SSH to VMC-AWS with Tanzu TKG Nodes via Private Key

2021-01-20

My Lab setup:

VMware Cloud on AWS with Tanzu Service on SDDC v1.16
vSphere namespace: vmc-dzhang
guest cluster: dzhang-c01

Pre-req:

VMC NSX DFW rules allowing SSH from your jumpbox
Access to the VMware Cloud on AWS with Tanzu Service supervisor cluster

Step 1: Change to namespace context.

root@photon-machine [ ~ ]# k config use-context vmc-dzhang
Switched to context "vmc-dzhang".

Step 2: Locate the secret resource

root@photon-machine [ ~ ]# k get secret
NAME                                      TYPE                                  DATA   AGE
default-token-m6pjz                       kubernetes.io/service-account-token   3      12h
dzhang-c01-antrea                         kubernetes.io/tls                     3      11h
dzhang-c01-auth-svc-cert                  kubernetes.io/tls                     3      11h
dzhang-c01-ca                             Opaque                                2      11h
dzhang-c01-ccm-token-v94vt                kubernetes.io/service-account-token   3      11h
dzhang-c01-control-plane-zpzmm            cluster.x-k8s.io/secret               1      11h
dzhang-c01-default-nodepool-gr8tn-j89qs   cluster.x-k8s.io/secret               1      11h
dzhang-c01-default-nodepool-gr8tn-wv5xl   cluster.x-k8s.io/secret               1      11h
dzhang-c01-encryption                     Opaque                                1      11h
dzhang-c01-etcd                           Opaque                                2      11h
dzhang-c01-extensions-ca                  kubernetes.io/tls                     3      11h
dzhang-c01-kubeconfig                     Opaque                                1      11h
dzhang-c01-metrics-server-cert            kubernetes.io/tls                     3      11h
dzhang-c01-proxy                          Opaque                                2      11h
dzhang-c01-pvcsi-token-f44cq              kubernetes.io/service-account-token   3      11h
dzhang-c01-sa                             Opaque                                2      11h
**dzhang-c01-ssh                            kubernetes.io/ssh-auth                1      11h**
dzhang-c01-ssh-password                   Opaque                                1      11h

Step 3: Get the private key from the secret.

root@photon-machine [ ~ ]# kubectl get secret dzhang-c01-ssh -o jsonpath={.data.ssh-privatekey} | base64 --decode > tkc-key
root@photon-machine [ ~ ]# cat tkc-key 
-----BEGIN RSA PRIVATE KEY-----
MIIJKAIBAAKCAgEAzcMCcU23uR+OLZx/K/nxX+O+PlA4V9ZErxhrJg+JRjNX6YMR
1UKkRwvHVEIwDJNtmRmJvD60IMOrcCNdwRiAyhOLqC86aFQ8lVnVzmzKQi/Eurcp
r5tz9wY5aaUzSNHmxQB7RPeaPznp3ywGEKmK0MTn5tLrumy/L0zXGOzpJhZalk6W
QN/tW13V9f4YlYImofesGNKTbRVD+drZNsag36Nkr62DViCZVM6/QnVmwq0903K9
gykmoHiC3brlukAo660p4ArdtNZikuPDcZrqkIWszWxJOiVNrVFz0ud3LbmR4S1S
dOI7ogMMWXghEO4qrqor2AJXw4E61nIWLhE4jcZ4nZuInS08gelxavaXn6C6cnkx
amp/I33wEnXh0T6jtA/VpwFYhyjVlbxyx32jpzYsLa4zFwtK54bUFQ9VUIPcL/5b
62swll2irLTE5Cr4tDzIf05GEvV+/W+aKarP4eD7Rwq4PtIqIgQeCCkOZmLq3KCW
ThB2ivrfQuQxTntO9KJH91gAB9+ky1bF4Yq65NcXLCQDozb6gJbQ9cSZuYioJCgY
...
uLS4Z+FHh+IjgeKWjbtsEdLS1b3XkMt/QtA6Vey0139VAZrzpVC3Y/SOBO6tUhnX
5IuyFkAoQnua5TlPaRdzbIP3ZzbzgFLtY8oCP1Oq2TauLfP7qohFhXQzdKr87y5c
y8g6VOx9XcPW2lxdZ/tsw8W+m5Cuu1Z3JYoTgArOxAFpS8gVyhwBNBTWNjlQymtV
iObdN6wfoPTWCt1o9OfZsvHG2jw4KZlZK+rnvIZ0bfVUwkvPQyuzwWtcGTtzU7dB
EnURAoIBAAd2g0Mdin6D5pQFYrkh4yzqNBzhQU3w9zBfcGltdHSm+T7V4d0pIpm4
HYhpwXDf4dAVM82wZt0Nfl2Nlbo9ipU5yyi7LH0msJ9nkWZVXctPyanl1+TQHGrN
wtDGBPdZ/xaLWLl0Sjq/fFkj7qjho4w0a7EKJYxeuUa1VWmI8AjKtYZjAImM5jAF
ALtD4pfA2lU34tc6bRyHo/t/cchI0Zab09cjg3+r8MtvWeegf8a5aPLuTsww3X17
djqeeMn/aUvBqNV3xlyopqyxYuu/ZMgQbEgCcZSfCGZyUFUe94dV+chft3m/FHXw
sZ/RwbFAnPQcj5olNpgKctTabh1VHncCggEBAN9tK/FnoHMEgF05KDPbgNnr5yo7
4dhEToATix3ttvW2RvG6lTkZkmRnUJ6D4ZsgrtbeTvYqedBPBLqPP25CT0w8WgXD
iY0M2xuF8lDGm/sqsgYv5iRKVBcPbi0nTaytU7SRS6bjSdVZCqXgYpQpVoKrr7hD
entLzYSK+uPk5KlEpoBZv/n7kGYdpXcpEN2d+/U4JeQNZwaJO4dh5KtiAikLJ6OE
9HpvgEAl6vZ6TlIMFFhcIX9clfY+uZ0LMkIzAGhJudETD6I59ZmyMJt7Y4eJwDXH
7itNl6yXH4RVp8Bm+KpL0AejpWYmZi+VPkoF5yYvtPR2GAZsLzxWhh/4I30=
-----END RSA PRIVATE KEY-----

