WilliamLam.com

VCF 9.1 - Configuring Harbor to use VCF Identity Broker (IDB) for External Identity Federation

by // 1 Comment

Similar to Configuring vSphere Supervisor to use VMware Cloud Foundation (VCF) Identity Broker (IDB) for external identity federation, Harbor also supports OpenID Connect (OIDC) identity providers (IdPs). This would allow Harbor or any components that support OIDC-based IdP to leverage our existing VCF IDB instance that is already integrated with VCF Single Sign-On (SSO), reducing the need to create an additional OIDC client configurations from the IdP itself.

Since I already had VCF Single Sign-On (SSO) configured with Keycloak using my VCF Infrastructure Services (VIS) Appliance Fling, it was easy for me to validate and demonstrate this integration after coming across a question about it this morning in one of our internal Google channels šŸ™‚

[Read more...]

Quick Tip - Configuring vSphere Supervisor Services with self-signed container registry

by // 2 Comments

When deploying additional vSphere Supervisor Services including the new Data Services Operator enabling Database-as-a-Service (DBaaS), the container images that are usedĀ areĀ hosted on Broadcom's container registry (projects.packages.broadcom.com).

For air-gapped deployments where you need to use an internal container registry, there is a process to relocate the Broadcom's container images into your own container registry, which has been possible since vSphere 8.0 Update 3.

While attempting to install the DSM Operator Supervisor Service, which had already been relocated into my standalone Harbor registry, I ran into the classic issue where the self-signed TLS certificate could not be trusted as you can see from the screenshot below.


While the validation error message was clear on why the installation will fail, it did not provide any details on how to actually add the trust the self-signed TLS certificate from my container registry.

After checking internally with a few folks, I was able to resolve this, but it took several attempts. I have already made a request to improve the official documentation to make these steps clearer.

[Read more...]

Quick Tip - Configuring vSphere Kubernetes Service (VKS) Cluster with self-signed container registry

by // 1 Comment

Over the weekend, I had finished building a small container application that I had developed on my local desktop, which worked great. However, the real test was to deploy the application on a vSphere Kubernetes Service (VKS) Cluster, which would require the container image to be hosted in a container registry.

Rather than using a public container registry, like many organizations, you typically would setup an internal registry that your infrastructure could have access to. Harbor is my go to container registry and is extremely simple to setup as it uses docker-compose under the hood.

After uploading my container image to Harbor, if you try to deploy itĀ to your VKS Cluster, you will immediately see the following image pull error:

tls: failed to verify certificate: x509: certificate signed by unknown authority


Just like any system that attempts to connect to an endpoint with a self-signed TLS certificate that it can not verify, it will not trust which is the default behavior.

For our VKS Cluster to be able to successfully pull an image from Harbor with a self-signed TLS certificate, we need to add the trusted CA to our vSphere Namespace and then reference that as part of our VKS Cluster deployment.

[Read more...]