Add a Tanzu Application Service (TAS) connector

Connect Harness to your Tanzu Application Service (TAS) accounts and spaces.

Use a Harness Tanzu Application Service (TAS) connector to connect Harness to your TAS environment. Use the TAS connector to deploy applications to your Tanzu cloud from Harness pipelines.

What you will learn from this topic

How to install the Cloud Foundry Command Line Interface (cf CLI) on your Harness Delegate.
How to create a TAS connector using the Harness Manager.
How to define a TAS connector using a YAML example.
How Harness supports refresh token authentication and custom configuration for extensible authentication with TAS.

Before you begin

Harness Delegate: A running Harness Delegate that can reach your TAS environment. Go to Delegate installation overview to install one. Connect through a Harness Delegate rather than the Harness Platform, because you need a delegate later to deploy to your TAS environment.
TAS Endpoint URL: The API endpoint of your TAS environment, for example https://api.system.tas-mycompany.com.
TAS credentials: A TAS username and password, stored as a Harness secret.

Install the Cloud Foundry Command Line Interface (cf CLI) on your Harness Delegate

After your delegate pods are created, edit your Harness Delegate YAML to install cf CLI v7, the autoscaler plugin, and the Create-Service-Push plugin. Harness uses these on the delegate to run Tanzu deployment steps in your pipelines.

Harness Delegate uses Red Hat-based distributions such as Red Hat Enterprise Linux (RHEL) or Red Hat Universal Base Image (UBI). Use microdnf commands to install cf CLI on your delegate. If your delegate runs a Debian-based distribution such as Ubuntu, use apt-get commands instead.

Use your Pivotal Network (Pivnet) API token in the pivnet login command in the script.

Open delegate.yaml in a text editor.
Locate the INIT_SCRIPT environment variable in the Deployment object.
```
- name: INIT_SCRIPT
  value: ""
```
Replace value: "" with the installation script for your delegate's operating system.

Use microdnf commands to install cf CLI on delegates running Red Hat-based distributions such as RHEL or Red Hat UBI.

INIT_SCRIPT for microdnf

- name: INIT_SCRIPT
  value: |
    # update package manager, install necessary packages, and install CF CLI v7
    microdnf update
    microdnf install yum
    microdnf install --nodocs unzip yum-utils
    microdnf install -y yum-utils
    echo y | yum install wget
    wget -O /etc/yum.repos.d/cloudfoundry-cli.repo https://packages.cloudfoundry.org/fedora/cloudfoundry-cli.repo
    echo y | yum install cf7-cli -y

    # autoscaler plugin
    # download and install pivnet
    wget -O pivnet https://github.com/pivotal-cf/pivnet-cli/releases/download/v0.0.55/pivnet-linux-amd64-0.0.55 && chmod +x pivnet && mv pivnet /usr/local/bin;
    pivnet login --api-token=<replace with api token>

    # download and install autoscaler plugin by pivnet
    pivnet download-product-files --product-slug='pcf-app-autoscaler' --release-version='2.0.295' --product-file-id=912441
    cf install-plugin -f autoscaler-for-pcf-cliplugin-linux64-binary-2.0.295

    # install Create-Service-Push plugin from community
    cf install-plugin -r CF-Community "Create-Service-Push"

    # verify cf version
    cf --version

    # verify plugins
    cf plugins

Use apt-get commands to install cf CLI on delegates running Debian-based distributions such as Ubuntu.

INIT_SCRIPT for apt-get

- name: INIT_SCRIPT
  value: |
    # update package manager, install necessary packages, and install CF CLI v7
    apt-get install wget
    wget -q -O - https://packages.cloudfoundry.org/debian/cli.cloudfoundry.org.key | apt-key add -
    echo "deb https://packages.cloudfoundry.org/debian stable main" | tee /etc/apt/sources.list.d/cloudfoundry-cli.list
    apt-get update
    apt-get install cf7-cli

    # autoscaler plugin
    # download and install pivnet
    wget -O pivnet https://github.com/pivotal-cf/pivnet-cli/releases/download/v0.0.55/pivnet-linux-amd64-0.0.55 && chmod +x pivnet && mv pivnet /usr/local/bin;
    pivnet login --api-token=<replace with api token>

    # download and install autoscaler plugin by pivnet
    pivnet download-product-files --product-slug='pcf-app-autoscaler' --release-version='2.0.295' --product-file-id=912441
    cf install-plugin -f autoscaler-for-pcf-cliplugin-linux64-binary-2.0.295

    # install Create-Service-Push plugin from community
    cf install-plugin -r CF-Community "Create-Service-Push"

    # verify cf version
    cf --version

    # verify plugins
    cf plugins

Apply the script to the delegate and check the logs.
The output for cf --version is cf version 7.2.0+be4a5ce2b.2020-12-10. The output for cf plugins lists the installed plugins, including App Autoscaler and Create-Service-Push.

The CF Command script does not require cf login. Harness logs in using the credentials in the TAS connector configured for the infrastructure definition that runs the CF command.

Create a TAS connector

Perform the following steps to create the TAS connector using the Harness Manager.

