How to deploy AppDefense in VMware Cloud Foundation 3.7

Products

VMware Cloud Foundation VMware AppDefense

Issue/Introduction

This article provides instructions for installing AppDefense into a VMware Cloud Foundation 3.7 Virtual Infrastructure workload domain.

Environment

VMware Cloud Foundation 3.7.x

Resolution

Prerequisites:

VMware Cloud Foundation 3.7 is deployed.
A Virtual Infrastructure (VI) workload domain has been created.
Access to a vSphere Platinum license or an AppDefense Cloud SaaS Subscription account. You can find details on provisioning an AppDefense Cloud SaaS account at Sign up for VMware AppDefense Service (SaaS).

Note: If you have upgraded VMware Cloud Foundation from version 3.5.x to version 3.7, use the following steps to prepare the environment for AppDefense installation:

Download the attached 67347_vcf-projectmanager.rpm file.
Use a file transfer utility to copy the 67347_vcf-projectmanager.rpm file to the /tmp/ folder on SDDC Manager VM.
SSH to the SDDC Manager VM as the vcf user and then issue the su - command to switch to the root user.
Issue the following command to install the /tmp/67347_vcf-projectmanager.rpm file:

rpm -Ihv /tmp/67347_vcf-projectmanager.rpm

Deploy AppDefense in On-Prem Mode:

Use the instructions at Obtain the AppDefense Plug-In Installer to download the AppDefense Appliance OVA.
Use a file transfer utility to copy the AppDefense Appliance OVA to the /opt/vmware/vcf/projectmanager/ova/ folder on the SDDC Manager VM.
SSH to the SDDC Manager VM as the vcf user.
Issue the following command to set the appropriate permissions on the .ova file uploaded in Step 2:

chmod 640 /opt/vmware/vcf/projectmanager/ova/*.ova

Issue the following command to prepare the environment for the AppDefense installation:

sudo /opt/vmware/vcf/projectmanager/scripts/start-projectmanager.sh

Note: You can review the log for this command at /var/log/vmware/vcf/projectmanager/projectmanager.log.

Issue the following command to collect the id values for the management workload domain cluster and the workload domain cluster where AppDefense is being installed:

curl http://localhost/inventory/clusters |json_pp

Note: You will see output similar to the following:

[
{
"datacenter" : "EPG-VCF-DS",
"status" : "ACTIVE",
"id" : "28b97c61-####-####-####-########d71",
"name" : "EPG-VCF-Cluster",
"resourcePoolName" : "EPG-VCF-sddc-mgmt",
"isDefault" : true,
"vcenterId" : "28abe7d1-####-####-####-########d71",
"ftt" : 0,
"domainId" : "280595b0-####-####-####-########d71",
"isStretched" : false,
"vdsIds" : [
"8be2b8e6-####-####-####-########e4f"
]
}
{
"datacenter" : "EPG-VCF-DS",
"status" : "ACTIVE",
"id" : "3566a2b1f-####-####-####-########12e",
"name" : "VI-WLD",
"resourcePoolName" : "VI-WLD-test",
"isDefault" : false,
"vcenterId" : "5567eba5-####-####-####-########1fa",
"ftt" : 0,
"domainId" : "aa5195b2-####-####-####-########b32",
"isStretched" : false,
"vdsIds" : [
"9c378be6-####-####-####-########ff4"
]
}
]

Note: Make a note of the id value for the management workload domain cluster and the workload domain cluster where AppDefense is being installed. In the previous example, 28b97c61-####-####-####-########d71 is the id value for the management workload domain cluster and 3566a2b1f-####-####-####-########12e is the id value for the workload domain cluster where AppDefense is being installed.

Open the /opt/vmware/vcf/projectmanager/templates/enable-appdefense-template.json file with a text editor.
Modify the requires section such that the id values obtained in Step 6 are used for the management-cluster and the workload-cluster, per the following example:

"requires": {
"management-cluster": {
"type": "Cluster",
"id": "28b97c61-####-####-####-########cd71"
},
"workload-cluster": {
"type": "Cluster",
"id": "3566a2b1f-####-####-####-########12e"
}
},

Modify the parameters section such that the following values are populated:

"parameters": {
"vm-name": {
"type": "String",
"value": "<desired VM Name>",
"defaultValue": "AppDefense-VM"
},
"vm-ipaddress": {
"type": "IpAddress",
"value": {
"ipAddress": "<IP address on the management network>",
"netmask": "<netmask>",
"gateway": "<default gateway>"
}
},
"vm-dns": {
"type": "String",
"value": "<DNS server IP address>"
},
"vm-ntp": {
"type": "String",
"value": "NTP Server IP/FQDN>"
},
"vm-admin-username": {
"type": "String",
"value": "<enter admin, or leave blank>",
"defaultValue": "admin"
},
"vm-admin-password": {
"type": "String",
"value": "<password between 8 to 20 characters long including at least one lowercase character, one number, and one special character?"
},
"vm-root-password": {
"type": "String",
"value": "<password between 8 to 20 characters long including atleast one lowercase character, one number, and one special character>"
},
"appdefense-id": {
"type": "String",
"value": "<UUID in the format of 12345678-1234-1234-1234-123456789012, can include 0-12 and a-f, or leave blank>",
"defaultValue": "6dc3f1bf-####-####-####-########5bcb"
}
}

