The VMware Tanzu command-line interface (Tanzu CLI) is a command-line tool that connects you to Tanzu. For example, you can use the Tanzu CLI to:
You can install the Tanzu CLI from a binary release or using a package manager such as Homebrew, Chocolatey, APT, YUM, and DNF. To install the Tanzu CLI:
To install the Tanzu CLI, follow the steps below.
NoteIf you want to retain an existing installation of the Tanzu CLI, move the CLI binary from
/usr/local/bin/tanzu
to a different location before following these steps.
Follow the instructions for your package manager below. This installs the latest version of the CLI available in the package registry.
APT (Debian or Ubuntu):
sudo apt update
sudo apt install -y ca-certificates curl gpg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://packages-prod.broadcom.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub | sudo gpg --dearmor -o /etc/apt/keyrings/tanzu-archive-keyring.gpg
echo "deb [signed-by=/etc/apt/keyrings/tanzu-archive-keyring.gpg] https://storage.googleapis.com/tanzu-cli-os-packages/apt tanzu-cli-jessie main" | sudo tee /etc/apt/sources.list.d/tanzu.list
sudo apt update
sudo apt install -y tanzu-cli
To uninstall the CLI:
sudo apt remove tanzu-cli
Chocolatey (Windows):
choco install tanzu-cli
To uninstall the CLI:
choco uninstall tanzu-cli
The tanzu-cli
package is part of the main Chocolatey Community Repository. When a new tanzu-cli
version is released, it may not be available immediately. If the above command fails, run:
choco install tanzu-cli --version TANZU-CLI-VERSION
Where TANZU-CLI-VERSION
is the Tanzu CLI version you want to install.
For example:
choco install tanzu-cli --version 1.4.0
Homebrew (MacOS):
brew update
brew install vmware-tanzu/tanzu/tanzu-cli
To uninstall the CLI:
brew uninstall tanzu-cli
YUM or DNF (RHEL):
cat << EOF | sudo tee /etc/yum.repos.d/tanzu-cli.repo
[tanzu-cli]
name=Tanzu CLI
baseurl=https://storage.googleapis.com/tanzu-cli-os-packages/rpm/tanzu-cli
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages-prod.broadcom.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub
EOF
sudo yum install -y tanzu-cli # If you are using DNF, run sudo dnf install -y tanzu-cli.
To uninstall the CLI:
sudo yum remove tanzu-cli
Check that the correct version of the CLI is properly installed.
tanzu version
version: v1.4.0
...
Proceed to Install Tanzu CLI Plugins. If you plan to use Tanzu CLI commands in automation scripts, see Interactive Prompts before installing the plugins.
To download a binary release of the Tanzu CLI and then install it:
Download the Tanzu CLI binary from Broadcom Support or GitHub:
From Broadcom Support:
From GitHub:
.tar.gz
or .zip
file of the Tanzu CLI binary for your OS, for example, tanzu-cli-windows-amd64.zip
.Unpack the Tanzu CLI file for your OS:
macOS:
tar -xvf tanzu-cli-darwin-amd64.tar.gz
Linux:
tar -xvf tanzu-cli-linux-amd64.tar.gz
Windows:
Use the Windows extractor tool to unzip tanzu-cli-windows-amd64.zip
.
Navigate to the directory containing the extracted CLI binary and then follow the steps below to install the CLI:
macOS:
Install the binary to /usr/local/bin
:
install tanzu-cli-darwin_amd64 /usr/local/bin/tanzu
Linux:
Install the binary to /usr/local/bin
:
sudo install tanzu-cli-linux_amd64 /usr/local/bin/tanzu
Windows:
Program Files\tanzu
folder.tanzu-cli-windows_amd64.exe
file into the new Program Files\tanzu
folder.tanzu-cli-windows_amd64.exe
to tanzu.exe
.tanzu
folder, select Properties > Security, and make sure that your user account has the Full Control permission.env
.Path
row under System variables, and click Edit.tanzu
CLI. The path value must not include the .exe
extension. For example, C:\Program Files\tanzu
.Check that the correct version of the CLI is properly installed.
tanzu version
version: v1.4.0
...
