`
+ ```
+1. Switch to the TKG cluster context.
+ ```bash
+ kubectl config use-context sfo01w01cluster01
+ ```
+1. Check TKG cluster resources.
+ ```bash
+ kubectl get nodes
+
+ kubectl get namespaces
+
+ kubectl get pods -A
+
+ kubectl cluster-info
+
+ kubectl cluster-info
+
+ kubectl api-resources
+ ```
+
+## Installing VMware Tanzu Packages on TKG Clusters
+
+VMware Tanzu packages are service add-ons for Tanzu products that distributed as Carvel packages for easy and standardized installation and management.
+
+You can install packages to:
+- Make services available to apps hosted on Kubernetes workload clusters, to help developers
+- Install platform intelligence or other services, to help platform operators
+
+The Tanzu Standard package repository contains CLI-managed packages that platform operators install for their own use or to provide services that application developers can use. For a list of packages that the Tanzu Standard repository contains and how to install them in clusters, see [Tanzu Standard Repository Packages](https://docs.vmware.com/en/VMware-Tanzu-Packages/2023.9.19/tanzu-packages/ts-packages.html)
+
+### Add the Tanzu Package Repository to the Cluster
+Before you can install Tanzu packages to a cluster, you need to add the package repository from which the cluster downloads the package images. In an air-gapped environmeny, you access these from the internal registry where you stored the required images.
+
+Kapp controller deployed automatically on classy clusters provisioned on vSphere 8. To add the Tanzu package repository from an internal registry, you need ensure kapp controller trust the registry by creating the kapp-controller-config with the registry cert information.
+
+```bash
+#kubectl create secret generic kapp-controller-config --namespace tkg-system --from-file caCerts=/etc/docker/certs.d/tkgs-harbor.sfo01.rainpole.vmw/ca.crt
+secret/kapp-controller-config created
+```
+Supervisor cluster 1.25 supports package repository version v2.2.x and latest is v2.2.0_update.2. For more information on Tanzu package repository compatibility, see [Supervisor version requirements](https://docs.vmware.com/en/VMware-Tanzu-Packages/2023.9.19/tanzu-packages/prep.html#supervisor-tkr). Add the package repository and validate by following the below commands.
+```bash
+# tanzu package repository add tanzu-standard --url tkgs-harbor.sfo01.rainpole.vmw/tkgs-airgap/packages/standard/repo:v2.2.0_update.2 --namespace tkg-system
+
+Waiting for package repository to be updated
+
+4:41:24AM: Waiting for package repository reconciliation for 'tanzu-standard'
+4:41:18AM: Fetching (7s ago)
+ | apiVersion: vendir.k14s.io/v1alpha1
+ | directories:
+ .
+ .
+ .
+ .
+ | Succeeded
+4:41:23AM: Deploy succeeded (2s ago)
+
+]# tanzu package repository get tanzu-standard -n tkg-system
+
+NAMESPACE: tkg-system
+NAME: tanzu-standard
+SOURCE: (imgpkg) tkgs-harbor.sfo01.rainpole.vmw/tkgs-airgap/packages/standard/repo:v2.2.0_update.2
+STATUS: Reconcile succeeded
+CONDITIONS: - type: ReconcileSucceeded
+ status: "True"
+ reason: ""
+ message: ""
+USEFUL-ERROR-MESSAGE:
+```
+
+### Install Cert Manager
+
+The first package that you should install on your cluster is the [**cert-manager**](https://github.com/cert-manager/cert-manager) package which adds certificates and certificate issuers as resource types in Kubernetes clusters and simplifies the process of obtaining, renewing and using those certificates.
+
+1. Capture the available Cert Manager package versions.
