Hyper-V Virtualization in Windows Server

Module 5: Hyper-V Virtualization and Containers in Windows Server

• Virtualization started with VMs, and expanded to virtual networking, applications, and containers, becoming software-defined infrastructures.
• Server administrators decide which workloads run virtually versus physically.
• This module covers Hyper-V in Windows Server 2022, including configuration of networking, storage, VM management and securing hosts/VMs using guarded fabrics.
• The module concludes with managing containers for application code virtualization, and an overview of Kubernetes.

Lesson 1: Hyper-V in Windows Server

• Hyper-V provides a virtualized computing environment for creating, configuring, and managing VMs.
• This lesson covers implementing virtualization with Hyper-V, best configuration practices, deployment scenarios, and migration of on-premises VMs to Microsoft Azure.

Overview of Hyper-V virtualization platform

• Hyper-V is a server role in Windows Server x64 OS versions using hardware capabilities to host multiple, independent operating systems.
• Installing Hyper-V implements a hypervisor, which controls hardware access via partition isolation.
• Hyper-V has a parent (or root) partition, which runs the Windows Server OS and hosts the virtualization management stack.
• Child partitions, also known as VMs, run any OS supported by the Hyper-V virtualization platform.
• Guest operating systems are the operating systems running in VMs.
• The maximum number of child partitions depends on physical resources, but Windows Server 2022 has scalability limits: 1024 running VMs; 2048 virtual processors; 48 TB of memory.
• VMs operate like physical counterparts, with the OS largely unaware of the hypervisor. Partition isolation enables resource sharing and dynamic allocation.
• Hyper-V supports scenarios from single VMs to complex software-defined infrastructures, and server consolidation, virtual test environments, virtual desktop infrastructure (VDI), and private clouds.
• Installing Hyper-V requires hardware support and sufficient resources, including a 64-bit processor with Second-Level Address Translation (SLAT), VM Monitor Mode extensions, at least 4 GB of memory, Intel VT or AMD-V and hardware-enforced DEP (Intel XD bit, AMD NX bit).
• The Windows Server contains the Systeminfo.exe command-line utility, which checks for Hyper-V installation prerequisites.
• Hyper-V deployment planning needs to evaluate resource requirements for virtualized workloads, along with resiliency and hardware access, including the number of physical processor cores, physical memory, physical storage, network throughput, and support for discrete device assignment such as GPUs and NVMe.
• You can install Hyper-V using Server Manager or the Install-windowsFeature cmdlet in Windows PowerShell.

Manage Hyper-V with Hyper-V Manager

• Hyper-V Manager is a GUI to manage local and remote Hyper-V hosts, available through the Hyper-V Management Tools.
• Hyper-V Manager supports previous versions of Windows Server operating systems such as 2019, 2016, or 2012 R2.
• The WS-Management protocol is supported, which allows Hyper-V Manager connections to use Kerberos protocol NTLM or CredSSP. Using CredSSP eases remote administration by removing the need for AD DS delegation and communicates over ports 80 or 443.
• Communicating over the WS-Management Protocol allows for using different credentials in Hyper-V Manager and to save the credentials for ease of management, only works with Windows 10 and newer and Windows Server 2016 and newer hosts, while older servers with Hyper-V do not support the WS-Management Protocol for Hyper-V Manager communication.
• Hyper-V Manager is the most common interface for managing VMs in Hyper-V, but there are other tools that provide similar features for specific management scenarios: Windows PowerShell, PowerShell Direct, Windows Admin Center, and System Center Virtual Machine Manager (SCVMM).

Best practices and considerations for configuring Hyper-V hosts

• Provision the host with adequate hardware.
• Deploy VMs on separate disks, solid state drives (SSDs), or Cluster Shared Volumes (CSVs) if using shared storage.
• Don't collocate other server roles.
• Manage Hyper-V remotely.
• Run Hyper-V by using a Server Core configuration.
• Run the Best Practices Analyzer and resource metering.
• Use generation 2 VMs if the guest OS supports them.
• The most important best practice is provisioning the Hyper-V host with adequate hardware, which ensures processing capacity and amount of random access memory (RAM), and that it has fast and redundant storage and multiple network adapters configured as a team.
• Use separate disks to host VM files instead of storing VM files on the same disk as the host OS files to minimize contention and ensures that read/write operations on VM files don't conflict with read/write operations at the host OS level, and minimizing the chance that VM hard disks will grow to consume all available space on an OS volume.
• Recommend using SSDs, which have much faster read-write speed and consume less power than standard hard-disk drives. If the user deploys to a disk that uses striping, such as a Redundant Array of Independent Disks (RAID) 1+0 array the effect on performance is reduced.

