Enable IaaS with Windows Azure Pack

Q: What is required to enable virtual machine (VM) provisioning (i.e., IaaS) using Windows Azure Pack?

A: Windows Azure Pack enables the deployment of many types of services, emulating the Microsoft Azure experience. A clean Windows Azure Pack deployment doesn't offer any services but rather provides the foundation to connect to other components to enable other types of services. To enable VM provisioning, you need:

Most likely, you'll also want Orchestrator's Service Management Automation (SMA) and System Center Operations Manager deployed for the life-cycle management of the VMs. However, SMA and Operations Manager aren't mandatory.

Deploying SPF

The first task is to deploy SPF. To do so, follow these steps:

After SPF is installed, you need to give the SPF service account (in this example, SPFService) the Administrator user role in VMM. To do so, follow these steps:

You also need to give the SPF service account the Sysadmin server role on the SQL Server instance housing the SPF database. You can do this in SQL Server Management Studio (SSMS). Open SSMS and navigate to Security, Logins. Select the SPF service account, choose Server Roles, and select the sysadmin check box.

Testing SPF

At this point, you should check that SPF can actually interact with VMM. The easiest way to do this is as follows:

Registering SPF with Windows Azure Pack

Assuming that SPF is working properly, you need to register SPF with Windows Azure Pack. In preparation, you need to:

The next task is to register SPF with Windows Azure Pack, which is documented on the Register the Service Provider Foundation Endpoint for Virtual Machine Clouds web page. Here's a high-level overview of the steps:

If you now select Clouds, you'll get a message stating that no VM cloud providers were found. That's because no connections from SPF to VMM have been added yet. To add a connection, click the Use an existing virtual machine cloud provider to provision virtual machines link. Enter the name of the VMM server (and port if you aren't using the default), as Figure 4 shows. Optionally, you can enter a Remote Desktop Gateway URL, which would allow entry to VMs from outside the environment. Click the checkmark icon.

Figure 4: Entering the Name of the VMM Server

Your VMM server should now be listed under Clouds, along with all the clouds defined in VMM, as shown in Figure 5.

Figure 5: Reviewing the VM Clouds

Importing and Creating Gallery Resources

You now need to create or import Windows Azure Pack Gallery Resources. Here are some great resources discussing how to do that:

Basically, you need to download and install the Gallery Resources on the VMM server (or on another server and then make them available to VMM) using the Web Platform Installer. You can download this installer from the Microsoft Web Platform Installer 5.0 web page. After the Web Platform Installer is installed, click the Options link at the bottom of the screen. In the Custom Feeds area, enter the URL http://www.microsoft.com/web/webpi/partners/servicemodels.xml, click Add feed, then click OK. If you select the Service Models tab and select Gallery Resources, you'll be able to add multiple items, as Figure 6 shows. After you select the items, click Install.

Figure 6: Selecting Gallery Resources from the Service Models Tab

You should read the readme files for all the Gallery Resources you download because some resources require you to add resource extension packages to VMM. The readme file will tell you which resource extension packages are required. The readme file will also tell you the tag names (e.g., WindowsServer2012) that must be added to the VHD, along with other configurations. It's important your .vhd and .vhdx files are tagged and configured per the requirements. Otherwise, the files won't be used by the Gallery Resources during deployment.

As part of the configuration for the items in VMM to be used with a Gallery Resource, there are changes required to the template VHD file. These changes are discussed in-depth in the two resources listed previously. In a nutshell, you need to change the release value to meet the Azure versioning scheme of n.n.n.n, you need to set the OS, and you need to configure a tag. The first two items can be accomplished using the VMM management console (see Figure 7) or PowerShell.

Figure 7: Using the VMM Management Console to Change the Template VHD File

The last item, configuring the tag, can only be accomplished using PowerShell. The tags must be OS specific. The exact values required will be based on the Gallery Resources you use, and the readme file will give you this information. Here's an example of how to change a tag using PowerShell:

$myVHD = Get-SCVirtualHardDisk |  where {$_.Name –eq 'win2012R2DatacenterG2.vhdx'} $tags = $myVHD.Tag if ( $tags -cnotcontains "WindowsServer2012" )  { $tags += @("WindowsServer2012") } if ( $tags -cnotcontains "R2" ) { $tags += @("R2") }Set-scvirtualharddisk –virtualharddisk $myVHD –Tag $tags

You can manually create your own Gallery Resources, but this is very hard to do, as they're defined in JavaScript Object Notation (JSON). Fortunately, the VM Role Authoring Tool is available on CodePlex. As Figure 8 shows, this tool has graphical interface, which makes it much easier to not only create but also edit resources.

Figure 8: Using the VM Role Authoring Tool

The VM Role Authoring Tool lets you edit existing Gallery Resources, such as those you might have already downloaded. When you download a Gallery Resource, you're downloading a resource definition package (a .resdefpkg file), which is actually a ZIP file. So, if you want to manually edit the files in a .resdefpkg file, you can rename the file to .zip. You can then extract files from it for editing.

If you want to create your own resource packages, you can add your files to a ZIP file, then rename it to .resdefpkg. The benefit of the resource definition package is you can include all the files needed for a Gallery Resource, which can even include entire setup structures copied from an .iso file. (The blog post "Windows Azure Pack VMRole Gallery Items for Collaboration Workloads" has examples of how to do this.)

The final task is to import the resource definition package into Windows Azure Pack, then publish it:

Figure 10: Going to the Virtual Machine Clouds Page, Where You Can Configure Plan Details

You can now add this Gallery item to a plan in the portal using the Plans workspace. Alternatively, you can create a new plan, which can include both VM Gallery Resources and regular VM Templates from VMM. If you're creating a new plan, you'll need to configure the plan details once the basic plan is created. Go to the Dashboard tab and select Virtual Machine Clouds in the plan services section, as shown in Figure 10.

Figure 11: Configuring the Plan Details

You can now configure the plan details, including the VMM server and cloud, as shown in Figure 11. You can also add networks, VM templates, and any gallery items you want to make available.



After the plan is created, click the Change Access button at the bottom of the screen, then click Public. Note that you need to have subscriptions that allocate plans to groups of users. You now have VMs available to tenants!

It's important to mention that there's a tool—the Gallery Resource Import Tool—that does all the import and configuration steps in Windows Azure Pack and VMM for you, thereby removing a lot of the manual work. This tool is definitely worth using and is detailed in the blog post "Introducing the 'Gallery Resource Import Tool'."

Allocating Plans

You can create user accounts that can access plans through the tenant portal. You can also configure other types of authentication, such as federation with Windows Azure Pack using Active Directory Federation Services (ADFS). Users will then be able to select plans to use, or you can pre-assign plans, which will create subscriptions. Users can then access their subscriptions through the tenant portal. If you add a plan to a user and the plan's status gets stuck in "Active - Out of Sync" status, you likely didn't add the SPF service account to the four local SPF_ groups on the SPF server and didn't give the SPF service account the Sysadmin server role on the SQL Server instance. Fix those configurations, then try the synchronization again. If you still get stuck in the "Active - Out of Sync" status, verify on the SPF server that the SPF application pools in IIS (Admin, Provider, VMM, and Usage) are all configured to use the SPF service account and not the NetworkService account. (I've seen this happen after certain updates.) For more details, check out the Provision Virtual Machine Clouds web page and the blog post "Troubleshooting Windows Azure Pack, SPF & VMM" if you're experiencing problems.