VMware Supervisor-Managed Kubernetes Cluster

Use this guide to configure Cloudaware access to Kubernetes clusters managed by VMware Supervisor.

info

• Audience: Cloudaware administrators, VMware platform engineers
• Outcome: Cloudaware can discover Kubernetes clusters through VMware Supervisor and collect resources from permitted clusters

Introduction

In a VMware vSphere environment with Supervisor enabled, Kubernetes resources are organized as follows:

vCenter Management Server
+-- Supervisor
    +-- vSphere Namespace
        +-- Kubernetes Cluster

• vCenter Server manages the underlying VMware infrastructure.
• Supervisor provides the Kubernetes management layer.
• vSphere Namespaces provide logical and access boundaries for workloads.
• Kubernetes clusters can run within vSphere Namespaces and are managed through the Supervisor.

Prerequisites

Before you start, make sure that:

• Supervisor is enabled in the VMware vSphere environment.
• The required vSphere Namespace and Kubernetes cluster are available.
• You know the Kubernetes control plane IP address.
• A user identity is available for Cloudaware authentication.
• You have permissions to configure Kubernetes RBAC.
• A trial/active Cloudaware account and a Cloudaware user with access to Admin for managing integrations.
• TunHub integration is configured in Cloudaware.

How Cloudaware Connects

Cloudaware accesses the environment in two stages:

• Cloudaware connects to the Supervisor to discover the Kubernetes clusters managed within its vSphere Namespaces.
• For each discovered Kubernetes cluster, Cloudaware obtains the required access token and connects to the cluster API to collect Kubernetes resources.

This requires network access to:

• The Supervisor IP address on port 443.
• The Kubernetes cluster API on port 6443 for each cluster that Cloudaware collects.

Configure Network Access to the Supervisor

Create a TunHub route to the Supervisor using its IP address and port 443:

<supervisor_cluster_endpoint>:443

If the route status is red after you create it, make sure that traffic to the Supervisor IP address on port 443 is allowed through the firewall.

Configure Kubernetes Cluster Discovery on the Supervisor

Cloudaware first connects to the Supervisor to retrieve the Kubernetes clusters available within the accessible vSphere Namespaces.

Grant the Cloudaware user identity the following permissions:

rules:
  - apiGroups: ["cluster.x-k8s.io"]
    resources:
      - clusters
    verbs:
      - get
      - list

These permissions allow Cloudaware to retrieve the Cluster API Cluster resources available through the Supervisor.

Limit Discovery to Specific vSphere Namespaces

If Cloudaware should discover Kubernetes clusters only in selected vSphere Namespaces, grant these permissions only in the required namespaces.

Use a Role and RoleBinding in each namespace instead of granting cluster-wide access.

Configure Network Access to Kubernetes Clusters

After Cloudaware discovers the Kubernetes clusters through the Supervisor, it connects to the API server of each required cluster.

Allow network access to the Kubernetes cluster API on port 6443:

<kubernetes_cluster_endpoint>:6443

Make sure that port 6443 is allowed through the firewall for each Kubernetes cluster that Cloudaware needs to collect.

Configure Kubernetes Cluster Permissions

After discovering a cluster, Cloudaware obtains access to that cluster and retrieves its Kubernetes resources.

Create a ClusterRole with the required read permissions:

rules:
  - apiGroups: [""]
    resources:
      - nodes
      - pods
      - services
      - endpoints
      - configmaps
    verbs:
      - get
      - list
      - watch

  - apiGroups: ["apps"]
    resources:
      - deployments
      - daemonsets
      - statefulsets
    verbs:
      - get
      - list
      - watch

Add permissions for additional Kubernetes resource types that Cloudaware should collect.

Create a ClusterRoleBinding that assigns this role to the user identity used by Cloudaware.

View vCenter Supervisor Cluster Data in CMDB

To browse discovered vCenter Supervisor Cluster resources:

1. In Cloudaware, open CMDB Navigator.
2. In the left pane, select VMWARE.
3. Open an object list, e.g., vCenter Supervisor Clusters, to view records.

Use CMDB list views and reports to analyze vSphere inventory, relationships, and coverage.

Supported Objects

Cloudaware ingests the following vCenter Supervisor Cluster objects:

vCenter Supervisor Cluster Object	CMDB Object API Name
vCenter K8s Cluster	CA10V__CaVCenterKubernetesCluster__c
vCenter Supervisor Cluster	CA10V__CaVCenterSupervisorCluster__c
vCenter Supervisor Cluster Namespace	CA10V__CaVCenterNamespace__c

Related

• VMware vCenter
• TunHub