Before you can deploy Tanzu Kubernetes Grid (TKG) with a standalone management cluster, you must provision resources and permissions on your infrastructure to accommodate the management cluster and the workload clusters that it creates.
For production deployments, VMware recommends enabling external identity management on each management cluster, to control access to it and its workload clusters.
Tanzu Kubernetes Grid 2.1.x do not have FIPS-capable OVA. However, you can harden the image using
ytt overlay. See STIG and NSA/CISA Hardening.
For how to deploy a standalone management cluster in a proxied or airgapped environment, see Prepare an Internet-Restricted Environment.
To deploy Tanzu Kubernetes Grid to VMware Cloud on AWS or to Azure VMware Solution, see Prepare to Deploy Management Clusters to a VMware Cloud Environment.