Step 4: Change the permission of private key file

root@photon-machine [ ~ ]# chmod 400 tkc-key

Step 5: Connect to your nodes

root@photon-machine [ ~ ]# ssh -i tkc-key [email protected]
Welcome to Photon 3.0 (\\m) - Kernel \\r (\\l)
Last login: Tue Nov 16 23:16:26 2021 from 192.168.2.106
 23:25:39 up 12:09,  0 users,  load average: 0.37, 0.13, 0.05
vmware-system-user@dzhang-c01-default-nodepool-7996g-6b9bf554-mxjmq [ ~ ]$ hostname
dzhang-c01-default-nodepool-7996g-6b9bf554-mxjmq
vmware-system-user@dzhang-c01-default-nodepool-7996g-6b9bf554-mxjmq [ ~ ]$ ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 04:50:56:00:48:02 brd ff:ff:ff:ff:ff:ff
    inet 10.244.0.20/28 brd 10.244.0.31 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::650:56ff:fe00:4802/64 scope link 
       valid_lft forever preferred_lft forever
3: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 1a:8d:c1:1f:b0:41 brd ff:ff:ff:ff:ff:ff
4: genev_sys_6081: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65000 qdisc noqueue master ovs-system state UNKNOWN group default qlen 1000
    link/ether 9a:19:ae:7a:cf:a8 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::9819:aeff:fe7a:cfa8/64 scope link 
       valid_lft forever preferred_lft forever
5: antrea-gw0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN group default qlen 1000
    link/ether c2:b5:a2:2f:66:cb brd ff:ff:ff:ff:ff:ff
    inet 10.245.2.1/24 brd 10.245.2.255 scope global antrea-gw0
       valid_lft forever preferred_lft forever
    inet6 fe80::c0b5:a2ff:fe2f:66cb/64 scope link 
       valid_lft forever preferred_lft forever
6: vsphere--a62844@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master ovs-system state UP group default 
    link/ether 26:b8:b1:b4:3a:c4 brd ff:ff:ff:ff:ff:ff link-netns cni-3c046edc-b9fa-dd9c-eedf-eb4243cd87b4
    inet6 fe80::24b8:b1ff:feb4:3ac4/64 scope link 
       valid_lft forever preferred_lft forever
7: extensio-0a3468@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master ovs-system state UP group default 
    link/ether 12:d8:dd:2b:12:ca brd ff:ff:ff:ff:ff:ff link-netns cni-3941e535-b8ce-129c-074e-fd4951c7273a
    inet6 fe80::10d8:ddff:fe2b:12ca/64 scope link 
       valid_lft forever preferred_lft forever
8: agent-up-bdecfa@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master ovs-system state UP group default 
    link/ether 92:f6:27:7c:53:7e brd ff:ff:ff:ff:ff:ff link-netns cni-60317543-5d72-ff5a-1781-1b27bc4feb03
    inet6 fe80::90f6:27ff:fe7c:537e/64 scope link 
       valid_lft forever preferred_lft forever
vmware-system-user@dzhang-c01-default-nodepool-7996g-6b9bf554-mxjmq [ ~ ]$

Thank you for your reading!