Error: Harbor UI unreachable with connection refused on vSphere Kubernetes Service

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

Users are unable to access the Harbor UI after deployment. A browser attempt results in an ERR_CONNECTION_REFUSED. Further investigation shows:

• The AVI load balancer virtual service for Harbor/Contour reports a 'Down' status or reset packets.
  
  
• The httpproxy status indicates an invalid TLS certificate
  
  
  • From the supervisor node run the following command:
    
    kubectl get httpproxy -n svc-harbor-domain-UUID


    
    
• TCP dumps show traffic reaching the IP but being rejected with a reset.

Environment

• VMware vSphere Kubernetes Service (VKS)
• vSphere 8.0 Update 3 and higher
• Harbor Supervisor Service

Cause

This issue occurs because the harbor-data-values.yaml file contains malformed certificate formatting or incorrect YAML indentation. The UI validator may not catch these specific syntax errors, allowing an invalid configuration to be applied.

Resolution

To resolve this issue, correct the formatting in the Harbor Supervisor Service configuration:

1. Log in to the vSphere Client.
   
   
2. Navigate to Workload Management > Services.
   
   
3. Select the Harbor service and click Actions > Manage Service.
   
   
4. In the YAML Service Config window, locate the tlsCertificate: block.
   
   
5. Ensure the certificate is formatted with the following indentation rules:
   
   
   • The key (e.g., tls.crt:) must be indented with two spaces.
     
     
   • The certificate content (starting with -----BEGIN CERTIFICATE-----) must be indented with four spaces.
     
     
   •  Carriage return (specifically at column 69). If you input as one long line it will not work.

Example:

  tls.crt: |
    -----BEGIN CERTIFICATE-----
    MIIFKzCCBBOgAwIBAgITFQAAk6CGmpMuJlfXDgABAACToDANBgkqhkiG9w0BAQ0F
    ADBZMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxHDAaBgoJkiaJk/IsZAEZFgxtczFz
    ....
    A1UECBMMTm9ydGggRGFrb3RhMQ4wDAYDVQQHEwVGYXJnbzENMAsGA1UEChMERklC
    VDELMAkGA1UECxMCSVQxIjAgBgNVBAMTGUhhcmJvci5tczFzdGludGVyYmsubG9j
    -----END CERTIFICATE-----

Additional Information

Install Harbor with a Custom Certificate