Tanzu Hub hubsm-install errand fails with "Get "https://<hub-url>/hub/graphql" returned status code: 403

Products

• VMware Tanzu Platform - Hub

Issue/Introduction

When attempting to install Tanzu Hub, it fails with HTTP 403 when running the hubsm-install errand like below:

===== 2026-07-09 16:20:51 UTC Running "/usr/local/bin/bosh --no-color --non-interactive --tty --environment=1<ENV> --deployment=hub-<GUID> run-errand hubsm-install --with-heartbeat --instance registry/first"
Using environment '<ENV>' as client 'ops_manager'

Using deployment 'hub-<GUID>'
Task 194568
Task 194568 | 16:20:51 | Task state: queued
...

Task 194568 done
Errand 'hubsm-install' completed with error (exit code 1)

          [i] successfully processed script file /tmp/log-bundle/work/tanzusm/prometheus-support-bundle-config/config.crash  
          [i] Successfully stored log bundle at /tmp/log-bundle/log-bundle-2026-07-09T16-26-36Z.tar.gz  
          [i] Log bundle execution took 1m24.284264939s  
          [x] Could not perform installation step: GraphQL API endpoint 'https://<HUB-URL>/hub/graphql' returned status code: 403 step="Verification checks will confirm the correctness of the installation and the health of the cluster."  
            
Stderr     /var/vcap/jobs/hubsm-install/bin/lib/helper.sh: line 72: jq: command not found  
          using KUBECONFIG at /var/vcap/jobs/hubsm-install/config/kubeconfig  
     
... 

1 errand(s)
===== 2026-07-09 16:26:45 UTC Finished "/usr/local/bin/bosh --no-color --non-interactive --tty --environment=<ENV> --deployment=hub-<GUID> run-errand hubsm-install --with-heartbeat --instance registry/first"; Duration: 353s; Exit Status: 1

Environment

• Tanzu Hub 10.4.x

Resolution

There are a few options to resolve this options:

1. Modify / create the hub domain record (the <HUB-URL> in the above output) in DNS to point one of IP of 5 control VM. 
2. Statically set Control Planes IPs in the tile's Settings -> Advanced Setting option. This allows to pre-create the DNS records.