DSM API Guide for VCF Automation Provider Administrator

Overview

As a Provider Administrator, you are responsible for configuring the DSM infrastructure that tenant organizations consume. This includes creating SQL Server clusters, defining Active Directory domains, and creating Data Service Policies that govern what resources tenant users can access.

For the full API reference, see the DSM Kubernetes API.

Prerequisites

Before configuring DSM in VCF Automation, the Provider Administrator must complete these steps:

Enable DSM for a region in VCF Automation via the VMware Data Services Manager under VCF Services.
(Optional) If deploying a Standalone DSM instance, install the DSM Consumption Operator Supervisor Service on the regional Supervisor(s) in vCenter.
Create a VCF Automation organization named DataServiceProvider, configure regional quotas, and create project namespaces within it. Set this as the dedicated DSM Provider Organization. Note: This is a one-time operation at the global level. This organization is dedicated to Provider Administrators for managing regional infrastructure for data service consumption, which customer tenants will share.

For more information on configuring VMware Data Services Manager in VCF Automation, see Using VMware Data Services Manager with VMware Cloud Foundation Automation as a Provider

Provider Administrator Capabilities

A VCF Automation Provider Administrator can perform the following operations:

Create, retrieve, update, delete (namespaced in dsm-system): SQLServerCluster, ActiveDirectoryDomain, DataServicePolicy
Retrieve, update (namespaced in dsm-system): VCFANetworkSecurityConfig, LoadBalancerNetworkSecurityConfig
Retrieve (namespaced in dsm-system): BackupLocation
Retrieve (non-namespaced): DataServiceVersion, InfrastructurePolicy, SupervisorInfrastructurePolicy

Authentication

DSM Kubernetes APIs require a VCF Automation access token for authentication. For details on obtaining tokens (including via SSO or your organization’s identity provider), refer to the VCF Automation documentation.

The following example uses the VCF Automation Provider Login API to authenticate as the system administrator. The credentials are encoded as username@system:password in Base64 and passed in the Authorization header.

Property	Value
Method & Path	`POST https://{vcfa_host}/cloudapi/1.0.0/sessions/provider`
Headers	`Accept: application/json;version={api_version}` and `Authorization: Basic {base64(username@system:password)}`

Note: Replace {api_version} with the supported API version. For details, see VCF Automation OpenAPI Principles.

Extract the access token from the response header x-vmware-vcloud-access-token.

Note: The access token is short-lived. If it has expired, the server responds with a 401 Unauthorized error. Re-authenticate to obtain a fresh token.

Configure DSM API Client

VCF Automation Data Service exposes a proxy that gives provider administrators access to DSM Kubernetes APIs. The proxy endpoint URL follows this pattern:

https://{vcfa_host}/proxy/external-endpoint/api/dsm/regions/{region_name}

Option 1: kubectl with kubeconfig

Construct a kubeconfig file using the VCF Automation access token and the DSM proxy endpoint URL:

apiVersion: v1
kind: Config
clusters:
- cluster:
    server: https://{vcfa_host}/proxy/external-endpoint/api/dsm/regions/{region_name}
    insecure-skip-tls-verify: true
  name: vcfa-dsm
contexts:
- context:
    cluster: vcfa-dsm
    user: vcfa-user
    namespace: dsm-system
  name: vcfa-dsm
current-context: vcfa-dsm
users:
- name: vcfa-user
  user:
    token: {vcfa_access_token}

Use kubectl (the Kubernetes command-line tool) to verify that the kubeconfig is correctly configured. The following command lists Data Service Policies, SQL Server Clusters, and Backup Locations in the dsm-system namespace:

export KUBECONFIG=vcfa-admin-kubeconfig.yaml
kubectl get dataservicepolicy,sqlservercluster,backuplocation -n dsm-system

Option 2: Direct REST API

The VCF Automation Proxy API can also be used to manage DSM resources directly. The DSM Kubernetes API is accessed through the proxy URL pattern shown above.

The following example lists all DataServicePolicy resources in the dsm-system namespace — equivalent to running kubectl get dataservicepolicy -n dsm-system. You can similarly substitute other resource types and namespaces to retrieve other DSM resources.

List DataServicePolicies (example)

Property	Value
Method & Path	`GET https://{vcfa_host}/proxy/external-endpoint/api/dsm/regions/{region_name}/apis/infrastructure.dataservices.vmware.com/v1alpha1/namespaces/dsm-system/dataservicepolicies`
Headers	`Authorization: Bearer {vcfa_access_token}`
Path Parameters	`vcfa_host` — VCF Automation hostname and `region_name` — DSM enabled region name

DSM System Resources

Provider administrators manage the following resource types. Full field specifications are available on the DSM Kubernetes API.

Namespaced in dsm-system: - SQLServerCluster — SQL Server cluster - DataServicePolicy — policies that control what tenant namespaces can provision - ActiveDirectoryDomain — Active Directory configurations for SQL Server authentication - BackupLocation — backup storage configurations (retrieve only) - VCFANetworkSecurityConfig — network security settings for regional external integrations - LoadBalancerNetworkSecurityConfig — network security configurations for Kubernetes API server and database load balancer services

Non-namespaced: - DataServiceVersion — available DSM database versions - InfrastructurePolicy — common infrastructure policies - SupervisorInfrastructurePolicy — infrastructure policies sourced from the Supervisor

API Samples

Create SQL Server Cluster

Before creating a SQL Server cluster, identify the expected InfrastructurePolicy or SupervisorInfrastructurePolicy (non-namespaced) for compute placement, and the DataServiceVersion (non-namespaced) entries for supported SQL Server versions.