+ ```bash
+ # tanzu package available list cert-manager.tanzu.vmware.com -A
+
+ NAMESPACE NAME VERSION RELEASED-AT
+ tkg-system cert-manager.tanzu.vmware.com 1.1.0+vmware.1-tkg.2 2020-11-24 18:00:00 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.1.0+vmware.2-tkg.1 2020-11-24 18:00:00 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.10.1+vmware.1-tkg.1 2021-10-29 12:00:00 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.10.1+vmware.1-tkg.2 2021-10-29 12:00:00 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.10.2+vmware.1-tkg.1 2023-01-11 12:00:00 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.5.3+vmware.2-tkg.1 2021-08-23 17:22:51 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.5.3+vmware.4-tkg.1 2021-08-23 17:22:51 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.5.3+vmware.6-tkg.1 2021-08-23 17:22:51 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.5.3+vmware.7-tkg.1 2021-08-23 17:22:51 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.5.3+vmware.7-tkg.2 2021-08-23 17:22:51 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.5.3+vmware.7-tkg.3 2021-08-23 17:22:51 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.7.2+vmware.1-tkg.1 2021-10-29 12:00:00 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.7.2+vmware.3-tkg.1 2021-10-29 12:00:00 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.7.2+vmware.3-tkg.2 2021-10-29 12:00:00 +0000 UTC
+ tkg-system cert-manager.tanzu.vmware.com 1.7.2+vmware.3-tkg.3 2021-10-29 12:00:00 +0000 UTC
+ ```
+
+1. Create the namespace by running `kubectl create ns cert-manager`.
+2. Install the `cert-manager` package.
+
+ Capture the latest version from the previous command, if there are multiple versions available, check the **RELEASED-AT** to collect the version of the latest one. This document uses the version 1.10.2+vmware.1-tkg.1 for installation.
+
+ The following command installs the `cert-manager` package:
+ ```bash
+ # tanzu package install cert-manager -p cert-manager.tanzu.vmware.com -n cert-manager -v 1.10.2+vmware.1-tkg.1
+
+ 4:45:05AM: Creating service account 'cert-manager-cert-manager-sa'
+ 4:45:05AM: Creating cluster admin role 'cert-manager-cert-manager-cluster-role'
+ 4:45:05AM: Creating cluster role binding 'cert-manager-cert-manager-cluster-rolebinding'
+ 4:45:05AM: Creating overlay secrets
+ 4:45:05AM: Creating package install resource
+ 4:45:05AM: Waiting for PackageInstall reconciliation for 'cert-manager'
+ 4:45:03AM: Fetch started (3s ago)
+ 4:45:03AM: Fetching (3s ago)
+ | apiVersion: vendir.k14s.io/v1alpha1
+ | directories:
+ .
+ .
+ .
+ | 4:45:27AM: ---- waiting complete [47/47 done] ----
+ | Succeeded
+ 4:45:27AM: Deploy succeeded (3s ago)
+ ```
+
+1. Confirm that the `cert-manager` package has been installed successfully and the status is `Reconcile succeeded`.
+
+ ```bash
+ # tanzu package installed get cert-manager -n cert-manager
+
+ NAMESPACE: cert-manager
+ NAME: cert-manager
+ PACKAGE-NAME: cert-manager.tanzu.vmware.com
+ PACKAGE-VERSION: 1.10.2+vmware.1-tkg.1
+ STATUS: Reconcile succeeded
+ CONDITIONS: - type: ReconcileSucceeded
+ status: "True"
+ reason: ""
+ message: ""
+ ```
+
+### Install Contour
+
+[Contour](https://projectcontour.io/) is a Kubernetes ingress controller that uses the Envoy reverse HTTP proxy. Contour with Envoy is commonly used with other packages, such as External DNS, Prometheus, and Harbor.
+
+The Contour package includes the Contour ingress controller and the Envoy reverse HTTP proxy.
+
+After you have set up the cluster, you must first create the configuration file that is used when you install the Contour package and then install the package.
+
+Package installation can be customized by entering the user-configurable values in YAML format. Following is an example YAML for customizing Contour installation. For more information on configurable variables, see [Install Contour for Ingress Control](https://docs.vmware.com/en/VMware-Tanzu-Packages/2023.9.19/tanzu-packages/packages-contour.html)
+
+ ```yaml
+ infrastructure_provider: vsphere
+ namespace: tanzu-system-ingress
+ contour:
+ configFileContents: {}
+ useProxyProtocol: false
+ replicas: 2
+ pspNames: "vmware-system-restricted"
+ logLevel: info
+ envoy:
+ service:
+ type: LoadBalancer
+ annotations: {}
+ nodePorts:
+ http: null
+ https: null
+ externalTrafficPolicy: Cluster
+ disableWait: false
+ hostPorts:
+ enable: true
+ http: 80
+ https: 443
+ hostNetwork: false
+ terminationGracePeriodSeconds: 300
+ logLevel: info
+ pspNames: null
+ certificates:
+ duration: 8760h
+ renewBefore: 360h
+
+ ```
+
+For a full list of user-configurable values, see [Contour: Ingress Control](https://docs.vmware.com/en/VMware-Tanzu-Packages/2023.9.19/tanzu-packages/packages-contour.html).
