Month: February 2016 | Electric Monk

Archive for February 2016

vRA 7 Part 1 Minimal Installation of vRA7

What is vRA7?

VMware vRealize Automation 7 sets a new standard in cloud automation by radically changing how fast and easy it is to automate the delivery of IT services and thereby accelerating your time to value. This major update has a simplified architecture and includes an installation wizard, the unified blueprint model, and enhanced NSX support.

IT organizations can use VMware vRealize™ Automation to deliver services to their lines of business.

vRealize Automation provides a secure portal where authorized administrators, developers or business users can request new IT services and manage specific cloud and IT resources, while ensuring compliance with business policies. Requests for IT service, including infrastructure, applications, desktops, and many others, are processed through a common service catalog to provide a consistent user experience.

You can improve cost control by using vRealize Automation to monitor resource and capacity usage. For further cost control management, you can integrate vRealize Business Advanced or Enterprise Edition with your vRealize Automation instance to expose the cost of cloud and virtual machine resources, and help you better manage capacity, cost, and efficiency

Support Documentation

https://www.vmware.com/support/pubs/vrealize-automation-pubs.html

New Features

http://pubs.vmware.com/New Features

Support Matrix

https://www.vmware.com/pdf/vrealize-automation-70-support-matrix.pdf

Reference Architecture

http://pubs.vmware.com/vra-70/topic/com.vmware.ICbase/PDF/vrealize-automation-70-reference-architecture.pdf

Installing vRealize Automation (Minimal Install in lab)

Depending on your deployment requirements, you can install and configure vRealize Automation components by using the Installation Wizard, or manually, through the management console. With either method, you can choose to create a minimal installation, or distribute components over separate servers in a custom distributed installation, with or without load balancers.

Choose a minimal installation to deploy a proof of concept (PoC) or development environment with a basic topology. Choose an enterprise installation to deploy a production environment with the topology best suited to your organizational needs

To complete a minimal deployment, a system administrator installs the vRealize Automation appliance and Infrastructure as a Service (IaaS) components.

■	vRealize Automation appliance includes the Web console interface and support for single sign-on capabilities. It is installed as a virtual appliance.
■	Infrastructure as a Service (IaaS) is installed on a Windows Server machine.
■	The IaaS uses an SQL database that can be installed on the same machine as IaaS or on its own server.

The following figure shows the relationship and purpose of components of a minimal installation.

Step 1 DNS

vRealize Automation requires the system administrator to identify all hosts by using a fully qualified domain name (FQDN).
In a distributed deployment, all vRealize Automation components must be able to resolve each other by using a FQDN.
The Model Manager Web service, Manager Service, and Microsoft SQL Server database must also be able to resolve each other by their Windows Internet Name Service (WINS) name. You must configure the Domain Name System (DNS) to resolve these host names in your environment.
So I created an A record in DNS for my vRA7 appliance and an A record in DNS for my IaaS Server

Step 2 Check minimum hardware requirements

Your deployment must meet minimum system resources to install virtual appliances and minimum hardware requirements to install IaaS components on the Windows Server.
For operating system and high-level environment requirements, including information about supported browsers and operating systems, see the vRealize Automation Support Matrix.
The Hardware Requirements table shows the minimum configuration requirements for deployment of virtual appliances and installation of IaaS components. Appliances are preconfigured virtual machines that you add to your vCenter Server or ESXi inventory. IaaS components are installed on physical or virtual Windows 2008 R2 SP1, or Windows 2012 R2 servers. An Active Directory is considered small when there are up to 25,000 users in the OU to be synced in the ID Store configuration. An Active Directory is considered large when there are more than 25,000 users in the O

Step 3 Browser Considerations

Some restrictions exist for browser use with vRealize Automation.

■	vRealize Automation does not support Compatibility View mode for Internet Explorer 10 on Windows 7 platforms. If you are unable to log in to appliance management consoles or you receive an error on the SSO tab when using Internet Explorer 10, use the Developer Tools to set the browser mode to Internet Explorer 7.
■	Multiple browser windows and tabs are not supported. vRealize Automation supports one session per user.
■	VMware Remote Consoles provisioned on support a subset of vRealize Automation-supported browsers.

For operating system and high-level environment requirements, including information about supported browsers and operating systems, see the vRealize Automation Support Matrix

Step 4 Password requirements

The vRealize Automation administrator password cannot contain a trailing “=” character.
Verify that the adminstrator password you assign during installation does not end with an “=” character. Such passwords are accepted when you assign them, but result in errors when you perform operations such as saving endpoints

Step 5 Database requirements

The vRealize Automation administrator password cannot contain a trailing “=” character.Verify that the adminstrator password you assign during installation does not end with an “=” character. Such passwords are accepted when you assign them, but result in errors when you perform operations such as saving endpoints
If you clone an IaaS node, install MS DTC on each node after it has been cloned. When you clone a node that has MS DTC installed, its unique identifier is copied to each clone, which causes communication to fail. See Error in Manager Service Communication for further information.
The database can reside on the IaaS (Windows) server host or on a remote host.
Java-related requirements apply for databases on the IaaS (Windows) server host. They do not apply for external databases.

Step 6 IaaS Server requirements

You can use the following script to install all pre-requisites on your IaaS server but do a double check of everything first

https://github.com/vtagion/Scripts/blob/master/vRA%206.2%20PreReq%20Automation%20Script.ps1

Step 7 Port requirements

vRealize Automation uses designated ports for communication and data access.

Although vRealize Automation uses only port 443 for communication, there might be other ports open on the system.
Because open, unsecure ports can be sources of security vulnerabilities, review all open ports on your system and ensure that only the ports that are required by your business applications are open

Step 8 Certificates

vRealize Automation uses SSL certificates for secure communication among IaaS components and instances of the vRealize Automation appliance. The appliances and the Windows installation machines exchange these certificates to establish a trusted connection. You can obtain certificates from an internal or external certificate authority, or generate self-signed certificates during the deployment process for each component.

For important information about troubleshooting, supportability, and trust requirements for certificates, see the VMware knowledge base article at http://kb.vmware.com/kb/2106583.

You can update or replace certificates after deployment. For example, a certificate may expire or you may choose to use self-signed certificates during your initial deployment, but then obtain certificates from a trusted authority before going live with your vRealize Automation implementation

Step 9 Time Synchronization

A system administrator must set up accurate timekeeping as part of the vRealize Automation installation.

Installation fails if time synchronization is set up incorrectly.

Timekeeping must be consistent and synchronized across the vRealize Automation appliance and Windows servers. By using the same timekeeping method for each component, you can ensure this consistency.

For virtual machines, you can use the following methods:

■	Configuration by using Network Time Protocol (directly)
■	Configuration by using Network Time Protocol through ESXi with VMware Tools. You must have NTP set up on the ESXi.

Step 10 Deploy the vRealize Automation appliance

Note: If you have to cancel out of the wizard and when you log back in to the appliance, the wizard doesn’t automatically come up then you can do the following

ssh into the appliance and run vcac-vami installation-wizard activate
Put /#wizard.wizard at the end of the vRA portal address

Follow the instructions below

Download the vRealize Automation appliance from the VMware Web site. Click here

Optionally on the same page you can download the VMware vRealize Orchestrator appliance

Procedure

Select File > Deploy OVF Template from the vSphere client.

Browse to the vRealize Automation appliance file you downloaded and click Open.

Click Next.

Click Next on the OVF Template Details page.

Accept the license agreement and click Next.

Type a unique virtual appliance name according to the IT naming convention of your organization in the Name text box, select the datacenter and location to which you want to deploy the virtual appliance, and click Next.

Follow the prompts until the Disk Format page appears.

Verify on the Disk Format page that enough space exists to deploy the virtual appliance and click Next.

Follow the prompts to the Properties page.

The options that appear depend on your vSphere configuration.

Configure the values on the Properties page.

a	Type the root password to use when you log in to the virtual appliance console in the Enter password and Confirm password text boxes.
b	Select or uncheck the SSH service checkbox to choose whether SSH service is enabled for the appliance. This value is used to set the initial status of the SSH service in the appliance. If you are installing with the Installation Wizard, enable this before you begin the wizard. You can change this setting from the appliance management console after installation.
c	Type the fully qualified domain name of the virtual machine in the Hostname text box, even if you are using DHCP.
d	Configure the networking properties.

Click Next.

Start the host machine.

■

If Power on after deployment is available on the Ready to Complete page.

a	Select Power on after deployment and click Finish.
b	Click Close after the file finishes deploying into vCenter.
c	Wait for the machine to start. This could take up to five minutes.

■

If Power on after deployment is not available on the Ready to Complete page.

a	Click Close.
b	Power on the machine. This could take up to five minutes. Check the Remote console window

After a few moments, a success message appears.

Open a command prompt and ping the FQDN to verify that the fully qualified domain name can be resolved against the IP address of vRealize Automation appliance.

Step 11 Run the Installation Wizard for a Minimal Deployment

Open a Web browser.

Navigate to the vRealize Automation appliance management console by using its fully qualified domain name, https://vra-va-hostname.domain.name:5480/.

When the Installation Wizard appears, click Next.

Accept the End User License Agreement and click Next.

Select Minimal Deployment and Install Infrastructure as a Service on the Deployment Type screen and click Next.

Check that the prerequisites listed on the Installation Prerequisites page have been met and that the Windows servers on which you installed a Management Agent are listed.

Click the link and obtain the Management Agent software and install this agent on your IaaS server

The Mangement Agent executes work items which are issued by the VAMI. the context under whom the management agent is running executes the installer. Certificate changes can now be performed from the VAMI for infrastructure machines as well and this is handled by the management agent

The Management agent requires a direct connection to 5480 on all virtual appliances. It becomes aware of all the appliances in the system after the initial connection is established to the first VA. It is also used for log collection and telemetry etc.

The next screen will ask you for account information that has administrative rights on your IaaS Server. This account will be used to install services and additional pre-requisite software

Once the installer finishes, go back to your wizard. Notice that at the bottom of the screen you were on, there is now an IaaS Server listed. Set your NTP settings (THIS IS VERY IMPORTANT !) and click next

If needed, you can change the timekeeping method for your vRealize Automation appliance. Click Change Time Settings, if you make changes.

Click Next.

Click Run on the Run the Prerequisite Checker screen to verify that the Windows servers in your deployment are correctly configured for vRealize Automation use.

Because this step runs remotely, it can take several minutes for the step to run.

a	If a failed status is returned for a machine, click Fix to start automatic corrections or click Show Details and follow the instructions. Automatic corrections also restart
b	Click Run to rerun the checker.
c	When all statuses show success, click Next.

Proceed through the next screens, supplying the requested information to configure your deployment components, including the Web server, Manager Service, Distributed Execution Manager, vSphere proxy agent, and certificate information.

Additional information is available from the Help buttons.

DNS of the vRA appliance

SSO Password

IaaS server details

Database Information

DEM Information

Agents Information

vRealize Appliance Certificate

Web Certificate

Manager Service Certificate

Validate: Click Validate – Can take between 10 minutes and half an hour

Hopefully you should then see

A reminder to take snapshots

Read the message and click Install

The installation can take between 30 minutes and one hour

And hopefully should say completed

Update the license key

Choose Telemetry settings

Initial Content creation

Optionally, you can start an initial content workflow for a vSphere endpoint.
The process uses a local user called configurationadmin that is granted administrator rights.

A configuration admin user is created and a configuration catalog item is created in the default tenant. The

configuration admin is granted the following rights:

Approval Administrator
Catalog Administrator
IaaS Administrator
Infrastructure Architect
Tenant Administrator
XaaS Architect

What to do next

After you finish the wizard, log in to the default tenant as the configurationadmin user or as administrator.
Go to the service catalog, request the Initial Content catalog item
Complete the request form for the Initial Content workflow

Step 12 – Login using the configurationadmin account or administrator

Note you don’t have to put administrator@vsphere.local in, just administrator and your SSO password

Type https://vra-appliance-fqdn/vcac

vSphere 6 Platform Services Controller

February 7, 2016 vSphere 6 No comments

What is the Platform Services Controller?

Starting with vSphere 6.0, all prerequisite services for running vCenter Server and the vCenter Server components are bundled in the VMware Platform Services Controller. You can deploy vCenter Server with an embedded or external Platform Services Controller, but you must always install or deploy the

Platform Services Controller before installing or deploying vCenter Server

Installation Scenarios (Embedded or External)

When you install vCenter Server with an embedded Platform Services Controller, or deploy the vCenter Server Appliance with an embedded Platform Services Controller, vCenter Server, the vCenter Server components, and the services included in the Platform Services Controller are deployed on the same system.
When you install vCenter Server with an external Platform Services Controller, or deploy the vCenter Server Appliance with an external Platform Services Controller, vCenter Server and the vCenter Server components are deployed on one system, and the services included in the Platform Services Controller are deployed on another system.

Components included in the vCenter Server and vCenter Server Appliance installations

The VMware Platform Services Controller group of infrastructure services contains:

vCenter Single Sign-On
License service
Lookup Service
VMware Certificate Authority.

The vCenter Server group of services contains:

vCenter Server
vSphere Web Client
Inventory Service
vSphere Auto Deploy
vSphere ESXi Dump Collector
VMware vSphere Syslog Collector on Windows
VMware Sphere Syslog Service for the vCenter Server Appliance

Scenario 1: vCenter with an embedded PSC

Advantages of vCenter with an embedded PSC

The connection between vCenter Server and the Platform Services Controller is not over the network and vCenter Server is not prone to outages because of connectivity and name resolution issues between vCenter Server and the Platform Services Controller.
You will need fewer Windows licenses.
You will have to manage fewer virtual machines or physical servers.
You do not need a load balancer to distribute the load across Platform Services Controller.

Disadvantages of vCenter with an embedded PSC

There is a Platform Services Controller for each product which might be more than required. This consumes more resources.
The model is suitable for small-scale environments

Scenario 2: vCenter Server with an External Platform Services Controller

vCenter Server and the Platform Services Controller are deployed on separate virtual machine or physical server. The Platform Services Controller can be shared across several vCenter Server instances. You can install a Platform Services Controller and then install several vCenter Server instances and register them with the Platform Services Controller. You can then install another Platform Services Controller, configure it to replicate data with the first Platform Services Controller, and then install vCenter Server instances and register them with the second Platform Services Controller.

Advantages of vCenter Server with an External Platform Services Controller

Less resources consumed by the combined services in the Platform Services Controllers enables a reduced footprint and reduced maintenance
Your environment can consist of more vCenter Server instances

Disadvantages of vCenter Server with an External Platform Services Controller

The connection between vCenter Server and Platform Services Controller is over the network and is prone to connectivity and name resolution issues.
If you install vCenter Server on Windows virtual machines or physical servers, you need more Microsoft Windows licenses.
You must manage more virtual machines or physical servers

Scenario 3: Mixed Operating Systems

A vCenter Server instance installed on Windows can be registered with either a Platform Services Controller installed on Windows or a Platform Services Controller appliance.

Example of a Mixed Operating Systems Environment with an External Platform Services Controller on Windows

Example of a Mixed Operating Systems Environment with an External Platform Services Controller Appliance

Both vCenter Server and the vCenter Server Appliance can be registered with the same Platform Services Controller within a domain
Having many Platform Services Controllers that replicate their infrastructure data, allows you to ensure high availability of your system.
If an external Platform Services Controller with which your vCenter Server instance or vCenter Server Appliance was initially registered, stops responding, you can repoint your vCenter Server or vCenter Server Appliance to another external Platform Services Controller in the domain

Enhanced Linked Mode Overview (http://kb.vmware.com/kb/210854)

Enhanced Linked Mode connects multiple vCenter Server systems together by using one or more Platform Services Controllers.
Enhanced Linked Mode lets you view and search across all linked vCenter Server systems and replicate roles, permissions, licenses, policies, and tags.
When you install vCenter Server or deploy the vCenter Server Appliance with an external Platform Services Controller, you must first install the Platform Services Controller.
With Enhanced Linked Mode, you can connect not only vCenter Server systems running on Windows but also many vCenter Server Appliances. You can also have an environment where multiple vCenter Server systems and vCenter Server Appliances are linked together.

During installation of the Platform Services Controller, you can select whether to create a new vCenter Single Sign-On domain or join an existing domain. You can select to join an existing vCenter Single Sign-On domain if you have already installed or deployed a Platform Services Controller, and have created a vCenter Single Sign-On domain. When you join an existing vCenter Single Sign-On domain, the data between the existing Platform Services Controller and the new Platform Services Controller is replicated, and the infrastructure data is replicated between the two Platform Services Controllers

If you install vCenter Server with an external Platform Services Controller, you first must deploy the Platform Services Controller on one virtual machines or physical server and then deploy vCenter Server on another virtual machines or physical server. While installing vCenter Server, you must select the external Platform Services Controller. Make sure that the Platform Services Controller you select is an external standalone Platform Services Controller. Selecting an existing Platform Services Controller that is a part of an embedded installation is not supported and cannot be reconfigured after the deployment.

Repoint the Connections Between vCenter Server and Platform Services Controller

Joining external Platform Services Controller instances in the same vCenter Single Sign-On domain, ensures high availability of your system.

If your environment contains external Platform Services Controller instances within a site that replicate the infrastructure data within a single domain, you can redirect the vCenter Server instances to another Platform Services Controller. If an external Platform Services Controller stops responding, you can repoint the vCenter Server instances to another Platform Services Controller within the same domain.

If you want to distribute the load of an external Platform Services Controller, you can repoint some of the vCenter Server instances to other Platform Services Controller instances in the same domain.
You can repoint the connections between a vCenter Server instance and the external Platform Services Controller instances in different vCenter Single Sign-On sites if the Platform Services Controller instances replicate the infrastructure data within a single domain. A site in the VMware Directory Service is a logical container in which you can group Platform Services Controller instances within a domain. You can name the sites in an intuitive way for easier implementation. Currently, the use of sites is for configuring Platform Services Controller High Availability groups behind a load balancer. vCenter Single Sign-On sites can be, for example, external Platform Services Controller instances that are deployed in multiple physical locations.

For more information, see the VMware knowledge base article at
http://kb.vmware.com/kb/2131191

Prerequisites

Verify that the external Platform Services Controller instances are within a single site and replicate the infrastructure data within a single domain.

Procedure

Log in to the vCenter Server instance.
For vCenter Server Appliance, log in to the vCenter Server Appliance shell as root
For a vCenter Server instance installed on Windows, log in as an administrator to the virtual machine or physical server that you installed vCenter Server on.
Run the cmsso-util script.
cmsso-util repoint –repoint-psc psc_fqdn_or_static_ip [–dc-port port_number]
where the square brackets [ ] enclose the command options.
Here, psc_fqdn_or_static_ip is the system name used to identify the Platform Services Controller. This system name must be an FQDN or a static IP address.
Use the –dc-port port_number option if the Platform Services Controller runs on a custom HTTPS port. The default value of the HTTPS port is 443.
Log in to the vCenter Server instance by using the vSphere Web Client to verify that the vCenter Serveris running and can be managed.

The vCenter Server instance is registered with the new Platform Services Controller

vRealize Automation large scale deployment Part 3 IaaS Server Install

February 1, 2016 Part 3, vRA Distributed Deployment v6.2.3 No comments

vRealize Automation large scale deployment Part 2 IaaS Server Install

In a distributed installation, the system administrator can deploy multiple instances of the appliances and install IaaS components over multiple machines in the deployment environment.

This install will include the following

2 x Windows 2012 R2 Server running IaaS
2 x Windows 2012 R2 Servers running SQL 2012 in a SQL failover cluster

IP Addresses

IaaS Service Account

Step 1 – Check Pre-requisites

Make sure the server is fully patched and snapshotted prior to installation to allow easy rollback in the event of any issues

There is a great PowerShell script which will install the pre-requisites for you but it is always worth checking all the steps I’ve listed following this for your own sanity. Reboot after running the script

https://github.com/vtagion/Scripts

SQL

TCP/IP protocol enabled for SQL Server

Microsoft Distributed Transaction Coordinator Service (MS DTC) enabled on all SQL nodes and IaaS nodes in the system. MS DTC is required to support database transactions and actions such as workflow creation. Start > Run > dcomcnfg > Computer > My Computer > Distributed Transaction Coordinator > Local DTC > Properties
Note there may be a clustered DTC, in which case modify this as well

No firewalls between Database Server and the Web server or IaaS Server, or ports opened as described in Port Requirement
If using SQL Server Express, the SQL Server Browser service must be running
For 6.0.x installations, the database name cannot contain a space. For 6.1 and later installations, the use of spaces in names is supported
Log into SQL Management Studio and add Domain Admins to Logins

IaaS Pre-requisites

Configuration of Active Directory Domain Service Accounts for Local Administrators Group

Configuration of Windows Server 2012 R2 Firewall

The firewall can either be turned off or there are certain rules which need enabling as per below if it is turned on

Installation of Microsoft .NET 4.5.2 Framework
Installation of Java Runtime 64-bit Environment (jre-7u67-windows-x64.exe; required to install the database)
Note I had to use the below version. 1.8 did not work and you can use the latest 1.7 version which is jre-7u79 currently I think

Click New

Type the following path to the Java installation directory

Installation and configuration of IIS Server

You can run these commands in PowerShell

Add-WindowsFeature -Name Web-Webserver,Web-Http-Redirect,Web-Asp-Net,Web-Windows-Auth,Web-Mgmt-Console,Web-Mgmt-Compat, web-metabase

Add-WindowsFeature -Name Was, Was-config-apis, was-Net-Environment,NET-Non-HTTP-Activ

Add-WindowsFeature -Name Web-Webserver,Web-Http-Redirect,Web-Asp-Net,Web-Windows-Auth,Web-Mgmt-Console,Web-Mgmt-Compat, web-metabase

Add-WindowsFeature -Name Was, Was-config-apis, was-Net-Environment,NET-Non-HTTP-Activ

Add-WindowsFeature -Name NET-WCF-HTTP-Activation45

Enabling the Secondary Login Service. You can just start this for the installation process then it can be stopped afterwards

Configuration of the batch login access and service login
Open Local Security Policy
Modify the Log on as a batch job and Log on as a service with the account you are going to install IaaS on

Next open IIS Manager and navigate to the default website

Click on Authentication

Next click on Providers and remove NTLM and Negotiate then add Negotiate back in followed by NTLM

Next click on Advanced Settings
Change it from Off to Accept. Click on OK then change it back to Off

Do an iisreset

Next we need to register asp.net
Go to c:\Windows\Microsoft.Net\Framework64\v4.0.30319
Type aspnet_regiis -i

Do another iisreset
The following registry modification is required for the IaaS web server to include Local Security Authority host names that can be referenced in in the NTLM authentication requests for CNAME and load balancer FQDN addresses.
Open the Windows registry and browse HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0.
Right-click MSV1_0, point to New, and click Multi-String Value.
In the Name column, type BackConnectionHostNames, and press Enter.
In the Value text box, type the CNAME or DNS alias that is used for the local shares on the computer, and click OK.
Example for IaaS Web Servers: f5.ias.techlab.local

Before the installation of the IaaS components, verify system cryptography
Go to the Local Group Policy Editor, expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, expand Security Options and use FIPS-compliant algorithms for encryption and hashing. Verify that signing is set to Disabled.

Next I also like to add my IaaS service account to the Local Admins group on the server or if it is the Domain Admins group then add this for lab purposes

Add REG_DWORD key DisableLoopbackCheck 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Add REG_DWORD key DisableStrictNameChecking 1 HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
Next I like to shutdown the server and take a snapshot at this point
Do exactly the same procedure on the second IaaS server

Note: Once DTC was enabled on both the IaaS and the remote SQL server, the installation still failed. After some searching, I found that since the IaaS server and SQL server VMs were provisioned using the same Virtual Machine template in vSphere, DTC had to be uninstalled and re-installed on one of the servers, either the IaaS server or the SQL server. To perform this task, execute the following commands from an elevated command prompt (run cmd.exe as an Administrator):

msdtc -uninstall
msdtc -install
Reconfigure settings
Reboot

Step 2 – Install certificates

You will need to refer to my other blog about creating and installing vRA IaaS certificates here if you haven’t created them already.

http://www.electricmonk.org.uk/2015/12/03/installing-vra-6-x-certificates/

Import the certificate into IIS

Step 3 – Install IaaS Website and Model Manager Data

Go to https://yourvRAserver.FQDN:5480/installer
Download the IaaS installer

Launch the installer from where you saved it and Run as Administrator

Click Next

Accept the License agreement

Put in root and your password

Choose Custom Install
Select IaaS Server

Select the Database checkbox
I have a Windows Server 2012 / SQL2012 cluster called SQLCLUSTER which was picked up when I put in my SQL server name and clicked Scan
I then unticked Use existing empty database and called it vcac

Fix any warnings which appear in the Verify Pre-requisites box

Click Check again

Click Next and click Install

Hopefully you should now see the below screen

Untick the box which says Guide me through the initial system configuration and click Finish

Installing the Primary IaaS Web and Model Manager Data Server

If you haven’t already, import the certificate you previously created. This is the PFX cert
Double click on the certificate
Choose Local Machine

Check the path to your cert file is correct
Click Next

Enter the password if you created one
Select Mark this key as exportable
Click Next

Accept the default store

Check the final box and click Finish

Add certificate into the IIS Console under Server Certificates. It may already be there. Check 443 bindings are linked to your certificate
Just double check in Local Security that System Cryptography: Use FIPS compliant algorithms is disabled

Launch the IaaS installer as Administrator again
Click Next, accept the license agreement put in the root username and password
Select Custom Install and IaaS server

Select Website and ModelManagerData checkboxes
On the Administration and Model Manager Website tab select the certificate that you previously imported
Select the Suppress certificate mismatch box

You should get a message back when you click Test Binding

Click on the Model Manager Data tab
Enter the FQDN of the vRA appliance load balanced address. In my case f5.vra.techlab.local
On SSO Default Tenant, click Load
Under certificate click Download (This is the certificate which should be pre-created from my other blog and imported into IIS
Click View Certificate and check it
Add in all the rest of the details