Intermittent Login Timeout during kubectl vsphere login to VKS Cluster via Avi Load Balancer

Products

• Tanzu Kubernetes Runtime

Issue/Introduction

Users experience intermittent connection timeouts when attempting to authenticate to a vSphere Kubernetes Service (VKS) cluster using the `kubectl vsphere login` command. The issue typically occurs when the connection is routed through an Avi (NSX Advanced Load Balancer) Service Engine.

Executing the login command with verbosity (`-v 10`) shows the following:

`Trying to login to <Avi_VIP>`
`WARN Error occurred during HTTP request: Post "https://<Avi_VIP>/wcp/login": net/http: TLS handshake timeout`

Environment

VMware Kubernetes Supervisor(VKS)

Avi Load Balancer

Cause

This issue is caused by **asymmetric routing** triggered when the **"Preserve Client IP"** feature is enabled in the Avi L4 Application Profile. 

When this feature is enabled:

1. The Avi Service Engine (SE) forwards the request to the backend VKS control-plane node while preserving the original client source IP (no SNAT).
2. The backend node receives the packet and attempts to send the return traffic (the TLS handshake response) directly to the client's IP address rather than routing it back through the Avi SE.
3. The return path fails because the client expects the response to come from the Avi Virtual Service VIP, leading to a dropped session and a TLS handshake timeout.

Resolution

To resolve the login timeouts, disable the "Preserve Client IP" feature on the affected Virtual Service to ensure symmetric routing via SNAT.

Here is a step to disable "Preserve Client IP".

1. Log into the **Avi Controller** UI.
2. Navigate to **Applications** > **Virtual Services**.
3. Locate and **Edit** the Virtual Service fronting the VKS/Supervisor API.
4. Go to the **Profiles** tab.
5. Click the edit icon for the **Application Profile** (ensure it is a Layer 4 profile).
6. Locate the **Preserve Client IP** checkbox and **uncheck** it.
7. Click **Save** on the Profile and then **Save** on the Virtual Service.