+
+1. Capture the available Contour package versions.
+
+ ```bash
+ # tanzu package available list contour.tanzu.vmware.com -A
+
+ NAMESPACE NAME VERSION RELEASED-AT
+ tkg-system contour.tanzu.vmware.com 1.17.1+vmware.1-tkg.1 2021-07-23 18:00:00 +0000 UTC
+ tkg-system contour.tanzu.vmware.com 1.17.2+vmware.1-tkg.2 2021-07-23 18:00:00 +0000 UTC
+ tkg-system contour.tanzu.vmware.com 1.17.2+vmware.1-tkg.3 2021-07-23 18:00:00 +0000 UTC
+ tkg-system contour.tanzu.vmware.com 1.18.2+vmware.1-tkg.1 2021-10-05 00:00:00 +0000 UTC
+ tkg-system contour.tanzu.vmware.com 1.20.2+vmware.1-tkg.1 2022-06-14 00:00:00 +0000 UTC
+ tkg-system contour.tanzu.vmware.com 1.20.2+vmware.2-tkg.1 2022-06-14 00:00:00 +0000 UTC
+ tkg-system contour.tanzu.vmware.com 1.22.3+vmware.1-tkg.1 2022-12-12 00:00:00 +0000 UTC
+ tkg-system contour.tanzu.vmware.com 1.23.5+vmware.1-tkg.1 2023-04-05 00:00:00 +0000 UTC
+ ```
+1. Create the namespace to install contour package: `kubectl create ns tanzu-system-ingress`
+1. Install the Contour package.
+ ```bash
+ # tanzu package install contour -p contour.tanzu.vmware.com -v 1.23.5+vmware.1-tkg.1 --values-file contour-data-values.yaml -n tanzu-system-ingress
+
+ 4:48:19AM: Creating service account 'contour-tanzu-system-ingress-sa'
+ 4:48:19AM: Creating cluster admin role 'contour-tanzu-system-ingress-cluster-role'
+ 4:48:19AM: Creating cluster role binding 'contour-tanzu-system-ingress-cluster-rolebinding'
+ 4:48:19AM: Creating secret 'contour-tanzu-system-ingress-values'
+ 4:48:19AM: Creating overlay secrets
+ 4:48:19AM: Creating package install resource
+ 4:48:19AM: Waiting for PackageInstall reconciliation for 'contour'
+ 4:48:17AM: Fetch started (3s ago)
+ 4:48:17AM: Fetching (3s ago)
+ | apiVersion: vendir.k14s.io/v1alpha1
+ | directories:
+ | - contents:
+ .
+ .
+ . | 4:48:47AM: ---- waiting complete [25/25 done] ----
+ | Succeeded
+ 4:48:47AM: Deploy succeeded (3s ago)
+ ```
+
+3. Confirm that the Contour package has been installed and the status is `Reconcile succeeded`.
+
+ ```bash
+ # tanzu package installed get contour -n tanzu-system-ingress
+
+ NAMESPACE: tanzu-system-ingresss
+ NAME: contour
+ PACKAGE-NAME: contour.tanzu.vmware.com
+ PACKAGE-VERSION: 1.23.5+vmware.1-tkg.1
+ STATUS: Reconcile succeeded
+ CONDITIONS: - type: ReconcileSucceeded
+ status: "True"
+ reason: ""
+ message: ""
+ ```
+
+### Install Harbor
+Harbor is an open-source, enterprise-ready container registry system that provides an image repository, image vulnerability scanning, and project administration.
+
+Perform the following procedure to deploy Harbor to Tanzu Kubernetes Grid (TKG) workload clusters deployed to vSphere by a vSphere with Tanzu Supervisor.
+
+1. Create the namespace for Harbor.
+ ```bash
+ kubectl create ns tanzu-system-registry
+ ```
+1. 1. Confirm that the Harbor package is available in the cluster and retrieve the version of the available package.
