Deactivating Admission Control Plugins for Tanzu Kubernetes Grid Integrated Edition Clusters

Topic provided by VMware

This section describes how to deactivate one or more admission control plugins for VMware Tanzu Kubernetes Grid Integrated Edition clusters. For more information, see Using Admission Control Plugins for Tanzu Kubernetes Grid Integrated Edition Clusters.

Deactivating a Single Admission Control Plugin

To deactivate a single admission control plugin, do the following:

1. Log in to Ops Manager.
2. Click the Tanzu Kubernetes Grid Integrated Edition tile.
3. Select the plan where you configured the admission control plugin, such as Plan 1.
4. Deselect the admission control plugin.
5. Click Save.
6. In the Errands pane, verify that Upgrade all clusters errand is activated.
7. Return to Installation Dashboard and select Review Pending Changes.
8. Click Apply Changes.

Alternatively, instead of enabling Upgrade all clusters errand, you can upgrade individual Kubernetes clusters through the TKGI Command Line Interface (TKGI CLI). For instructions on upgrading individual Kubernetes clusters, see Upgrading Clusters.

Deactivating an Orphaned Admission Control Plugin

The Ops Manager UI does not let you deselect (deactivate) all admission control plugins.

In other words, after an admission control plugin is activated, the Ops Manager UI requires that at least one admission control plugin checkbox is selected (activated).

To deactivate an orphaned Admission control Plugin, complete the following workflow:

1. Obtain the FQDN, user name and password of your Ops Manager.
2. Authenticate into the Ops Manager API and retrieve a UAA access token to access Ops Manager. For more information, see Using the Ops Manager API.

3. Obtain the BOSH deployment name for the Tanzu Kubernetes Grid Integrated Edition tile by doing one of the following options:

   1. Option 1: Use the Ops Manager API:

      1. In a terminal, run the following command:

         curl -i "https://OPS-MAN-FQDN/api/v0/staged/products" -X GET -H "Authorization: Bearer UAA-ACCESS-TOKEN" -k
         

      2. In the output, locate the installation_name that begins with pivotal-container-service.
      3. Copy the entire BOSH deployment name, including the unique GUID. For example, pivotal-container-service-4b48fc5b704d54c6c7de.

   2. Option 2: Use the Ops Manager UI:

      1. In Ops Manager, click on the Tanzu Kubernetes Grid Integrated Edition tile.

      2. Copy the BOSH deployment name including the GUID from the URL:

         
         
         The deployment name contains “pivotal-container-service” and a unique GUID string. For example, pivotal-container-service-4b48fc5b704d54c6c7de.

4. To deactivate the orphaned admission control plugin, run the following Ops Manager API command:

   curl -i "https://OPS-MAN-FQDN/api/v0/staged/pivotal-container-service-GUID/properties" \
   -H "Authorization: Bearer UAA-ACCESS-TOKEN" \
   -X PUT -d '{"properties": {".properties.PLAN-NUMBER_selector.active.admission_plugins":{"value":[]}}}' \
   -H "Content-Type: application/json"
   

   Where:

   • OPS-MAN-FQDN is the URL of your Ops Manager.
   • pivotal-container-service-GUID is the BOSH deployment name of your Tanzu Kubernetes Grid Integrated Edition that you retrieved earlier in this procedure.
   • UAA-ACCESS-TOKEN is the UAA token you retrieved earlier in this procedure.
   • PLAN-NUMBER is the plan configuration you want to update. For example, plan1 or plan2.

   For example:

    $ curl -i “https://pcf.example.com/api/v0/staged/products/pivotal-container-service-4b48fc5b704d54c6c7de/properties” \
   
   -H “Authorization: Bearer aBcdEfg0hIJKlm123.e” \
   
   -X PUT -d ‘{“properties”: {“.properties.plan1_selector.active.admission_plugins”:{“value”:[]}}}’ \
   
   -H “Content-Type: application/json”
   
   

5. From the output, verify that the command returns a HTTP 200 status code.

6. Validate your manifest change in the Ops Manager UI. Do the following:

   1. Log in to Ops Manager.
   2. Select Review Pending Changes.
   3. On the Review Pending Changes pane, navigate to the Tanzu Kubernetes Grid Integrated Edition section and select SEE CHANGES.

   4. Verify that the admission control plugins are displayed as removed in the Manifest section. For example:

      

7. Click Apply Changes.