Error "Reconcile failed" for auto-attach package during VCFA installation of VKS cluster

Products

• VMware vSphere Kubernetes Service
• VCF Automation

Issue/Introduction

Possible symptoms:

• During the VMware Cloud Foundation (VCFA) installation of a VMware Kubernetes Service (VKS) cluster, the auto-attach package install (pkgi) fails to deploy. 
  • Reason: ReconcileFailed. Message: vendir: Error: Syncing directory '0': Syncing directory '.' with imgpkgBundle contents: Fetching image: GET https://localhost:5000/v2/images/vksm/auto-attach-service/manifests/latest: MANIFEST_UNKNOWN: manifest unknown; map[Tag:latest] .
• Executing `kubectl get pkgi -A` displays the `auto-attach.vksm.broadcom.com` package in a failed state with the message `Reconcile failed: Error`. 
• Workload Control Plane (WCP) logs show the `svc-auto-attach-domain-c10` workload repeatedly setting to the `PENDING` phase.
  • debug wcp [logger/trace.go:xx] [BEGIN] [workload.(*Workload).updateStatePhase:xxxx] setting workload svc-auto-attach  -domain-cXX phase to PENDING
• In VCFA GUI, VKS cluster management service shows Unhealthy status for Elements such as auto-attach-configuration with errors such as:
  • endpoint https://tenant-manager.prelude.svc.cluster.local:443/api/task/<UUID> failed
  • Waiting for service account secret to be released

Environment

• VMware Cloud Foundation (VCFA)  9.0.2 
• VMware Kubernetes Service (VKS) 3.5.0

Cause

The service manager fails to override the default `localhost` address with the correct management image proxy URL (`mgmt-image-proxy.kube-system.svc.cluster.local`). Consequently, the service attempts to pull the required `auto-attach` image from `localhost`, where it does not exist. A caching issue in the supervisor retains this incorrect definition, preventing successful deployment.

Resolution

Reach out Broadcom support referencing this article (KB #431436) in your case description:

• Contact Broadcom support

Additional Information

To verify the image proxy failure and absence of the required image, you can query the supervisor container registry using the following commands:

curl -k https://localhost:5000/v2/_catalog
curl -k mgmt-image-proxy.kube-system.svc.cluster.local:5000/v2/images/vksm/auto-attach/list