Blog

I Miss vCenter — So I’m Building My Own (in AWS)

Joseph Klimczak December 31, 2025 No Comments

I’ve been living in AWS long enough that I’m supposed to have moved on.

I can design multi-account landing zones, argue about Transit Gateways vs. VPC peering, and recite IAM best practices in my sleep. I understand why cloud-native patterns exist. I even agree with most of them.

But if I’m being honest?

I miss vCenter.

The Comfort of a Single Pane of Glass

Back in the vSphere days, vCenter was home base. One UI. One mental model. One place where I could:

• See all my workloads
• Understand capacity at a glance
• Migrate compute without rewriting the world
• Apply policies consistently
• Fix problems visually instead of spelunking through APIs

Yes, it was centralized. Yes, it had limitations. Yes, it could be fragile.

But it was coherent.

In AWS, coherence is… optional.

AWS Is Powerful — But Fragmented

Don’t get me wrong: AWS is incredible. The primitives are flexible, scalable, and battle-tested. But as an operator, the experience is scattered:

• EC2 over here
• ASGs over there
• Load balancers somewhere else
• Metrics in CloudWatch
• Config in tags (maybe)
• Inventory split across accounts and regions

The AWS Console isn’t lying to you — but it also isn’t telling you the whole story in one place.

Instead of operating infrastructure, I often feel like I’m assembling context.

What vCenter Got Right

vCenter wasn’t just a hypervisor manager. It was an operations platform:

• Strong inventory model
• Clear parent/child relationships
• First-class lifecycle concepts
• Human-readable abstractions
• Predictable workflows

You didn’t need five services and a wiki page just to answer:

“What’s running where, and why?”

So… I’m Building My Own vCenter (Sort Of)

I’m not trying to recreate vSphere in the cloud. That would miss the point.

What I am doing is building a control plane on top of AWS Using APIS that gives me back what I miss:

• A unified inventory across accounts and regions
• Opinionated metadata instead of tag chaos
• Clear ownership and lifecycle states
• Capacity and cost visibility that makes sense to humans
• Operational workflows that don’t start with “open three consoles”

Think less “hypervisor replacement” and more operator experience layer.

AWS provides the raw materials. I’m just putting a dashboard, model, and brain on top of them.

Cloud-Native Doesn’t Have to Mean Operator-Hostile

Somewhere along the way, “cloud-native” became synonymous with:

• More YAML
• More dashboards
• More glue code
• More tribal knowledge

But abstraction isn’t the enemy. Bad abstraction is.

vCenter succeeded because it respected how humans think about systems. AWS succeeds because it gives you freedom. The gap between the two is where a lot of operator pain lives.

That gap is exactly what I’m trying to close.

This Is Not Nostalgia — It’s a Design Problem

I don’t miss vCenter because it was old.

I miss it because it solved real operational problems well.

If we can acknowledge that, we can stop pretending the current state is perfect — and start building better tools on top of the cloud we actually run.

So yes, I’m an AWS admin Now.

And yes, I miss vCenter.

That’s why I’m building my own. More to come

🛡 How to Turn an Alpine Linux Server into a Tailscale Gateway for Your LAN

Joseph Klimczak August 10, 2025 No Comments

Why a Tailscale Gateway?

Tailscale normally requires each device to run the Tailscale client. That works fine for laptops, phones, and servers, but what about devices like printers, cameras, or NAS boxes?

With a Subnet Router, a single Tailscale-connected server can act as a bridge to your entire LAN — so any device on your Tailscale network can reach those local-only devices securely.

What You’ll Need

• A small Alpine Linux server (VM, bare metal, or Raspberry Pi)
• An active Tailscale account
• Access to your LAN network (e.g., 192.168.1.0/24)
• Your Tailscale auth key (from the Tailscale admin panel)

Step 1: Update & Install Tailscale

First, update Alpine and install Tailscale:

apk update && apk upgrade
apk add tailscale tailscale-openrc

Step 2: Enable IP Forwarding

This allows the Alpine box to forward traffic between your Tailscale network and LAN.

Edit /etc/sysctl.conf:

nano /etc/sysctl.conf

Add:

net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

Apply:

sysctl -p

Step 3: Start Tailscale & Advertise Routes

Start the Tailscale service:

rc-update add tailscaled default
rc-service tailscaled start

Now bring Tailscale online, advertising your LAN subnet:

tailscale up \
  --auth-key=tskey-auth-XXXXXXX \
  --advertise-routes=192.168.1.0/24 \
  --accept-routes

Step 4: Approve Routes in Tailscale Admin

Log in to Tailscale Admin Routes and enable the route for 192.168.1.0/24.

Step 5: (Optional) Adjust Firewall Rules

If Alpine’s firewall is active, you’ll need to allow forwarding:

apk add iptables
iptables -A FORWARD -i tailscale0 -j ACCEPT
iptables -A FORWARD -o tailscale0 -j ACCEPT
/etc/init.d/iptables save

Done! 🎉

Now, any device on your Tailscale network can securely reach devices on your LAN without needing a VPN client installed.

Example:

• From your laptop on Tailscale, you can hit http://192.168.1.50 to access your NAS dashboard — even from across the world.

