Wednesday, March 28, 2018

VMware Pivotal Container Service – User Account and Authentication CLI

Continuing my series of command lines options for managing VMware Pivotal Container Service (PKS), today I present you the User Account and Authentication command line.

The primary role of UAAC is to create, delete and manage users within the context of PKS, which means give Cloud Admins authority to create and manage Kubernetes clusters themselves, giving them the freedom and agility the business demands.

Let's see how easy it is:

*** Installing UAAC CLI ***
UAAC is installed with the use of gem, which allows you to interact with RubyGems, so in order to use it first, we need to install ruby and ruby-dev.
Obs: I’m using Ubuntu, if you are using other distribution use the accordingly install tool.

- Install Ruby
Run: apt install ruby

- Install ruby-dev
Run: apt install ruby-dev

Now that the prerequisites are done, let's install UAAC
- Install UAAC
Run: gem install cf-uaac

To make sure UAAC has been installed successfully
- Testing UAAC installation
Run: uaac version

*** Connecting to PKS ***
With UAAC installed the first thing we have to do is point it to our PKS target.

- Targeting PKS
Run: uaac target https://”UAA_URL”:8443 --skip-ssl-validation

During Pivotal Container Service Tile configuration, we set up the UAA URL.

Once the target is configured, log in with the credential to perform the actions you want.
 Since I want to create users I’m using admin.

- Login to UAA
Run: uaac token client get admin -s “password”

You can find the password as part of Pivotal Container Service Tile

*** Creating Users ***
Now it’s just a matter of adding the users

- create user
Run: uaac user add “user_id” --emails “e-mail” -p “password”

The final thing is to attribute some privileges to the user
- adjusting group membership
Run: uaac member add “group” “user_id”

Thinking about PKS cluster’s management we have two main groups;
- pks.clusters.admin: allow the user to create and manage all clusters within the system;
- pks.clusters.manage: allow the user to create and manage only the cluster’s they own;

That’s all I have for today’s post, next one I will show you how to create Kubernetes cluster with the users we just created.

Stay tuned

Monday, March 5, 2018

VMware Pivotal Container Service - Bosh CLI

While VMware Pivotal Container Service UI is great, there are a few things you still need to perform on the command line (or API requests), like troubleshooting and stuff.

Of course, you could just SSH into Ops Manager and run every command from there, but giving access to this crucial resource to others is far from ideal.
That’s why I decided to create some basic tutorials on how to access and perform PKS tasks remotely throughout the CLI.

The tutorials will cover:

Bosh CLI is intended to manage Bosh resources, tasks and objects; In other for PKS to be able to instantiate VMs (K8s Master and Nodes) on vCenter, it needs a broker which has specific vSphere CPI, that’s the Ops Director you first deploy on your PKS environment.

After you deploy it you can connect to the Bosh Director service running within and see the VMs and tasks it’s managing.

*** Installing Bosh CLI ***

- Download bosh cli;   
  Run: wget

- Make it executable;
  Run: chmod +x bosh-cli-2.0.48-linux-amd64

- Move the CLI to the bin directory;
  Run: cp bosh-cli-2.0.28-linux-amd64 /usr/local/bin/bosh

- You can test if it's installed properly;
  Run: bosh -v

*** Connecting to Bosh Director ***
Once you get the bosh CLI installed you can point it to your Bosh Director and start issuing commands.

If you are using a self-signed certificate, don’t forget to first download the root CA certificate
- Go to PKS Settings;

On the Advanced option, download the Root CA Certificate;

- Create an environment alias for future reference;
  Run: bosh alias-env "alias" -e "Ops-Director" --ca-cert "CA_CERT_Path"

- Login with the desired credentials (for this purpose I’m using director);
  Run: bosh -e “alias” log-in

You can get the credentials from the Ops Director’s Credentials tab

You are ready to go !! It's possible to create as many environments as you need and you just need to specify which environment the command will run against, like:
bosh -e "alias" tasks

But, If you have a single environment it’s easier to set up a system environment and then you can omit the parameter.

*** Bosh CLI examples ***

Here are a few commands to get you started

Checking all tasks performed on the system;
Run: bosh tasks -ar

If you need details about a specific task;
Run: bosh tasks "ID" 

To list all VMs provisioned by the system;
Run:  bosh vms

SSH into a specific VM without providing any credentials;
Run: bosh ssh -e “alias” -d “deployment_ID” “vm_Instance”

You can get the deployment ID and VM instance from the bosh vms command.

that’s it, stay tuned for the next basic PKS tutorials.

Thursday, March 1, 2018

Pivotal Container Service and NSX-T integration

I have to admit, since the launch of VMware Pivotal Container Service (PKS), I was very anxious to start creating and managing production grade Kubernetes clusters from within.
As soon as the product gets released I just grabbed my copy and started playing with that without reading anything about it (yeah I know), a few minutes late I realized there were some concepts that I needed to grasp if I want to succeed.

The automation PKS provides is amazing and make the platform deployment very easy to consume, but if you don’t know exactly what the input parameters are there’s a huge chance you get yourself into problems.

Thinking about that I decided to share what I learned about the network aspects of PKS, specially NSX-T integration and how to set it up.

I'm not showing how to configure NSX-T components, like T0, Logical Switch, etc.. but how do you consume them from PKS.

Once Ops Manager OVA has been deployed; 
The first thing you need to configure is the Ops Manager Director Tile.

Right on the vCenter Config section, you will see an option to configure the integration with NSX-T

LEAVE it to Standard vCenter Networking option, I know the anxiety to start using PKS with NSX-T, but it’s not there yet, in fact, this option is to allow other Pivotal solutions to communicate with NSX-T, like PAS.


Jumping to Network section, you need to create the networks where your components will be hooked to;
I created two networks;

- one for management components, like Ops Director, PKS broker and Harbor
- another one for Service components, like Kubernetes Master, ETCD and nodes VMs
the only difference between them is that on the service network you select the service check box.
 Don't forget to configure what vSphere Network (Port Group or Logical Switches) the VMs will be connected to, CIDR and others network parameters accordingly.

Once you are done with Ops Director it’s time to configure Pivotal Container Service Tile.

On the Networking section is where you configure your PKS integration with NSX-T, just provide your NSX-T Manager hostname and credentials

Scrolling down a little bit you will see the fields for the NSX-T integration details

1 – T0 Router ID, this one is easy, If you remember about how PKS works (when integrated with NSX) every time you create a new Kubernetes namespace a new T1 router will be created to segregate and secure this new namespace workloads, in order to allow communication this T1 will be connected with a T0, that’s why it needs to know T0 ID.

2 – IP Block ID, that’s the range of IPs to be assigned to your PODs. Through the use of NSX-T Container Plugin, those address will be configured through the use of Container Network Interface (CNI).

On NSX go to DDI/IPAM Section and create a new IP Block, the CIDR recommend is

3 – Floating IP Pool ID, that’s the range of IPs assigned to NSX-T Load Balance when Kubernetes Services and Ingress be created.

On NSX go to Inventory/Groups and create a new IP Pool with the desired range of IPs
 No doubt there's a lot to learn and understand yet, but I hope this post reduce a little the burden to get your PKS up and running.

See you

Who am I

My photo
I’m an IT specialist with over 15 years of experience, working from IT infrastructure to management products, troubleshooting and project management skills from medium to large environments. Nowadays I'm working for VMware as a Consulting Architect, helping customers to embrace the Cloud Era and make them successfully on their journey. Despite the fact I'm a VMware employee these postings reflect my own opinion and do not represents VMware's position, strategies or opinions. Reach me at @dumeirell

Most Viewed Posts

Blog Archive