Identity Management in the Management Console

This topic describes how to manage users and groups in VMware Tanzu Kubernetes Grid Integrated Edition Management Console (TKGI MC).

Overview

On vSphere, you can add individual users or user groups to Tanzu Kubernetes Grid Integrated Edition Management Console. You can assign roles to individual users or to groups. If you assign a role to a group, all of the users in that group have that role.

For information about the roles that you can assign, see UAA Scopes for Tanzu Kubernetes Grid Integrated Edition Users.

For information about the tasks that Cluster Managers can perform, see Tanzu Kubernetes Grid Integrated Edition Architecture. The TKGI Administrator role allows users to manage the Tanzu Kubernetes Grid Integrated Edition infrastructure.

Add Individual Users

The procedure to add individual users to Tanzu Kubernetes Grid Integrated Edition Management Console is as follows.

Note: This release of Tanzu Kubernetes Grid Integrated Edition Management Console does not support assigning roles to individual LDAP or SAML users. To assign roles to LDAP or SAML users, use user groups.

1. Go to the Identity Management view of the management console.

2. Select the Users tab.

   View a larger version of this image

3. Click Add User.

4. Enter a user name and enter and verify a password to create a new user account.
   
   The password that you set must meet the following criteria:

   • Minimum eight characters
   • Maximum 20 characters
   • Minimum one lowercase character
   • Minimum one numeric character
   • Minimum one special character
   • Minimum one uppercase character
   • Maximum 3 identical adjacent characters

   

5. Assign a role to the user.
   • pks.clusters.manage: Accounts with this scope can create and access their own clusters.
   • pks.clusters.admin: Accounts with this scope can create and access all clusters.
   • pks.clusters.admin.read: Accounts with this scope can access any information about all clusters except for cluster credentials.
6. Click Save.
7. If you do not assign a role to a user when you create or add the account, or to change a user’s role, select the user in the Users tab, and select Assign Role.

Add User Groups

The procedure to add user groups to Tanzu Kubernetes Grid Integrated Edition Management Console is as follows.

1. Go to the Identity Management view of the management console.

2. Select the Groups tab.

   View a larger version of this image

3. Click Add Group.
4. Enter an existing LDAP or SAML user group.
   • LDAP: Enter the distinguished name of an existing LDAP group under the configured group search base, for example cn=admins,ou=engineering,dc=username,dc=local.
   • SAML: Enter the name of your SAML identity provider group.

5. Assign a role to the group.

   • pks.clusters.manage: Accounts with this scope can create and access their own clusters.
   • pks.clusters.admin: Accounts with this scope can create and access all clusters.
   • pks.clusters.admin.read: Accounts with this scope can access any information about all clusters except for cluster credentials.

   

6. Click Save.

Note: You must assign a role to a group when you add it. You cannot assign, change, or revoke a group role after you have added the group.

Remove Individual Users

The procedure to remove individual users from Tanzu Kubernetes Grid Integrated Edition Management Console is as follows.

1. Go to the Identity Management view of the management console.
2. Select the Users tab.
3. Select a user.
4. Click Remove User.

Remove User Groups

The procedure to remove individual users from Tanzu Kubernetes Grid Integrated Edition Management Console is as follows.

1. Go to the Identity Management view of the management console.
2. Select the Groups tab.
3. Select a group.
4. Click Remove Group.

Next Steps

• Assign Resource Quotas to Users
• Working with Network Profiles
• Create Clusters in the Management Console