To provision a SQLServerCluster resource, please refer to the API samples provided in the API Samples documentation.

To provision an ActiveDirectoryDomain resource, please refer to the API samples provided in the API Samples documentation.

Create Data Service Policy

A DataServicePolicy defines what resources a tenant namespace can use.

For the full DataServicePolicy field reference, see the DSM Kubernetes API.

The matchCriteria field scopes a DataServicePolicy to specific tenant organizations using the VCF Automation organization ID. The following example uses the VCF Automation Orgs API to look up that ID by organization display name.

Query Orgs (example)

Property	Value
Method & Path	`GET https://{vcfa_host}/cloudapi/1.0.0/orgs`
Headers	`Accept: application/json;version={api_version};multisite=global` and `Authorization: Bearer {vcfa_access_token}`
Query Parameters	`filter` — FIQL filter expression, e.g. `displayName=={org_name}`

Note: Replace {api_version} with the supported API version. For details, see VCF Automation OpenAPI Principles.

Success Response (200 OK):

{
  "resultTotal": 1,
  "values": [
    {
      "id": "urn:vcloud:org:da260cd4-25c2-4687-bfaf-3c1035564abf",
      "name": "my-org",
      "displayName": "My Organization",
      "isEnabled": true
    }
  ]
}

Use the id value from the response as the value in matchCriteria.

To provision a DataServicePolicy resource, please refer to the API samples provided in the API Samples documentation.

Note: All DataServicePolicy resources created for VCF Automation must include the label dsm.vmware.com/created-in: vcfa. This label identifies the policy as VCF Automation-managed and is required for proper integration.

Note: The matchCriteria must use the key vcfa.vmware.com/org with the organization ID as the value. This ensures the policy is applied only to namespaces belonging to the specified organization.

Manage Network Security Configuration

The Data Services Manager Network Security feature is introduced in version 9.1.1.0. This feature allows Provider Administrators to enable or disable network security configurations (such as VPCs, load balancers, and firewall rules) for regional external integrations.

The network-security-config resource of type VCFANetworkSecurityConfig (short name: vnsc) is a singleton resource in the dsm-system namespace. It is automatically created once the Provider Organization and Region are successfully configured in the VCFABinding resource.

For the full VCFANetworkSecurityConfig field reference, see the DSM Kubernetes API.

To enable or disable the network security configuration, apply a JSON merge patch to the singleton VCFANetworkSecurityConfig resource.

Enable Network Security:

kubectl patch vcfanetworksecurityconfig network-security-config \
  -n dsm-system \
  --type=merge \
  -p '{"spec":{"enabled":true}}'

Disable Network Security:

kubectl patch vcfanetworksecurityconfig network-security-config \
  -n dsm-system \
  --type=merge \
  -p '{"spec":{"enabled":false}}'

Manage Load Balancer Network Security Configurations

When a database cluster (PostgresCluster, MySQLCluster, or SQLServerCluster) is created, DSM automatically creates two LoadBalancerNetworkSecurityConfig (short name: lbnsc) resources in the dsm-system namespace: - One for the Kubernetes API server IP as the LoadBalancerIP (with spec.serviceType set to k8s) - One for the database service IP as the LoadBalancerIP (with spec.serviceType set to db)

Note for SQL Server: Because a SQLServerCluster is provisioned by the Provider Administrator and the SQLServerDatabase is provisioned later by a Tenant User, a cluster may initially have no associated databases. In this scenario, the source IP in the db-type LoadBalancerNetworkSecurityConfig remains empty because the tenant’s SNAT IP is unknown until a database is created.

As a Provider Administrator, you can view these configurations, temporarily disable their firewall rules for troubleshooting, or authorize additional client IPs to access the database cluster.

For the full LoadBalancerNetworkSecurityConfig field reference, see the DSM Kubernetes API.

List all Load Balancer Network Security Configurations:

kubectl get loadbalancernetworksecurityconfigs -n dsm-system

Get details of a specific configuration:

kubectl get loadbalancernetworksecurityconfig example-lb-config -n dsm-system -o yaml

Disable firewall rules for a specific load balancer:

To temporarily disable firewall rules and allow unrestricted access to the load balancer (e.g., for troubleshooting), set the disabled field to true.

kubectl patch loadbalancernetworksecurityconfig example-lb-config \
  -n dsm-system \
  --type=merge \
  -p '{"spec":{"disabled":true}}'

Configure extra clients for external access:

To authorize additional external clients to access the load balancer, add their IPv4 addresses or CIDR ranges to the extraClients list.

kubectl patch loadbalancernetworksecurityconfig example-lb-config \
  -n dsm-system \
  --type=merge \
  -p '{"spec":{"extraClients":["192.168.1.50","10.0.0.0/24"]}}'

VMware Data Services Manager Kubernetes API