+
+ ```bash
+ # tanzu package available list harbor.tanzu.vmware.com -A
+
+ NAMESPACE NAME VERSION RELEASED-AT
+ tkg-system harbor.tanzu.vmware.com 2.2.3+vmware.1-tkg.1 2021-07-07 18:00:00 +0000 UTC
+ tkg-system harbor.tanzu.vmware.com 2.2.3+vmware.1-tkg.2 2021-07-07 18:00:00 +0000 UTC
+ tkg-system harbor.tanzu.vmware.com 2.3.3+vmware.1-tkg.1 2021-09-28 06:05:00 +0000 UTC
+ tkg-system harbor.tanzu.vmware.com 2.5.3+vmware.1-tkg.1 2021-09-28 06:05:00 +0000 UTC
+ tkg-system harbor.tanzu.vmware.com 2.6.1+vmware.1-tkg.1 2021-09-28 06:05:00 +0000 UTC
+ tkg-system harbor.tanzu.vmware.com 2.6.3+vmware.1-tkg.1 2021-09-28 06:05:00 +0000 UTC
+ tkg-system harbor.tanzu.vmware.com 2.7.1+vmware.1-tkg.1 2021-09-28 06:05:00 +0000 UTC
+ ```
+
+1. Create a configuration file named `harbor-data-values.yaml` by executing the following commands:
+
+ ```bash
+ image_url=$(kubectl -n tkg-system get packages harbor.tanzu.vmware.com.2.6.3+vmware.1-tkg.1 -o jsonpath='{.spec.template.spec.fetch[0].imgpkgBundle.image}')
+
+ imgpkg pull -b $image_url -o /tmp/harbor-package --registry-ca-cert-path /etc/docker/certs.d/harbor.tanzu.lab/ca.crt
+
+ cp /tmp/harbor-package/config/values.yaml harbor-data-values.yaml
+ ```
+
+ **Note**: Harbor version 2.7.2 has some overlay issues with this specific Tanzu cli version which will be fixed in later version. So Harbor 2.6.3 is used for the demonstration purpose.
+
+1. Set the mandatory passwords and secrets in the `harbor-data-values.yaml` file.
+
+ ```bash
+ bash /tmp/harbor-package/config/scripts/generate-passwords.sh harbor-data-values.yaml
+ ```
+
+1. Edit the `harbor-data-values.yaml` file and configure the values for the following mandatory parameters.
+
+ - hostname
+ - harborAdminPassword
+ - storage class names for databse, jobservice ,redis, registry and trivy config
+ - tls certificate labels
+
+ You can also change the values for other parameters to meet the requirements for your deployment. For the full list of the user-configurable values, see [Install Harbor for Service registry](https://docs.vmware.com/en/VMware-Tanzu-Packages/2023.9.19/tanzu-packages/packages-harbor.html#harbor-configuration-parameters-3).
+
+1. Remove the comments in the `harbor-data-values.yaml` file.
+
+ ```bash
+ yq -i eval '... comments=""' harbor-data-values.yaml
+ ```
+
+1. Install the Harbor package by executing the following command:
+
+ ```bash
+ # tanzu package install harbor --package harbor.tanzu.vmware.com --version 2.6.3+vmware.1-tkg.1 --values-file ./harbor-data-values.yaml --namespace tanzu-system-registry
+
+ 5:40:51AM: Creating service account 'harbor-tanzu-system-registry-sa'
+ 5:40:51AM: Creating cluster admin role 'harbor-tanzu-system-registry-cluster-role'
+ 5:40:51AM: Creating cluster role binding 'harbor-tanzu-system-registry-cluster-rolebinding'
+ 5:40:51AM: Creating secret 'harbor-tanzu-system-registry-values'
+ 5:40:51AM: Creating overlay secrets
+ 5:40:51AM: Creating package install resource
+ 5:40:51AM: Waiting for PackageInstall reconciliation for 'harbor'
+ 5:40:49AM: Fetch started (3s ago)
+ 5:40:49AM: Fetching (3s ago)
+ | apiVersion: vendir.k14s.io/v1alpha1
+ | directories:
+ .
+ .
+ .
+ | 5:42:29AM: ---- applying complete [50/50 done] ----
+ | 5:42:29AM: ---- waiting complete [50/50 done] ----
+ | Succeeded
+ 5:42:29AM: Deploy succeeded (3s ago)
+ ```
+
+7. Confirm that the Harbor package has been installed and the status is `Reconcile succeeded`.
