Hey Luc -- Bob Plankers here. It's API-driven, in crypto_manager/kms/providers.

Hi Curtis -- Bob Plankers here. Sorry for the lag, your comment got caught in YT's moderation and I didn't see it. If you do a custom install of VMware Tools and select the Time Provider you'll get the driver for that device.

From ransomware? Not specifically, though it can make it harder to exfiltrate data because it adds some permissions to vCenter Server that can be used to prevent decryption and such. It won't stop a ransomware attack from re-encrypting a VM on disk as part of the attack, though. Data-at-rest encryption can help with lots of other types of threats, including data destruction & sanitization as part of hardware lifecycle, and especially with flash/SSD/NVMe which cannot be sanitized.

As far as I know, only Dell and HPE are supported at this moment.

Have a look at github.com/corrieb/pacific/tree/master/docs/tkg-service/cluster-lifecycle. I put a lot in there that may help. It needs an update, but this is what I used to educate our internal Service teams

Thanks! Went on vacation last week, so working on it now. Focus of next episode is sanity checking the Tanzu Kubernetes Cluster and how to work with the "least privilege" RBAC model. Happy to take requests, so will add something on Docker registry config (assuming that's what you meant)

I could not agree more - STOP the background music.

Yea to some extent this shows why SDN was invented. Happy to help if you can describe the issue. Otherwise William Lam recently posted a single node environment that simplifies the networking requirements: www.virtuallyghetto.com/2020/11/complete-vsphere-with-tanzu-homelab-with-just-32gb-of-memory.html

@@VMwarevSphere Thanks Mate. I'll take a look at William's latest via your link. The problem I'm running into is that the HAProxy VIPs are not resolving to the control plane VM IPs. I can hit the management interface on each control plane VM IP on port 443 from a VM on the combined workload/frontend network. The HAProxy addresses are pingable, but just hang on an https request. I inspected the /etc/haproxy/haproxy.cfg file and it looks like it's configured to resolve the VIPs to the workload interface on the Supervisor, not to the management interface. The workload interface doesn't respond to https requests either. Tried different ways of configuring the network for 2 days straight and keep getting the same result.

@@MrEzandy Ok. Glad you found the haproxy.cfg file as this should certainly help in diagnosing. The HAProxy VM IPs will be pingable regardless of whether HAProxy is even running. It's Linux routing that's responding to those pings, not HAProxy, so that can be a red herring. The fact that you have some backends defined in HAProxy means that vSphere is able to reach your management endpoint, which is good. I'm not sure whether the control plane nodes you're talking about are the Supervisor nodes or a Tanzu Kubernetes Cluster node. HAProxy will load-balance traffic to both and always to the workload network. Regardless, you should be able to get a response by curling the ip:port backends defined in haproxy.cfg from a shell in the HAProxy appliance. If you can't, you may have a routing problem, although if you're using a single network for workload/frontend we should be talking about IPs on the same network. Don't trust ping because TKC nodes are configured to drop ICMP (don't ask me why). Also check you didn't accidentally configure your Load Balanced IP range in HAProxy to conflict with your gateway or any other essential IP.

@@MrEzandy I have the same behavior. HAproxy.cfg configured correct but Guest TKG cluster deploys only Control VM and than stalls. Did you manage to get it running?

@@VMwarevSphere Don't know if I fully understand routing requirements for those VLANs, which should route to which and which should not (FE, WL, MGMT). Can you tell some more about this? Thanx for confirming about ICMP dropping settings and TKC nodes (would not tell you why ;-)) Regards

And also here: www.yellow-bricks.com/2020/10/09/vmware-vsphere-clustering-services-vcls-considerations-questions-and-answers/

The VM's data is encrypted in the CPU registers, yes! -Bob Plankers

Was about to ask the same thing. After 20 minutes of hearing this vmware music I swear I'll jump out the window if I ever have to hear it again.

I believe this is all on vSphere 7, so ESXi 7. And based on the links in the description it looks like this will be included in vSphere 7 Update 1.

Tom Otomanski Thank you

It's reversed using Premiere... but we appreciate the respect, it's hard to write and talk and not write over your face, even when you're doing it forwards. :)

Try on Linkedin, I started "Learning Kubernetes" by Karthik Gaekwad