All Posts

We've been looking into this and can confirm you will be able to use roles other than 'tmc:admin' or 'tmc:member' to give access to specific resources. I believe this scenario would've worked if you had added the 'Organization Administrator' group to the 'organization.credential.view' role binding or some other 'organization.*' role. Please try this after we GA a release with support for CSE 4.1 and let us know if you run into issues.

My TMC Local is not working as I am waiting for a newer version compatible with CSE 4.1. But I was trying to use Acces Roles to manage/limit K8s API access (e.g: limit certain users to certain namespaces) What I noticed was that you need  either tmc-admin` or `tmc-member` roles to log onto TMC CLI (the command line interface for TMC), which allows you to access the k8s API via kubectl. Having  tmc-admin` or `tmc-member` roles automatically gives full (admin) access to TMC managed K8s clusters and I am therefore unable to limit certain users or groups (i.e.: useer `johndoe` should only be able to list namesapces fro k8s cluster xyz). I hope this makes sense. If not, lets wait for a new version of TMC that supports CSE 4.1. Will reinstall and can get into a meeting.

We are still looking into this but I want to make sure I understand what you would like to achieve. Are you trying to use the "Cloud Administrator" role to grant access to the TMC-SM API/GUI so they can define policies/packages/etc in TMC-SM?

Is there a newer version of TMC local that is compatible with CSE 4.1? I tried to install it but it is complaining that no CSE server is available ``` root@PhotonOS-001 [ ~ ]# /mnt/cdrom/linux.run create instance --name $TMC_SM_INSTANCE_NAME --host $VCD_HOSTNAME --username $VCD_USERNAME --certificate-file /tmp/vcd.pem --encryption-key ${TMC_SM_ENCRYPTION_KEY} --input-kube-cluster-name=${TMC_SM_KUBE_CLUSTER_NAME} --input-cert-provider=cluster-issuer --input-cert-cluster-issuer-name=selfsigned-ca-clusterissuer --input-dns-zone=${TMC_SM_DNS_ZONE} --input-contour-envoy-load-balancer-ip=${TMC_SM_LOAD_BALANCER_IP} --input-harbor-url=${TMC_SM_HARBOR_URL} --input-harbor-username=${TMC_SM_HARBOR_USERNAME} --accept INFO [0019] Creating Solution instance entity instance=vmware.vcd-tmc-0.1.0-21897297-tmc INFO [0019] Triggering action action=hook event=PreCreate INFO [0020] Run EventPreCreate Hook action=hook event=PreCreate INFO [0020] Run EventPreCreate Hook successfully action=hook event=PreCreate INFO [0021] Creating element name=rde INFO [0021] Creating element name=tmc-admin-global-role INFO [0022] Creating element name=tmc-member-global-role INFO [0023] Creating element name=rights-bundle INFO [0023] Triggering action action=hook event=PostCreate INFO [0024] Run EventPostCreate Hook action=hook event=PostCreate INFO [0024] Copy the rights from global roles [Kubernetes Cluster Author] to the global role [tmc:member] action=hook event=PostCreate INFO [0025] Update rights of global role tmc:member action=hook event=PostCreate INFO [0025] Copy the rights from global roles [Organization Administrator Kubernetes Cluster Author] to the global role [tmc:admin] action=hook event=PostCreate INFO [0025] Update rights of global role tmc:admin action=hook event=PostCreate INFO [0025] Get Solution Org action=hook event=PostCreate INFO [0025] Solution Org: CSE action=hook event=PostCreate INFO [0025] Search CSE4 Cluster action=hook event=PostCreate ERROR [0025] Failed to find any cse cluster in org CSE action=hook event=PostCreate ERROR [0026] Failed to create instance 'tmc' name=tmc ERROR [0026] Failed to find any cse cluster in org CSE: exit status 6: failed to execute trigger hook errorCode=5012110011142353 ```

I managed to delete it manually by: "curl -ks -H "Accept: application/json;version=37.0" -H "Content-Type: application/json" -H "Authorization: Bearer ${VCLOUD_ACCESS_TOKEN}" -X DELETE https://$VCD_HOSTNAME/cloudapi/1.0.0/entities/urn:vcloud:entity:vmware:solutions_add_on_instance:72f202b9-a8a9-46ac-8ebd-9fa4490d0f0b" The next problem is that the CSI 4.1 Plugin does not have a certificate session during cluster creation. I will need to find a way to add the certificate after cluster creation