Opsman, Bosh, TKGI credential change

Products

• VMware Tanzu Kubernetes Grid Integrated Edition
• Operations Manager

Issue/Introduction

Currently, there is no central document detailing steps to change credentials on the Operations Manager, Bosh Director, and TKGI tiles comprehensively. This KB provides a central location for the different documented operations required to replace credentials for these products.

Environment

Opsman 3.0+

TKGI 1.19+

 

Cause

Users may wish to replace credentials in their environment periodically for security. 

Resolution

Operations Manager:

• Opsman password
• Opsman decryption passphrase
• Certificates:
  • • Note that this will require a replacement of configurable and non-configurable Leaf certs as well
    • Once CA's are replaced, the TKGI ControlPlane certs can be replaced with this documentation
    • the TKGI cluster certs can be rotated with this documentation
    • These operations require multiple Apply Changes and cluster upgrade operations to all clusters managed by TKGI and all tiles managed by Opsman.

 

Bosh Director Tile:

• vCenter password
  • This operation will require Apply Changes on Bosh and TKGI tiles. Then need to upgrade ALL clusters
• NSX-T password
  • This operation will require Apply Changes on Bosh and TKGI tiles. Then need to upgrade ALL clusters

 

For the Bosh and TKGI tile credentials replacement operations are risky and potentially destructive. Depending on if additional tiles are configured, the step to replace these might interfere with normal operations. Please contact Broadcom support for assistance if these credentials are required to be replaced.