Design Implications

vFabric Application Director server is supported only when deployed to an environment based on vCloud Director. Often the vCloud environment on which vFabric Application Director is deployed is the same environment where applications are being provisioned. Because vFabric Application Director uses the vCloud API to issue provisioning requests, the vFabric Application Director server must be able to issue API calls to the vCloud Director servers that are managing the vCloud environment. This has the following security implications for some consumers:

In public vCloud deployments, vCloud consumers often have access to only one vCloud organization. In this scenario, the vFabric Application Director vCloud provider organization is the same as the organization housing the vFabric Application Director server. If access to multiple organizations is available, it may be beneficial to deploy the vFabric Application Director server and software repository to one organization and have provisioned workloads deployed to another organization. Network access must be available from the deployed virtual machines to the vFabric Application Director server and software repository.

In private vCloud deployments, deploy the vFabric Application Director server to a vCloud organization designated for management systems. This provides isolation for administrative purposes and can simplify Chargeback administration. The software repository can also be deployed to the management organization. vCloud providers can be defined in vFabric Application Director based on organization separation policies. Network access must be available from the deployed virtual machines to the vFabric Application Director server and software repository.

In a hybrid vCloud deployment, the vFabric Application Director server might not be local to the vCloud provider where applications are deployed. vFabric Application Director uses the vCloud API to make provisioning requests to the vCloud provider. The agent installed in each vFabric Application Director-provisioned virtual machine must also be able to establish a network connection to the vFabric Application Director server. VMware recommends locating the software repository in the same environment or datacenter as the target vCloud provider due to bandwidth and latency considerations.