Contour deployment fails with error "Get "https://depot.kube-system.svc/v2/": dial tcp: lookup depot.kube-system.svc on 127.0.0.53:53: no such host"

Products

• VCF Private AI Services

Issue/Introduction

• When deploying the Contour service on a VMware vSphere Kubernetes Service (VKS) Supervisor cluster, the deployment fails with a signature verification error.
  
  
• The app-platform-operator logs or the ServiceSignatureVerification status show the following error.
  
  Connectivity to image depot.kube-system.svc/... cannot be verified: Get "https://depot.kube-system.svc/v2/": dial tcp: lookup depot.kube-system.svc on 127.0.0.53:53: no such host
  
  
• Checking the ServiceSignatureVerification resource confirms the below failure.
  
  status:
  conditions:
  - message: 'Connectivity to image depot.kube-system.svc/vcf/supervisor-service-contour/ga/1.33.1/contour:v1.33.1_vmware.2-vks.1
      cannot be verified: Get "https://depot.kube-system.svc/v2/": dial tcp: lookup
      depot.kube-system.svc on 127.0.0.53:53: no such host'
    reason: Failure
    status: "False"
    type: ConnectivityChecked

Environment

VMware vSphere Kubernetes Service

Cause

This happens when the contour yaml being used is the non-legacy yaml which is pulling the image from depot.kube-system.svc/vcf/supervisor-service-contour/ga/1.33.1/contour:v1.33.1_vmware.2-vks.1 and not the public facing URL projects.packages.broadcom.com/vsphere/supervisor/contour/1.33.1/contour:v1.33.1_vmware.2-vks.1. 

Resolution

Use the legacy YAML to deploy contour. The same can be downloaded from the official Broadcom site.