Deploying and configuring the NVIDIA DLS licensing appliance

Overview

Over the years, I’ve had to deal with numerous installations of the NVIDIA licensing server, which is required in vGPU setups to provide licenses to the endpoints. While I haven’t had many issues with the releases since 2019, it never really felt right to install a Windows or Linux machine, install and set up Java (especially after the license changes), and then get to the part where you install the NVIDIA licensing software.
So when NVIDIA announced they would release a new version of their licensing solution, which would feature (among others) be an appliance, I was pretty excited!

For those that are unaware, NVIDIA now offers a Cloud License Service (CLS) and a Delegated License Service (DLS). The CLS, as the name implies is a cloud offering in which your licenses are directly consumed from the cloud.

As with the DLS, an on-premises appliance is used for your VDI desktops to communicate with.

In this blog post, I’ll cover the installation and configuration of the DLSlicensing appliance in my homelab, this was the perfect opportunity to get some hands-on experience with the new licensing system as I’ll be expanding my lab with a vGPU soon.

Deploying the OVA template on vSphere

Start by downloading the OVA template from the NVIDIA Enterprise portal for the appropriate hypervisor. As my homelab is VMware based, this blog post will focus on deploying the appliance on VMware vSphere.

Once downloaded, open the vSphere client and start the Deploy OVF Template wizard. From there, follow the instructions and screenshots below to deploy the appliance.

1. Upload and specify the OVA you downloaded earlier.
   
2. Specify the name for the virtual machine and select the folder where you would like to place the virtual machine.
   
3. Specify the compute resources on which you want to deploy the appliance.
   
4. On the Review details pane, review what is displayed, but let’s face it, it won’t change anything going from here.
   
5. Select the datastore (cluster) on which you want to deploy the appliance.
   
6. Unfortunately, on the Select networks pane, you can only specify the port group. There is no way to specify the IP address of the appliance up front.
   
7. On the Ready to complete pane you should confirm if everything checks out as specified in the previous steps and hit Complete to start the deployment.
   
8. Now you should wait until the appliance is deployed so you can start the virtual machine.

Configuring the appliance

After the deployment has been completed successfully and the appliance is started, you can browse to the IP address of the appliance, which it got from the DHCP server. If you don’t have a DHCP server in the used network segment, please go to the previous section, which explains how to change it manually through the CLI.

Optional: Manually changing the IP address of the appliance

The DLS appliance expects a DHCP server in the network segment in which it’s present during the initial startup. Luckily, you can manually configure the IP address through the CLI quite easily by following the steps below.

1. From the vSphere client, open the remote or web console of the appliance.
2. Log in using the account dls_system, there is no need to provide a password.
3. From the CLI, execute the following script:
   /etc/adminscripts/set-static-ip-cli.sh
4. Now through a couple of steps, you will be prompted to provide the networking configuration for the appliance:
   1. Select if you want to configure the settings for IPv4 or IPv6
   2. Specify the (new) IP address
   3. Specify the default gateway
   4. Specify the primary DNS server
   5. Specify the secondary DNS server
   6. Specify the prefix for the subnetmask, for 255.255.255.0 enter 24
5. Now the script will go about and configure the networking of the appliance, after which you should be able to use a browser to open the webpage and continue the configuration.
   

Post configuration steps

Once you browse to the IP address of the appliance, there are a few things to do before you can start using the appliance.

1. Assuming this is the first time you are deploying the appliance, you select First time setup.
   
2. The second step is to specify the password for the dls_admin user account. And decide if you want to create a diagnostic user or not. This account will be able to access log files from the appliance console and will get the same password as the dls_admin account.
   
3. Write down and store the local reset secret on a secure location, as that is required to reset the password for the dls_admin user.
   
4. Once finished, you’ll see this familiar (but slightly different) screen.
   

Changing the IP address

To change the IP address from the one provided by the DHCP server, you can follow the steps below:

1. Log in to the administrative console of the appliance using the dls_admin account and the password you specified at an earlier moment.
2. In the menu on the left, select Service Instance.
3. On the Service Instance Details page, you’ll see the nodes listed and a button which states Configure IP address.
4. After having clicked that button, a pop-up will appear asking you to provide the appropiate settings for your network.
   
   1. Specify the IP address
   1. Specify the default gateway
   2. Specify the prefix for the subnet mask, for 255.255.255.0 enter 24
   3. Specify the primary DNS server
   4. Specify the secondary DNS server
5. Once you click Set node IP address, the appliance will be reconfigured and should shortly be available on its new IP address.

Optional: Changing the SSL certificate

Even though I marked this step as optional, I feel it’s mandatory to change the certificate on systems when used in a production environment. To do so, follow the steps below:

1. Log in to the administrative console of the appliance using the dls_admin account and the password you specified at an earlier moment.
2. In the menu on the left, select Service Instance.
3. On the Service Instance Details page, you’ll see a green button in the top right corner, with the label Actions.
   
