Unable to register VM Service VMs to Supervisor Namespace in VCF 9.1

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• In VMware Cloud Foundation 9.1 environments, administrators may be unable to register VM Service VMs into a Supervisor namespace.
• This commonly manifests as backup and restore failures when a third-party backup solution attempts to re-register a restored VM to its namespace via the API path: POST /api/vcenter/namespaces/instances/{namespace}/registervm

This issue presents the following symptoms: 

• API calls fail at the namespace-folder boundary.
• A NoPermissionFault is triggered on VirtualMachine.Inventory.Register (namespace folder) and Resource.AssignVMToPool (namespace ResourcePool).
• The WCP-initiated registration task aborts with the error message: "Virtual machine does not belong to the Supervisor namespace folder."

Environment

VMware vSphere Kubernetes Service
VMware Cloud Foundation 9.1

Cause

This is a known issue in VCF 9.1. When a new Supervisor namespace is created, the system fails to automatically assign the "VM Service VM Management" role to the administrators group. As a result, no account (including vCenter administrators) natively holds the privileges required by the Workload Control Plane to register a VM into the namespace folder.

Resolution

Engineering is aware of the issue and is working to resolve it in an upcoming release. 

To unblock VM registrations and allow backup/restore workflows to complete successfully, restart the WCP service on vCenter Server: 

1. Open an SSH session to the vCenter Server using the root account. 
2. Restart the WCP service with the following command: 
   vmon-cli -r wcp
3. Retry the VM registration or backup/restore operation.