Tanzu Kubernetes Grid Clusters on VMware vSphere and Workspace ONE Integration

Tanzu Kubernetes Grid Clusters on VMware vSphere and Workspace ONE Integration 

Author: Pramita Gautam, Kalyaan Krushna Codadu

In this blog, we are covering how customers can leverage the integration between VMware Tanzu Kubernetes Grid clusters on vSphere and VMware Workspace ONE as an external identity provider. 

Workspace ONE is designed to provide a management platform that allows IT administrators to centrally control end user’s mobile devices, cloud-hosted virtual desktops, and applications from the cloud or from an on-premises deployment.

In this documentation, Workspace ONE is the identity provider and integrated in it is VMware Tanzu as the pinniped supervisor.

Workspace ONE configuration

1. Requirements

1. Deploy and configure VMware Workspace ONE Access. If needed, refer to the documentation for more information on Workspace ONE Access.

2. Install and configure Workspace ONE Access connector on a Windows server joined to the domain (for integrating with Active Directory and making use of features such as Directory Sync, User Auth, Kerberos Auth, or Virtual App services).

• Click on the Access Connector installer file.

• Accept the EULA.

• Select all the components listed and click Next.

• Browse to the json file generated from Workspace ONE Access, and add the connector screen.

• Select the Custom Installation option.

• If connection between the connector virtual machine (VM) and Workspace ONE Access occurs via proxy servers, select the proxy box and provide the details. Otherwise, click Next, with Enable Proxy unchecked.

• Configure syslog, if available.

• If using Citrix multi-site aggregation, provide the required cofiguration details.

• Provide the root certificate authority (CA) of the Workspace ONE Access appliance.

• Select the default ports and click Next.

• If you have certificate for Kerberos Auth services, select the certificate. Otherwise, leave the box unchecked and click Next to use the self-signed certificate.

• Select any domain user/service account part of the domain that is being integrated with Workspace ONE Access using the following connector instance.

• Click Install to complete the connector installation.

• Once the installation is complete, you should see the connector displayed in Workspace ONE Access UI console.

• Once the connector is updated in the Workspace ONE Access UI, create the directory.

If needed, refer to this documentation for details on installing Workspace ONE Access Connector.

2. Perform the following configurations on Workspace ONE Access to create the OpenID Connect (OIDC) Client to be able to integrate with the Tanzu Kubernetes Grid cluster on vSphere.

1. Log in to the Workspace ONE Access admin console and navigate to Resources. Select Web Apps from the righthand menu and click NEW.

2. Specify a Name to the new web app and click NEXT.

3. From the configuration screen

• Specify the Authentication type – OpenID Connect
• Specify the Target URL – This should be the NSX Load Balancer (LB) URL/IP for the pinniped supervisor service running in the Tanzu Kubernetes Grid cluster on vSphere.

Syntax: https://[lb Ip address]/callback

Note: If the Tanzu Kubernetes Grid cluster is not yet created, any IP address could be specified here and updated later, once the cluster is deployed and a LB IP is assigned to the pinniped service.

• Redirect URL – List the same URL mentioned for the Target URL
• Enter a Name for ClientID

Note: This ClientID will be used in the pinniped configured in the Tanzu Kubernetes Grid cluster on vSphere.

• The client secret can be created as specified below on any machine.

• Make sure the toggle buttons for Open in Workspace ONE Web and Show in User Portal are disabled. Click Next.

• Assign an access policy from the drop-down menu or select the default policy.

• Click Save, then Assign.
• Assign the web app now created to the users/groups synced in Workspace ONE Access using the connector installed previously.

Note: Make sure to select Deployment Type as Automatic, when the web app is assigned to users.

3. Configure Remote App Access in the Workspace ONE Access console with the following steps.

1.  In the Workspace ONE Access console navigate to Settings > Remote App Access, then click the newly created web app.

2. On the screen that has opened, click Edit next to Scope in the OAuth 2 Client section.

3.  Select the following scope option check boxes.

• Email
• Profile
• User
• NAPPS
• OpenID
• Group

4. Click Save.

5. Click Next to navigate to Client Configuration. On this screen, uncheck the box for Prompt users for access.
6. Ensure the token type is set to Bearer and update/redirect the URL with the correct IP LB for the pinniped supervisor.

Click Save.

4. Assign the web app to Users Synced.

1. Click Accounts, then navigate to Users.
2. Double-click on the username and select the Application Tab.
3. Click Assign and select the web app you created in the previous step.
4. Ensure you have the Deployment Type set to Automatic. The same is applicable for User Groups.

5. Next, we’ll need the root CA of Workspace ONE.

1. Log in to the Workspace ONE Access virtual appliance management UI (https://<ws1-fqdn>:8443).

2. Navigate to Install SSL Certificates.
3. Under Server Certificate select Auto Generate Certificate (self-signed). You should now see the location from which you can download the root CA.

6. For an alternate way to obtain the root CA for the VIDM appliance, follow the next steps. Otherwise, skip ahead to Tanzu Kubernetes Grid cluster configuration.

1. From any machines with OpenSSL installed, run the following command:

2. Copy the root CA from the output of the above command and save it in a notepad file.
3. You will need to convert this certificate from a base64-encoded format to use for OIDC integration.
   
   1. To convert to base64-encoded format:

cat [name to root ca file] | base64 | tr -d ‘\n’ > [output file name]

         Tanzu Kubernetes Grid cluster configuration

1. For new management of Tanzu Kubernetes Grid clusters follow these steps:
   
   1. If management of the Tanzu Kubernetes Grid cluster is to be created using the cluster YAML file, then refer to this documentation.

Update the values related to OIDC in the YAML file as specified below:

Use “tanzu management-cluster create -f <yaml-file>” to create the management cluster.

Use “tanzu cluster create -f <yaml-file>” to create workload clusters.

2. If the management Tanzu Kubernetes Grid cluster is to be created using the Tanzu installer, then review this documentation.

In the cluster creation wizard under the Identity Management section, select OIDC and provide the required details as shared.

3. After creating the management Tanzu Kubernetes Grid cluster, follow the steps in the Enable and Configure Identity Management in an Existing Deployment of this documentation. To update the pinniped secret file to add the CA of the Workspace ONE Access appliance for the key: “upstream_oidc_tls_ca_data” under the pinniped section.
4. To get the CA of Workspace ONE, refer the Workspace ONE configuration section above.

2. For existing management Tanzu Kubernetes Grid clusters, the same secret file can be updated with the OIDC details.
   
   1. If needed, refer to the Enable and Configure Identity Management in an Existing Deployment section of this documentation.

3. Workload Tanzu Kubernetes Grid clusters
   
   1. Any workload clusters that you create when you enable identity management in the management cluster are automatically configured to use the same identity management service.
   2. Before you create workload cluster, remember to unset the variables (e.g., “_TKG_CLUSTER_FORCE_ROLE”) you might have set while updating the management cluster with identity management

         How to test

For the management Tanzu Kubernetes Grid cluster

For the workload Tanzu Kubernetes Grid cluster

Note: If you also have the groups in Workspace ONE and you want to give access to that group, then create clusterrolebinding with the group email ID and follow the same steps.

• Multiple ADs

In this documentation, we have completed an integration of Tanzu with Workspace ONE, however, we must point out that this is for the use of multiple ADs in Workspace ONE.

Therefore, we can say that we have tested not only the integration of Tanzu with Workspace ONE, but also tested the access of clusters by the users present in multiple ADs in Workspace ONE.

LAB Details