Why This Rocks

• Zero Trust Security — Every connection is authenticated via your Tailscale identity provider.
• No Port Forwarding — Works through NAT and firewalls.
• Cross-Platform — Works for Windows, macOS, Linux, iOS, Android, and even cloud VMs.

💡 Pro tip: Combine this with Tailscale ACLs to restrict who can access which LAN devices.

CrowdStrike MacOS Workspace One Setup

Joseph Klimczak June 16, 2025 No Comments

After weeks of troubleshooting Verese issues I thought it would be good to document a working process. Hopefully this helps not go through some of the pain that I have been through due to some of corks.

I have a few profile to enable CrowdStrike with no user interaction needed.

macOS - CrowdStrike - Content Filter

Filter Name: falcon
Identifier: com.crowdstrike.falcon.App
Organization: CrowdStrike, Inc.
Filter Socket Traffic: Enabled
Socket Filter Bundle ID: com.crowdstrike.falcon.Agent
Socket Requirement: identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = X9E956P446
Filter Grade: Inspector

macOS – CrowdStrike – Login and Background Items

Rule Type: BundleIdentifier
Rule Value: com.crowdstrike.falcon.UserAgent
Team Identifier: X9E956P446

macOS - CrowdStrike - Notification Settings
App Bundle ID: com.crowdstrike.falcon.UserAgent
Allow notifications: Enable
Show in Notification Center: Enable
Show in Lock Screen: Enable
Allow badging: Enable
Allow sounds: Enable
Allow critical alert notifications: Enable
Alert Type: Temporary Banner 

macOS – CrowdStrike – System Extension

Allowed System Extension Types
Team Identifier: X9E956P446
Endpoint Security & Network Enable

Allowed System Extensions
Team Identifier: X9E956P446
Bundle Identifier: com.crowdstrike.falcon.Agent

Now this is what gave me and so many people issue. I dont know if this is a bug or undocumented need for Workspace one and Crowd Strike Profile.

In this order Create a MacOS – Crowdstrike – Privacy Preference in this order

Identifier: com.crowdstrike.falcon.Agent
Identifier Type Bundle ID
Code Requirement: identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
Comment: agent
System Policy All Files: Allow
System Policy Sys Admin Files: Allow

Now add a second Prefrences inside the same one for Falcon App

Identifier: com.crowdstrike.falcon.App
Identifier Type Bundle ID
Code Requirement: identifier "com.crowdstrike.falcon.App" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
Comment: app
System Policy All Files: Allow
System Policy Sys Admin Files: Allow

I hope this helps save you time: The big issue was not having something in the comments. Once that was added the rest your app should not go green in some cases I need to reboot

Bonus: Install Script

Post Install Script
#!/bin/bash
sudo /Applications/Falcon.app/Contents/Resources/falconctl license "Your Key"

Health & Environment

Joseph Klimczak December 23, 2024 No Comments

Introducing the Health & Environment Tile in the New Omnissa Cloud Services Portal

The Omnissa Cloud Services Portal is evolving, and one of the most exciting updates is the addition of the Health & Environment tile. This new feature is designed to streamline critical processes, centralize management tasks, and provide a comprehensive view of your Workspace ONE Cloud Managed Hosting environment.

What Does the Health & Environment Tile Offer?

The Health & Environment tile brings together several key services that were previously spread across platforms, including My.WorkspaceONE.com. As part of the broader transition to the Omnissa Cloud Services Portal under Omnissa Connect, this tile will enable you to:

1. Schedule UEM Upgrades

Effortlessly manage upgrades for your Workspace ONE Cloud Managed Hosting environment. The scheduling tool ensures minimal downtime and keeps your environment up-to-date with the latest features and security updates.

2. Sign and Renew Certificates

Certificate management is now more accessible than ever. Whether you need to sign or renew certificates for your environment, this tool simplifies the process, ensuring compliance and operational continuity.

3. Monitor Omnissa Products and Services

Stay informed about the status of all Omnissa products and services in one centralized dashboard. Whether you’re tracking performance metrics or troubleshooting potential issues, the Health & Environment tile provides real-time insights to keep your operations running smoothly.

Transition to Omnissa Connect

The integration of these features into the Omnissa Cloud Services Portal is part of a larger effort under Omnissa Connect. This initiative focuses on creating a seamless user experience by consolidating tools and services into a unified platform. As more features transition from My.WorkspaceONE.com to the Cloud Services Portal, you’ll enjoy a cohesive and efficient management experience.

Why It Matters

The Health & Environment tile is more than just a new feature—it’s a step forward in simplifying cloud service management. By centralizing tools and services in one portal, Omnissa is reducing complexity and empowering users to take control of their environments with ease.

Stay tuned as more features make their way into the Omnissa Cloud Services Portal, further enhancing your ability to manage and optimize your Workspace ONE environment.

Ready to explore the new Health & Environment tile? Log in to the Omnissa Cloud Services Portal today and experience the next generation of cloud service management!

WSO Tunnel VPN Profile 2.0

Joseph Klimczak July 13, 2024 No Comments

This is for UEM 24.x.x

The Old Way was custom XML

The new way

Some of my Key XML Configs

Conclusion:

We have covered the key configurations for Workspace ONE Tunnel on Windows Desktop