Replace Supervisor Workload Platform Management certificates using the API or Datacenter Command-Line Interface (DCLI) in vSphere with Tanzu.

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

This article provides alternative methods for updating the Supervisor Workload Platform Management certificate. 

Environment

VMware vSphere Kubernetes Service (VKS)
vSphere with Tanzu
vCenter 8.x / 9.x

Resolution

Supervisor Certificate APIs are only available with VCF 9.1 and later.
To manage Supervisor certificates via the API, refer to Vcenter Namespace Management Supervisors Certificates APIs

To replace certificates using the DCLI:

1. Generate a Certificate Signing Request (CSR) by running the following command on the vCenter Server: dcli +show-unreleased-apis com vmware vcenter namespacemanagement certificatemanagement tlscsr create --cluster <CLUSTER_ID> --organization-unit-name <OU_NAME> --common-name <COMMON_NAME> --key-size <KEY_SIZE> --country <COUNTRY> --email-address <EMAIL> --locality <LOCALITY> --organization-name <ORG_NAME> --state-or-province <STATE>
2. Submit the CSR to your Certificate Authority (CA) and obtain the signed certificate.
3. Import the signed certificate for the Supervisor Cluster: dcli +show-unreleased-apis com vmware vcenter namespacemanagement clusters update --cluster <CLUSTER_ID> --tls-endpoint-certificate "<CERTIFICATE_DATA>"

Additional Information

For additional details on vSphere Supervisor certificate architecture, see Master vSphere Supervisor Certificate Guide

"Workload Platform Management" certificates are automatically renewed.
vSphere Supervisor Certificates - authproxy-client.crt, pinniped.crt, vip.crt, wcp-node-bootstrapper certificates
Manual method to replace the self-signed vip.crt certificate in vSphere with Tanzu