+
+ ```bash
+ # tanzu package installed get harbor -n tanzu-system-registry
+
+ NAMESPACE: tanzu-system-registry
+ NAME: harbor
+ PACKAGE-NAME: harbor.tanzu.vmware.com
+ PACKAGE-VERSION: 2.6.3+vmware.1-tkg.1
+ STATUS: Reconcile succeeded
+ CONDITIONS: - type: ReconcileSucceeded
+ status: "True"
+ reason: ""
+ message: ""
+ ```
+
+
+### Install Prometheus
+
+Prometheus is an open-source systems monitoring and alerting toolkit. It can collect metrics from target clusters at specified intervals, evaluate rule expressions, display the results, and trigger alerts if certain conditions arise. For more information about Prometheus, see the [Prometheus Overview](https://www.prometheus.io/docs/introduction/overview/). The Tanzu Kubernetes Grid implementation of Prometheus includes Alert Manager, which you can configure to notify you when certain events occur.
+
+Complete these steps to install the Prometheus package.
+
+1. Create the namespace.
+ ```bash
+ kubectl create ns tanzu-system-monitoring
+ ```
+1. Get the latest Prometheus package version for your repository.
+ ```bash
+ # tanzu package available list prometheus.tanzu.vmware.com -A
+
+ NAMESPACE NAME VERSION RELEASED-AT
+ tkg-system prometheus.tanzu.vmware.com 2.27.0+vmware.1-tkg.1 2021-05-12 18:00:00 +0000 UTC
+ tkg-system prometheus.tanzu.vmware.com 2.27.0+vmware.2-tkg.1 2021-05-12 18:00:00 +0000 UTC
+ tkg-system prometheus.tanzu.vmware.com 2.36.2+vmware.1-tkg.1 2022-06-23 18:00:00 +0000 UTC
+ tkg-system prometheus.tanzu.vmware.com 2.37.0+vmware.1-tkg.1 2022-10-25 18:00:00 +0000 UTC
+ tkg-system prometheus.tanzu.vmware.com 2.37.0+vmware.2-tkg.1 2022-10-25 18:00:00 +0000 UTC
+ tkg-system prometheus.tanzu.vmware.com 2.37.0+vmware.3-tkg.1 2022-10-25 18:00:00 +0000 UTC
+ ```
+1. Create the `prometheus-data-values.yaml` file by running the below command:
+ ```bash
+ tanzu package available get prometheus.tanzu.vmware.com/2.37.0+vmware.3-tkg.1 --default-values-file-output prometheus-data-values.yaml
+ ```
+1. Edit the `prometheus-data-values.yaml` file and configure the following values. These values are required to access the Prometheus dashboard. For more information, see `Prometheus Data Values` section in [Install Prometheus and Grafana for Monitoring](https://docs.vmware.com/en/VMware-Tanzu-Packages/2023.9.19/tanzu-packages/packages-monitoring.html#prometheus-data-values-2)
+
+ |**Key**|**Default Value**|**Modified value**|
+ | --- | --- | --- |
+ |Ingress.tlsCertificate.tls.crt|Null|
Note: This is optional.
|
+ |ingress.tlsCertificate.tls.key|Null|Cert Key provided in Input file.
Note: This is optional.
|
+ |ingress.enabled|false|true|
+ |ingress.virtual_host_fqdn|prometheus.system.tanzu|prometheus.your-domain|
+ |alertmanager.pvc.storageClassName|default|vsan-default-storage-policy|
+
+1. Install the Prometheus package by running the command:
+ ```bash
+ # tanzu package install prometheus -p prometheus.tanzu.vmware.com -v 2.37.0+vmware.3-tkg.1 --values-file prometheus-data-values.yaml -n tanzu-system-monitoring
+ ```
+1. If the tanzu package install prometheus operation returns the error `Failed to get final advertise address: No private IP address found, and explicit IP not provided` apply a package overlay to reconfigure the alertmanager component.
+ - Create the file `overlay-alertmanager.yaml`.