Nested virtualization

• Nested virtualization is when Hyper-V server role is installed within a VM's OS, to enable nested VMs within that VM, which is useful for development and testing.
• Implementing nested virtualization requires additional setup beyond prerequisites for traditional Hyper-V server role installations.
• When using an Intel processor with VT-x and EPT, the Hyper-V host must run Windows Server 2016 or newer, and the VM configuration must be version 8.0 or newer. When using AMD EPYC or AMD Ryzen processors or newer, the Hyper-V host must be Windows Server 2022, and the VM configuration must be version 10.0 or newer.
• Before you configure nested virtualization in a VM, you must enable virtualization extensions for its virtual processor, by stopping the VM, and run the following command: Set-VMProcessor -VMName <vmname> -ExposeVirtualizationExtensions $true
• Consider assigning the number of virtual central processing units (vCPUs) assigned to the VM, the amount of memory allocated to it, and its network configuration.
• While 4 GB of RAM is sufficient to install the Hyper-V server role, the optimal amount will depend on the planned number of nested VMs and their memory demands.
• Dynamic memory and runtime memory resizing are unavailable on VMs running Hyper-V.
• Establishing connectivity between nested VMs and external networks involves enabling the MAC Address Spoofing feature on the network adapter of the VM configured as the Hyper-V host, which can be performed from the Hyper-V Manager console or by the Set-NetworkAdapter PowerShell cmdlet.
• Run command from the physical Hyper-V host machine: Set-VMNetworkAdapter -VMName <VMName> | Set-VMNetworkAdapter -MacAddressSpoofing On
• Connect nested VMs to external networks via network address translation (NAT) in the VM serving the role of the Hyper-V host.
• After you enable virtualization extensions and satisfy all other prerequisites, the rest of the setup process is the same as when you configure Hyper-V on a physical host.

Integrate Hyper-V platform with Azure IaaS

• Many organizations move server infrastructure to cloud platforms like Azure, due to decreased infrastructure maintenance costs, increased scalability, and high availability.
• The Azure Migrate service, is a tool to discover, assess, and migrate on-premises workloads, apps, and VMs to Azure, by providing a single platform/portal to start, run, and track migration to Azure. Includes assessment and migration tools and assesses/migrates multiple object types, including: Servers, databases, web applications, virtual desktops, and data.
• Migrating VMs from local Hyper-V to Azure uses the Server Migration tool, providing agentless replication, needing software agents installed only on Hyper-V hosts or cluster nodes.
• The Server Migration tool shares technology with Microsoft Azure Site Recovery tool and components include: a replication provider, installed on Hyper-V hosts and registered with Azure Migration Server Migration, which is used to orchestrate replication for Hyper-V VMs; and a Recovery Services agent, which works with the provider to replicate data from Hyper-V VMs to Azure. Replicated data is migrated to a storage account in the Azure subscription.

Lesson 2: Configure VMs

• Configure the infrastructure after installing Hyper-V server role, consisting of virtual networks, virtual disks, and VMs with supported operating systems.
• This lesson covers VM configurations, generation versions, VM settings, storage options, virtual disk types, virtual networks and VM creation/management.

VM configuration and generation versions

• A Hyper-V VM's configuration version determines capabilities and affects configurable options, saved state, and checkpoints.
• The initial configuration version value is set during VM creation, depending on the OS of the Hyper-V host server, and prior to Windows Server 2016 Hyper-V, upgrading the OS upgraded all VMs, but starting with Windows Server 2016, a configuration-version upgrade is explicit, enabling administrative control and failback if issues arise.
• PowerShell command for identifying the configuration version of VMs on a Hyper-V host: Get-VM | Format-Table Name, Version.
• PowerShell commands for updating a VM's configuration version: ensure the VM is stopped Stop-VM -Name <vmname>; Update: Update-VMVersion <vmname> -Confirm $false; Start: Start-VM -Name <vmname>.
• The VM must be in the stopped state to succeed in updating, which sets it to the highest value supported by the Hyper-V host OS.

