}

Poll the status of the task using the task API with the ID from the response of the previous API.

Tip	Refer to: Get a Task.

2.27.4. Get the Edge Clusters

Get the Edge Clusters API is used to get all the edge clusters.

Prerequisites

None

Steps

Invoke the Get the Edge Clusters.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/edge-clusters' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/edge-clusters HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 346

{
  "elements" : [ {
    "id" : "618eb382-f84f-4f56-b92f-66a1c262d389",
    "name" : "acme-edge-cluster",
    "clusters" : [ {
      "id" : "d1052c9c-6973-4e32-8034-06e7fa71e83c"
    } ],
    "nsxtCluster" : {
      "id" : "84f3c671-bbbe-4b3c-89d8-4600409cb5f9",
      "vipFqdn" : "vip-nsxt-mgmt.acme.com",
      "vip" : "10.0.0.30"
    }
  } ]
}

2.27.5. Get Edge Cluster

Get an Edge Cluster API is used to get a specific edge cluster.

Prerequisites

The following data is required:
- ID of the Edge Cluster

Steps

Invoke the Get an Edge Cluster.

cURL Request

$ curl 'https://sddc-manager.sfo01.rainpole.local/v1/edge-clusters/16872ff8-186a-4b0c-a639-5d50c96738e4' -i -X GET \
    -H 'Accept: application/json' \
    -H 'Authorization: Bearer etYWRta....'

HTTP Request

GET /v1/edge-clusters/16872ff8-186a-4b0c-a639-5d50c96738e4 HTTP/1.1
Accept: application/json
Host: sddc-manager.sfo01.rainpole.local
Authorization: Bearer etYWRta....

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 301

{
  "id" : "8f4f3457-24b7-429c-b233-1974f4d25fb3",
  "name" : "acme-edge-cluster",
  "clusters" : [ {
    "id" : "d1052c9c-6973-4e32-8034-06e7fa71e83c"
  } ],
  "nsxtCluster" : {
    "id" : "099162b2-1dfb-420b-a6bb-1c51d953bc40",
    "vipFqdn" : "vip-nsxt-mgmt.acme.com",
    "vip" : "10.0.0.30"
  }
}

Create NSX-T VI workload domain.
1. VUM (vSphere Update Manager) option should be enabled.

Tip	Refer to: Create a Domain

Deploy an NSX-T Edge cluster with the following properties:
1. Edge Form Factor - Large
2. Tier0 Service High Availability - Active-Active

Tip	Refer to: Create an Edge Cluster

All hosts in the cluster where you want to deploy Workload Management must have a vSphere with Kubernetes license applied on them.
Workload Management supports one Edge cluster per transport zone, so ensure that the overlay transport zone connected to this cluster does not have other Edge clusters connected to it.
The following subnets must have been defined:
1. Subnet for pod networking (non-routable), minimum of a /22 subnet.
2. Subnet for Service IP addresses (non-routable), minimum of a /24 subnet.
3. Subnet for Ingress (routable), minimum of a /27 subnet.
4. Subnet for Egress (routable), minimum of a /27 subnet.
Create OIDC registration using NSX-T API.

Steps

Enable Workload Management using vCenter API.