A workload/guest cluster is stuck when attempting to upgrade from version 1.31 to 1.32

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

When attempting to upgrade a VKS workload/guest cluster from VKr version 1.31 to 1.32 by editing the Cluster resource, the following error message may be received:

• error: clusters.cluster.x-k8s.io "<cluser_name>" could not be patched: admission webhook "capi.validating.tanzukubernetescluster.run.tanzu.vmware.com" denied the request: User sso:<SSO_user_account> cannot change resources owned by TanzuKubernetesCluster

Environment

• vSphere 8.x

Cause

The affected workload/guest cluster cannot be upgraded to 1.32 by updating the Cluster resource, because the cluster is still managed by the TKC resource. 

Resolution

The workload/guest cluster will need to be upgraded by editing the TKC resource of the cluster:

• kubectl edit tkc <cluster_name> -n <namespace_name>

Additional Information

• The TKC API is deprecated, and will need to be "retired" in order to transition to using the Cluster API.
• Additional information on retiring the TKC resource can be found in the following blog post and documentation:
  • Embracing Open Standards: Transitioning vSphere Kubernetes Clusters to native Cluster API
  • Retire TanzuKubernetesCluster Resources

• Japanese version: ワークロード（ゲスト）クラスタが バージョン 1.31 から 1.32 へのアップグレードを試行中に停止（スタック）している状態です。