When creating a TKC cluster, for the ControlPlane node to finish to be provisioned, the following connectivity must be enabled:
The purpose of this article is to verify that the above connectivity is enabled and there's nothing blocking it.
TKC cluster creation gets stuck with ControlPlane nodes in Provisioned state and Worker nodes in Pending state.
ControlPlane node gets an IP address assigned but the cluster creation doesn't progress.
The reason why the TKC ControlPlane node got stuck in Provisioned and never progressed to Running state is because the connectivity between TKC ControlPlane node and TKC cluster endpoint was blocked by a firewall.
To test the connectivity between the Supervisor nodes, the TKC ControlPlane nodes and the endpoints:
The endpoints can be obtained as:
To login to the Supervisor node https://kb.vmware.com/s/article/90194 "How to SSH into Supervisor Control Plane VMs" can be followed.
To login to TKC ControlPlane node https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-37DC1DF2-119B-4E9E-8CA6-C194F39DDEDA.html can be followed.
The expected output is to get Unauthorized and Forbidden responses for each of the curl commands, meaning the Endpoints are reachable.
E.g.:
{
"kind": "Status",
"apiVersion": "v1",
"metadata": {},
"status": "Failure",
"message": "forbidden: User \"system:anonymous\" cannot get path \"/\"",
"reason": "Forbidden",
"details": {},
"code": 403
}
If any of the above curl commands times out, that may mean there's something blocking the connectivity and thus preventing the TKC cluster from being successfully created.
Connectivity checks don't have any impacts.