Failed to enable VKS, Error message: context deadline exceeded

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

1) The following error message appears when  enabling VKS :

 

2)  KB 392483  doesn't help,  the connectivity between Esxi host and vCenter is OK

3) /etc/init.d/spherelet status show "is not running", if we start it , this service will stop automatically in a couple of seconds.

4) In spherelet.log,   error message is found:

msg="nodes \"<ESXi_Hostname>\" is forbidden: node \"localhost\" is not allowed to modify node \"<ESXi_Hostname>\""

Environment

vCenter 8.x

vCenter 9.0

 

Cause

FQDN and IP address are not included in /etc/hosts

And the certificate of spherelet is for 'localhost' , not for the FQDN:

cat  /etc/vmware/spherelet/client.crt  | openssl x509 -text -noout | grep CN | grep Subject

      Subject:   C = US,  ST = CA,  L =  Palo Alto,  O = system:nodes,   CN = system:node:localhost

   

Resolution

1) Edit /etc/hosts,  ensure there is a row about the Esxi FQDN and IP address 

2) Make the Esxi host enter maintainence mode, then disconnect it from vCenter, then re-connect the Esxi host.

It will regenerate the certificate of spherelet.

Ensure the CN in new certificate is about FQDN, not about 'localhost'

 

cat  /etc/vmware/spherelet/client.crt  | openssl x509 -text -noout | grep CN