Install and Configure the Tanzu CLI and Tanzu Mission Control Plug-ins

Install and initialize the Tanzu command line interface (tanzu), and install the plug-ins for Tanzu Mission Control.

Prerequisites

To download and use the CLI, you must be a member of a VMware Cloud Services organization that has access to Tanzu Mission Control.
Identify your organization’s endpoint for Tanzu Mission Control. You will need it when creating a context. Log in to the Tanzu Mission Control console, and then copy the domain from the URL in your browser. It looks something like this:
my-organization.tmc.cloud.vmware.com
If you intend to run the CLI from a location protected by a proxy server, you must add the following URL to your proxy allowlist.
console.cloud.vmware.com

Retrieve an API token.

In the Tanzu Mission Control console, click on your name in the top right corner, and then click the link to go to the My Account page in the VMware Cloud Services console.
Click the API Tokens tab.
Provide a name and duration for the token.
Select All Roles when defining the scope.
Check the OpenID checkbox.
When generating an API token for Tanzu Mission Control, OpenID is required. Otherwise VMware Cloud services doesn’t include groups in the ID Token, which directly impacts the Tanzu Mission Control RBAC.
Click Generate to create an API token with a scope of all roles, and then make a copy the generated token. Save this token in a safe place in the event you need to use it again.
Return to the Download CLI page in the Tanzu Mission Control console.
For more information, see How do I generate API tokens in the VMware Cloud services documentation.
You can optionally store your API token in an environment variable. This allows the CLI to find the token when you create a context.
For example, in the following command, replace my-api-token with your API token.
```
export  TANZU_API_TOKEN="my-api-token"
```

Download the CLI binary.

Log in to the Tanzu Mission Control console.
In the left navigation pane, click Automation center.
Click Download the CLI, and then choose your operating system.

You can alternatively download the binary through the VMware Downloads page at VMware Customer Connect.

Install the core `tanzu` CLI.

After the download completes, open a command window to rename and move the binary to an accessible bin directory and make the file executable.

For Linux, use an install command, for example:

sudo install /<path-to-download-file>/tanzu-core-linux_amd64 /usr/local/bin/tanzu

For Mac OS, use an install command, for example:

sudo install /<path-to-download-file>/tanzu-core-darwin_amd64 /usr/local/bin/tanzu

For Windows
1. Create a bin directory (for example, %UserProfile%\bin) if you don’t already have one.
2. Move and rename the binary, for example:
```
mv <path-to-download-file>\tanzu-core-windows_amd64.exe %UserProfile%\bin\tanzu.exe
```
3. Make sure the binary is executable, for example:
```
attrib +x %UserProfile%\bin\tanzu.exe
```
4. Make sure the bin directory is accessible on your PATH.

For more information, see Installing and Using VMware Tanzu CLI.

Initialize and verify your `tanzu` CLI installation.

For version 0.90 (and earlier) of the tanzu CLI, use the following steps to initialize your installation. These steps are not necessary if you are using version 1.0 (and later) of the CLI.

Open a new command window and run the following command:

tanzu init

The init command installs a set of core plug-ins. The output from this command looks something like this:

ℹ Checking for required plugins...
ℹ Installing plugin 'login:v0.28.0'
ℹ Installing plugin 'management-cluster:v0.28.0' with target 'kubernetes'
ℹ Installing plugin 'package:v0.28.0' with target 'kubernetes'
ℹ Installing plugin 'pinniped-auth:v0.28.0'
ℹ Installing plugin 'secret:v0.28.0' with target 'kubernetes'
ℹ Installing plugin 'telemetry:v0.28.0' with target 'kubernetes'
ℹ Installing plugin 'isolated-cluster:v0.28.0'
ℹ Successfully installed all required plugins
✔ successfully initialized CLI

If you are running on Mac OS, you might encounter the following error:

"tanzu" cannot be opened because the developer cannot be verified.

If this happens, you need to create a security exception for the tanzu binary. Locate the tanzu app in the Finder, control-click the app, and then choose Open.

Verify the version using the following command:
```
tanzu version
```

Log in and create a context.

