VMware : Terraform VCD Provider 3.5.0 General Availability

We begin a new year with a new Terraform VMware Cloud Director Provider release - 3.5.0 with support for tenant operations for the NSX-T Advanced Load Balancer (ALB) and many other features. (Note: the provider part of the ALB has been introduced in the previous release.)

Additional way of connecting to VCD with API Token

VCD 10.3.1 adds the capability of generating an API access token for provider and tenant. These tokens cannot be used directly to authenticate against a VCD: users should first exchange the token for a bearer token using a REST API call and then connect as usual with the new token. The VCD Terraform plugin 3.5.0, however, makes things simpler by exchanging the API token for a bearer token and use it transparently. All users need to do is providing the following in the block :

provider "vcd" { user = "none" password = "none" api_token = "NsqWSrgFCHFWMdZJO1t3hmt9SwlOajAJ" # token received from administrator auth_type = "api_token" # [...] }

Ability to set Lease for a vApp

The resource and corresponding data source add the ability of setting the lease period for run time and storage. The lease is indicated in seconds. A lease of means that the vApp takes the default lease as it was set in the parent organization.

resource "vcd_vapp" "my-vapp" { name = "my-vapp" # [...] lease { runtime_lease_in_sec = 60 * 60 * 24 * 30 # extends the runtime lease to 30 days storage_lease_in_sec = 60 * 60 * 24 * 7 # extends the storage lease to 7 days } }

Initial VDC Group support.

This release adds ability for providers and Org users (with certain rights) to create and manage NSX-T VDC Groups. Here is a quick example on how to configure one using Terraform:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

data "vcd_org_vdc" "startVdc" { name = "existingVdc" } data "vcd_org_vdc" "additionalVdc" { name = "oneMoreVdc" } resource "vcd_vdc_group" "new-vdc-group" { org = "myOrg" name = "newVdcGroup" description = "my description" starting_vdc_id = data.vcd_org_vdc.startVdc.id participating_vdc_ids = [data.vcd_org_vdc.startVdc.id, data.vcd_org_vdc.additionalVdc.id] dfw_enabled = true default_policy_status = true }

Only System Administrator and Org Users with rights View VDC Group, Configure VDC Group, vDC Group: Configure Logging, Organization vDC Distributed Firewall: Enable/Disable can manage VDC groups using this resource.

NSX-T Advanced Load Balancer

Terraform provider VCD release 3.4.0 introduced resources to configure NSX-T ALB infrastructure for
providers. The latest release 3.5.0 continued to evolve the NSX-T ALB support, but this time it focused
on NSX-T Edge Gateway side of configuration. It is now complete with 4 new resources and data sources in 3.5.0:

and still require provider
interaction to enable ALB on a particular Edge Gateway, but and
are made for tenants and this is where actual load balancer configuration happens.

Have a look at a new page in our Guides section dedicated for NSX-T ALB for a complete
overview and example.

Here is a brief example demonstrating how tenants can define an NSX-T ALB Pool and then consume it
in virtual service:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47

data "vcd_nsxt_edgegateway" "existing" { org = "my-org" vdc = "nsxt-vdc" name = "nsxt-gw" } data "vcd_nsxt_alb_edgegateway_service_engine_group" "assigned" { org = "my-org" vdc = "nsxt-vdc" edge_gateway_id = data.vcd_nsxt_edgegateway.existing.id # This name comes from prerequisite setup (can be looked up in the UI by tenants) service_engine_group_name = "assigned-service-engine-group-name" } resource "vcd_nsxt_alb_pool" "test" { org = "my-org" vdc = "nsxt-vdc" name = "first-pool" edge_gateway_id = data.vcd_nsxt_edgegateway.existing.id default_port = "9000" member { ip_address = "192.168.1.1" } } resource "vcd_nsxt_alb_virtual_service" "test" { org = "my-org" vdc = "nsxt-vdc" name = "first-virtual-service" edge_gateway_id = data.vcd_nsxt_edgegateway.existing.id pool_id = vcd_nsxt_alb_pool.test.id service_engine_group_id = data.vcd_nsxt_alb_edgegateway_service_engine_group.assigned.service_engine_group_id virtual_ip_address = tolist(data.vcd_nsxt_edgegateway.existing.subnet)[0].primary_ip application_profile_type = "HTTP" service_port { start_port = 80 type = "TCP_PROXY" } }

Ability to configure Certificates

Certificates in the Certificates library can be used when creating secured services.
This is how easy it is to add one:

resource "vcd_library_certificate" "new-certificate" { org = "myOrg" alias = "SAML certificate" description = "my description" certificate = file("/home/user/cert.pem") private_key = file("/home/user/key.pem") private_key_passphrase = "passphrase" }

Please see examples how to reference them in the new Load Balancer resources here:

More information

As usual, there is more than that - please see complete changelog for the full picture.

Also, documentation:
https://registry.terraform.io/providers/vmware/vcd/latest/docs

And, as always with the new Terraform VCD Provider release, we have released a new version of the govcd library (Go language library for VCD). If you're developing a VCD client with Go, please update:

https://github.com/vmware/go-vcloud-director/releases/tag/v2.14.0

https://github.com/vmware/go-vcloud-director/blob/v2.14.0/CHANGELOG.md