Authenticating Using kubectl

In vSphere with Tanzu, authentication is performed using vCenter Single Sign-On. You run the command kubectl vsphere login to authenticate a user through vCenter Single Sign-On to Kubernetes clusters.

kubectl vsphere login --server < kubernetes control plane > -u < username >

The --insecure-skip-tls-verify flag is required if the certificate presented by the vSphere with Tanzu control plane is not trusted by the client machine. The control plane is signed by the vCenter Server VMware CA by default. You can replace the control plane certificate with a trusted certificate if needed. Alternatively, install the vCenter Server VMware CA root certificate into your client machine to remove the need for the --insecure-skip-tls-verify flag.

Prerequisites

Configure a cluster with vSphere with Tanzu.

Create users or groups for all DevOps engineers who will access the namespace.

Create storage policies  for persistent storage. Storage policies can define different types and classes of storage, for example, gold, silver, and bronze.

Create VM classes and content libraries for stand-alone VMs.

Create a content library for Tanzu Kubernetes releases for use with Tanzu Kubernetes clusters. See  Creating and Managing Content Libraries for Tanzu Kubernetes releases .

Required privileges:

Namespaces . Modify cluster-wide configuration

Namespaces . Modify namespace configuration

Spherelet is a kubelet that is ported natively to ESXi. It allows the ESXi host to become part of a Kubernetes cluster. Spherelet performs the following functions:

• Communicates with the control plane VMs

• Manages node configuration

• Starts vSphere Pods

• Monitors vSphere Pods

For a Supervisor Cluster that is configured with the vSphere networking stack, you can provide Layer 2 isolation for your Kubernetes workloads by creating Workload Networks and assigning them to namespaces. Workload Networks provide connectivity to Tanzu Kubernetes clusters in the namespace and are backed by distributed port groups on the switch that is connected to the hosts in the Supervisor Cluster.

Graphical user interface, Teams Description automatically generated

A vSphere Pod is a VM with a small footprint that runs one or more Linux containers. With vSphere Pods, workloads have the following capabilities:

•  Strong isolation  from a Linux kernel based on Photon OS

• Resource management using DRS

• Same level of resource isolation as VMs

• Open Container Initiative (OCI) compatible

• Equivalent to a Kubernetes Container Host

vSphere Pods are not compatible with vSphere vMotion. When an ESXi host is placed into maintenance mode, running vSphere Pods are drained and redeployed on another ESXi host, but only if the vSphere Pod is part of a ReplicaSet.