To log in securely to the Supervisor and TKG clusters, configure the vSphere Plugin for kubectl with the appropriate TLS certificate and ensure that you are running the latest edition of the plug-in.

Supervisor CA Certificate

vSphere IaaS control plane supports vCenter Single Sign-On for cluster access by using the vSphere Plugin for kubectl command kubectl vsphere login …. To install and use this utility, see Download and Install the Kubernetes CLI Tools for vSphere.

The vSphere Plugin for kubectl defaults to secure login and requires a trusted certificate, the default being the certificate signed by the vCenter Server root CA. Although the plug-in supports the --insecure-skip-tls-verify flag, for security reasons this is not recommended.

To securely log in to the Supervisor and TKG clusters by using the vSphere Plugin for kubectl, you have two options:
Option Instructions

Download and install the vCenter Server root CA certificate on each client machine.

Refer to the VMware knowledge base article How to download and install vCenter Server root certificates.

Replace the VIP certificate used for the Supervisor with a certificate signed by a CA each client machine trusts.

See Replace the VIP Certificate to Securely Connect to the Supervisor API Endpoint
Note: For additional information on vSphere authentication, including vCenter Single Sign-On, managing and rotating vCenter Server certificates, and troubleshooting authentication, see the vSphere Authentication documentation. For more information about vSphere IaaS control plane certificates, see VMware Knowledge Base article 89324.

TKG Cluster CA Certificate

To connect securely with the TKG cluster API server using the kubectl CLI, you download the TKG cluster CA certificate.

If you are using the latest edition of the vSphere Plugin for kubectl, the first time you log in to the TKG cluster, the plug-in registers the TKG cluster CA certificate in your kubeconfig file. This certificate is stored in the Kubernetes secret named TANZU-KUBERNETES-CLUSTER-NAME-ca. The plug-in uses this certificate to populate the CA information in the corresponding cluster's CA datastore.

If you are updating vSphere IaaS control plane, make sure you update to the latest version of the plug-in. See Update the vSphere Plugin for kubectl in Maintaining vSphere IaaS Control Plane.