+ ```bash
+ ---
+ #@ load("@ytt:overlay", "overlay")
+
+ #@overlay/match by=overlay.and_op(overlay.subset({"kind": "Deployment"}), overlay.subset({"metadata": {"name": "alertmanager"}}))
+ ---
+ spec:
+ template:
+ spec:
+ containers:
+ #@overlay/match by="name",expects="0+"
+ - name: alertmanager
+ args:
+ - --cluster.listen-address=
+ ```
+ - Use Kubectl to create a secret from the file `overlay-alertmanager.yaml`.
+ ```bash
+ # kubectl create secret generic alertmanager-overlay -n tanzu-system-monitoring -o yaml --dry-run=client --from-file=overlay-alertmanager.yaml | kubectl apply -f -
+ secret/alertmanager-overlay created
+ ```
+ - Use Kubectl to annotate the Prometheus package with the overlay secret.
+ ```bash
+ # kubectl annotate PackageInstall prometheus -n tanzu-system-monitoring ext.packaging.carvel.dev/ytt-paths-from-secret-name.1=alertmanager-overlay
+ packageinstall.packaging.carvel.dev/prometheus annotated
+ ```
+1. Run the Prometheus installation command again:
+ ```bash
+ # tanzu package install prometheus -p prometheus.tanzu.vmware.com -v 2.37.0+vmware.3-tkg.1 --values-file prometheus-data-values.yaml -n tanzu-system-monitoring
+
+ 5:00:53AM: Pausing reconciliation for package installation 'prometheus' in namespace 'tanzu-system-monitoring'
+ 5:02:32AM: Updating secret 'prometheus-tanzu-system-monitoring-values'
+ 5:02:32AM: Creating overlay secrets
+ 5:02:32AM: Resuming reconciliation for package installation 'prometheus' in namespace 'tanzu-system-monitoring'
+ 5:02:32AM: Waiting for PackageInstall reconciliation for 'prometheus'
+ 5:02:32AM: Waiting for generation 4 to be observed
+ 5:02:30AM: Fetch started (3s ago)
+ 5:02:30AM: Fetching (3s ago)
+ | apiVersion: vendir.k14s.io/v1alpha1
+ | directories:
+ .
+ .
+ | 5:03:20AM: ok: reconcile deployment/alertmanager (apps/v1) namespace: tanzu-system-monitoring
+ | 5:03:20AM: ---- applying complete [3/3 done] ----
+ | 5:03:20AM: ---- waiting complete [3/3 done] ----
+ | Succeeded
+ 5:03:21AM: Deploy succeeded (2s ago)
+ ```
+1. Verify Prometheus installation using the Tanzu CLI.
+ ```bash
+ # tanzu package installed get prometheus -n tanzu-system-monitoring
+
+ NAMESPACE: tanzu-system-monitoring
+ NAME: prometheus
+ PACKAGE-NAME: prometheus.tanzu.vmware.com
+ PACKAGE-VERSION: 2.37.0+vmware.3-tkg.1
+ STATUS: Reconcile succeeded
+ OVERLAY-SECRETS: - alertmanager-overlay
+ CONDITIONS: - type: ReconcileSucceeded
+ status: "True"
+ reason: ""
+ message: ""
+ ```
+
+### Install Grafana
+
+[Grafana](https://grafana.com/) allows you to query, visualize, alert on, and explore metrics irrespective of their storage location. Grafana provides tools to form graphs and visualizations from application data.
+
+> **Note** Grafana is configured with Prometheus as a default data source. If you have customized the Prometheus deployment namespace and it is not deployed in the default namespace, `tanzu-system-monitoring`, you need to change the Grafana data source configuration in the following code.
+
+Complete these steps to install the Grafana package.
+
+1. Create the namespace for Grafana.
+ ```bash
+ # kubectl create ns tanzu-system-dashboards
+ namespace/tanzu-system-dashboards created
+ ```
+1. Get the latest Grafana package version for your repo.
