With TAS for VMs, you can isolate deployment workloads into dedicated resource pools called isolation segments. This article explains how.
To enable isolation segments, an operator must install the Isolation Segment tile by performing the procedures in Installing Isolation Segment. Installing the tile creates a single isolation segment.
After an admin creates a new isolation segment, the admin can then create and manage relationships between the orgs and spaces of a VMware Tanzu Application Service for VMs (TAS for VMs) deployment and the new isolation segment.
Target the API endpoint of your deployment with cf api
and log in with cf login
before performing the procedures in this topic. For more information, see Identifying the API Endpoint for Your TAS for VMs Instance.
To register an isolation segment in the Cloud Controller database (CCDB), use the cf CLI.
If you run smoke tests as a post-deploy errand in the Isolation Segment tile, the smoke tests check if your isolation segment is registered in the CCDB. If the isolation segment is not registered, the smoke tests register it in the CCDB. This eliminates the need to manually register an isolation segment with cf create-isolation-segment
.
To register an isolation segment in the CCDB:
Log in to your deployment by running:
cf login
Run:
cf create-isolation-segment SEGMENT-NAME
Where SEGMENT-NAME
is the name you give your isolation segment.
NoteThe isolation segment name used in the cf CLI command must match the value specified in the Segment name field of the Isolation Segment tile. If the names do not match, Tanzu Operations Manager fails to place apps in the isolation segment when apps are started or restarted in the space assigned to the isolation segment.
If successful, the command returns an `OK` message:
Creating isolation segment SEGMENT-NAME as admin... OK
The cf isolation-segments
, cf org
, and cf space
commands retrieve information about isolation segments. The isolation segments you can see depends on your role:
To see a list of the isolation segments that are available to you:
Log in to your deployment by running:
cf login
Run:
cf isolation-segments
The command returns results similar to this example output:
Getting isolation segments as admin... OK name orgs SEGMENT-NAME org1, org2
An admin can entitle an org to multiple isolation segments.
To view the isolation segments that are available to an org:
Log in to your deployment by running:
cf login
Run:
cf org ORG-NAME
Where ORG-NAME
is the name of your org.
The command returns results similar to this example output:
Getting info for org ORG-NAME as [email protected]... name: ORG-NAME domains: example.com, apps.example.com quota: paid spaces: development, production, sample-apps, staging isolation segments: SEGMENT-NAME, OTHER-SEGMENT-NAME
Only one isolation segment can be assigned to a space.
To view the isolation segment assigned to a space:
Log in to your deployment by running:
cf login
Run:
cf space SPACE-NAME
Where SPACE-NAME
is the name of the space to which your isolation segment is assigned.
The command returns results similar to this example output:
name: staging org: ORG-NAME apps: services: isolation segment: SEGMENT-NAME space quota: security groups: dns, p-mysql, p.mysql, public_networks, rabbitmq, ssh-logging
Note the following: * Only admins can delete isolation segments. * An isolation segment with deployed apps cannot be deleted.
To delete an isolation segment:
Log in to your deployment by running:
cf login
Run:
cf delete-isolation-segment SEGMENT-NAME
Where SEGMENT-NAME
is the name of the isolation segment you want to delete.
If successful, the command returns an OK
message:
$ cf delete-isolation-segment SEGMENT-NAME Deleting isolation segment SEGMENT-NAME as admin... OK
The commands listed in the sections below manage the relationships between isolation segments, orgs, and spaces.
Only admins can enable orgs to use isolation segments.
To enable the use of an isolation segment:
Log in to your deployment by running:
cf login
Run:
cf enable-org-isolation ORG-NAME SEGMENT-NAME
Where:
ORG-NAME
is the name of your org.SEGMENT-NAME
is the name of the isolation segment you want your org to use.If an org is entitled to use only one isolation segment, that isolation segment does not automatically become the default isolation segment for the org. You must explicitly set the default isolation segment of an org. For more information, see Set the Default Isolation Segment for an Org.
You cannot prevent an org from using an isolation segment if a space within that org is assigned to the isolation segment. Additionally, you cannot prevent an org from using an isolation segment if the isolation segment is configured as the default for that org.
To disable an org from using an isolation segment:
Log in to your deployment by running:
cf login
Run:
cf disable-org-isolation ORG-NAME SEGMENT-NAME
Where:
ORG-NAME
is the name of your org.SEGMENT-NAME
is the name of the isolation segment you want to disable the org from using.If successful, the command returns an OK
message:
Removing entitlement to isolation segment SEGMENT-NAME from org org1 as admin... OK
Note: This section requires cf CLI v6.29.0 or later. To download cf CLI v6.29.0 or later, go to the Releases section of the Cloud Foundry CLI repository on GitHub.
Only admins and org managers can set the default isolation segment for an org.
When an org has a default isolation segment, apps in its spaces belong to the default isolation segment unless you assign them to another isolation segment. You must restart running apps to move them into the default isolation segment.
To set the default isolation segment for an org:
Log in to your deployment by running:
cf login
Run:
cf set-org-default-isolation-segment ORG-NAME SEGMENT-NAME
Where:
ORG-NAME
is the name of your org.SEGMENT-NAME
is the name of the isolation segment you want to set as your org's default.If successful, the command returns an OK
message:
$ cf set-org-default-isolation-segment org1 SEGMENT-NAME Setting isolation segment SEGMENT-NAME to default on org org1 as admin... OK
To display the default isolation segment for an org:
Run:
cf org
Admins and org managers can assign an isolation segment to a space. Apps in that space start in the specified isolation segment.
To assign an isolation segment to a space, you must first enable the space’s org to use the isolation segment. For more information, see Enable an Org to Use Isolation Segments.
To assign an isolation segment to a space:
Log in to your deployment by running:
cf login
Run:
cf set-space-isolation-segment SPACE-NAME SEGMENT-NAME
Where:
SPACE-NAME
is the name of your space.SEGMENT-NAME
is the name of the isolation segment you want to assign to your space.Admins can reset the isolation segment assigned to a space to use the org’s default isolation segment.
To assign the default isolation segment for an org to a space:
Log in to your deployment by running:
cf login
Run:
cf reset-space-isolation-segment SPACE-NAME
Where SPACE-NAME
is the name of the space to which you want to assign your org’s default isolation segment.