Setting Up Tanzu Kubernetes Grid Integrated Edition Admin Users on vSphere

This topic describes how to create admin users in VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) with User Account and Authentication (UAA).

Overview

You must create at least one admin user during the initial set up of TKGI.

UAA is the identity management service for Tanzu Kubernetes Grid Integrated Edition. Tanzu Kubernetes Grid Integrated Edition includes a UAA server, which is hosted on the TKGI API VM.

To interact with the UAA server, you can use the UAA Command Line Interface (UAAC). You can either run UAAC commands from the Ops Manager VM or install UAAC on your local workstation.

Prerequisites

Before setting up admin users for Tanzu Kubernetes Grid Integrated Edition, you must have one of the following:

• SSH access to the Ops Manager VM

• A machine that can connect to your TKGI API VM

Step 1: Connect to the TKGI API VM

You can connect to the TKGI API VM from the Ops Manager VM or from a different machine such as your local workstation.

Option 1: Connect through the Ops Manager VM

You can connect to TKGI API VM by logging in to the Ops Manager VM through SSH.

To SSH into the Ops Manager VM on vSphere, do the following:

1. Locate the credentials that were used to import the Ops Manager .ova or .ovf file into your virtualization system. You configured these credentials when you installed Ops Manager and used them to complete the Prepare vSphere steps in Deploying Ops Manager on vSphere.

2. Change the permissions for your private SSH key by running the following command:

   chmod 600 PRIVATE-KEY
   

   Where PRIVATE-KEY is the name of your private SSH key.
   
   

3. SSH into the Ops Manager VM by running the following command:

   ssh -i PRIVATE-KEY ubuntu@OPS-MANAGER-FQDN
   

   Where OPS-MANAGER-FQDN is the fully qualified domain name (FQDN) of Ops Manager.

   For example:

   ssh -i id_rsa [email protected]
   

4. Proceed to the Log In as a UAA Admin section to create admin users with UAAC.

Option 2: Connect through a Non-Ops Manager Machine

To connect to the TKGI API VM and run UAA commands, do the following:

1. Install UAAC on your machine. For example:

   gem install cf-uaac
   

2. Download a copy of your Ops Manager root CA certificate to the machine. To download the certificate, do the following:

   1. In a web browser, navigate to the FQDN of Ops Manager and log in.
   2. In Ops Manager, navigate to Settings in the drop-down menu under your user name.
   3. Click Advanced Options.
   4. On the Advanced Options configuration page, click Download Root CA Cert.
   5. Move the certificate to a secure location on your machine and record the path.

3. Proceed to the Log In as a UAA Admin section to create admin users with UAAC.

Step 2: Log In as a UAA Admin

Before creating TKGI users, you must log in to the UAA server as a UAA admin. To log in to the UAA server, do the following:

1. Retrieve the UAA management admin client secret:

   1. In a web browser, navigate to the Ops Manager Installation Dashboard and click the Tanzu Kubernetes Grid Integrated Edition tile.

   2. Click the Credentials tab.

   3. Click Link to Credential next to Pks Uaa Management Admin Client and copy the value of
      secret.

2. Target your UAA server by running the following command:

   uaac target https://TKGI-API:8443 --ca-cert CERTIFICATE-PATH
   

   Where:

   • TKGI-API is the domain name of your TKGI API server. You entered this domain name in the Tanzu Kubernetes Grid Integrated Edition tile > TKGI API > API Hostname (FQDN).

   • CERTIFICATE-PATH is the path to your Ops Manager root CA certificate. Provide this certificate to validate the TKGI API certificate with SSL.

     • If you are logged in to the Ops Manager VM, specify /var/tempest/workspaces/default/root_ca_certificate as the path. This is the default location of the root certificate on the Ops Manager VM.
     • If you downloaded the Ops Manager root CA certificate to your machine, specify the path where you stored the certificate.

     For example:

     $ uaac target api.tkgi.example.com:8443 --ca-cert /var/tempest/workspaces/default/root_ca_certificate
     

     Note: If you receive an Unknown key: Max-Age = 86400 warning message, you can ignore it because it has no impact.

3. Authenticate with UAA by running the following command:

   uaac token client get admin -s ADMIN-CLIENT-SECRET
   

   Where ADMIN-CLIENT-SECRET is your UAA management admin client secret that you retrieved in a previous step. The client user name is admin.

Step 3: Assign Tanzu Kubernetes Grid Integrated Edition Cluster Scopes

The pks.clusters.manage and pks.clusters.admin UAA scopes grant users the ability to create and manage Kubernetes clusters in Tanzu Kubernetes Grid Integrated Edition. For information about UAA scopes in Tanzu Kubernetes Grid Integrated Edition, see UAA Scopes for Tanzu Kubernetes Grid Integrated Edition Users.

To create Tanzu Kubernetes Grid Integrated Edition users with the pks.clusters.manage or pks.clusters.admin UAA scope, perform one or more of the following procedures based on the needs of your deployment:

• To assign TKGI cluster scopes to an individual user, see Grant Tanzu Kubernetes Grid Integrated Edition Access to an Individual User. Follow this procedure if you selected Internal UAA when you configured UAA in the Tanzu Kubernetes Grid Integrated Edition tile. For more information, see Installing Tanzu Kubernetes Grid Integrated Edition on vSphere.
• To assign TKGI cluster scopes to an LDAP group, see Grant Tanzu Kubernetes Grid Integrated Edition Access to an External LDAP Group. Follow this procedure if you selected LDAP Server when you configured UAA in the Tanzu Kubernetes Grid Integrated Edition tile. For more information, see Installing Tanzu Kubernetes Grid Integrated Edition TKGI on vSphere.
• To assign TKGI cluster scopes to a SAML group, see Grant Tanzu Kubernetes Grid Integrated Edition Access to an External SAML Group. Follow this procedure if you selected SAML Identity Provider when you configured UAA in the Tanzu Kubernetes Grid Integrated Edition tile. For more information, see Installing Tanzu Kubernetes Grid Integrated Edition TKGI on vSphere.
• To assign TKGI cluster scopes to a client, see Grant Tanzu Kubernetes Grid Integrated Edition Access to a Client.

Next Step

After you create admin users in Tanzu Kubernetes Grid Integrated Edition, the admin users can create and manage Kubernetes clusters in Tanzu Kubernetes Grid Integrated Edition. For more information, see Managing Kubernetes Clusters and Workloads.