vrabbi

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: capv-static-ip-leader-election-role
  namespace: capv-system
rules:
- apiGroups:
  - ""
  resources:

vrabbi

Enabling Static IPs for VMs with TCE / TKGm on vSphere

This is experimental and your mileage may vary

Steps

1. Install TCE Management Cluster - not documented as nothing is different then usual
2. Install Metal3 IPAM Provider
3. Install CAPV IPAM Controller from spectrocloud
4. Add YTT Overlays
5. Create cluster config file
6. Deploy clusters

vrabbi

#@data/values
---
workload:
  metadata:
    name: test-workload
    namespace: default
params:
  chart_name: tanzu-java-web-app
  chart_repo:
    name: demo-repo

vrabbi

Adding ECR Repo Creation To TAP

This procedure is a POC of how one could have cartographer stamp out ECR Repo resources for our workloads as needed.

The Reason

ECR does not allow auto creation of repositories on push and every repo must be created in advance. This gives a very bad UX when using TAP where every workload typically needs 1 or 2 repos depending on the configuration.

What was the issue

The initial idea was to simply create a crossplane composition and stamp that out via a cartographer cluster template, however this is not possible as crossplane makes changes to the spec of the resources it manages, which makes cartographer try and restamp as it believes its desired state is the correct state, and we end up in an endless loop of the controllers fighting for control.

The solution

vrabbi

#@data/values
---
build:
  stages: ["dev", "stage", "prod"]
  repo:  ["repo-dev", "repo-stage", "repo-prod"]
  params: ["dev", "stage", "prod"]

vrabbi

TAP Production Supply Chain Diagram

flowchart TD
subgraph "Legend"
    red("Custom - Not officially supported")
    style red fill:red,color:black
    blue{A Choice}
    style blue fill:blue,color:white
    black(Supported - Not Default)

vrabbi

Deploy External DNS

Microsoft DNS

Secure Updates Using RFC3645 (GSS-TSIG)

Prerequisites:

• Create a DNS zone
• Enable secure dynamic updates for the zone

vrabbi

1. Create ns

kubectl create ns tap-install

2. Add Package repository

tanzu package repository add tanzu-tap-repository \
  --url ${INSTALL_REGISTRY_HOSTNAME}/tap/tap-packages:1.4.0 \
  --namespace tap-install

vrabbi

Update the overlay

You need to update values for http_proxy, https_proxy and no_proxy at the top of the overlay file to fix the environment specific values.

Update the package install

kctrl package installed update -n tap-install -i prisma -p scanning.apps.tanzu.vmware.com --version 0.1.4-alpha.12 --ytt-overlay-file prisma-overlay.yaml

vrabbi

Tanzu Application Platform GitHub authentication & integration

• ref: https://docs.vmware.com/en/VMware-Tanzu-Application-Platform/1.4/tap/tap-gui-auth.html

• Tanzu Application Platform GitHub authentication & integration
  • 1. GitHub Authentication Provider
    • 1.1. Create an OAuth App on GitHub
    • 1.2. Configuration
• 2. Add a GitHub provider integration