4. After clicking the button, a dropdown menu appears in which you can select SSL configuration, which will show a pop-up called SSL Certificate Configuration.
   
5. Toggle the radio button if you are using a wildcard certificate (which will apply to the secondary node too if present). Select the certificate and private key files separtely, and click configure when done to change the certificate.

Optional: Configuring a log archive

Besides using a valid SSL certificate for services in production, it’s also considered common practice to store logfiles on an external location. Do note this is not a realtime log forwarding solution, log files will only be archived periodically!

Luckily it’s pretty easy to set this up from the Service Instance Details page and the green Actions button, where you’ll find the option Log Archive Settings.

Just pay attention that you don’t try to connect to a hidden share (using the dollar ($) sign) and that you use forward (/) slashes.

Setting up the service instance

Now we’re ready to start with what we are really here for, setting up the licenses so they can be actively consumed. Which we’ll do in three different steps:

1. Creating the license server
2. Registering the service instance
3. Binding the license server and the service instance

Creating the license server

1. Start by signing in to the NVIDIA application hub and go to the NVIDIA Licensing Portal.
2. From the menu on the left, select License Servers, and on the newly appeared page, click the green Create server button. This will start the create license server wizard.
   
3. Enter an appropriate name and description for the license server. Just make sure Create legacy server and Express CLS installation are not toggled, as those are not applicable for our configuration.
   
4. On the next page, select the licensing entitlements that you want to associate with your license server and finish the wizard by clicking Create server on the Preview server creation page.
5. Now you are ready to register the service instance, or if you have already, bind the license server and the service instance.

Registering the service instance

1. First, we need to log in to the administrative console of the appliance and download the DLS instance token. Which we can do from the dashboard.
   
2. Go to and sign in to the NVIDIA application hub and go to the NVIDIA Licensing Portal.
3. From the menu on the left, select Service Instances, and on the newly appeared page click the green Actions button.
   
4. From the context menu, select Upload DLS instance token, make sure you toggled New installation and select your instance token, and hit the Upload token button.
   
5. Back in the Services instances window, you’ll see that your new instance has the status Pending.
6. To get in a registered state, you click the Actions button on the right and select Register from the context menu. A confirmation window will appear, in which you will confirm that you want to register this instance.
   
7. Now that the service instance is registered, we can continue with binding the service instance and the license server.

Binding the license server and the service instance

1. Start by signing in to the NVIDIA application hub and go to the NVIDIA Licensing Portal.
2. From the menu on the left, select License Servers, and on the newly appeared page, click the Actions button in the same row as the earlier created license server.
   
3. From the context menu, click Bind (shown in the image above) and in the pop-up Window, select your service instance and click the green Bind button.
   
4. From the same Actions button, you now select Download and go back to the administrative console of the appliance.
5. On the dashboard, you click the Select license server file and select the file you just downloaded
   
6. Now all you need to do is click Install server to finalize setting up the licensing appliance.

Pointing the NVIDIA guest software to the licensing server

The last thing (I promise) we need to do is make sure that the NVIDIA guest software uses the license. The way this works has also been changed, where in the past, you had to provide the hostname of your license server. This now works with a token. For the instructions below, I’m assuming you have already installed the NVIDIA guest software.

1. First, we need to log in to the administrative console of the appliance and download the client config token. Which we can do from the dashboard.
2. Click on the green Actions button, and from the context menu, select Generate client config token.
   
3. Select the license server that you want to include in the token and click Download client configuration token.
   
4. Now all you need to do is make sure that the token ends up on the following location (for Windows), after which you will have to restart the NvDisplayContainer service:
   %SystemDrive%:\Program Files\NVIDIA Corporation\vGPU Licensing\ClientConfigToken 
5. If you want to use a custom location, be it local or on a network share, use the ClientConfigTokenPath (REG_SZ) registry key, which should be in the following location :
   HKEY_LOCAL_MACHINE\SOFTWARE\NVIDIA Corporation\Global\GridLicensing
6. Just make sure the computer object has the rights to access the location you specify, as the licensing service runs before the user logs in.
7. If done correctly, you should now see a lease appearing on your license server.

Conclusion

NVIDIA really improved the whole “vGPU licensing” experience. The deployment of the appliance is quick, easy and there is no more fiddling with Java. While there are some small things that they could improve, the biggest one would be to allow OVF properties to be configured during the deployment so that you can set the hostname and IP address upfront. Another “problem” I have is the fact that you are bound to a single user account, granted you might not use it that often, but I’m certain this will be a topic of discussion at a lot of organizations.