Use this design decision list for reference related to SDDC Manager in an environment with a single or multiple VMware Cloud Foundation instances.

For full design details, see SDDC Manager Design.

Deployment Specification

Table 1. Design Decisions on the Deployment Model of SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-CFG-001

Deploy an SDDC Manager system in the first availability zone of the management domain.

SDDC Manager is required to perform VMware Cloud Foundation capabilities, such as provisioning of VI workload domains, deployment of solutions, patching and upgrade, and others.

None.

Table 2. Design Decisions on Sizing Resources for SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-CFG-002

Deploy SDDC Manager with its default configuration.

The configuration of SDDC Manager is not configurable and should not be changed from its defaults.

None.

Table 3. Design Decisions on Repository Access of SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-CFG-003

Connect SDDC Manager to the Internet for downloading software bundles.

SDDC Manager must be able to download install and upgrade software bundles for deployment of VI workload domains and solutions, and for upgrade from a repository.

The rules of your organization might not permit direct access to the Internet. In this case, you must download software bundles for SDDC Manager manually.

VCF-MGMT-SDDC-CFG-004

Configure a network proxy to connect SDDC Manager to the Internet.

To protect SDDC Manager against external attacks from the Internet.

The proxy must not use authentication because SDDC Manager does not support using a proxy with authentication.

VCF-MGMT-SDDC-CFG-005

To check for and download software bundles, configure SDDC Manager with a My VMware account with VMware Cloud Foundation entitlement.

Software bundles for VMware Cloud Foundation are stored in a repository that is secured with access controls.

Requires the use of a My VMware user account with access to VMware Cloud Foundation licensing.

Table 4. Design Decisions on Certificate Authority Integration for SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-CFG-006

Configure SDDC Manager with an external certificate authority that is responsible for providing signed certificates.

Provides increased security by implementing signed certificate generation and replacement across the management components.

An external certificate authority, such as Microsoft CA, must be locally available.

Table 5. Design Decisions on Multi-Instance Management for SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-CFG-007

For multiple VMware Cloud Foundation instances, enable multi-instance management by creating a federation between the SDDC Manager applications in all instances.

Provides a single view across multiple instances of VMware Cloud Foundation.

You must provide connectivity between the SDDC Manager instances.

Network Design

Table 6. Design Decisions on Network Segments for SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-NET-001

Place the SDDC Manager appliance on the management VLAN network segment.

Reduces the number of VLANs. You allocate a single VLAN to vCenter Server, NSX-T Data Center, SDDC Manager, and other SDDC management components.

None.

Table 7. Design Decisions on the IP Addressing Scheme for SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-NET-002

Allocate a statically assigned IP address and host name to the SDDC Manager appliance in the management domain.

Ensures stability across the SDDC, makes it simpler to maintain and track, and to implement a DNS configuration.

Requires precise IP address management.

Table 8. Design Decisions on Name Resolution for SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-NET-003

Configure forward and reverse DNS records for the SDDC Manager appliance, assigning the records to the child domain for the region.

SDDC Manager is accessible by using a fully qualified domain name instead of by using IP addresses only.

You must provide DNS records for the SDDC Manager appliance.

Table 9. Design Decisions on Time Synchronization for SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-NET-004

Configure time synchronization by using an internal NTP time for the SDDC Manager appliance in the management domain.

Prevents from failures in the deployment of the SDDC Manager appliance.

  • An operational NTP service must be available to the environment.

  • All firewalls located between the SDDC Manager appliance and the NTP servers must allow NTP traffic on the required network ports.

Life Cycle Management Design

Table 10. Design Decisions on Life Cycle Management of SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-LCM-001

Use SDDC Manager to manage its own life cycle.

SDDC Manager supports own life cycle management.

None.

Information Security and Access Control Design

Table 11. Design Decisions on Certificate Management for SDDC Manager

Decision ID

Design Decision

Design Justification

Design Implication

VCF-MGMT-SDDC-SEC-001

Replace the default VMCA-signed certificate of the SDDC Manager appliance with a CA-signed certificate.

Ensures that the communication to the externally facing Web user interface and API of SDDC Manager is encrypted.

Replacing the default certificate with a trusted CA-signed certificate from a certificate authority might increase the deployment preparation time as certificates requests are generated and delivered.

VCF-MGMT-SDDC-SEC-002

Use a SHA-2 algorithm or stronger for signed certificates.

The SHA-1 algorithm is considered less secure and has been deprecated.

Not all certificate authorities support SHA-2.