Supervisor Cluster fails to register with Tanzu Mission Control Self-Managed with "domain name verification failed"

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

When attempting to register a vSphere Supervisor Cluster with a Tanzu Mission Control (TMC) Self-Managed instance, the registration process fails and the cluster remains in a "Pending" or "Failed" state in the TMC console.

Checking the logs of the installer pod on the Supervisor Cluster reveals the following error: # kubectl -n svc-tmc-c<org-id> logs pod/tmc-agent-installer-<suffix> "error":"download and apply registration link, attempt: #: registration link domain name verification failed", "extension":"tmc-agent-installer"

Cause

The primary cause is a missing or incomplete AgentConfig Custom Resource (CR) on the Supervisor Cluster.

In Tanzu Mission Control Self-Managed, the AgentConfig CR is responsible for providing the caBundle required for the cluster to verify the identity of the TMC domain. Without this resource, the tmc-agent-installer cannot validate the TLS certificate presented by the TMC endpoint, leading to the "domain name verification failed" error and a termination of the registration handshake.

Resolution

To resolve this issue, you must manually provide the TMC certificate to the Supervisor and reset the registration state.

Step 1. Extract the TMC Self-Managed Certificate

Retrieve the public CA certificate from your TMC Self-Managed URL. You can use a browser or openssl:

openssl s_client -connect <TMC_SM_FQDN>:443 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM > tmc-sm.crt

Step 2. Create the AgentConfig Custom Resource

Create the AgentConfig CR on the Supervisor Cluster, ensuring the caBundle field contains the string of the certificate retrieved in Step 1: 

• Follow the official documentation for Complete the Registration of a Supervisor

Step 3. Clean Up Stale Registration State

If the UI shows a hung registration, manually remove the existing agent install components to ensure a clean retry:

• Follow the official documentation for Manually Removing the Cluster Agent from a Supervisor.

Step 4. Re-initiate Registration

Navigate back to the TMC Self-Managed console for the link and follow the standard workflow to Register Tanzu Mission Control with Supervisor.