Installing and Using VMware Tanzu CLI v0.90.x

The VMware Tanzu command-line interface (Tanzu CLI) is a command-line tool that connects you to Tanzu. For example, you can use the Tanzu CLI to:

Create and manage management clusters
Create and manage workload clusters
Manage Kubernetes releases
Install and manage packages
Create and manage application workloads
Configure the Tanzu CLI itself

Installing the Tanzu CLI in Internet-Connected Environments

You can install the Tanzu CLI from a binary release or using a package manager such as Homebrew, Chocolatey, APT, YUM, and DNF. To install the Tanzu CLI:

Install the Tanzu CLI
Install Tanzu CLI Plugins

Install the Tanzu CLI

To install the Tanzu CLI, follow the steps below. After you install the Tanzu CLI, proceed to Install Tanzu CLI Plugins.

Note
If you want to retain an existing installation of the Tanzu CLI, move the CLI binary from /usr/local/bin/tanzu to a different location before following these steps.

Install using a package manager

To install the Tanzu CLI using a package manager:

Follow the instructions for your package manager below. This installs the latest version of the CLI available in the package registry.

APT (Debian or Ubuntu):

sudo apt-get update
sudo apt-get install -y ca-certificates curl gpg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://packages.vmware.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub | sudo gpg --dearmor -o /etc/apt/keyrings/tanzu-archive-keyring.gpg
echo "deb [signed-by=/etc/apt/keyrings/tanzu-archive-keyring.gpg] https://storage.googleapis.com/tanzu-cli-os-packages/apt tanzu-cli-jessie main" | sudo tee /etc/apt/sources.list.d/tanzu.list
sudo apt-get update
sudo apt-get install -y tanzu-cli

To uninstall the CLI:

sudo apt-get remove tanzu-cli

Chocolatey (Windows):
```
choco install tanzu-cli
```
To uninstall the CLI:
```
choco uninstall tanzu-cli
```
The tanzu-cli package is part of the main Chocolatey Community Repository. When a new tanzu-cli version is released, it may not be available immediately. If the above command fails, run:
```
choco install tanzu-cli --version TANZU-CLI-VERSION
```
Where TANZU-CLI-VERSION is the Tanzu CLI version you want to install.

For example:
```
choco install tanzu-cli --version 0.90.1
```

Homebrew (MacOS):

brew update
brew install vmware-tanzu/tanzu/tanzu-cli

To uninstall the CLI:

brew uninstall tanzu-cli

YUM or DNF (RHEL):

cat << EOF | sudo tee /etc/yum.repos.d/tanzu-cli.repo
[tanzu-cli]
name=Tanzu CLI
baseurl=https://storage.googleapis.com/tanzu-cli-os-packages/rpm/tanzu-cli
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.vmware.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub
EOF

sudo yum install -y tanzu-cli # If you are using DNF, run sudo dnf install -y tanzu-cli.

To uninstall the CLI:

sudo yum remove tanzu-cli

Check that the correct version of the CLI is properly installed.
```
tanzu version
version: v0.90.1
...
```

Install from a binary release

You can download the Tanzu CLI binary from VMware Customer Connect or GitHub.

To download a binary release of the Tanzu CLI and then install it:

Download the Tanzu CLI binary from VMware Customer Connect or GitHub:
- From VMware Customer Connect:
  1. Go to the VMware Tanzu CLI page on VMware Customer Connect.
  2. Under Product Downloads for the CLI version that you want to install, locate and download the Tanzu CLI binary for your operating system (OS).
- From GitHub:
  1. Go to the Tanzu CLI releases page on GitHub.
  2. Locate your desired release version.
  3. From the Assets section of your chosen release, click to download the .tar.gz or .zip file of the Tanzu CLI binary for your OS, for example, tanzu-cli-windows-amd64.zip.
Unpack the Tanzu CLI file for your OS:
- macOS:
```
tar -xvf tanzu-cli-darwin-amd64.tar.gz
```
- Linux:
```
tar -xvf tanzu-cli-linux-amd64.tar.gz
```
- Windows:
  
