Connect to a TKG Cluster as an OIDC User with the Tanzu CLI

Connect to a TKG cluster using the Tanzu CLI and authenticate with your OIDC provider.

Prerequisites

These instructions assume that Supervisor is configured with a supported external identity provider (IDP), that you (a DevOps user) have connected to Supervisor using the Tanzu CLI, and that you have provisioned a TKG cluster. Refer to the following topics as needed:

• Connecting to TKG Clusters on Supervisor Using an External Identity Provider
• Provisioning TKG Service Clusters

DevOps User Workflow

As a DevOps user with edit permissions on the target vSphere Namespace, you use the Tanzu CLI to generate a shareable kubeconfig file that you then distribute to TKG clusters users. In Kubernetes, a configuration context contains a cluster, a namespace, and a user. You can view the cluster context in the file .kube/config. This file is commonly called the kubeconfig file.

Note: These steps must be performed by a DevOps user with edit permissions on the target vSphere Namespace.

1. Verify that the Tanzu CLI context is set to Supervisor.

   See Connect to Supervisor Using the Tanzu CLI and an External IDP.

2. Verify that the vSphere Administrator has configured user permissions for the target vSphere Namespace.

   External OIDC users and groups are mapped directly to vSphere Namespace roles. Cluster users should be added to the vSphere Namespace before you generate the shareable kubeconfig.

   See Configure vSphere Namespace Permissions for External Identity Provider Users and Groups.

3. List the TKG clusters provisioned in the target vSphere Namespace.

   tanzu cluster list --namespace VSPHERE-NAMESPACE

4. Generate a shareable kubeconfig file for the target TKG cluster.

   tanzu cluster kubeconfig get CLUSTER-NAME --namespace=NAMESPACE

5. Distribute the shared kubeconfig file to cluster users so they can login to the TKG cluster.

Cluster User Workflow

Complete these steps to log in to a TKG cluster as a cluster user.

1. Obtain the kubeconfig file from the DevOps user.
2. Log in to the TKGS cluster using the kubeconfig file and kubectl.

   kubectl --kubeconfig

3. Complete the browser authentication process.
   1. When the challenge is issued, visit the link using your browser.
   2. Copy/paste the authorization code into the CLI.
4. Use kubectl to interact with the cluster.