Proceed to Install Tanzu CLI Plugins if you intend to use the Tanzu CLI in an internet-connected environment or to Download Tanzu CLI Plugins if you intend to use the Tanzu CLI in an internet-restricted environment. If you plan to use Tanzu CLI commands in automation scripts, see Interactive Prompts before installing or downloading the plugins.
A Tanzu CLI plugin is an executable binary that packages a group of CLI commands. The core CLI has some command groups built in, and CLI plugins extend the CLI with additional command groups. For the list of built-in commands, see System Commands.
Specific plugins are relevant to different products and to different contexts that you connect the CLI to, based on the context type. Each product designates its relevant plugins as either standalone or context-scoped, as described in CLI Core, Plugins, Plugin Groups, and Products.
Context-scoped plugins: When you create a Tanzu CLI context to connect to a product, context-scoped plugins install automatically if they are not already installed. As a backup, if plugins do not automatically install, you can install them by running tanzu plugin sync
with the CLI set to the desired context.
Standalone plugins: For some but not all products, you need to install standalone plugins by running tanzu plugin install
as described below. To find out whether you need to install standalone plugins for your product, see CLI Core, Plugins, Plugin Groups, and Products.
After completing the steps in Install the Tanzu CLI above, follow these instructions to install standalone Tanzu CLI plugins. You can use one command to install all plugins in a plugin group or install each plugin individually.
Choose the plugin group by listing available plugin groups:
tanzu plugin group search
The output lists plugin groups, resembling:
tanzu plugin group search
GROUP DESCRIPTION LATEST
vmware-tanzu/app-developer Plugins for Application Developer for Tanzu Platform v0.1.1
vmware-tanzu/platform-engineer Plugins for Platform Engineer for Tanzu Platform v0.1.1
vmware-tanzucli/essentials Essential plugins for the Tanzu CLI v1.0.0
vmware-tap/default Plugins for TAP v1.9.1
vmware-tkg/default Plugins for TKG v2.5.1
vmware-tmc/default Plugins for TMC v1.0.0
vmware-vsphere/default Plugins for vSphere v8.0.2
In the output, look for the plugin group for your target, such as vmware-tkg
for TKG.
If you do not want to install the latest version listed, list all available versions for the plugin group:
tanzu plugin group search -n PLUGIN-GROUP-NAME --show-details
Where PLUGIN-GROUP-NAME
is the group listed in the previous step.
To see the list of plugins included in the plugin group, run:
tanzu plugin group get PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
Where PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
is the plugin group and group version for which you want to list the plugins. If you want to list the plugins for the latest version of the plugin group, you can omit :PLUGIN-GROUP-VERSION
when running tanzu plugin group get
. For more information about how to list available plugin groups, see tanzu plugin group.
Run one of the following:
If you want to install all plugins included in the latest version of the plugin group:
tanzu plugin install --group PLUGIN-GROUP-NAME
For example:
tanzu plugin install --group vmware-tkg/default
The CLI lists the installed version.
If you want to install all plugins included in a specific version of the plugin group:
tanzu plugin install --group PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
Where PLUGIN-GROUP-VERSION
is the desired version as listed with --show-details
in the previous step. For example:
tanzu plugin install --group vmware-tkg/default:v2.3.0
Verify that the plugins installed successfully by running:
tanzu plugin group get PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
tanzu plugin list
Where PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
is the plugin group and group version from which you installed the plugins. If you installed the plugins from the latest version of the plugin group, you can omit :PLUGIN-GROUP-VERSION
when running tanzu plugin group get
. Each plugin name and plugin version returned by tanzu plugin group get
must be included in the output of tanzu plugin list
.
Choose the plugin you want to install:
tanzu plugin search
The output lists plugins, resembling:
tanzu plugin search
NAME DESCRIPTION TARGET LATEST
cluster Kubernetes cluster operations kubernetes v0.29.0
feature Operate on features and featuregates kubernetes v0.29.0
kubernetes-release Kubernetes release operations kubernetes v0.29.0
If you want to list all available versions for the plugin, run:
tanzu plugin search -n PLUGIN-NAME --show-details
Where PLUGIN-NAME
is the plugin you chose above. For more information about this command and its options, see tanzu plugin search.
