Supervisor Service upgrade stuck with the error admission webhook ""validation.extensionconfig.runtime.cluster.x-k8s.io"" denied the request

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

When installing VKS or upgrading from an older version, you may face an intermittent runtime extension kapp package issue where the Supervisor Service upgrade may get stuck in an error state for ~30 minutes.

The detailed error message is,

“Reason: ReconcileFailed. Message: kapp: Error: waiting on reconcile packageinstall/runtime-extension (packaging.carvel.dev/v1alpha1) namespace: svc-tkg-domain-c8: Finished unsuccessfully (Reconcile failed: (message: kapp: Error: create extensionconfig/runtime-extension (runtime.cluster.x-k8s.io/v1alpha1) cluster: Creating resource extensionconfig/runtime-extension (runtime.cluster.x-k8s.io/v1alpha1) cluster: API server says: admission webhook ""validation.extensionconfig.runtime.cluster.x-k8s.io"" denied the request: spec: Forbidden: can be set only if the RuntimeSDK feature flag is enabled (reason: Forbidden))).”

Environment

vSphere Kubernetes Service 3.2+

vSphere with Tanzu

Resolution

The error is transient in nature and after some time, the kapp package will reconcile successfully and the installation/upgrade will complete.