[How-To] Authenticate with the vSphere Supervisor API

Have you always wondered how to log in directly to the vSphere Supervisor API to communicate directly with the Kubernetes API without having to rely on kubectl-vsphere or vcf-cli command line tool?

This short example shows quite simply how you can easily log in to the Supervisor API and, for example, retrieve the vSphere namespaces:

# Get the JSON Web Token (JWT)
TOKEN=$(curl -sk -u "USER@DOMAIN" \
-X POST https://SUPERVISOR_FQDN_OR_IP/wcp/login | jq -r '.session_id')

# Query all vSphere Namespaces
curl -k -H "Authorization: Bearer ${TOKEN}" -X GET https://SUPERVISOR_FQDN_OR_IP/api/v1/namespaces | jq -r '.items[].metadata.name'

# Output
default
kube-node-lease
kube-public
kube-state-metrics-139ce
kube-system
svc-argocd
svc-argocd-service-3srmt
svc-auto-attach-1hnu0
svc-cci-ns-xk907
svc-configuration-tbe79
svc-consumption-operator-63v75
svc-contour-m8mn1
svc-harbor-jpft6
svc-metrics-aggregator-rs4er
svc-pais-lyk5h
svc-secret-store-6rqli
svc-supervisor-management-proxy-l4g5n
svc-tkg-gf8p0
svc-tmc-c9
svc-velero-od4zi
svc-vks-cluster-manager-service-3873a
vmware-system-ako
vmware-system-appplatform-operator-system
vmware-system-cert-manager
vmware-system-csi
vmware-system-imageregistry
vmware-system-kubeimage
vmware-system-logging
vmware-system-mgmt-proxy
vmware-system-mobility-operator
vmware-system-monitoring
vmware-system-netop
vmware-system-network-operations
vmware-system-nsop
vmware-system-nsx
vmware-system-pinniped
vmware-system-supervisor-services
vmware-system-supervisor-services-vpc
vmware-system-vks-public
vmware-system-vmop
vmware-system-workload-cli
vmware-system-zoneop

You can also use this token directly and embed it in a kubeconfig file so that you can use the kubectl CLI as well:

apiVersion: v1
kind: Config
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://SUPERVISOR_IP:443
  name: vcf-mgmt-sn91:SUPERVISOR_IP
contexts:
- context:
    cluster: vcf-mgmt-sn91:SUPERVISOR_IP
    user: vcf-mgmt-sn91:USER@DOMAIN@10.24.68.5
  name: vcf-mgmt-sn91
current-context: vcf-mgmt-sn91
users:
- name: vcf-mgmt-sn91:USER@DOMAIN@SUPERVISOR_IP
  user:
    token: REDACTED_JWT

Many thanks to Will Arroyo (github.com/warroyo) for his support and contribution.

A big thank you also goes to Louis Baumann (github.com/soultecag), who provided us with a simple Go client that allows us to log in to a vSphere Supervisor and create a Kubernetes client or a kubeconfig file, either for the Supervisor cluster itself or for one of its VKS guest clusters.