  Use the Windows extractor tool to unzip tanzu-cli-windows-amd64.zip.
Navigate to the directory containing the extracted CLI binary and then follow the steps below to install the CLI:
- macOS:
  
  Install the binary to /usr/local/bin:
```
install tanzu-cli-darwin_amd64 /usr/local/bin/tanzu
```
- Linux:
  
  Install the binary to /usr/local/bin:
```
sudo install tanzu-cli-linux_amd64 /usr/local/bin/tanzu
```
- Windows:
  1. Create a new Program Files\tanzu folder.
  2. Copy the tanzu-cli-windows_amd64.exe file into the new Program Files\tanzu folder.
  3. Rename tanzu-cli-windows_amd64.exe to tanzu.exe.
  4. Right-click the tanzu folder, select Properties > Security, and make sure that your user account has the Full Control permission.
  5. Use Windows Search to search for env.
  6. Select Edit the system environment variables and click the Environment Variables button.
  7. Select the Path row under System variables, and click Edit.
  8. Click New to add a new row and enter the path to the tanzu CLI. The path value must not include the .exe extension. For example, C:\Program Files\tanzu.
Check that the correct version of the CLI is properly installed.
```
tanzu version
version: v0.90.1
...
```

Install Tanzu CLI Plugins

A Tanzu CLI plugin is an executable binary that packages a group of CLI commands. The core CLI has some command groups built in, and CLI plugins extend the CLI with additional command groups. For the list of built-in commands, see System Commands.

Specific plugins are relevant to different products and to different contexts that you connect the CLI to, based on the context type, or target. Each product designates its relevant plugins as either standalone or context-scoped, as described in CLI Core, Plugins, Plugin Groups, and Products.

Context-scoped plugins: When you create a Tanzu CLI context to connect to a product, context-scoped plugins install automatically if they are not already installed. As a backup, if plugins do not automatically install, you can install them by running tanzu plugin sync with the CLI set to the desired context.

Standalone plugins: For some but not all products, you need to install standalone plugins by running tanzu plugin install as described below. To find out whether you need to install standalone plugins for your product, see CLI Core, Plugins, Plugin Groups, and Products.

After completing the steps in Install the Tanzu CLI above, follow these instructions to install standalone Tanzu CLI plugins. You can use one command to install all plugins in a plugin group or install each plugin individually.

Install all plugins in a group

To install all plugins in a plugin group:

Choose the plugin group by listing available plugin groups:

tanzu plugin group search

The output lists plugin groups, resembling:

tanzu plugin group search

GROUP               DESCRIPTION              LATEST
vmware-tap/default  Plugins for TAP          v1.6.1
vmware-tkg/default  Plugins for TKG          v2.3.0

In the output, look for the plugin group for your target, such as vmware-tkg for TKG.
- If you do not want to install the latest version listed, list all available versions for the plugin group:
```
tanzu plugin group search -n PLUGIN-GROUP-NAME --show-details
```
  Where PLUGIN-GROUP-NAME is the group listed in the previous step.
- To see the list of plugins included in the plugin group, run:
```
tanzu plugin group get PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
```
  Where PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION is the plugin group and group version for which you want to list the plugins. If you want to list the plugins for the latest version of the plugin group, you can omit :PLUGIN-GROUP-VERSION when running tanzu plugin group get. For more information about how to list available plugin groups, see tanzu plugin group.
Run one of the following:
- If you want to install all plugins included in the latest version of the plugin group:
```
tanzu plugin install --group PLUGIN-GROUP-NAME
```
  For example:
```
tanzu plugin install --group vmware-tkg/default
```
  The CLI lists the installed version.
- If you want to install all plugins included in a specific version of the plugin group:
```
tanzu plugin install --group PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
```
  Where PLUGIN-GROUP-VERSION is the desired version as listed with --show-details in the previous step. For example:
```
tanzu plugin install --group vmware-tkg/default:v2.1.0
```
Verify that the plugins installed successfully by running:
```
tanzu plugin group get PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
tanzu plugin list
```
Where PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION is the plugin group and group version from which you installed the plugins. If you installed the plugins from the latest version of the plugin group, you can omit :PLUGIN-GROUP-VERSION when running tanzu plugin group get. Each plugin name and plugin version returned by tanzu plugin group get must be included in the output of tanzu plugin list.

