CNF130005 Grant request failed: "Unauthorized" during CNF instantiation

Products

• VMware Telco Cloud Automation
• VMware Telco Cloud Platform

Issue/Introduction

The TCA UI displays the error: Grant request failed: Error loading Kubernetes API resources: : Unauthorized (CNF130005).

Review of the app-engine.log on the TCA Control Plane (TCA-CP) shows a 401 Unauthorized response when querying the Kubernetes API server for the workload cluster.

Environment

TCA build : 3.2
TCP : 5.0

Cause

The kubeconfig used by TCA to communicate with the Workload Cluster is out of sync leading to a 401 Unauthorized response from the Kubernetes API server.

Resolution

To resolve the issue, follow the Synchronize the kubeconfig steps from Broadcom KB 402659

To bypass the Unauthorized (CNF130005) error and allow the instantiation to proceed, you can disable the Grant Request validation feature. This feature performs a pre-instantiation check against the Kubernetes API to ensure resource availability and policy compliance. Disabling it stops the immediate authentication failure from blocking the deployment.

Steps to Disable Grant Request:

1. Log in to the VMware Telco Cloud Automation UI.
2. Navigate to Inventory --> Network function
3. Locate the specific CNF package and click the Options (three dots) icon next to the CNF name.
4. Select Instantiate.
5. In the Inventory Detail tab, scroll down to the Advanced Settings section.
6. Locate the Grant Validation drop-down menu and select Disable.
   Note: This setting ensures that TCA does not run validation or feasibility checks (such as resource dry-runs) for the target Kubernetes cluster, bypassing the current authentication failure.
7. Complete the remaining instantiation wizard steps.
   

   Note: While this workaround allows the instantiation to complete, the underlying authentication or resource validation issue remains.

Additional Information

Note: Please contact your CNF Vendor and make sure that they validate their Helm charts and instantiation workflows with the Broadcom Partner Engineering team.

Compliance Check: The vendor must ensure the CNF is fully compliant with VMware Telco Cloud standards, specifically regarding OCI chart structure and RBAC requirements for the Grant phase.

The issue can also be caused by any of the following reason: 

• Expired or invalid Kubernetes credentials-- ServiceAccount token expired
• RBAC misconfiguration--Missing ClusterRole / RoleBinding, Read access to required resources denied
• Certificate or trust issue-- CA rotation not reflected in Hybridity / NFV system
• Wrong Kubernetes context-- Placement attempting to access wrong cluster endpoint
• Credential drift after cluster upgrade-- Kubernetes upgraded but NFV Placement credentials not refreshed