]

Solution

  • App Modernization

Type

  • Document

Level

  • Intermediate

Category

  • Technical Guide

Technology

  • Kubernetes

Demo Appliance for Tanzu Kubernetes Grid - Prerequisites

Introduction

This workshop takes advantage of the the Demo Appliance for Tanzu Kubernetes Grid (TKG) Fling which bundles all the required dependency to deployg deploy TKG Clusters running on either VMware Cloud on AWS.

Please refer to the infrastructure provider specific pre-reqs below before attempting the workshop.

VMware Cloud on AWS Prerequisite

 ☐ Existing SDDC or deploy new 1-Node SDDC

☐ vSphere Management Network (on-prem) or NSX-T Segment (VMC) to run TKG Demo Appliance which has access to VMC vCenter Server

☐ DHCP Enabled Network to run TKG Workloads which has access to VMC vCenter Server

☐ Desktop to access the SDDC and TKG Demo Appliance with the following ports open

☐ Outbound Port 22 (SSH)

☐ Outbound Port 443 (vCenter & K8s API)

☐ Outbound Port 31001 (K8s Demo App)

1. NSX-T Network

Network Segment

For demo purposes, we will be running both the TKG Demo Appliance and the TKG Management and Workload Cluster on an NSX-T Segment running in VMC.

With TKG 1.2, the HAProxy VM has been replaced with kube-vip and this means that as part of any TKG Cluster deployment (Management or Workload), an additional IP Address must be specified for the virtual IP.

In our example below, we will carve up our 192.168.2.0/24 in to the following:

IP

Usage

192.168.2.1

Network Gateway

192.168.2.2

TKG Demo Appliance

192.168.2.3 to 192.168.2.49

TKG VIP Address Range

192.168.2.50 to 192.168.254

TKG Workload Address Range

where 192.168.2.3 to 192.168.2.49 will NOT be included in the DHCP scope so that we can manually reserve those for both the TKG Demo Appliance and VIP addressess.

            Create a new Network Segment which will run the TKG workloads with the following configuration:

             Setting

             Value

             Segment Name

             tkg-network

             Type

             Routed

             Subents

             192.168.2.1/24

 

Click on the Save button to save our initial settings.

Note: If 192.168.2.1/24 is already in use, you can specify another network

When prompted to edit the new Network Segment, select Yes and then click on SET DHCP CONFIG in the upper right hand corner. Toggle the DHCP Config to Enabled and then add the DHCP range as specified in the table below and then click on Apply to save the changes.

             Setting

             Value

             DHCP Config

             Enabled

             DHCP Ranges

             192.168.2.50-192.168.2.254

2. NSX-T Inventory Group

Configure Compute Inventory Group

Create the following three Inventory Groups for Compute by clicking Add Group and providing the name specified below and then “Set Members” to set the value

             Group Name

             Value

             Desktop

             IP Address from https://www.whatismyip.com/ or network you will use to connect to TKG Network

             SDDC Management

             The SDDC CIDR used when deploying your SDDC. You can find this under Network & Security->Overview page and search for “Infrastructure Network”. It should look like 10.2.0.0/16 as example but subsitute your value

             TKG Network

             192.168.2.0/24 (or network you used)

Here is what the Compute Inventory Group should look like after you have completed the above.

Configure Management Inventory Group

Create the following two Inventory Groups for Management by clicking Add Group and providing the name specified below and then “Set Members” to the value below

             Group Name

             Value

             Desktop

             IP Address from https://www.whatismyip.com/ or network you will use to connect to TKG Network

             TKG Network

             192.168.2.0/24 (or network you used)

Here is what the Management Inventory Group should look like after you have completed the above.

3. NSX-T Edge Gateway Firewall

Configure Compute Gateway Firewall

Create the following three Compute Gateway Firewall Rules (ensure to click Publish to actualy create the Firewall Rules)

Rule Name

Sources

Destinations

Services

Desktop to TKG Network

Desktop

TKG Network

ANY

TKG Network to SDDC Management

TKG Network

SDDC Management

Any

Here is what the Compute Edge Firewall should look like after you have completed the above.

Configure Management Gateway Firewall

Create the following Management Gateway Firewall Rules (ensure to click Publish to actualy create the Firewall Rules)

Rule Name

Sources

Destinations

Services

Desktop to vCenter Server

Desktop

vCenter Server

HTTPS

TKG Network to vCenter Server

TKG Network

vCenter Server

HTTPS

Here is what the Management Edge Firewall should look like after you have completed the above.

4. Public IP and NAT (optional for going over internet)

This step is only required if you do not have Desktop system that already has access to the SDDC via Direct Connect and/or VPN.

Configure Public IP for TKG Demo Appliance

Request a new Public IP Address and name the entry TKG Demo Appliance. Make a note of this IP as you will be SSH’ingn to this address during the workshop

Configure NAT for TKG Demo Appliance

Create a new NAT mapping to the Public IP Address from the previous step using the following settings:

Name

Public IP

Service

Port

Internal IP

TKG Demo Appliance

Public IP from prevoius step

Any

Any

192.168.2.2

5. Configure VMC vCenter Server Inventory

Configure Resource Pool for TKG in vCenter Server

Configure VMC VM Folder for TKG in vCenter Server

6. Configure VMC vCenter Server Content Library

Sync K8s and TKG Demo Appliance OVAs

Navigate to Menu->Content Library in the vSphere UI and create a new vSphere Content Library with the following configurations:

Setting

Value

Name

TKG Demo

Subscribed URL

https://download3.vmware.com/software/vmw-tools/tkg-demo-appliance/cl3/lib.json

Download Content

Immediately

Storage

WorkloadDatastore

Note: Ensure that your vCenter Server has outbound connectivity to sync from the S3 Content Library

To download TKG Demo Appliance offline, you can find it at: * TKG Demo Appliance OVA- https://download3.vmware.com/software/vmw-tools/tkg-demo-appliance/TKG-Demo-Appliance-1.2.0.ova

To download K8s OVA offline, you can also find it on MyVMware:

K8s v1.19.1 OVA - https://my.vmware.com/web/vmware/downloads/details?downloadGroup=TKG-120&productId=988&rPId=53095

K8s v1.18.8 OVA - https://my.vmware.com/web/vmware/downloads/details?downloadGroup=TKG-120&productId=988&rPId=53095

Once the vSphere Content Library has been created, it should start downloading the content immediately.

Note: To verify everything was downloaded correctly, you should see the “Stored Locally” value show Yes under the “OVF & OVA Templates” tab of the vSphere Content Library. If you do not see this value, either the content is still being downloaded or you have a connectivity issue preventing you from connecting to the S3 Content Library from the vCenter Server. If you are having issues sync’ing from S3 Content Library in a VMC environment, please make sure you have reviewed the following accessing S3 endpoint in VMC

7. Configure K8s vSphere Template

Deploy K8s OVA from vSphere Content Library

Right click on vSphere Content Library item photon-3-kube-v1.19.1_vmware.2 and select “New VM from this Template” with the following configuration:

Setting

Value

Name

photon-3-kube-v1.19.1_vmware.2

VM Folder

VM Templates

Resource Pool

TKG

Storage

WorkloadDatastore

Network

tkg-network

Right click on vSphere Content Library item photon-3-kube-v1.18.8_vmware.1 and select “New VM from this Template” with the following configuration:

Setting

Value

Name

photon-3-kube-v1.18.8_vmware.1

VM Folder

VM Templates

Resource Pool

TKG

Storage

WorkloadDatastore

Network

tkg-network

Note: Do not power on these VMs, these will be used by TKG to provision TKG Clusters

Once both VMs have been deployed, right click on the VM and select Template->Convert to Template to convert the VM to vSphere VM Template

8. Configure TKG Demo OVA

Deploy TKG Demo Appliance from vSphere Content Library

Right click on the TKG Resource Pool and select “New Virtual Machine” and chose the “Deploy from Template” option and specify the TKG Demo Appliance and provide a name for the VM.

Select the TKG VM Folder:

Select the TKG Resource Pool:

Select theWorkloadDatastore Datastore:

Select tkg-network Network:

In the Networking section, please fill in the respective setings based on your network configuration. A static IP Address will be required for proper functionality.

Scroll down to OS Credentials and select a secure password, especially if you plan to connect from the Internet. SSH key authentication can also be used to connect to appliance. To do so, simply add your SSH key.

Click finish to start the deployment of the OVA.

Note: It is recommended that if you are un-sure of some of the settings to take an offline snapshot prior to powering on, this way you can adjust settings or easily revert the enviorment if you wish to walk through this again without having to re-deploy the OVA

Lastly, power on the TKG Demo Apppliance and then SSH using root to the Public IP that you had requested earlier. If you can access the VM without going over the public internet, then the address would be the IP Address you had configured for the TKG Demo Appliance.

Filter Tags

  • App Modernization
  • Intermediate
  • Technical Guide
  • Document
  • Kubernetes