Welcome to Part 3 of the TMc Self-Managed series. Part 1 concentrated on a general introduction to TMC Self-Managed, while Part 2 dived into the DNS configuration. You may read the previous entries in this series if you missed them by clicking the links below.

1: TMC Self-Managed – Introduction & Architecture

2: Configure DNS for TMC Self-Managed

Tanzu Mission Control Self-Managed manages user authentication using Pinniped Supervisor as the identity broker and requires an existing OIDC-compliant identity provider (IDP). Examples of OIDC-compliant IDPs are Okta, Keycloak, VMware Workspace One, etc. The Pinniped Supervisor expects the Issuer URL, client ID, and client secret to integrate with your IDP.

Note: This post demonstrates configuring Okta as an IDP. Although Okta is a SaaS service and is reachable over the internet, the intent is to show how you configure upstream IDP for authentication. In an airgap environment, you may use any IDP that doesn’t require an internet connection.… Read More

I covered the basic introduction of TMC Self-Managed, the general architecture, and the requirements your environment needs to meet before installing TMC Self-Managed in the first post of this series. Before getting your hands dirty with the installation, I’ll cover configuring DNS Zones and records in this post.

To enable correct traffic flow and access to various TMC endpoints, TMC Self-Managed needs a DNS zone to hold the DNS records. To ensure name resolution between the objects that are deployed during TMC Self-Managed installation, create the following A records in your DNS domain. You can create a new DNS zone or can leverage an existing zone.

• alertmanager.<my-tmc-dns-zone>
• auth.<my-tmc-dns-zone>
• blob.<my-tmc-dns-zone>
• console.s3.<my-tmc-dns-zone>
• gts-rest.<my-tmc-dns-zone>
• gts.<my-tmc-dns-zone>
• landing.<my-tmc-dns-zone>
• pinniped-supervisor.<my-tmc-dns-zone>
• prometheus.<my-tmc-dns-zone>
• s3.<my-tmc-dns-zone>
• tmc-local.s3.<my-tmc-dns-zone>
• tmc.<my-tmc-dns-zone>

To simplify the installation procedure, you can also use a wildcard DNS entry as shown below (for POCs only).

The IP address for the above records must point to the external IP of the contour-envoy service that is deployed during the installation.… Read More

Introduction

VMware Tanzu Mission Control is a SaaS offering available through VMware Cloud Services and provides:

• A centralized platform to deploy and manage Kubernetes clusters across multiple clouds.
• Attach existing Kubernetes Clusters in the TMC portal for centralized operations and management.
• A Policy Engine that automates Access control and security policies across a fleet of clusters.
• Manage security across multiple clusters.
• Centralize authentication and authorization, with federated identity from multiple sources.

TMC SaaS cannot be used in specific environments because of compliance or data governance requirements. Industries like Banking, Health Care, and the Defence sector are usually running workloads in an air-gapped environment (dark site). Imagine running a large number of Kubernetes clusters without any central pane of glass to manage day-1 & day-2 operations across the clusters. VMware understood this pain and introduced Tanzu Mission Control Self-Managed (TMC-SM) as an installable product that you can deploy in your environment.

TMC Self-Managed can be installed in data centers, sovereign clouds, and service-provider environments.… Read More