Save and close the file.
Issue the following command to deploy AppDefense:

/opt/vmware/vcf/projectmanager/cli.py enableAppDefense --input /opt/vmware/vcf/projectmanager/templates/enable-appdefense-template.json

Deploy AppDefense in SaaS Mode:

Prerequisites:

Ensure that there is connectivity to the internet for VMs on the management network within VMware Cloud Foundation. This will be required for the AppDefense on-prem instance to synchronize with the Cloud Manager service.

Log in to your AppDefense Cloud Manager account. (For US based customers : https://appdefense.vmware.com/app/).
Click the settings icon > Appliance > Provision New Appliance page. The New Appliance window appears.
Create an appliance by entering the appliance name, and then click Provision. The appliance name is an identifier and does not need to match the actual VM name within the vCenter Server, but the best practice is to match the names. For example, Appliance.
The New Appliance Created window displays the URL for the manager in the region, manager UUID, and appliance API key. Keep this window open until the appliance configuration is done or note down the information as it will be used during the SaaS configuration.
SSH to the SDDC Manager VM as the vcf user.
Open the /opt/vmware/vcf/projectmanager/templates/configure-appdefense-saas-template.json file with a text editor.
Modify the requires section such that the AppDefense UUID value used in Step 9 (appdefense-id section) of the previous section is used for the id, per the following example:

"requires": {
"appdefense-vm" : {
"type" : "AppDefenseAgent",
"id" : "<appdefense-id>"
}
}

Modify the parameters section such that the following values are populated using the AppDefense Manager URL, UUID and Key values obtained in Step 4:

"parameters": {
"appdefense-mgr-url": {
"type": "String",
"value": "<AppDefense Manager URL, or leave blank if using the US default value below>",
"defaultValue": "https://appdefense.vmware.com"
},
"appdefense-mgr-uuid": {
"type" : "String",
"value": "<AppDefense Manager UUID>"
},
"appdefense-mgr-key": {
"type" : "String",
"value": "<AppDefense Manager Key>"
}
}

Save and close the file.
Issue the following command to deploy AppDefense:

/opt/vmware/vcf/projectmanager/cli.py configureSaas --input /opt/vmware/vcf/projectmanager/templates/configure-appdefense-saas-template.json

Install AppDefense Guest Modules

AppDefense needs to install guest modules in guest VMs to protect the applications. A helper script for guest virtual machines running Centos and Ubuntu OSs can be used to install modules. More information to install guest modules can be found at https://docs.vmware.com/en/VMware-AppDefense/2.0/install-appdefense-plugin/GUID-BE81594E-ED34-4ED0-9A71-68EA0C58DC51.html based on your guest OS.

To use the helper script, deploy a guest VM (Centos or Ubuntu OS) in a workload domain and upload the guestmodule.sh script under /opt/vmware/vcf/projectmanager/scripts to the guest. Run this script inside the guest VM.

Once the installation is complete you can check the status using the following commands:

/etc/init.d/vmw_glxd status
/etc/init.d/vmw_conn_notifyd status

Delete AppDefense

SSH to the SDDC Manager VM as the vcf user.
Issue a command similar to the following:

/opt/vmware/vcf/projectmanager/cli.py deleteAppDefense --id 6dc3f1bf-####-####-####-########5bcb

Note: Replace 6dc3f1bf-64d2-49af-8cfb-d4be74b85bcb with the AppDefense UUID used in your installation.

Note: If you deploy AppDefense again after deleting it, you might not see the AppDefense plugin in the vSphere Client. Use the following steps to resolve this issue:

Log in to the vCenter Server Appliance as the root user.
Issue the following commands to restart the vSphere HTML5 and Web clients:

service-control --stop vsphere-client
service-control --stop vsphere-ui
service-control --start vsphere-client
service-control --start vsphere-ui

Log back in to the vSphere client. The AppDefense plugin should now be present.

Note: It may be necessary to clear browser cache or try a different browser.

Additional Information

If a workload domain with AppDefense deployed is deleted and the /opt/vmware/sddc-suppor/sos --cleanup-decommissioned-host command is run to clean the hosts and prepare them for re-use, the AppDefense host module is not uninstalled. This can be validated on a host by running the following command:

esxcli software vib list |grep glxhost

Note: You will see output similar to the following:

glxhost 1.3.2.0-10483793 VMware VMwareCertified 2019-02-26

To remedy this issue, issue the following command to manually remove the AppDefense host module on each affected host:

esxcli software vib remove glxhost

Attachments

67347_1_67347_vcf-projectmanager get_app

67347_vcf-projectmanager get_app