Install a single plugin

To install a single plugin:

Choose the plugin you want to install:

tanzu plugin search

The output lists plugins, resembling:

tanzu plugin search
NAME                DESCRIPTION                                                    TARGET      LATEST
cluster             Kubernetes cluster operations                                  kubernetes  v0.29.0
feature             Operate on features and featuregates                           kubernetes  v0.29.0
kubernetes-release  Kubernetes release operations                                  kubernetes  v0.29.0

If you want to list all available versions for the plugin, run:

tanzu plugin search -n PLUGIN-NAME --show-details

Where PLUGIN-NAME is the plugin you chose above. For more information about this command and its options, see tanzu plugin search.

Run one of the following:
- If you want to install the latest version of the plugin:
```
tanzu plugin install PLUGIN-NAME
```
- If you want to install a specific version of the plugin:
```
tanzu plugin install PLUGIN-NAME --version PLUGIN-VERSION
```
If a plugin with the same name exists for more than one target, you must specify the --target flag when installing the plugin. For example, for the target k8s:
```
tanzu plugin install PLUGIN-NAME --target k8s
```
For more information about tanzu plugin install and its options, see tanzu plugin install.
Verify that the plugin installed successfully by running:
```
tanzu plugin list
```

Installing the Tanzu CLI in Internet-Restricted Environments

You can install and use the Tanzu CLI in an internet-restricted environment, which includes the following steps:

Download and Install the Tanzu CLI Binary
Download Tanzu CLI Plugins
Move the Tanzu CLI and CLI Plugins to Your Internet-Restricted Environment

Download and Install the Tanzu CLI Binary

To download and install the Tanzu CLI binary:

While connected to the internet, download the Tanzu CLI binary to a storage device, such as your computer, and then install it. To download and install the Tanzu CLI binary, follow the instructions in the Install from a binary release tab in Install the Tanzu CLI above.
Proceed to Download Tanzu CLI Plugins below.

Download Tanzu CLI Plugins

The Tanzu CLI allows you to install and run CLI plugins in internet-restricted environments with no physical connection to the internet. For information about Tanzu CLI plugins, see Install Tanzu CLI Plugins above.

To enable the Tanzu CLI to install and update plugins in an internet-restricted environment, you must set up a private Docker-compatible container registry such as Harbor, Docker, or Artifactory.

Note: The Tanzu CLI supports uploading plugins to private registries that require authentication. However, your private registry must allow the CLI to pull the resulting images without authentication.

After the private registry is set up, the operator of the private registry can download the Tanzu CLI plugins required from the publicly available registry and move them to the private registry as follows:

Using the computer with the Tanzu CLI installed, download the desired CLI plugins as a tar.gz file to your storage device.

To discover which plugin groups and plugins are available for download, use the tanzu plugin group search and tanzu plugin search commands. For information about using these commands, see tanzu plugin. After you identify the desired CLI plugins, you can use any of the options below to download them:
- Download all plugins available in the default central repository:
```
tanzu plugin download-bundle --to-tar /tmp/FILE-NAME.tar.gz
```
- Download all plugins included in the latest version of a specific plugin group. The command below uses the vmware-tkg/default plugin group as an example:
```
tanzu plugin download-bundle --group vmware-tkg/default --to-tar /tmp/FILE-NAME.tar.gz
```
- Download all plugins included in a specific version of a plugin group, for example, v2.1.0 of vmware-tkg/default:
```
tanzu plugin download-bundle --group vmware-tkg/default:v2.1.0 --to-tar /tmp/FILE-NAME.tar.gz
```
  You can also specify more than one plugin group version. For example:
```
tanzu plugin download-bundle --group vmware-tkg/default:v2.1.0,vmware-tkg/default:v1.6.0 --to-tar /tmp/FILE-NAME.tar.gz
```
  For more information about tanzu plugin download-bundle and its options, see tanzu plugin download-bundle.
Proceed to Move the Tanzu CLI and CLI Plugins to Your Internet-Restricted Environment below.

