Workload Management "Configure Load Balancer" fails with error "unable to authenticate to HAProxy with the username"

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

During vSphere Workload Management enablement, the deployment fails at the "Configure Load Balancer" stage. The vCenter Server UI returns the following configuration error:

The control plane VM <REDACTED_HOSTNAME> was unable to authenticate to the load balancer (HAProxy - https://<REDACTED_IPS>:5556/v2/cluster) with the username '<USERNAME>' and the supplied password. Validate the Supervisor cluster load balancer's authentication configuration.

Cause

This issue may occur due to a credential mismatch between the Supervisor enablement wizard and the HAProxy appliance provisioning parameters. If the credentials provided in the Workload Management wizard do not match the expected credentials on the HAProxy appliance, authentication fails.

Resolution

1) Cancel the failed Workload Management enablement task in the vSphere Client.

2) Re-initiate the Supervisor enablement wizard.

3) Navigate to the Load Balancer configuration step.

4) Verify that the username and password provided exactly match the credentials configured during the initial HAProxy OVF deployment. Note: Broadcom Support cannot provide technical support for the HAProxy appliance. A support contract with HAProxy is required. 

5) Complete the wizard and monitor the deployment task for successful completion.

Additional Information

Keep in mind the following considerations when planning a vSphere Supervisor with the HAProxy load balancer:

• A support contract is required with HAProxy to get technical support for the HAProxy load balancer. Broadcom Support cannot provide technical support for the HAProxy appliance.
• The HAProxy appliance is a singleton with no possibility for a highly available topology. For highly available environments, VMware recommends using either a full installation of NSX or the NSX Advanced Load Balancer.
• It is not possible to expand the IP address range used for the front-end at a later date, meaning the network should be sized for all future growth.

For more details, see: Topologies for Deploying the HAProxy Load Balancer