将现有基于 VMware Enterprise PKS 的 CI/CD 流水线平滑迁移到 Tanzu Kubernetes Grid (TKG)，关键在于“分层解耦、渐进替换、能力对齐、验证闭环”。PKS 与 TKG 虽同源（均基于 BOSH/Kubernetes），但架构演进显著：PKS 是 Pivotal 主导的封闭式发行版，而 TKG 是 VMware 统一的、面向多云/边缘的现代化 Kubernetes 发行版，深度集成 Tanzu Mission Control（TMC）、Cluster API 和 Tanzu Developer Portal。

以下是可落地的迁移路径（含实操要点与避坑指南）：

✅ 一、迁移前评估与准备（1–2 周）

🔍 工具检查清单：

• 升级 tanzu CLI 至 v2.6+（下载地址）
• 确认目标 vSphere/vCenter 版本 ≥ 7.0 U3（TKG 2.4+ 最低要求）
• 备份 PKS BOSH Director DB 与 Harbor 数据库（用于审计追溯）

✅ 二、分阶段迁移策略（推荐 3 阶段）

▶ 阶段 1：并行运行 & 配置同步（PoC）

• 在同一 vSphere 环境中，用 tanzu cluster create 部署一个小型 dev-tkg-cluster（与原 PKS dev 集群同规格）；
• 复用原有 CI/CD 流水线脚本，仅修改认证与上下文切换逻辑：
• 将一个非核心服务（如内部文档站点）部署到 TKG 集群，验证构建→推送→部署→健康检查全链路。

▶ 阶段 2：流水线双轨制 & 自动化适配（灰度）

• 在 GitLab CI 或 Jenkins Pipeline 中引入 if $CI_ENV == "tkg" 分支逻辑；
• 使用 Tanzu Package Repository 替代 PKS Add-on 管理（如 Ingress、Cert-Manager、Prometheus）：
• 启用 Tanzu Mission Control（TMC）策略同步：将 PKS 中的 PSP/OPA 策略导出为 YAML，导入 TMC 的 “Cluster Profiles” 并自动绑定至 TKG 集群。

▶ 阶段 3：下线 PKS & 切流（Go-Live）

• 执行 pks delete-cluster 前，确保所有应用已 100% 迁移，并完成以下验证：
  ✅ TKG 集群 etcd 备份恢复演练（使用 Velero + MinIO/S3）
  ✅ 所有 CI/CD 触发器（Webhook/Tag Push）指向新 TKG 上下文
  ✅ 审计日志比对：TMC Audit Log vs PKS BOSH Task Log（确认权限变更无遗漏）
• 一键清理残留（可选）：

✅ 三、关键注意事项（避坑指南）

✅ 四、验证清单（上线前必检）

• 所有 CI/CD Job 日志中不再出现 pks 命令报错
• tanzu cluster list --include-management-cluster 显示集群状态 running 且 K8s Version 一致
• kubectl get pods -A 中 tkg-system, cert-manager, contour 命名空间全部 Running
• 任一服务通过 Ingress 访问正常，且 TLS 证书由 cert-manager 自动签发（kubectl get certificate）
• TMC 中该集群显示 “Compliant” 状态，且策略违规数 = 0

💡 Bonus：自动化迁移脚本片段（Bash）

VMware Enterprise PKS（Pivotal Container Service）是一个企业级 Kubernetes 运行时平台，专为敏捷开发与云原生应用交付而优化。构建面向敏捷开发的全面基础，需围绕自动化、可重复性、安全合规、持续交付与跨团队协作五大支柱展开。以下是关键实践路径：

✅ 1. 基础架构即代码（IaC）与声明式集群管理

• 使用 BOSH + PKS CLI 或 Tanzu Mission Control（TMC）统一纳管多云/混合云 Kubernetes 集群；
• 通过 YAML 模板定义集群配置（如 worker node 数量、网络策略、存储类），实现“一键部署+版本化管控”；
• 集成 GitOps 工具（如 Flux 或 Argo CD）实现集群状态与 Git 仓库的自动同步，支撑敏捷迭代中的环境一致性。

✅ 2. 敏捷 CI/CD 流水线深度集成

• 在 Jenkins/GitLab CI/Tekton 中嵌入 PKS API 调用：自动创建命名空间、配额、RBAC 角色；
• 利用 PKS 内置 Harbor 镜像仓库 + Clair 扫描，实现镜像构建→漏洞扫描→签名→推送→部署的闭环；
• 支持蓝绿/金丝雀发布（借助 Istio 或 Contour Ingress），配合 Prometheus + Grafana 实现发布过程可观测性，加速反馈闭环。