Move the Tanzu CLI and CLI Plugins to Your Internet-Restricted Environment

To configure the Tanzu CLI in your internet-restricted environment:

Move the storage device and if separate, the computer with the Tanzu CLI installed to your internet-restricted environment.
If the private registry requires authentication to upload images, run docker login or crane auth login to set up authentication with the registry.
If the private registry is configured with a self-signed CA certificate, add your certificate verification preferences by following the instructions in Adding Certificate Configuration for the Custom Registry below.
Upload the CLI plugins to the registry in the internet-restricted environment using the tanzu plugin upload-bundle command. For example:
```
tanzu plugin upload-bundle --tar /tmp/FILE-NAME.tar.gz --to-repo registry.example.com/tanzu-cli/plugin
```
The tanzu plugin upload-bundle command uploads the plugin bundle to the specified private repository and publishes the plugin inventory image under plugin-inventory:latest. In the example above, the plugin inventory image will be published to registry.example.com/tanzu-cli/plugin/plugin-inventory:latest. If you already uploaded any plugins to the specified private repository, the command will keep them and append your new plugins from the plugin bundle to the existing ones.
Update the Tanzu CLI to point to the new plugin source:
```
tanzu plugin source update default --uri registry.example.com/tanzu-cli/plugin/plugin-inventory:latest
```
Note: Each Tanzu CLI user working within your organization will need to execute the tanzu plugin source update command above in order to access and install or update the plugins that you make available in your internal registry.
Verify that the plugins are discoverable by running the tanzu plugin search and tanzu plugin group search commands.
Remove all pre-existing plugins before the final validation step:
```
tanzu plugin clean && tanzu plugin list
```
Run tanzu plugin install --group PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION to test plugin installation from your new plugin source.
Run tanzu plugin list to confirm the expected plugins have been installed.

Adding Certificate Configuration for the Custom Registry

If your custom registry is configured with a self-signed CA certificate, you must do one of the following:

Provide the registry CA certificate to the Tanzu CLI
Configure the Tanzu CLI to use HTTPS connections and skip server certificate verification by activating the skip-cert-verify option
Allow HTTP connections to the registry and skip server certificate verification by activating the --insecure option

If your registry CA certificate is expired, use the --skip-cert-verify or --insecure option.

To configure your certificate verification preferences for the registry CA certificate:

To add the registry CA certificate to the Tanzu CLI, run the tanzu config cert add command with the --ca-certificate option. For example:
```
tanzu config cert add --host test.registry.com --ca-certificate PATH-TO-CA-CERT
```
If the registry is serving on a non-default port, add the port number. For example:
```
tanzu config cert add --host test.registry.com:8443 --ca-certificate PATH-TO-CA-CERT
```
To skip certificate verification, run the tanzu config cert add command with the skip-cert-verify option. For example:
```
tanzu config cert add --host test.registry.com --skip-cert-verify true
```
To allow HTTP connections to the registry and skip certificate verification, run the tanzu config cert add command with the --insecure option. For example:
```
tanzu config cert add --host test.registry.com  --insecure true
```

You can update or delete your certificate configuration using the tanzu config cert update and tanzu config cert delete commands. For more information, see tanzu config cert.

Adding a Proxy CA certificate

If you configured a proxy between the Tanzu CLI and the central repository and the proxy uses a self-signed CA certificate, set the PROXY_CA_CERT environment variable to the Base64 value of the proxy CA certificate.

Previous Versions

Previous versions of the Tanzu CLI were bundled with product downloads for Tanzu Kubernetes Grid (TKG) and Tanzu Application Platform (TAP), and the installation of the CLI was different depending on which product you were using. For more information about Tanzu CLI releases prior to v0.90.0, see Compatibility with VMware Tanzu Products.

What to Do Next

For more information, see: