VMware Supervisor-Managed Kubernetes Cluster

Use this guide to configure Cloudaware access to Kubernetes clusters managed by VMware Supervisor.

info

• Audience: Cloudaware administrators, VMware platform engineers
• Outcome: Cloudaware can discover Kubernetes clusters through VMware Supervisor and collect resources from permitted clusters

Introduction

In a VMware vSphere environment with Supervisor enabled, Kubernetes resources are organized as follows:

vCenter Management Server
+-- Supervisor
    +-- vSphere Namespace
        +-- Kubernetes Cluster

• vCenter Server manages the underlying VMware infrastructure.
• Supervisor provides the Kubernetes management layer.
• vSphere Namespaces provide logical and access boundaries for workloads.
• Kubernetes clusters can run within vSphere Namespaces and are managed through the Supervisor.

Prerequisites

Before you start, make sure that:

• Supervisor is enabled in the VMware vSphere environment.
• The required vSphere Namespace and Kubernetes cluster are available.
• You know the Kubernetes control plane IP address.
• A vCenter user identity is available for Cloudaware authentication and can be assigned the required vCenter and Kubernetes permissions.
• You have permissions to configure Kubernetes RBAC.
• You have a trial or active Cloudaware account and a Cloudaware user with access to Admin for managing integrations.
• TunHub integration is configured in Cloudaware.

How Cloudaware Connects

Cloudaware accesses the environment in two stages:

• Cloudaware connects to the Supervisor to discover the Kubernetes clusters managed within its vSphere Namespaces.
• For each discovered Kubernetes cluster, Cloudaware obtains the required access token and connects to the cluster API to collect Kubernetes resources.

This requires network access to:

• The Supervisor IP address on port 443.
• The Kubernetes cluster API on port 6443 for each cluster that Cloudaware collects.

High-Level Setup Flow

1. Configure vCenter permissions for the Cloudaware user:

   • Assign Read-only access to the required vSphere cluster and Namespaces.
   • Add the user to the ServiceProviderUsers group so Cloudaware can discover Supervisor-related virtual machines.

2. Configure network access to the Supervisor.

3. Configure Kubernetes cluster discovery.

4. Configure network access to discovered clusters.

5. Configure Kubernetes resource permissions.

Configure vCenter Permissions

Cloudaware requires access to the vCenter inventory to discover Supervisor clusters, vSphere Namespaces, and the virtual machines associated with Kubernetes workloads.

Configure the user identity used by Cloudaware as follows:

1. Assign a role that includes Read-only permissions to the required vSphere cluster.
2. Assign a role that includes Read-only permissions to the Namespaces folder or to each vSphere Namespace that Cloudaware should collect.
3. In vCenter Single Sign-On, add the user to the ServiceProviderUsers group:
   • In the vSphere Client, go to Administration.
   • Go to Single Sign On → Users and Groups → Groups.
   • Find ServiceProviderUsers and add the Cloudaware user as a member.

note

Read-only access alone can allow the user to see regular vCenter virtual machines while Tanzu/VKS-managed virtual machines remain unavailable. Membership in ServiceProviderUsers is required for the user to see Supervisor- and namespace-associated virtual machines.

Configure Network Access to the Supervisor

Create a TunHub route to the Supervisor using its IP address and port 443:

<supervisor_cluster_endpoint>:443

If the route status is red after you create it, make sure that traffic to the Supervisor IP address on port 443 is allowed through the firewall.

Configure Kubernetes Cluster Discovery on the Supervisor

Cloudaware first connects to the Supervisor to retrieve the Kubernetes clusters available within the accessible vSphere Namespaces.

Grant the Cloudaware user identity the following permissions:

rules:
  - apiGroups: ["cluster.x-k8s.io"]
    resources:
      - clusters
    verbs:
      - get
      - list

These permissions allow Cloudaware to retrieve the Cluster API Cluster resources available through the Supervisor.

Limit Discovery to Specific vSphere Namespaces

If Cloudaware should discover Kubernetes clusters only in selected vSphere Namespaces, grant these permissions only in the required namespaces.

Use a Role and RoleBinding in each namespace instead of granting cluster-wide access.

Configure Network Access to Kubernetes Clusters

After Cloudaware discovers the Kubernetes clusters through the Supervisor, it connects to the API server of each required cluster.

Allow network access to the Kubernetes cluster API on port 6443:

<kubernetes_cluster_endpoint>:6443

Make sure that port 6443 is allowed through the firewall for each Kubernetes cluster that Cloudaware needs to collect.

Configure Kubernetes Cluster Permissions

After discovering a cluster, Cloudaware obtains access to that cluster and retrieves its Kubernetes resources.

Create a ClusterRole with the required read permissions:

rules:
  - apiGroups: [""]
    resources:
      - nodes
      - pods
      - services
      - endpoints
      - configmaps
    verbs:
      - get
      - list
      - watch

  - apiGroups: ["apps"]
    resources:
      - deployments
      - daemonsets
      - statefulsets
    verbs:
      - get
      - list
      - watch

Add permissions for additional Kubernetes resource types that Cloudaware should collect.

Create a ClusterRoleBinding that assigns this role to the user identity used by Cloudaware.

View vCenter Supervisor Cluster Data in CMDB

To browse discovered vCenter Supervisor Cluster resources:

1. In Cloudaware, open CMDB Navigator.
2. In the left pane, select VMWARE.
3. Open an object list, for example, vCenter Supervisor Clusters, to view records.

Use CMDB list views and reports to analyze vSphere inventory, relationships, and coverage.

Supported Objects

Cloudaware ingests the following vCenter Supervisor Cluster objects:

vCenter Supervisor Cluster Object	CMDB Object API Name
vCenter K8s Cluster	CA10V__CaVCenterKubernetesCluster__c
vCenter Supervisor Cluster	CA10V__CaVCenterSupervisorCluster__c
vCenter Supervisor Cluster Namespace	CA10V__CaVCenterNamespace__c

Related

• VMware vCenter
• TunHub