✅ 3. 开发者自助服务门户（Dev Self-Service）

• 基于 Tanzu Developer Portal（原 Lightbend Console）或自建 UI，提供“申请命名空间”“一键部署示例应用”“查看日志/指标”等低代码能力；
• 结合 RBAC + OPA（Open Policy Agent）策略引擎，实现细粒度权限控制（如：前端组仅能访问 frontend-* 命名空间，且禁止 exec 权限）。

✅ 4. 安全与合规内建（Shift-Left Security）

• PKS 默认启用 PodSecurityPolicy（PSP）或 Pod Security Admission（PSA）；
• 集成 VMware Carbon Black 或 Sysdig Secure 实现运行时威胁检测；
• 通过 PKS 的 NSX-T CNI 插件启用微隔离（micro-segmentation），按服务网格策略限制东西向流量。

✅ 5. 敏捷赋能与组织协同

• 推行“Platform Engineering Team”模式：专职维护 PKS 平台层（含升级、备份、灾备），使应用团队专注业务逻辑；
• 提供标准化 Helm Charts 库（含 Spring Boot、Node.js 等语言运行时模板）+ Concourse Pipeline 模板，降低新项目启动门槛；
• 结合 Jira + TMC 的审计日志，实现需求→部署→资源消耗的端到端追溯。

⚠️ 注意：VMware Enterprise PKS 已于 2023 年正式并入 VMware Tanzu Kubernetes Grid (TKG) 生态。当前推荐采用 TKG + Tanzu Mission Control + Tanzu Developer Portal 构建新一代敏捷平台基座，以获得长期支持与云原生演进能力。

Building a comprehensive foundation for agile development with VMware Enterprise PKS
Pivotal is now part of VMware, so some of these products and services are now part of VMware Tanzu. Learn more

The famous Hong Kong jewelry brand Chow Sang Sang gets its name from the Chinese classic philosophy text, Book of Changes. It means “everything is repeated, and life is endless.” Chow Sang Sang is passionate about jewelry, insisting not only on excellent quality, but also on instilling innovation and creativity. Over the past 80 years, Chow Sang Sang has made many breakthrough achievements, becoming the first jewelry company listed on the Hong Kong Stock Exchange (1973); the first jewelry brand to launch the Hello Kitty boutique Series (1997); and the first Hong Kong jewelry company to establish a brand website and online store (2001).

Online sales channels are critical to Chow Sang Sang. The company actively participates in e-commerce platforms such as Tmall and Jingdong. In 2017, its online sales continued to grow, reaching 14% of mainland sales. In 2018, Chow Sang Sang began promoting digital transformation, teaming with Pivotal to build a comprehensive foundation for agile development by adopting the latest VMware Enterprise PKS. Chow Sang Sang intends for the PKS containerised infrastructure to support physical stores and networks.

“Chow Sang Sang’s digital transformation and cooperation with Pivotal is a milestone,” said Donald Mak, CIO of Chow Sang Sang. The company developed its website using SAP Hybris’s standalone architecture 10 years ago, and recently, after almost a year, decided to implement their IT transformation plans. The Chow Sang Sang team constantly thinks about how to implement IT transformation. For the business transformation, IT capabilities are the core driver. Therefore, Chow Sang Sang works with Pivotal, VMware, and Dell to establish a private cloud platform and seamlessly connect with the public cloud. With this, DevOps automation is realised, from software development to operation, and they can now fully automate and catch up with business transformation with agile IT.
Photos by Chow Sang Sang
The challenge of digital transformation

Consumers are becoming savvier, mainly because of the existence of e-commerce channels. Mak explained that Chow Sang Sang began to actively enter the channels of Tmall, JD.com, and Vipshop 10 years ago. Sales achieved rapid growth, but it also brought challenges to offline channels. Since consumers can easily obtain product and price information from different e-commerce channels through mobile phones, they especially like to browse products online, go to physical stores to see products, listen to salespeople, and then go back to online channels to buy products. As a result, the salesperson who led the physical store did not have the motivation to attend to such customers.

By integrating the physical store sales process, tracking online sales results, and calculating the offline store contribution rate in a sales process, offline stores can also share online sales results, which is part of the new omnichannel concept proposed by Chow Sang Sang.

