Introduction

In a VMware vSphere environment, Tanzu Kubernetes Grid (TKG) makes it easy to build a Kubernetes environment. This article uses the standalone, multi-cloud-compatible TKGm edition. NSX ALB continues to use the Essentials license. This article explains how to create a machine other than the Bootstrap machine to run the Tanzu CLI and manage Management and Workload clusters.

Last time

This article assumes that the Management cluster and Workload cluster have already been built. If you have not built Tanzu Kubernetes Grid yet, refer to the article below first.

https://www.munenick.me/blog/tkg-nsx-alb-03

Environment

Prerequisites

• Ability to build VMware ESXi and manage the datacenter with vCenter
• Two or more VLAN networks are available.
  • In this environment, I prepared a management network, VM Network (VLAN0), and a Kubernetes network, VLAN100 (VLAN100).
• Servers and storage with sufficient resources
  • NSX ALB uses CPU: 8, RAM: 24GB, ROM: 128GB.
  • Depending on the requirements, 4 to 12 virtual machines with CPU: 2, RAM: 8GB, and ROM: 40GB are deployed as Kubernetes nodes.

Preparing the cluster management machine

Build a new OS that meets your requirements, or use an existing OS. The management machine can run Linux, macOS, or Windows. Refer to the link below for details. This article uses the same Linux-based approach as the Bootstrap machine.

https://docs.vmware.com/jp/VMware-Tanzu-Kubernetes-Grid/2.1/tkg-deploy-mc-21/install-cli.html

Install Tanzu CLI and kubectl

Install Tanzu CLI and kubectl on the cluster management machine. On Linux, you can use the same steps as Bootstrap machine setup.

For other operating systems, refer to the URL below.

https://docs.vmware.com/jp/VMware-Tanzu-Kubernetes-Grid/2.1/tkg-deploy-mc-21/install-cli.html

Copy kubeconfig

Copy the kubeconfig from your Bootstrap machine to your cluster management machine.

Working on the Bootstrap machine

• Run the following command to get the kubeconfig of the Management cluster.

MuNeNiCK [ ~ ]$ tanzu mc kubeconfig get tkg21mc01 --admin --export-file=$HOME/t
kg21mc01.kubeconfig.yaml
Credentials of cluster 'tkg21mc01' have been saved
You can now access the cluster by running 'kubectl config use-context tkg21mc01       -admin@tkg21mc01' under path '/home/MuNeNiCK/tkg21mc01.kubeconfig.yml'
MuNeNiCK [ ~ ]$ ls -l tkg21mc01.kubeconfig.yml
-rw------- 1 MuNeNiCK users 5567 May 11 11:02 tkg21mc01.kubeconfig.yaml

• Save this file so that you can transfer it to your cluster management machine.

Working on the cluster management machine

• Transfer the saved kubeconfig to the cluster management machine.

• Run the command below to place the kubeconfig file.

MuNeNiCK [ ~ ]$ mkdir $HOME/.kube-tkg
MuNeNiCK [ ~ ]$ cp $HOME/tkg21mc01.kubeconfig.yaml $HOME/.kube-tkg/config

Connecting to the Management cluster

• Run the following command and log in to the Management cluster.

MuNeNiCK [ ~ ]$ tanzu login --name=tkg21mc01 --kubeconfig=$HOME/.kube-tkg/config --context=tkg21mc01-admin@tkg21mc01

• The tab-completion function has been updated, so run the following command.

MuNeNiCK [ ~ ]$ source <(tanzu completion bash)

• Run the following command to obtain the kubeconfig of the Management cluster.

MuNeNiCK [ ~ ]$ tanzu mc kubeconfig get --admin
Credentials of cluster 'tkg21mc01' have been saved 
You can now access the cluster by running 'kubectl config use-context tkg21mc01-admin@tkg21mc01'

• Run the command below and specify the context to use.

MuNeNiCK [ ~ ]$ kubectl config use-context tkg21mc01-admin@tkg21mc01
Switched to context "tkg21mc01-admin@tkg21mc01".

• Check the current context by running the command below.

MuNeNiCK [ ~ ]$ kubectl config get-contexts
CURRENT   NAME                        CLUSTER     AUTHINFO          NAMESPACE
          tkg21mc01-admin@tkg21mc01   tkg21mc01   tkg21mc01-admin   

• Verify the nodes in the current context with the following command.

MuNeNiCK [ ~ ]$ kubectl get nodes
NAME                                   STATUS   ROLES           AGE   VERSION
tkg21mc01-md-0-2dzzk-bc849dd49-8svzt   Ready    <none>          11h   v1.24.10+vmware.1
tkg21mc01-s8ssk-fhjlq                  Ready    control-plane   11h   v1.24.10+vmware.1

Connecting to a Workload cluster

• First, run the command below to get the kubeconfig.

MuNeNiCK [ ~ ]$ tanzu cluster kubeconfig get tkg21wc01 --admin
Credentials of cluster 'tkg21wc01' have been saved
You can now access the cluster by running 'kubectl config use-context tkg21wc01admin@tkg21wc01'

• Next, run the command shown in the log output.

MuNeNiCK [ ~ ]$ kubectl config use-context tkg21wc01-admin@tkg21wc01
Switched to context "tkg21wc01-admin@tkg21wc01".

• Check the current context by running the command below.

MuNeNiCK [ ~ ]$ kubectl config get-contexts
CURRENT   NAME                        CLUSTER     AUTHINFO          NAMESPACE
          tkg21mc01-admin@tkg21mc01   tkg21mc01   tkg21mc01-admin
*         tkg21wc01-admin@tkg21wc01   tkg21wc01   tkg21wc01-admin

• Verify the nodes in the current context with the following command.

MuNeNiCK [ ~ ]$ kubectl get nodes
NAME                                    STATUS   ROLES           AGE     VERSION
tkg21wc01-md-0-bzhsf-7876ffdcb7-8nkg8   Ready    <none>          8h      v1.24.10+vmware.1
tkg21wc01-md-1-hxlzn-7cbf69bd58-4tqjc   Ready    <none>          8h      v1.24.10+vmware.1
tkg21wc01-md-2-nrn7z-6bb84c66c-gxjgx    Ready    <none>          8h      v1.24.10+vmware.1
tkg21wc01-mdcg5-52ld6                   Ready    control-plane   8h      v1.24.10+vmware.1
tkg21wc01-mdcg5-n46zx                   Ready    control-plane   7h53m   v1.24.10+vmware.1
tkg21wc01-mdcg5-zkqg8                   Ready    control-plane   8h      v1.24.10+vmware.1

Finally

At this point, you can run the Tanzu CLI on the cluster management machine and access both clusters. From now on, cluster management is basically performed on this machine. In general, you can delete the Bootstrap machine after completing these steps, but decide based on your own requirements. In my case, I keep it. If you delete the Bootstrap machine, I recommend saving the YAML files for both Management and Workload clusters.

Next time

NSX ALB can run L7 Ingress. Depending on the configuration, you may also need to implement a DNS Provider on NSX ALB. Next time, I will show how to build a DNS Provider for NSX ALB, build AKO Ingress, and implement a certificate for Ingress. From here on, Enterprise Edition is required. https://www.munenick.me/blog/tkg-nsx-alb-05

Sites I referred to

• Moving the Tanzu CLI execution environment on Tanzu Kubernetes Grid.