+ ```bash
+ # tanzu package available list grafana.tanzu.vmware.com -A
+
+ NAMESPACE NAME VERSION RELEASED-AT
+ tkg-system grafana.tanzu.vmware.com 7.5.16+vmware.1-tkg.1 2022-05-19 18:00:00 +0000 UTC
+ tkg-system grafana.tanzu.vmware.com 7.5.16+vmware.1-tkg.2 2022-05-19 18:00:00 +0000 UTC
+ tkg-system grafana.tanzu.vmware.com 7.5.17+vmware.1-tkg.1 2022-05-19 18:00:00 +0000 UTC
+ tkg-system grafana.tanzu.vmware.com 7.5.17+vmware.2-tkg.1 2022-05-19 18:00:00 +0000 UTC
+ tkg-system grafana.tanzu.vmware.com 7.5.7+vmware.1-tkg.1 2021-05-19 18:00:00 +0000 UTC
+ tkg-system grafana.tanzu.vmware.com 7.5.7+vmware.2-tkg.1 2021-05-19 18:00:00 +0000 UTC
+ ```
+1. Generate a `grafana-default-values.yaml` file by running the command:
+ ```bash
+ # tanzu package available get grafana.tanzu.vmware.com/7.5.17+vmware.2-tkg.1 --default-values-file-output grafana-data-values.yaml
+
+ Created default values file at grafana-data-values.yaml
+ ```
+1. Edit the grafana-data-values.yaml file and update the values as needed.
+ > **Note**: To avoid a common error, remove the secret from the data values file and manually create the secret. See [Secret not created when installing Grafana from default YAML file](https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/2.3/using-tkg/workload-troubleshoot-index.html#TKG-16132) in Troubleshooting Workload Cluster Issues.
+ ```bash
+ # kubectl create secret generic grafana -n tanzu-system-dashboards --from-literal=admin=admin
+ secret/grafana created
+ ```
+
+1. Here is a minimal grafandata-values.yaml used for this deployment. For more information on Grafana variables, see see `Grafana Data Values` section in [Install Prometheus and Grafana for Monitoring](https://docs.vmware.com/en/VMware-Tanzu-Packages/2023.9.19/tanzu-packages/packages-monitoring.html#config-grafana)
+
+ ```yaml
+ # grafana:
+ # deployment:
+ # replicas: 1
+ # updateStrategy: Recreate
+ # pvc:
+ # accessMode: ReadWriteOnce
+ # storage: 2Gi
+ # secret:
+ # admin_password: admin
+ # admin_user: admin
+ # type: Opaque
+ # service:
+ # port: 80
+ # targetPort: 3000
+ # type: LoadBalancer
+ # ingress:
+ # enabled: true
+ # prefix: /
+ # servicePort: 80
+ # virtual_host_fqdn: grafana.sfo01.rainpole.vmw
+ # namespace: grafana
+ ```
+1. Install the Grafana package using the Tanzu CLI.
+ ```bash
+ # tanzu package install grafana -p grafana.tanzu.vmware.com -v 7.5.17+vmware.2-tkg.1 --values-file grafana-data-values.yaml -n tanzu-system-dashboards
+
+ 5:08:39AM: Creating service account 'grafana-tanzu-system-dashboards-sa'
+ 5:08:39AM: Creating cluster admin role 'grafana-tanzu-system-dashboards-cluster-role'
+ 5:08:39AM: Creating cluster role binding 'grafana-tanzu-system-dashboards-cluster-rolebinding'
+ 5:08:39AM: Creating secret 'grafana-tanzu-system-dashboards-values'
+ 5:08:39AM: Creating overlay secrets
+ 5:08:39AM: Creating package install resource
+ 5:08:39AM: Waiting for PackageInstall reconciliation for 'grafana'
+ 5:08:37AM: Fetch started (3s ago)
+ 5:08:38AM: Fetching (2s ago)
+ | apiVersion: vendir.k14s.io/v1alpha1
+ | directories:
+ .
+ .
+ .
+ | 5:09:32AM: ---- waiting complete [19/19 done] ----
+ | Succeeded
+ 5:09:32AM: Deploy succeeded (2s ago)
+ ```
+
+1. Verify Grafana installation using the Tanzu CLI.
+ ```bash
+ # tanzu package installed get grafana -n tanzu-system-dashboards
+
+ NAMESPACE: tanzu-system-dashboards
+ NAME: grafana
+ PACKAGE-NAME: grafana.tanzu.vmware.com
+ PACKAGE-VERSION: 7.5.17+vmware.2-tkg.1
+ STATUS: Reconcile succeeded
+ CONDITIONS: - type: ReconcileSucceeded
+ status: "True"
+ reason: ""
+ message: ""
+ ```