Hyper-V VM generations

• Windows Server Hyper-V supports two VM generations: Generation 1 and Generation 2, where a VM's generation determines its virtual hardware and functionality.
• Generation 2 VMs use a different virtualized hardware model, no longer supporting legacy devices like COM ports, floppy drives, and IDE controllers, relying on Unified Extensible Firmware Interface (UEFI) firmware, whereas Gen 1 relied on the basic input/output system (BIOS).
• You must choose a VM's generation when provisioning with both Gen 1 and Gen 2 VMs able to run the same Hyper-V host.
• Gen 2 VMs boast capabilities like secure boot with UEFI firmware support, booting from a virtual SCSI controller, PXE boot with a synthetic Hyper-V network adapter, larger boot volumes (up to 64 TB with .vhdx), and shorter boot/installation times, but lack support for 32-bit OSs since they rely on UEFI.

Operating systems in Hyper-V VMs

• Every current Windows Server OS version has the option to install Hyper-V and older Windows Server versions (up to Windows Server 2019) support the free Hyper-V Server edition, including the Windows hypervisor and virtualization components.
• Any OS using x86/x64 architecture can run in a Hyper-V VM, even if Microsoft doesn't officially support it and the Hyper-V in Windows Server 2022 does support the guest operating systems Windows Server 2008 with Service Pack 2 (SP2) or newer, Windows 7 with Service Pack 1 (SP1) or newer, main Linux distributions including CentOS, Red Hat Enterprise Linux, Debian, Oracle Linux, SUSE, and Ubuntu, and FreeBSD.

VM settings overview

• The VM settings are grouped under Hardware and Management, with configuration files separating data into .vmcx for VM settings and .vmrs for runtime data.
• VMs use simulated hardware, and Hyper-V uses this virtual hardware to mediate access to actual hardware, so not all available simulated hardware needs to be present.
• Gen 1 default hardware includes: BIOS, memory, processor, IDE controller, SCSI controller, network adapter, COM port and disk drive while Gen 2 default hardware includes Firmware, memory and processor.

Storage options in Hyper-V

• Hyper-V provides multiple VM storage options, requiring that each option is appropriate for a given situation by ensuring proper VM performance, without unnecessary space consumption or performance burden, understanding storage options for VHDs so to meets high-availability requirements.
• Key factors when provisioning VMs ensure correct VHD placement with well-provisioned with RAM and processor capacity, with VHD's able to be stored on local disks, a SAN, or Server Message Block (SMB) version 3.0 file shares.
• Consider the following to plan VHD file storage: high-performance connection to storage, redundant storage, high-performance storage, adequate growth space.
• Deploying a virtual Fibre Channel requires configuration of the Hyper-V host with a Fibre Channel host bus adapter (HBA) or Fibre Channel over Ethernet (FCoE) network adapter and the Fibre Channel HBA must have a driver that supports virtual Fibre Channel.
• Virtual Fibre Channel adapters support port virtualization by exposing HBA ports in the guest OS, allowing a VM to access a SAN via a standard World Wide Name, that's associated with the VM.

VHD formats and types

• Windows Server 2016 offers three virtual hard disk formats: .vhd, .vhdx, and .vhds.
• The .vhd format lacks performance-optimization and resiliency features with a 2 TB size limit.
• The .vhdx format provides protection vs data corruption, larger block sizes on dynamic disks, and efficient data representation, and a larger 64 TB maximum disk size.
• The .vhds format optimized for sharing disks among multiple VMs, used for shared storage of VMs operating as nodes in a failover cluster.
• Windows Server supports multiple virtual hard-disk types, such as Fixed size, Dynamically expanding, Differencing, and Pass-through.
• Fixed-size VHDs minimize fragmentation for enhanced performance.
• Dynamically expanding VHDs optimize usage and can dynamically shrink.
• Differencing VHDs rely on a parent disk for read-only content.
• Pass-through VHDs map directly to a physical disk and introduce limitations in VM migrations.

Shared VHDX and VHD Set files

• Sharing a single VHD between multiple VMs enables high availability using VMs configured to support failover clustering, using Shared VHDs, and VHD Sets.
• Shared VHDs with guest failover clustering has limitations, since its disk format doesn't support resizing the file while the cluster is running and Shared VHDs don't support Hyper-V Replica.

Overview of Hyper-V networking

• Networking in Hyper-V uses a virtual network adapter and a virtual switch, by configuring the virtual network adapter on the VM and connecting it to the port.
• Hyper-V uses three configurations : external, internal, and private, but customization through VLAN integration and Switch Embedded Teaming (SET) is possible.
• A Hyper-V virtual switch: is software-based, and its available after installing the Hyper-V server role, and enabling connectivity between different networking endpoints.

