Caas infra control plane nodes will not complete boot with error : SELinux: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE is non-zero
search cancel

Caas infra control plane nodes will not complete boot with error : SELinux: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE is non-zero

book

Article ID: 442049

calendar_today

Updated On:

Products

VMware Telco Cloud Automation

Issue/Introduction

  • CaaS clusters display a Disconnected status in the VMware Telco Cloud Automation (TCA) Manager UI following a facility power outage.

  • The cluster's Kubernetes Endpoint IP (VIP) is unreachable.

  • When checking the Control Plane nodes, a majority (e.g., 2 out of 3) are unreachable over the network.

  • Attempting to restart the affected Control Plane nodes results in the VMs failing to acquire IP addresses.

  • The VMs may appear to hang during the boot sequence (often stalling on early kernel initialization events, indicating storage locks or resource allocation problems). Web console would report the below :

  • Standard kubectl commands fail to execute against the cluster.

  • Cluster certificates have been verified and are still valid.

Environment

VMware Telco Cloud Automation (TCA) 3.4,3.x

Cause

This issue occurs when cluster virtual machines (Worker nodes and/or Control Plane nodes) are manually moved out of their designated vSphere Resource Pools during power outage recovery efforts.

When nodes are displaced from their expected resource boundaries, the underlying infrastructure may fail to allocate the necessary compute, storage, or network resources. This prevents the VMs from booting completely or acquiring their DHCP IP addresses, ultimately causing the Kubernetes control plane to fracture and the TCA Manager to lose connectivity with the cluster.

Resolution

To resolve this issue and restore cluster connectivity, the displaced virtual machines must be returned to their correct vSphere inventory locations.

  1. Locate the VMs in vCenter: Log in to the vSphere Client and search for the affected CaaS cluster's Worker and Control Plane nodes.

  2. Restore Resource Pool Placement: Manually migrate or drag-and-drop the displaced virtual machines back into their originally designated Resource Pools within the vCenter inventory.

  3. Reboot the Affected Nodes: Once the VMs are in the correct resource pool, perform a Guest OS restart or power cycle the affected Control Plane and Worker nodes so they can successfully boot and acquire their IP addresses.

  4. Restart TCA Manager Services: Restart the TCA Manager appliance (or its core services) to force a state sync and refresh the cluster health status.

  5. Verify Cluster Health:

    • Confirm that the Control Plane nodes are now reachable.

    • Verify that kubectl commands execute successfully.

    • Check the TCA UI to ensure the cluster status has returned to a normal/connected state.

Powered by Wolken Software