Live and let Learn

Way back in 2020 I’d detailed how I’d setup a Tanzu Kubernetes Grid 1.1 management cluster with OpenID Connect support (for single sign-on) before installing Kubeapps with single sign-on on that management cluster.

Recently TKG 1.3 was released and the identity management support in TKG has changed significantly, so it’s time to see what’s different when setting up a TKG cluster with identity management as well as how we can run Kubeapps on TKG 1.3 with identity management. You will of course need to work through the TKG 1.3 documentation for your environment, I’ll just highlight the significant points and small issues that I needed to work around, due to my environment.

We’ve been able to run Kubeapps in a multi-cluster setup on various Kubernetes clusters for a while now, but this was dependent on the Kubeapps’ user being authenticated in a way that all the clusters trust. Up until now, this meant having all the clusters configured to trust the same OIDC identity provider, which is not possible in some Kubernetes environments.

Particularly, this meant we were unable to demonstrate multi-cluster Kubeapps with clusters created by Tanzu Mission Control since we can’t specify API server options, such as OIDC configuration, when creating a cluster in TMC. But that requirement has now changed thanks to a new project called Pinniped.

For the past couple of years I’ve been working on the Kubeapps project, which until recently has been a UI dashboard for the Helm project - providing a simple, web-based UI to deploy applications on Kubernetes.

I’m currently looking at generalising Kubeapps to support other Kubernetes packages formats, including Carvel from VMware of course. So I set out today to start learning more about Carvel, which in contrast to more monolithic tools like Helm, provides “a set of single-purpose, composable tools that aid in your application building, configuration and deployment to Kubernetes”.

As an example of that composability, I found I can deploy a helm chart using a set of immutable images by utilizing Helm’s new-ish support for post rendering of a chart. Here’s how…

The 8th day of our course was completely blown out weather-wise with no possibility of flying, which is unfortunate as most of us only need to do some ridge soaring hours practising the give-way rules of the air and get more experience doing our reverse launches on our own in varying conditions. On the 9th day some of us were able to do a brief ridge soar after our theory test, but it was only by staying an extra day that I was able to get in the air for a longer period and demonstrate ridge soaring in traffic.

There’s some windy weather headed this way for the weekend, so our aim for the day was to get as much practise in as we could, which is exactly what we did - a day without theory classes! We left around 7:45 as planned to head up to the north launch and got 4 flights in before the wind died, landing in the East paddock. In the evening we managed another 3 flights from the west and south launches, the last one into the sunset!

We started the day at 7:45 heading up the hill in the basher to the North launch at Mt Borah again. After our first flight to the triange paddock we began doing solo flights so that after takeoff, Godfrey hands us over to the landing-site instructors, Karl and Bob, but they only use the radio if necessary. On my last flight for the morning I got to fly with another student all the way from Mt Borah back to the paddock outside the headquarters building! The afternoon saw us doing more reverse inflation ground handling as well as some more theory for landing approaches and handling injuries.

The winds just wouldn’t cooperate today, even for learning reverse launches in the paddock. We all got up ready to go, packed ourselves into the basher 4WD with our gear in the trailer, but didn’t even leave. The winds at the top of the mountain were getting stronger rather than weaker over the previous half-an-hour, so that it was currently gusts of 30km/h or 8m/s. So we came inside to do more theory: this time learning about wind gradients, turbulence and strategies for judging whether you’ll clear obstacles. We did head out to the paddock before lunch to learn reverse launches with Bob, but the wind in the paddock then died down so we couldn’t practise the new skill, so more theory instead. We headed out to the paddock again in the late afternoon when the wind had picked up a bit but again it died off on us and we were left standing there “parawaiting”.

At 8am we were in the basher heading up to the north launch and ready to go! Our first high flights are done with pretty strict supervision: Godfrey checks everything at the top and gets us into the air safely and then hands over on the radio to Karl and Bob who instruct us via radio for our approach and landing. All up the flights were only 6 or 7 minutes, but that’s 6 or 7 minutes being in control of our own wing in the air! It’s still incredible each time at the moment, realising I’m in the air, gliding like a bird down to land (well, a pretty clumsy bird, but still). In the afternoon the wind had picked up and was too strong for us, so it was back to head-quarters to learn about various emergency situations and how best to handle them.

As planned we headed out to the training slope first thing this morning at 8am as the wind was calm but would be getting stronger later on. A thunderstorm after lunch saw us heading to head-quarters to start the course theory, beginning with wing shapes, glide angles and stalls.

We started early today, heading straight out to the training hill which sits in the morning sun and so has heated air rising for a nice gentle breeze (anabatic flow). We each had an Advance Alpha 6 matching our size (the 6 is the previous model but similar to the current 7). Everyone did pretty well, getting off the ground, learning to flare when landing, as well as doing a little bit of steering. In the afternoon we had a tandem flight where we could take the controls.