"Kubeletconfigchanged" warning on attached GKE clusters in TMC after upgrading to kubernetes version v1.34
Article ID: 432104
Updated On:
Products
Issue/Introduction
- After upgrading an attached Google Kubernetes Engine (GKE) cluster to kubernetes version v1.34, the cluster displays a warning state in the Tanzu Mission Control-Self Managed UI.
- A node-level alert is triggered with the name
Kubeletconfigchanged. The alert payload details show{"managed": {"readOnlyPort": 10255}}. - Cluster workloads, autoscaling, and general performance are entirely unaffected, and the cluster functions normally.
Environment
VMware Tanzu Mission Control
Cause
This is a false-positive warning triggered by an expected, cloud-provider-driven security enhancement.
The alert points to the readOnlyPort: 10255 setting on the GKE worker node's kubelet service. Historically, port 10255 was used as an unauthenticated, read-only port to scrape node metrics. Because it does not require authentication, it is considered a legacy security risk.
With the release of kubernetes v1.34, Google updated their GKE security baselines. When the node pool is upgraded, Tanzu Mission Control's inspection agents detect a configuration drift regarding this port compared to the node's previous state and flag it as a warning. TMC is successfully detecting the change, but in this specific scenario, the change is an intentional and secure lifecycle event managed by Google.
Resolution
Because the cluster is perfectly healthy, no immediate action is strictly required. However, to clear the warning state from the TMC UI, one of the following paths can be chosen:
Option 1: Explicitly Disable the Read-Only Port: To align the GKE cluster's configuration and clear the configuration drift alert in TMC, the kubelet read-only port can be explicitly disabled on the GKE side.
-
Refer to the official Google Cloud documentation: Disable the kubelet read-only port in GKE clusters.
-
Once the port is explicitly disabled at the GKE control plane level, the TMC inspection agent will validate the new baseline, and the alert will automatically resolve.
Option 2: Safely Ignore the Alert: If modifying the GKE cluster configuration is not desired, this alert can be safely ignored. It will not impact workloads or cluster performance.
Additional Information
Feedback