Run one of the following:
If you want to install the latest version of the plugin:
tanzu plugin install PLUGIN-NAME
If you want to install a specific version of the plugin:
tanzu plugin install PLUGIN-NAME --version PLUGIN-VERSION
If a plugin with the same name exists for more than one target, you must specify the --target
flag when installing the plugin. For example, for the target k8s
:
tanzu plugin install PLUGIN-NAME --target k8s
For more information about tanzu plugin install
and its options, see tanzu plugin install.
Verify that the plugin installed successfully by running:
tanzu plugin list
You can install and use the Tanzu CLI in an internet-restricted environment, which includes the following steps:
To download and install the Tanzu CLI binary:
The Tanzu CLI allows you to install and run CLI plugins in internet-restricted environments with no physical connection to the internet. For information about Tanzu CLI plugins, see Install Tanzu CLI Plugins above.
To enable the Tanzu CLI to install and update plugins in an internet-restricted environment, you must set up a private Docker-compatible container registry such as Harbor, Docker, or Artifactory.
Note: The Tanzu CLI supports uploading plugins to private registries that require authentication. However, your private registry must allow the CLI to pull the resulting images without authentication.
After the private registry is set up, the operator of the private registry can download the Tanzu CLI plugins required from the publicly available registry and move them to the private registry as follows:
Using the computer with the Tanzu CLI installed, download the desired CLI plugins as a tar.gz
file to your storage device.
To discover which plugin groups and plugins are available for download, use the tanzu plugin group search
and tanzu plugin search
commands. For information about using these commands, see tanzu plugin. After you identify the desired CLI plugins, you can use any of the options below to download them:
Download all plugins available in the default central repository:
tanzu plugin download-bundle --to-tar /tmp/FILE-NAME.tar.gz
Download all plugins included in the latest version of a specific plugin group. The command below uses the vmware-tkg/default
plugin group as an example:
tanzu plugin download-bundle --group vmware-tkg/default --to-tar /tmp/FILE-NAME.tar.gz
Download all plugins included in a specific version of a plugin group, for example, v2.3.0
of vmware-tkg/default
:
tanzu plugin download-bundle --group vmware-tkg/default:v2.3.0 --to-tar /tmp/FILE-NAME.tar.gz
You can also specify more than one plugin group version. For example:
tanzu plugin download-bundle --group vmware-tkg/default:v2.3.0,vmware-tkg/default:v2.2.0 --to-tar /tmp/FILE-NAME.tar.gz
For more information about tanzu plugin download-bundle
and its options, see tanzu plugin download-bundle.
Proceed to Move the Tanzu CLI and CLI Plugins to Your Internet-Restricted Environment below.
To configure the Tanzu CLI in your internet-restricted environment:
Move the storage device and if separate, the computer with the Tanzu CLI installed to your internet-restricted environment.
If the private registry requires authentication to upload images, run docker login
or crane auth login
to set up authentication with the registry.
If the private registry is configured with a self-signed CA certificate, add your certificate verification preferences by following the instructions in Adding Certificate Configuration for the Custom Registry below.
Upload the CLI plugins to the registry in the internet-restricted environment using the tanzu plugin upload-bundle
command. For example:
tanzu plugin upload-bundle --tar /tmp/FILE-NAME.tar.gz --to-repo registry.example.com/tanzu_cli/plugins
The tanzu plugin upload-bundle
command uploads the plugin bundle to the specified private repository and publishes the plugin inventory image under plugin-inventory:latest
. In the example above, the plugin inventory image will be published to registry.example.com/tanzu_cli/plugins/plugin-inventory:latest
. If you already uploaded any plugins to the specified private repository, the command will keep them and append your new plugins from the plugin bundle to the existing ones.
Update the Tanzu CLI to point to the new plugin source:
tanzu plugin source update default --uri registry.example.com/tanzu_cli/plugins/plugin-inventory:latest
Note: Each Tanzu CLI user working within your organization will need to execute the
tanzu plugin source update
command above in order to access and install or update the plugins that you make available in your internal registry.