Manage VM checkpoints

• Saving the current state of VMs almost instantly, is referred to as checkpoints.
• When you create a checkpoint, Hyper-V creates a differencing disk, in the form of a .avhd file, which stores changes .

Lesson 3: Secure virtualization in Windows Server

• Virtualization of network infrastructure allows for consolidation and management ease but also introduces security concerns since VMs are easily exported, copied, and imported elsewhere.
• Hyper-V supports a guarded fabric for secure VM environment, and lessons introduce the Host Guardian Service (HGS), guarded host servers, and shielded VMs.

What is a guarded fabric?

• Guaraded fabrics are used to help protect VMs from tampering and theft and also known as shielded VMs, which secured both at rest and runtime.
• The guarded fabric provides benefits such as Secure and authorized Hyper-V hosts, Verification that a host is in a healthy state ,and Secure method to release keys to healthy hosts.
• To summarize, a guarded fabric is comprised of Guarded Hyper-V hosts, Host Guardian Service, and Shielded virtual machines.
• A guarded fabric can run a normal VM with no protection, similar to a standard Hyper-V environment,.

Attestation modes for guarded fabric

• Hyper-V hosts run protected VMs in the guarded fabric infrastructure after HGS validates them, by using the evaluation of Hyper-V hosts.
• The HGS supports the attestation modes such as Trusted platform module (TPM)-trusted attestation and Host key attestation.
• The HGS contains the Attestation Service, and the Key Protection Service (KPS), and helps enforce and assure Protected VMs.

Types of protected VMs in a guarded fabric

• The guarded fabric can run the types of VMs protected such as Shielded, Encryption-supported and Normal Vms.

General process for creating shielded VMs

• The three steps to create a shielded VM include creating a shielded VM template disk, its shielded data file, then deploying the shielded VM.
• The VM template disk is uses for future VMs as it provides additional security by also hiding credentials from administrators, while also meeting the VHDX and disk type requirements.

Lesson 4: Containers in Windows Server

• Windows Server 2022 supports packaging and deploying applications and dependencies in containers to package, provision, and run across environments either on-premises or in the cloud.
• This lesson introduces preparing-using Windows containers and to achieve the knowledge and skills to Describe containers, containers, Describe the difference between Process Isolation and Hyper-V isolation modes,describe Docker, identify the container, understand the process, explain how to manage using the Windows Admin Center, and Docker.

What are containers?

• Containers are used packaging an application and for abstracting it and the host OS in which it will reside.
• The benefits of conttainers Ability to run anywhere,isolation, and increased efficiency.
• When you install container technology on a computer, each container creates an isolated, lightweight silo for running an app on the host OS.

Overview of container isolation modes

• Windows containers can run in of two modes, process, and Hyper-V, whereas Process isolation allows multiple container instances to run concurrently on a host and Hyper-V isolation runs inside a highly optimized VM.

Manage containers using Docker

• Docker is a collection of open-source tools that provides a common model for packaging such as standardizing units with the docker which wraps into to a file system with code, system tools, libraries.
• The Docker Engine is the core of the Docker platform, while the Docker client is another component, as a command-line interface (CLI) to integrate with the engine and run commands.
• The Docker Desktop is available for both Mac and Windows 10 or newer desktop environments, allowing the build and distribution of containerized applications and services .

Download container base images

• The step after install Docker Engine entails the usage to pull a base image, for providing a foundational layer of OS services for your container which runs a container based on the image.
• Microsoft provides the base images as Windows Server Core, Windows, and Windows Internet of Things (IoT) Core, which host or contain a large collection of tools, components or API's and its needed services.

Run a Windows container

• Access and download with Docker allows access to Docker Hub to access and download prebuilt images.
• Docker's components include the ability to store container images as code, the rapid and precise recreation and also its the continues integration within container images and the development cycle.

Manage containers using Windows Admin Center

• Windows Admin Center is a browser-based GUI and for most tasks thats to perform using variety of tools such as the consoles.

Lesson 5: Overview of Kubernetes

• Methods and processes and application which allows efficient container deployment in Microsoft Azure.
• Kubernetes is used to efficiently deploy, manage, and scale containers in a hosted environment.

What is Windows container orchestration?

• Automating the processes in environment with job of orchestrates and it includes scheduling, Affinity,failover, scaling, service discovery, and service discovery.

Overview of Kubernetes

• The Master or control plane (its software centralization), is what runs schedule within a cluster and its managed as a single system,
• The Kubernetes cluster contains services to use the Master which is used to manage which uses cluster.