clusterbuilders show UPTODATE as False

Products

• VMware Tanzu Application Platform

Issue/Introduction

After updating the "clusterbuildpacks" in the cluster, the "clusterbuilders" show UPTODATE as "False".

$ kubectl get clusterbuilders
NAME         LATESTIMAGE                                                                        READY   UPTODATE
base-jammy   harbor.example.com/tap/buildservice:base-jammy-builder@sha256:xxxxxxxxxxxxxxxxxx   True    False
default      harbor.example.com/tap/buildservice:default-builder@sha256:xxxxxxxxxxxxxxxxxx      True    False
full-jammy   harbor.example.com/tap/buildservice:full-jammy-builder@sha256:xxxxxxxxxxxxxxxxxx   True    False
tiny-jammy   harbor.example.com/tap/buildservice:tiny-jammy-builder@sha256:xxxxxxxxxxxxxxxxxx   True    False

The "conditions" in the output of a "kubectl describe" on a clusterbuilder shows the following which indicates that the corresponding "clusterstack" is not ready.

  conditions:
  - lastTransitionTime: "2025-07-29T07:26:34Z"
    status: "True"
    type: Ready
  - lastTransitionTime: "2025-07-29T07:26:34Z"
    message: stack base-jammy is not ready
    reason: ReconcileFailed
    status: "False"
    type: UpToDate

The "conditions" in the output of a "kubectl describe" on the corresponding "clusterstack" shows the following, which indicates that the token (being used to download artifacts from Broadcom) has expired already.

  Conditions:
    Last Transition Time:  2025-07-09T05:02:14Z
    Message:               GET https://tanzu-build.packages.broadcom.com/artifactory/api/docker/tanzu-build/v2/token?scope=repository:build-service-dependency-updater/package-repo:pull&service=tanzu-build.packages.broadcom.com: : Token failed verification: expired
    Status:                False
    Type:                  Ready

Environment

Tanzu Application Platform 1.12.x

Cause

Expired token was being used to connect to Broadcom server (tanzu-build.packages.broadcom.com).

Resolution

Get a new token as per the step "Retrieve your Broadcom registry API Token".

Edit the secret named "tap-registry" in the "tap-install" namespace to update the API Token with the new unexpired one.