Kubelet Extra Arguments and CPU Manager Policy Overwritten on TCA / CAPI Worker Nodes

Products

• VMware Telco Cloud Automation
• VMware Telco Cloud Platform

Issue/Introduction

• Worker nodes fail to apply the cpu-manager-policy: static configuration despite it being explicitly defined in the Kubeadmin Config Template
• Other Kubelet parameters (e.g., tls-cipher-suites, protect-kernel-defaults) applied via the workerKubeletExtraArgs variable are present

Environment

TCA: 3.4

TCP: 5.1

Cause

This is a known architectural behavior in ClusterAPI (CAPI) JSON patching. When the workerKubeletExtraArgs variable is injected into a node pool configuration, the CAPI controller processes it as a JSON patch replacement operation. This completely overwrites the entire kubeletExtraArgs map at the /spec/template/spec/joinConfiguration/nodeRegistration/kubeletExtraArgs path defined in the Day 0 template. Consequently, any baseline parameters (such as kube-reserved, system-reserved, and cpu-manager-policy) defined in the template are discarded.

Resolution

Do not use the workerKubeletExtraArgs variable interface when overlapping with baseline template configurations.

1. Consolidate all required Kubelet arguments (including TLS ciphers, timeouts, and reserved compute) strictly within the Kubeadmin Config Template.
2. Ensure all values within the kubeletExtraArgs dictionary are cast as strings.
3. Completely remove the workerKubeletExtraArgs array/variable from the Node Pool definition in the TCA UI.

After consolidating the arguments on one of the worker node in the nodepool:

1. Verify all arguments are present in the Kubeadm environment file
   cat /var/lib/kubelet/kubeadm-flags.env
2. Confirm CPU Manager successfully initialized in static mode
   cat /var/lib/kubelet/cpu_manager_state | grep -i static
3. Ensure the Kubelet service is stable
   systemctl status kubelet