Verify that the plugins are discoverable by running the tanzu plugin search
and tanzu plugin group search
commands.
Remove all pre-existing plugins before the final validation step:
tanzu plugin clean && tanzu plugin list
Run tanzu plugin install --group PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
to test plugin installation from your new plugin source.
Run tanzu plugin list
to confirm the expected plugins have been installed.
If your custom registry is configured with a self-signed CA certificate, you must do one of the following:
skip-cert-verify
option--insecure
optionIf your registry CA certificate is expired, use the --skip-cert-verify
or --insecure
option.
To configure your certificate verification preferences for the registry CA certificate:
To add the registry CA certificate to the Tanzu CLI, run the tanzu config cert add
command with the --ca-certificate
option. For example:
tanzu config cert add --host test.registry.com --ca-certificate PATH-TO-CA-CERT
If the registry is serving on a non-default port, add the port number. For example:
tanzu config cert add --host test.registry.com:8443 --ca-certificate PATH-TO-CA-CERT
To skip certificate verification, run the tanzu config cert add
command with the skip-cert-verify
option. For example:
tanzu config cert add --host test.registry.com --skip-cert-verify true
To allow HTTP connections to the registry and skip certificate verification, run the tanzu config cert add
command with the --insecure
option. For example:
tanzu config cert add --host test.registry.com --insecure true
You can update or delete your certificate configuration using the tanzu config cert update
and tanzu config cert delete
commands. For more information, see tanzu config cert.
If you configured a proxy between the Tanzu CLI and the central repository and the proxy uses a self-signed CA certificate, set the PROXY_CA_CERT
environment variable to the Base64 value of the proxy CA certificate.
To update your Tanzu CLI version, follow the instructions below.
NoteIf you want to retain an existing installation of the Tanzu CLI, move the CLI binary from
/usr/local/bin/tanzu
to a different location before following the instructions below.
Follow the instructions for your package manager below. This updates the CLI to the latest available version.
APT (Debian or Ubuntu):
sudo apt update
sudo apt upgrade -y tanzu-cli
Chocolatey (Windows):
choco install tanzu-cli
The tanzu-cli
package is part of the main Chocolatey Community Repository. When a new tanzu-cli
version is released, it may not be available immediately. If the above command fails, run:
choco install tanzu-cli --version TANZU-CLI-VERSION
Where TANZU-CLI-VERSION
is the version you want to update the CLI to.
For example:
choco install tanzu-cli --version 1.4.0
Homebrew (MacOS):
brew update
brew upgrade tanzu-cli
YUM or DNF (RHEL):
sudo yum update -y tanzu-cli # If you are using DNF, run sudo dnf update -y tanzu-cli.
Check that the correct version of the CLI is properly installed.
tanzu version
version: v1.4.0
...
When you run any Tanzu CLI command, except tanzu version
, tanzu config set
, and tanzu config eula
, for the first time, the Tanzu CLI prompts you to accept the VMware General Terms and configure the status of VMware’s Customer Experience Improvement Program (CEIP). If you plan to use Tanzu CLI commands non-interactively, for example, in automation scripts, ensure that you accept the VMware General Terms and configure your CEIP status before executing Tanzu CLI commands in your scripts.
tanzu config eula show
and tanzu config eula accept
commands. For more information about these commands, see tanzu config eula in Tanzu CLI Command Reference.TANZU_CLI_CEIP_OPT_IN_PROMPT_ANSWER
environment variable to Yes
or No
or use the tanzu telemetry cli-usage-analytics update
command. For more information about tanzu telemetry cli-usage-analytics update
, see tanzu telemetry cli-usage-analytics in Tanzu CLI Command Reference.Previous versions of the Tanzu CLI were bundled with product downloads for Tanzu Kubernetes Grid (TKG) and Tanzu Application Platform (TAP), and the installation of the CLI was different depending on which product you were using. For more information about Tanzu CLI releases prior to v0.90.0, see Compatibility with VMware Tanzu Products.
For information about the current Tanzu CLI support policy, see Tanzu CLI Policy on GitHub.
For more information, see: