Configure a VCF software depot

To deploy and upgrade VMware Cloud Foundation (VCF) in VMware solution on Google Cloud, your VCF Installer and SDDC Manager appliances need access to VCF software bundles, patches, and compatibility metadata. This document compares the available VCF software repository architectures and explains how to configure private connectivity to the Google-provided offline depot by using Private Service Connect.

Choose your repository architecture

You can provide VCF software bundles to your VMware solution environment by using either of the following methods:

Broadcom public repository (online depot): Connect your VCF Installer and SDDC Manager appliances directly to the Broadcom online depot over the internet (for example, by using Cloud NAT or an outbound web proxy) and authenticate with your Broadcom Support Portal credentials and download token. For more information, see the Broadcom documentation on connecting to the online depot.
Google-provided offline depot (Private Service Connect): Connect privately to a regional software repository hosted by Google Cloud over a Private Service Connect endpoint. All software downloads remain on the Google Cloud internal network without requiring internet egress.

The following table compares the two repository architectures:

Feature	Broadcom online depot	Google-provided offline depot
Network path	Outbound internet access (Cloud NAT or proxy)	Private VPC connectivity (Private Service Connect endpoint)
Authentication	Broadcom Support Portal download token	VPC-level access control through Private Service Connect
Bandwidth and latency	Depends on internet egress configuration	High-throughput regional transfer within Google Cloud
Air-gapped support	Not supported without an external jump host	Supported for isolated VPC environments

Before you begin

Before you configure a Private Service Connect endpoint for the Google-provided offline depot, complete the following prerequisites:

Enable the required Google Cloud APIs in your project. The following table lists the required APIs:

Service name	API identifier	Purpose
Compute Engine API	`compute.googleapis.com`	Provisions subnets, internal IP addresses, and forwarding rules
Cloud DNS API	`dns.googleapis.com`	Creates private DNS zones and records for depot resolution
Service Directory API	`servicedirectory.googleapis.com`	Registers Private Service Connect endpoints

To enable these APIs by using the Google Cloud CLI, run the following command:

gcloud services enable compute.googleapis.com \
   dns.googleapis.com \
   servicedirectory.googleapis.com \
   --project=PROJECT_ID

Before you run the command, replace the following:

PROJECT_ID: the ID of your Google Cloud project.

Verify that your user account or service account has the following Identity and Access Management (IAM) roles on the target project:
- Compute Network Admin (roles/compute.networkAdmin)
- DNS Administrator (roles/dns.admin)
Set up your Virtual Private Cloud (VPC) network and plan your subnet IP address ranges for management, vSAN, vMotion, and NSX Tunnel Endpoints (TEP). Set the VPC network MTU to 8896 bytes before you deploy the nodes, and create new subnets in VMware solution while creating the nodes.

VMware solution requires your VPC network's subnets to have the Resolve Subnet Mask property set to Broadcast primary range only with learning to support VLAN-based networking. Open a support ticket in the Google Cloud console Support Center with the following information:
- Product: Google Cloud VMware Engine
- Priority: P2
- Category: Network Connectivity
- Business Impact: General Technical question
- Provide more details: Allowlist L2 network connectivity for my project, along with your project ID, project number, and the target region and zone for your deployment
For more information about support for VLAN-based networking, see Layer 2 emulation: ARP broadcasting and custom MAC learning.

Configure the Google-provided offline depot

To set up private access to the regional VCF offline depot, provision a dedicated standard (non-Layer 2 broadcast) subnet, deploy a Private Service Connect endpoint, and configure Cloud DNS resolution.

Provision the offline depot subnet

Create a dedicated standard (non-Layer 2 broadcast) subnet with a minimum CIDR size of /29 in the same region as your bare-metal nodes:

gcloud compute networks subnets create SUBNET_NAME \
    --network=VPC_NETWORK_NAME \
    --region=REGION \
    --range=SUBNET_CIDR \
    --project=PROJECT_ID

Before you run the command, replace the following:

SUBNET_NAME: the name of the standard subnet for the offline depot endpoint (for example, snet-offline-depot).
VPC_NETWORK_NAME: the name of your VPC network.
REGION: the Google Cloud region where your bare-metal nodes reside (for example, us-central1).
SUBNET_CIDR: an unused CIDR block of /29 or larger (for example, 192.168.10.0/29).
PROJECT_ID: the ID of your Google Cloud project.

Deploy the Private Service Connect endpoint

Reserve an internal IP address for the endpoint and create a forwarding rule that targets the regional offline depot service attachment:

Reserve a regional internal IP address with the GCE_ENDPOINT purpose:
```
gcloud compute addresses create offline-depot-ip \
   --region=REGION \
   --subnet=SUBNET_NAME \
   --purpose=GCE_ENDPOINT \
   --project=PROJECT_ID
```
Before you run the command, replace the following:
- REGION: the Google Cloud region (for example, us-central1).
- SUBNET_NAME: the name of your standard offline depot subnet.
- PROJECT_ID: the ID of your Google Cloud project.
Retrieve the reserved internal IP address so that you can use it when you configure DNS:
```
gcloud compute addresses describe offline-depot-ip \
   --region=REGION \
   --format='get(address)' \
   --project=PROJECT_ID
```
Before you run the command, replace the following:
- REGION: the Google Cloud region.
- PROJECT_ID: the ID of your Google Cloud project.
Create the Private Service Connect forwarding rule pointing to the regional offline depot service attachment:
```
gcloud compute forwarding-rules create offline-depot-endpoint \
   --region=REGION \
   --network=VPC_NETWORK_NAME \
   --address=offline-depot-ip \
   --target-service-attachment=projects/smve-prod-offline-depot/regions/REGION/serviceAttachments/offline-depot-service-attachment-REGION \
   --project=PROJECT_ID
```
Before you run the command, replace the following:
- REGION: the Google Cloud region where your bare-metal nodes are deployed (for example, us-central1).
- VPC_NETWORK_NAME: the name of your VPC network.
- PROJECT_ID: the ID of your Google Cloud project.

Configure Cloud DNS resolution

The offline depot HTTPS server presents a TLS certificate for offline-depot.REGION.selfmanagedvmwareengine.goog. Create a private Cloud DNS zone and an A record so that your VCF appliances resolve this fully qualified domain name (FQDN) to your Private Service Connect endpoint IP address:

Create a private managed DNS zone for the regional domain:

gcloud dns managed-zones create offline-depot-zone \
   --dns-name=REGION.selfmanagedvmwareengine.goog. \
   --description='Private DNS zone for the regional VCF offline depot' \
   --visibility=private \
   --networks=VPC_NETWORK_NAME \
   --project=PROJECT_ID

Before you run the command, replace the following:

REGION: the Google Cloud region (for example, us-central1).
VPC_NETWORK_NAME: the name of your VPC network.
PROJECT_ID: the ID of your Google Cloud project.

Create an A record for offline-depot.REGION.selfmanagedvmwareengine.goog. that maps to your reserved Private Service Connect IP address:
```
gcloud dns record-sets create offline-depot.REGION.selfmanagedvmwareengine.goog. \
   --zone=offline-depot-zone \
   --type=A \
   --ttl=300 \
   --rrdatas=PSC_INTERNAL_IP \
   --project=PROJECT_ID
```
Before you run the command, replace the following:
- REGION: the Google Cloud region.
- PSC_INTERNAL_IP: the internal IP address reserved for offline-depot-ip.
- PROJECT_ID: the ID of your Google Cloud project.
Note: If you register the Private Service Connect forwarding rule with a Service Directory namespace during endpoint creation, Google Cloud can automatically populate the private DNS record in your linked Cloud DNS zone.

Associate the DNS zone with connected VPC networks

If your VCF management appliances or jump host reside in a Shared VPC or a peered VPC network, authorize those networks to query the offline-depot-zone private zone. For instructions on binding additional VPC networks or configuring cross-project DNS peering, see Manage private zones across VPC networks.

Verify connectivity

From a jump host or management VM inside your VPC network, verify that DNS resolution and HTTPS connectivity to the regional offline depot succeed:

Verify that the regional FQDN resolves to your Private Service Connect internal IP address:
```
nslookup offline-depot.REGION.selfmanagedvmwareengine.goog
```
Test HTTPS connectivity to the offline depot endpoint:
```
curl -I https://offline-depot.REGION.selfmanagedvmwareengine.goog
```
Before you run the commands, replace the following:
- REGION: the Google Cloud region where you configured the endpoint (for example, us-central1).
A successful connection returns an HTTP 200 OK or 301/302 response from the depot web server.

What's next

Review the Deployment options overview.
Deploy your environment by using Deploy nodes and VCF by using Terraform and toolkit or Deploy nodes and configure appliance networking by using the console.