Open a Harness project, and select Connectors under Project Setup. You can also create connectors at the account or organization levels.
Select New Connector, and then select Tanzu Application Service under Cloud Providers.

Overview

Enter a Name for the connector. Description and Tags are optional. Harness automatically creates an Id (entity identifier) for the connector based on the Name. Select Continue to proceed to Credentials.

Credentials

Select Continue after entering the following details:

Endpoint URL: Enter the TAS API endpoint URL, for example https://api.system.tas-mycompany.com.
Authentication: Select one of the following options for the username and password:
- Plaintext: Enter the username, and select Create or Select a Secret to add the password.
- Encrypted: Create or select a secret for both the username and the password.
Refresh Token (optional): Create or select a secret for the refresh token used to authenticate with TAS. Go to Refresh token support for details.

Select Connectivity Mode

Under Connect to the provider, select how you want Harness to connect to TAS, and then select Save and Continue:

Connect through Harness Platform: Harness communicates with TAS securely through the Harness Platform. Credentials are encrypted and stored in the Secret Manager configured in Harness.
Connect through a Harness Delegate: Harness communicates with TAS through a Harness Delegate installed in your environment. Select this option if TAS is behind a corporate firewall.

A Harness Delegate is used for deployment operations even if you select Connect through Harness Platform.

Delegates Setup

This step appears only if you selected Connect through a Harness Delegate. Select one of the following options, and then select Save and Continue:

Use any available Delegate.
Only use Delegates with all of the following tags: Enter the tag of the delegate you installed.

Connection Test

Harness validates the TAS connector authentication and permissions. Once verification succeeds, select Finish.

The connector now appears in the Connectors list.

YAML example

The following YAML defines a TAS connector that authenticates using a username and password, and connects through a Harness Delegate.

TAS connector YAML

connector:
  name: TASconnector # Connector display name shown in the Harness UI
  identifier: TASconnector # Unique connector identifier, cannot be changed after creation
  description: "" # Optional description for the connector
  accountIdentifier: <YOUR_ACCOUNT_ID> # Harness account identifier that owns the connector
  orgIdentifier: default # Harness org identifier that owns the connector
  projectIdentifier: <YOUR_PROJECT_ID> # Harness project identifier that owns the connector
  type: Tas
  spec:
    credential:
      type: ManualConfig
      spec:
        username: <YOUR_TAS_USERNAME> # Your TAS username
        endpointUrl: https://api.system.tas-mycompany.com # TAS API endpoint URL
        passwordRef: <YOUR_TAS_PASSWORD_SECRET_REF> # Harness secret reference storing your TAS password
    executeOnDelegate: true # Set to false to connect through the Harness Platform instead of a delegate
    ignoreTestConnection: false # Set to true to skip the connection test when the connector is created

Refresh token support

Harness Delegate version 23.12.81804 or later is required to use this feature.

Harness provides the option to use a refresh token to authenticate with the Tanzu connector. Harness uses this refresh token to verify your Tanzu instance. You still need to provide a username and password to authenticate with Tanzu. Harness uses these credentials to obtain a new refresh token. Once you provide the refresh token in the connector, Harness uses it to authenticate and perform each task. Harness authenticates with the refresh token before executing each Tanzu step defined in the pipeline.

You can retrieve the refresh token from the config.json file you receive when authenticating with the CF client. You can pass the refresh token as a secret stored in the Harness Secrets Manager or your secrets manager of choice.

To generate the refresh token using a client ID and client secret instead, go to Custom configuration for extensible authentication.

Custom configuration for extensible authentication

For Harness Delegate version 23.12.81811 and later, you can create a Tanzu connector by setting the ENABLE_TAS_REFRESH_TOKEN_CLIENT_ID, TAS_REFRESH_TOKEN_CLIENT_ID, and TAS_REFRESH_TOKEN_CLIENT_SECRET parameters, and providing the refresh token. The connector generates a refresh token using the client ID and secret ID environment variables.

ENABLE_TAS_REFRESH_TOKEN_CLIENT_ID: The setting to configure the alternative authentication mode on the Harness Delegate for Tanzu.
TAS_REFRESH_TOKEN_CLIENT_ID: The client ID parameter for Tanzu authentication.
TAS_REFRESH_TOKEN_CLIENT_SECRET: The client secret parameter for Tanzu authentication.

To configure the delegate YAML, do the following:

Go to the Kubernetes delegate YAML (deployment) or the actual deployed resource.
Under spec.template.spec.containers.env, add the following environment variables.

- name: ENABLE_TAS_REFRESH_TOKEN_CLIENT_ID
  value: "true"
- name: TAS_REFRESH_TOKEN_CLIENT_ID
  value: gam
- name: TAS_REFRESH_TOKEN_CLIENT_SECRET
  value: public

Next steps

Delegate installation overview: Install and configure a Harness Delegate for your TAS connector.
Delegate troubleshooting: Resolve common delegate installation and connectivity issues.

PreviousAdd a Spot connector

NextAdd a Terraform Cloud connector

Last updated 11 days ago

Was this helpful?