Kafka tile installation fails with x509: certificate signed by unknown authority

Products

• VMware Tanzu Platform Core

Issue/Introduction

Kafka tile installation fails during the execution of the apply-carvel-specs errand. The following error appears in the errand logs even when TCP and TLS are enabled in the tile configuration:

kapp: Error: Getting app: Get "https://####.sys.####.####.com/api/v1/namespaces/default/configmaps/cluster-essentials.apps.k14s.io": tls: failed to verify certificate: x509: certificate signed by unknown authority

Environment

• VMware Tanzu Platform
• Embedded Kubernetes (K8S) Provider
• Bring Your Own (BYO) Kubernetes (K8S) Provider
• Kafka Tile

Cause

The certificate validation fails because the trust store used during the apply-carvel-specs errand does not contain publicly trusted certs, required to verify the cluster's certificate chain. This is a known product issue affecting both embedded and BYO Kubernetes configurations.

Resolution

Targeted to be fixed in a future release. Subscribe to this article to receive updates on the fix status by following the steps in How to subscribe to a Knowledge Document.

Perform the following workaround to restore functionality:

1. Obtain the complete certificate chain (Root CA and any Intermediate CAs) for the cluster endpoint.
2. Navigate to Ops Manager > BOSH Director Tile.
3. Select the Security tab.
4. Add the retrieved CA certificates to the Trusted Certificates field.
5. Save the changes and run Apply Changes on the BOSH Director and the Kafka tile.

Additional Information

This configuration ensures that the environment running the errand correctly recognizes and trusts the public or private CA chain used by the Kubernetes cluster endpoint.