Mak believes that omnichannel coverage goes beyond integrating the physical stores with online stores. Rather, true omnichannel coverage requires the company’s IT to be more agile and deliver business changes. Also, e-commerce partners are in a state of rapid change. For example, JD’s unbounded retail also requires the cooperation of physical stores, and Chow Sang Sang’s IT becomes more agile. On Chow Sang Sang’s official website, you can also achieve the “Monthly Money,” part of the internal CRM system. These internal- and external-facing systems need to integrate, but remain loosely coupled to avoid painful upgrade processes. Therefore, the ever-changing business and IT needs of shopping, online stores, and CRM systems require a microservices architecture. This is the main reason for choosing PKS, and seamlessly opening the private cloud through the PKS and Pivotal BOSH platform. With the public cloud platform, it connects its business system with the e-commerce business system to meet the rapidly changing needs of the business.

“All-channel” IT platform

Chow Sang Sang is building a new generation of omnichannel sales of physical and online stores, which correspondingly requires the company’s IT to become an “all-channel” platform to achieve agile IT and support agile business. Because it used to be a standalone system, Chow Sang Sang also needs to establish a full cloud architecture, including splitting a large Oracle library into an independently expandable, distributed database.

Pivotal provides a modern agile development process and a cloud native platform that can be deployed on every major private and public cloud. In addition, Pivotal’s cloud native platform supports the full application lifecycle from development to testing to production. In addition to the cloud native PaaS Pivotal Platform, it also provides data platform solutions: Greenplum and GemFire. In the agile IT architecture, containers are an indispensable technology and an important foundation for modern microservices. Pivotal Platform also offers PKS, an enterprise-grade Kubernetes-based solution for running containerized workloads. Pivotal services like Greenplum also ship in a containerised version to run on PKS.

PKS is a collaboration between Pivotal and VMware, and is based on open-source Kubernetes container orchestration technology, a project started at Google. For Chow Sang Sang, the biggest benefit of PKS is that it can be seamlessly integrated with VMware software, allowing the company to use VMware’s unified SDDC infrastructure for containers. To ensure maximum portability, PKS adds support for the latest version of Kubernetes in parallel with the major public clouds.

“Kubernetes itself is more complex and there are still many challenges deploying and operating the open-source version,” said James Tso, Chief Strategy Officer at Masterson, Chow Sang Sang’s IT partner in Hong Kong.

PKS addresses many of these problems by providing a simplified installation experience and automated Day 2 operational experience (especially with VMware and Google), providing zero-downtime upgrades. Through a PKS integration platform, you can achieve DevOps without spending too much time and effort on development and operations management. For the new version of Kubernetes, production system downtime is not required for updates.

PKS operates open-source Kubernetes on top of Pivotal Platform BOSH, a platform for infrastructure configuration and automation. BOSH abstracts away the complexities of operating across multiple different private and public cloud infrastructures. In addition to GCP, PKS is compatible with AWS, Alibaba Cloud, and other public cloud resources and hybrid clouds based on OpenStack and VMware vSphere. BOSH solves the automated management of cloud resources for container applications and the automated operation and maintenance of Kubernetes clusters in production environments.

Chow Sang Sang’s next-generation IT system is based on VMware SDDC’s private cloud software and Dell EMC hardware-enabled, cloud-based private cloud, the Pivotal Ready Architecture (PRA). PRA hosts the PKS container management platform, a complete cloud solution based on Dell Technologies. This provides Chow Sang Sang with the “all-channel” IT resources that have laid a good foundation for Chow Sang Sang’s next digital transformation.

On the road to agile

Mak noted that Chow Sang Sang has three DevOps teams in mainland China, Hong Kong, and Taiwan. Under the premise of rapid business changes, Chow Sang Sang needs to execute simultaneous software development using the three teams. Each team should independently develop different parts of the application. Chow Sang Sang has been working with Masterson and Pivotal since May 2018. Using the complete Pivotal Platform and agile methodology, adding automated CI/CD automation will build the foundation of agile development.

In addition to PKS, Chow Sang Sang’s current agile development mainly uses Spring Boot and Spring Cloud, an open-source development operation and maintenance framework based on microservices. Pivotal is the leader of the Spring Cloud open-source community and also offers Spring Cloud business solutions. The cooperation between Chow Sang Sang and Pivotal has more room for innovation.

Mak stressed that the core of Chow Sang Sang’s digital transformation is data-driven decision making. The all-cloud platform and agile development will support the “all-channel” transformation of Chow Sang Sang’s business and use data analysis to achieve more refined operations for the company.

“To launch a new business, we must have the support of IT systems. Double 11, smart stores, etc., need to be implemented quickly. IT is involved more and more in the business, promotion, and conversion,” Mak said. “Chow Sang Sang has changed from a technical level to an innovation-driven company.”