Supervisor cluster stuck in "Configuring" state with error "failed to get VC Category wp_vmvmaa_category"

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• The Workload Management dashboard shows the Supervisor Cluster status as "Configuring" indefinitely.
  
  
• The below error message in seen in the vSphere UI.
  
  Configured Control Plane VMs
A general system error occurred. Error message: failed to get VC Category wp_vmvmaa_category. Err failed to create VC Category wp_vmvmaa_category. Err POST http://localhost:1080/rest/com/vmware/cis/tagging/category: 401 Unauthorized.
A general system error occurred. Error message: GET http://localhost:1080/rest/com/vmware/content/library: 401 Unauthorized.


• The below log entries can be seen in /var/log/vmware/wcp/wcpsvc.log of the vCenter Server.
  
  error wcp [kubelifecycle/controller.go:] [opID=<ID>] Error occurred while fetching content library <Content-Library-UUID>. Err: GET http://localhost:1080/rest/com/vmware/content/library: 401 Unauthorized
error wcp [kubelifecycle/controller.go:] [opID=<ID>] Error occurred when reconciling Kubernetes Service Content Library GET http://localhost:1080/rest/com/vmware/content/library: 401 Unauthorized

Environment

VMware vSphere Kubernetes Service

Cause

This issue occurs due to an authentication failure (HTTP 401 Unauthorized) between the Workload Control Plane (WCP) service and the vCenter Single Sign-On (SSO) or the REST API gateway.

The WCP service uses an internal session to communicate with the Tagging and Content Library services to create the necessary metadata categories (like wp_vmvmaa_category) and retrieve OVF templates. If the security token becomes invalid or the session cache in the local API gateway (localhost:1080) becomes stale, WCP is unable to authorize these requests. This causes the configuration workflow to stall.

Resolution

Restart the wcp and vmware-content-library services to force a session re-authentication.To complete the same,

1. Log in to the vCenter Server via SSH as root.
   
   
2. Restart the Workload Control Plane (WCP) service as below.
   
   service-control --restart wcp


3. Restart the Content Library service as below.
   
   service-control --restart vmware-content-library


4. (Optional) If the issue persists, restart the vAPI Endpoint service to clear the REST API gateway cache.
   
   service-control --restart vapi-endpoint


5. Monitor the wcpsvc.log to confirm the 401 errors have ceased.
   
   tail -f /var/log/vmware/wcp/wcpsvc.log | grep -i "Unauthorized"

In the vSphere Client, navigate to Workload Management and observe if the Supervisor Cluster transitions from "Configuring" to "Running".