Updating the vCenter credentials of your clusters

Starting in GKE on-prem version 1.3.1, you can update the vCenter credentials of your admin and user clusters with the gkectl update credentials vsphere command.

Each admin and user cluster is initially configured to use the vCenter username and password that you used to create those clusters. If you need to update your vCenter credentials or transfer administrative ownership to another vSphere user account, you can update the cluster's configuration file and then use the gkectl update credentials vsphere command to deploy those changes.

Example vCenter username and password configuration:

...
vcenter:
  credentials:
    ...
    username: "vCenter-username@vsphere.local"
    password: "vCenter-user-password"
...

Before you begin

Ensure that you meet the following prerequisites before updating your vCenter credentials:

• Only clusters version 1.3.1 or later are supported.

• The gkectl update credentials vsphere command currently supports only your cluster's vCenter username and password. All other changes that exist in the configuration file are ignored.

• The vCenter credentials that you want to add to a cluster must already exist. Learn about vCenter roles and user privileges.

Updating cluster credentials

Use the following steps to update the vCenter credentials on your clusters:

1. Obtain the username and password of the existing vCenter credentials to which you want to configure your admin or user clusters.

2. SSH into your admin workstation by running the following command:

   ssh -i ~/.ssh/vsphere_workstation ubuntu@[IP_ADDRESS]
   

   where [IP_ADDRESS] is the IP address of your admin workstation.

3. Open your configuration file in an editor.

   Consider creating a copy that you can modify and use for this purpose only. For example: vcenter-creds-config.yaml

4. Modify your configuration file:

   1. Depending on whether you are updating either your admin cluster or user cluster, you must modify your configuration file by removing one of the following sections:

      • To update the user cluster, remove the admincluster section.

        Leave the usercluster section in your configuration but remove all of the contents of the admincluster section. For example:

        admincluster:
          vcenter:
            network: ""
          bigip:
            ...
          podiprange: ""

      • To update the admin cluster, remove the usercluster section.

        Leave the admincluster section in your configuration but remove all of the contents of the usercluster section. For example:

        usercluster:
          vcenter:
            network: ""
          bigip:
            ...
          clustername: ""
          masternode:
            ...
          podiprange: ""

   2. Update the username and password attributes under vCenter.credentials to include the vCenter credentials that you want to set for the cluster. For example:

      gcp:
        whitelistedServiceAccountKeyPath: "my-key-folder/whitelisted-key.json"
      vCenter:
        credentials:
          address: "203.0.113.1"
          username: "vCenter-user-account@vsphere.local"
          password: "user-account-password"
        datacenter: "MY-DATACENTER"
        datastore: "MY-DATASTORE"
        cluster: "MY-CLUSTER"
        ...

5. Run the gkectl update credentials vsphere command to deploy the changes to your cluster:

   gkectl update credentials vsphere \
   --config [VCENTER_CREDS_CONFIG.YAML] \
   --kubeconfig [CLUSTER_KUBECONFIG] \
   --update-admin-cluster

   where:

   • [VCENTER_CREDS_CONFIG.YAML]: Specifies the configuration file that includes the vCenter credentials that you want to deploy to your cluster. Example: vcenter-creds-config.yaml
   • [CLUSTER_KUBECONFIG]: Specifies the kubeconfig file of the admin cluster that you want to update. Example: kubeconfig

     For the admin cluster, you must also include the --update-admin-cluster flag.

   • --update-admin-cluster: Required flag if you are deploying changes to the admin cluster. Exclude this flag when deploying changes to the user cluster.

   Result: The changed vCenter credentials are immediately validated against the server and a confirmation is output to the terminal: "vsphere credentials updated successfully". If the new credentials fail to log in to the vCenter server, you can edit the username and password in the configuration file and redeploy your changes.

   Examples:

   • User cluster example: To deploy changes to the vCenter credentials on a user cluster, you run:

     gkectl update credentials vsphere \
     --config vcenter-creds-user-config.yaml --kubeconfig admin-cluster-kubeconfig

     Result:

     validating new credentials against vcenter
     restarted "deployment/clusterapi-controllers" in namespace "testcluster"
     restarted "deployment/kube-controller-manager" in namespace "testcluster"
     restarted "statefulsets/kube-apiserver" in namespace "testcluster"
     vsphere credentials updated successfully.

   • Admin cluster example: To deploy changes to the vCenter credentials on an admin cluster, you run:

     gkectl update credentials vsphere \
     --config vcenter-creds-admin-config.yaml --kubeconfig admin-cluster-kubeconfig \
     --update-admin-cluster

     Result:

     validating new credentials against vcenter
     restarted "deployment/clusterapi-controllers" in namespace "kube-system"
     vsphere credentials updated successfully.