Configuring Multi-Org Tenancy in vRA 8.x - Part 1: DNS Requirements
vRealize Automation vRA Multi-Tenancy
Published on 14 April 2020 by Christopher Lewis. Words: 902. Reading Time: 5 mins.
Introduction
In this series of posts, we will be taking a look at how to configure a Multi-Organization Tenancy (aka Multi-Tenancy) in vRealize Automation (vRA) 8.x.
In this post, we will be looking at the additional DNS requirements for configuring vRA 8.x Multi-Organisation Tenancy. We will cover which DNS Records are required and then cover how those can be created easily using PowerShell.
For more information on the rest of the posts in this series, click here .
DNS Record Creation
In this section, we will highlight which DNS A and CNAME records that need to be created and then how to use PowerShell to create the DNS A, PTR and CNAME Records to support the multi-organization tenant configuration.
Which DNS Records do I need to create? (Simple Deployment)
The following DNS Records should already exist in the DNS infrastructure because they were required to originally deploy vRA:
| Appliance | DNS Name | DNS Record Type | IP Address |
|---|---|---|---|
| vRealize Suite Lifecycle Manager | lcm.domain.name | A Record | 172.16.50.120 |
| Workspace ONE Access | idm.domain.name | A Record | 172.16.50.122 |
| vRealize Automation | vra.domain.name | A Record | 172.16.50.126 |
To support multi-tenancy in a Simple deployment we need the following DNS records created per Organization/Tenant:
- One DNS A Record with the Organization Name as the DNS prefix (i.e.
org.domain.name) that uses the same IP address as the WOA Appliance DNS A Record (idm.domain.name). - One DNS CNAME Record with the Organiation Name as the DNS prefix (i.e.
org.vra.domain.name) that points to the vRA Appliance DNS A Record (vra.domain.name).
In our scenario, the following additional DNS Records will need to be created to support the enabling of multiple Organizations within vRA 8.x:
| DNS Name | DNS Record Type | Value | Notes |
|---|---|---|---|
| provider.domain.name | A | 172.16.50.122 | The DNS A Record for the WOA Appliance for the Provider/Default Organization |
| medtech.domain.name | A | 172.16.50.122 | The DNS A Record for the WOA Appliance for the MedTech Hospital Organization |
| medtech.vra.domain.name | CNAME | vra.domain.name | The DNS CNAME Record for the vRA Appliance for the MedTech Hospital Organization |
| fintech.domain.name | A | 172.16.50.122 | The DNS A Record for the WOA Appliance for the FinTech Bank Organization |
| fintech.vra.domain.name | CNAME | vra.domain.name | The DNS CNAME Record for the vRA Appliance for the FinTech Bank Organization |
| scitech.domain.name | A | 172.16.50.122 | The DNS A Record for the WOA Appliance for the SciTech Labs Organization |
| scitech.vra.domain.name | CNAME | vra.domain.name | The DNS CNAME Record for the vRA Appliance for the SciTech Labs Organization |
Note: For the default/provider organization, we only need the to configure the DNS A Record that points to the WOA appliance IP address.
Which DNS Records do I need to create? (Clustered Deployment)
The following DNS Records should already exist in the DNS infrastructure because they were required to originally deploy vRA:
| Product | Appliance/VIP | DNS Name | DNS Record Type | IP Address |
|---|---|---|---|---|
| vRealize Suite Lifecycle Manager | Appliance | lcm.domain.name | A Record | 172.16.50.120 |
| Workspace ONE Access | VIP | idm-vip.domain.name | A Record | 172.16.50.121 |
| Workspace ONE Access | Appliance | idm01.domain.name | A Record | 172.16.50.122 |
| Workspace ONE Access | Appliance | idm02.domain.name | A Record | 172.16.50.123 |
| Workspace ONE Access | Appliance | idm03.domain.name | A Record | 172.16.50.124 |
| vRealize Automation | VIP | vra-vip.domain.name | A Record | 172.16.50.125 |
| vRealize Automation | Appliance | vra01.domain.name | A Record | 172.16.50.126 |
| vRealize Automation | Appliance | vra02.domain.name | A Record | 172.16.50.127 |
| vRealize Automation | Appliance | vra03.domain.name | A Record | 172.16.50.128 |
To support multi-tenancy in a Clustered deployment we need the following DNS records created per Organization/Tenant:
- One DNS A Record with the Organization Name as the DNS prefix (i.e.
org.domain.name) that uses the same IP address as the WOA VIP DNS A Record (idm.domain.name). - One DNS CNAME Record with the Organization Name as the DNS prefix (i.e.
org.vra-vip.domain.name) that points to the vRA VIP DNS A Record (vra-vip.domain.name).
In our scenario, the following additional DNS Records will need to be created to support the enabling of multiple Organizations within vRA 8.x:
| DNS Name | DNS Record Type | Value | Notes |
|---|---|---|---|
| provider.domain.name | A | 172.16.50.121 | The DNS A Record for the WOA VIP for the Provider/Default Organization |
| medtech.domain.name | A | 172.16.50.121 | The DNS A Record for the WOA VIP for the MedTech Hospital Organization |
| medtech.vra-vip.domain.name | CNAME | vra-vip.domain.name | The DNS CNAME Record for the vRA VIP for the MedTech Hospital Organization |
| fintech.domain.name | A | 172.16.50.121 | The DNS A Record for the WOA VIP for the FinTech Bank Organization |
| fintech.vra-vip.domain.name | CNAME | vra-vip.domain.name | The DNS CNAME Record for the vRA VIP for the FinTech Bank Organization |
| scitech.domain.name | A | 172.16.50.121 | The DNS A Record for the WOA VIP for the SciTech Labs Organization |
| scitech.vra-vip.domain.name | CNAME | vra-vip.domain.name | The DNS CNAME Record for the vRA VIP for the SciTech Labs Organization |
Note: For the default/provider Organization, we only need the to configure the DNS A Record that points to WOA.
Creating a DNS Records using PowerShell
The DNS Records can be created in a multitude of ways. The way I try to do things is using PowerShell. The following commands provide examples on how to create the required DNS records with PowerShell.
Note: The commands above have been tested on Windows Server 2016 Server with Active Directory and DNS installed.
Bringing it all together!
The DNS requirements for vRA 8.x Multi-Organization Tenancy can be very complicated. Hopefully this article has helped demystify which DNS records are required for both Simple and Clustered deployments.
In Part 2 of the Series we will look at how to create Subject Alternate Name certificates to support the vRA 8.x Multi-Organization Tenancy.
Published on 14 April 2020 by Christopher Lewis. Words: 902. Reading Time: 5 mins.
- Running Platypus on Docker with Synology NAS ()
- Updating the embedded vRealize Orchestrator 7.3 Certificate ()
- Replacing the vRealize Automation 7.3 IaaS Manager Service Certificate ()
- Replacing the vRealize Automation 7.3 IaaS Web Certificate ()
- Replacing SSL Certificates in vRealize Automation 7.3 ()
- Operating a Private Cloud - Part 3: Creating a Pricing Card in VMware Aria Automation
- Operating a Private Cloud - Part 2: Creating a Pricing Card in VMware Aria Operations
- Operating a Private Cloud - Part 1: Understanding Pricing Cards in VMware Aria
- Zero2Hero - Using Aria Automation to Deploy Multiple Machines with Multiple Disks - Part 5
- Zero2Hero - Using Aria Automation to Deploy Multiple Machines with Multiple Disks - Part 4