WCP Cluster Pods in CrashLoopBackOff (CLBO) state and receiving 403 error from NCP

Products

• VMware vSphere Kubernetes Service
• VMware NSX

Issue/Introduction

• WCP Cluster go in to CrashLoopBackOff (CLBO) state
• You may see the following errors in the NSX Manager log file /var/log/proxy/reverse-proxy.log

2025-10-13T16:32:36.496Z ERROR Processing request ########-####-####-####-########265e VcAuthTokenInterceptingFilter 2902 - [nsx@6876 comp="nsx-manager" errorCode="MP403" level="ERROR" subcomp="http"] Failed to Authenticate: Token has been issued in the future: ##########
2025-10-13T16:32:36.497Z ERROR Processing request ########-####-####-####-########265e NsxRestAuthenticationEntryPoint 2902 - [nsx@6876 comp="nsx-manager" errorCode="MP403" level="ERROR" subcomp="http"] The credentials were incorrect or the account specified has been locked.

• Running the command "kubectl logs <ncp-pod-name>" you may see the following error 
   [ncp MainThread W] vmware_nsxlib.v3.cluster [############] Request failed due to: The credentials were incorrect or the account specified has been locked.

 

Environment

VMware NSX 
VMware vSphere Kubernetes Service

Cause

The time difference observed between the NSX Manger nodes and the vCenter appliance must be within 60 seconds to communicate without issue.

Resolution

This is a condition that may occur in a VMware NSX environment.

Workaround: 
Correct the time difference. It is recommended to configure NTP servers on appliances. 

Additional Information

Configuring NTP on Appliances and Transport Nodes