Before you begin, make sure you have already generated an API token, and that you know the Tanzu Mission Control endpoint for your organization, as described above.
1. For version 1.0 and later of the tanzu CLI, you must first install the context plug-in. (Versions prior to 1.0 do not require this step.) tanzu plugin install --group vmware-tmc/default This command installs the context plugin.
1. Run the command to create a context. - For version 1.0 and later:
tanzu mission-control context create - For older versions (earlier than 1.0):
tanzu context create 1. Respond to the prompts to configure the context.
a. For context type, choose Control plane endpoint.
b. For control plane endpoint, enter the name of your organization’s endpoint.
Do not include the https:// prefix. For example, if the name of your organization is myorg, then your endpoint looks like this:
myorg.tmc.cloud.vmware.com c. When prompted for the context name, provide a name that you can easily remember when you need to switch contexts.
d. For API Token, copy and paste your API token.
If you have already stored your API token in an environment variable (as described above in Retrieve an API token), then you are not prompted to provide it here.

When you create a context, the CLI installs the plug-ins for Tanzu Mission Control. If you subsequently run tanzu context list, you’ll see the default kubernetes and mission-control targets and your newly created context is listed under the mission-control target.
- If you need to delete your existing contexts, you can remove catalog.yaml and .config/tanzu.
For example:

rm -rf ~/.cache/tanzu/catalog.yaml 
rm -rf ~/.config/tanzu

Verify the Tanzu Mission Control plug-ins.

You can check the status of your Tanzu Mission Control plug-ins using the following command:

tanzu plugin list

The output looks something like this:

Plugins from Context:  my-tmc-context

NAME                DESCRIPTION                                                     TARGET           VERSION  STATUS
account             Account for tmc resources                                       mission-control  v0.0.1   installed
apply               Create/Update a resource with a resource file                   mission-control  v0.0.1   installed
audit               Run an audit request on an org                                  mission-control  v0.0.1   installed
cluster                                                                             mission-control  v0.0.1   installed
clustergroup        A group of Kubernetes clusters                                  mission-control  v0.0.1   installed
data-protection     Data protection for tmc resources                               mission-control  v0.0.1   installed
ekscluster                                                                          mission-control  v0.0.1   installed
events              Events for any meaningful user activity or system state change  mission-control  v0.0.1   installed
iam                 IAM Policies for tmc resources                                  mission-control  v0.0.1   installed
inspection          Inspection for tmc resources                                    mission-control  v0.0.1   installed
integration         Get available integrations and their information from registry  mission-control  v0.0.1   installed
management-cluster  A TMC registered Management cluster                             mission-control  v0.0.1   installed
policy              Policy for tmc resources                                        mission-control  v0.0.1   installed
workspace           A group of Kubernetes namespaces                                mission-control  v0.0.1   installed

You can optionally remove existing plug-ins from previous installations using the following command:
tanzu plugin clean
You can update plug-ins using the following command:
tanzu plugin sync

About Core Commands and Global Flags in the `tanzu` CLI

The tanzu CLI contains a number of core commands, such as completion, plugin, and update that are always available regardless of the plug-ins you are using.
The --help flag is available for all tanzu CLI commands.
For more information about the CLI architecture, see Tanzu CLI Architecture and Configuration.

About Context and Targets in the `tanzu` CLI

In the tanzu CLI there are commands that work differently depending on which context they are run in. For example in Tanzu Kubernetes Grid, the management-cluster plug-in provides commands for creating and deleting a specific management cluster (as well as others), while the management-cluster plug-in Tanzu Mission Control provides commands to register, deregister, and other fleet-management commands.

It is important to understand, therefore, the concepts of target and context. - A target defines the kind of plug-in used when you run a command. - A context defines the endpoint for your CLI command, and is always associated with a target.

When you create a context for Tanzu Mission Control, you specify the endpoint that identifies your organization (for example, my-org.tmc.cloud.vmware.com) and your API token that gives you permission to run commands within your organization. Similarly, when you create a context for Tanzu Kubernetes Grid, you specify an endpoint and the name of the management cluster.

It is also possible to have more than one context for a given target. For example the default kubernetes target for Tanzu Kubernetes Grid can have multiple contexts, one for each management cluster.

For commands that exist in more than one plug-in (like management-cluster) you must specify a target. You can do this explicitly in each command like this:

tanzu mission-control management-cluster create . . .

tanzu kubernetes management-cluster create . . .

You can also set the context for a session, which remains in effect until you change the context. For example:

tanzu context use my-context