Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Using NSX-SM with VMware Enterprise PKS (71309)

Last Updated: 8/27/2020Categories: InformationalTotal Views: 11206Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Details

This article describes how to use NSX Service Mesh (NSX-SM) with VMware Enterprise PKS.

Prerequisites:
This topic assumes the following:

You have deployed VMware Enterprise PKS.

You have provisioned a Kubernetes cluster where you will install NSX-SM.

You enabled Pod Security Policies for the target Kubernetes cluster.

Solution

About NSX-SM:

Authorized Kubernetes cluster users can deploy NSX Service Mesh (NSX-SM), giving you visibility, control, and security for services, data, and users at the API level. It provides a service mesh solution for Kubernetes based on the NSX platform. For more information, refer to the NSX-SM blog post Federated Service Mesh on VMware PKS.

NSX-SM is deployed as a Pod in a Kubernetes cluster using a YAML file. The recommendation is to deploy NSX-SM in an Enterprise PKS foundation with Pod Security Policies (PSPs) enabled. PSPs are enabled by selecting the check box in the appropriate Plan on the PKS tile.

Installing NSX-SM in the Cluster:

NSX-SM is provided as a service through VMware Cloud Services. You need to go through the service on-boarding process using the NSX-SM web site.

Register with VMware Cloud Services:

Contact Sales contact to request access or send an email to Mark Schweighardt ([email-masked]).

Complete the registration process by following the emails you receive.

Sign in to the VMware Cloud Services Console.

Create a new organization.

Select the NSX-SM service offering and add your account to the service.

Onboard a Kubernetes Cluster:

Complete the following steps to install NSX-SM onto a PKS-provisioned Kubernetes cluster.

Once the account is sucessfully created, at the NSX-SM welcome page, select the ONBOARD CLUSTERS item on the home web page.

At the Onboard Clusters screen, enter a unique name for the target cluster and click on Generate Security Token button. The cluster name is used by NSX-SM to identify a particular cluster. While the cluster name does not have to match the Enterprise PKS cluster name, it is recommended.

Download the YAML file, which contains the deployment definition of the NSX-SM agent. Copy the command to apply the YAML by clicking the copy icon.

Log in to your PKS-provisioned Kubernetes cluster and apply the registration YAML to the cluster by using the command you copied:
kubectl apply -f https://prod-1.servicemesh.biz/cluster-registration/k8s/v0.8.5/k8s-registration.yaml.

Then add the token to establish secure connection with NSX Service Mesh:
kubectl -n allspark create secret generic cluster-token --from-literal=token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.xxxxxxxxxxxx

Click on INSTALL NSX SERVICE MESH green button, to install NSX-SM on the cluster.

The YAML file deploys a Pod to the target Kubernetes cluster that includes the NSX-SM agent. If the target cluster is not discovered, click Exit and Reload and try again.

Install and Configure Istio:

Once the NSX-SM agent is correctly started on a cluster, go back the NSX-SM web site and complete the on-boarding process by clicking on the Install ISTIO button in the on-boarding menu. This operation installs the ISTIO components on the target cluster. Included in these components is the ISTIO CNI plugin, which allows ISTIO to automatically inject its Envoy sidecar container whenever a new Pod is started.
Since PSPs are enabled on the cluster, deployment of services require a few additional steps, in particular you must create and use a PSP and grant use of it to a service account. While the additional steps are typical for any cluster with PSPs enabled, the content of the PSP object itself is specific to the needs of sidecar injection as requested by ISTIO. Use the psp.yaml file attached in this KB for this purpose. For instructions on how to create the PSP, see Enabling and Configuring Pod Security Policies.

Related Information

Known Issue :
When the pks delete cluster command is issued, the system runs an errand to clean up the pods currently running in the cluster. Istio installs a few pods that have a Pod Disruption Budget that conflict with the Enterprise PKS cleanup errand. This means that the errand will run for a long time.

In Enterprise PKS v1.5 we allow the user to select a timeout for Pod Disruption Budget, therefore the errand will run up to that timeout. Prior to v1.5 the timeout was very long (approximately 24 hours) and it looked like the deleting process was hanging forever.

To avoid this problem we suggest that you first try removing the on-boarded cluster from the NSX-SM web UI. To perform this operation log on to the NSX-SM web UI and click on the name of cluster you want to remove. Near the top right corner click on: REMOVE CLUSTER. If this operation is successful the cluster can be safely deleted.

If the operation is not successful, run the following command on the cluster before attempting to delete it through Enterprise PKS:
kubectl delete namespace istio-system

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

psp

Additional Resources

KB
•
VMware vCloud Director で認定されたバックアップ ソリューション︰Commvault バージョン 11 (71356)

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
修补 VCSA 6.7 U2/U2a 时报错：方法调用错误 Checksum 验证失败 (70837)

KB
•
如何从 vRealize Automation 7.3+ 内容包迁移到 7.5+ 内容包 (71284)

KB
•
VCSA 6.7 U2/U2a のパッチ適用中に「メソッドの起動でエラーが発生し、チェックサム検証に失敗しました (Error in method invocation Checksum verification failed)」メッセージが表示される (70837)

Results 1-5 of 5

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Tanzu Kubernetes Grid

Related Versions:

Take Our Survey

Support Assistant