Contour Envoy Service Deploys as NodePort Instead of LoadBalancer in VKS environment managed by a vSphere Supervisor Cluster

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• After deploying or updating the Contour package on a Supervisor-managed guest cluster using the Tanzu CLI, the Envoy service fails to receive an external IP address.
• Running kubectl get svc -n tanzu-system-ingress shows the Envoy service TYPE as NodePort instead of the expected LoadBalancer.
• The data-values.yaml file explicitly contains type: LoadBalancer under the envoy.service block, but the package controller appears to ignore it.
  • user@host:~/project/path# kubectl get svc -n tanzu-system-ingress
NAME      TYPE           CLUSTER-IP       EXTERNAL-IP     PORT(S)                      
contour   ClusterIP      <REDACTED_IP>    <none>          8001/TCP                     
envoy     NodePort       <REDACTED_IP>    <none>          80:31471/TCP,443:32356/TCP   
• contour-data-values.yml
  • envoy:
  service:
    type: LoadBalancer
    disableWait: false
    externalTrafficPolicy: Cluster
    ipFamilies: []
    ipFamilyPolicy: ""
    loadBalancerIP: ""
    loadBalancerTLSTermination: false
    nodePorts:
      http: 0
      https: 0
    type: ""

 

Environment

• vSphere with Tanzu
• vSphere Kubernetes Service

Cause

• This issue is caused by a redundant and conflicting YAML key in the package configuration file (data-values.yaml). Standard YAML parsers evaluate duplicate keys sequentially, meaning the last defined key takes precedence.
• If a trailing type: "" entry exists at the bottom of the envoy.service block, it silently overrides the earlier type: LoadBalancer declaration. When the Tanzu package reconciler encounters an empty or invalid service type, it falls back to the default infrastructure configuration for vSphere, which is NodePort.
• Example of the misconfiguration:

envoy:
  service:
    type: LoadBalancer          # <--- Intended configuration
    disableWait: false
    externalTrafficPolicy: Cluster
    ipFamilies: []
    ipFamilyPolicy: ""
    loadBalancerIP: ""
    loadBalancerTLSTermination: false
    nodePorts:
      http: 0
      https: 0
    type: ""                    # <--- Duplicate entry overriding the above

Resolution

• To resolve this issue, remove the duplicate YAML key and force the package reconciler to update the deployment on the VKS cluster.

Step 1: Edit your data-values.yaml file and delete the trailing type: "" line from the envoy.service block. Ensure type: LoadBalancer remains intact at the top of the block.

Step 2: Run the update command: tanzu package installed update contour --version 1.32.0+vmware.1-tkg.1 --values-file data-values.yaml -n tanzu-system-ingress.

Step 3: Verify the service type using kubectl get svc -n tanzu-system-ingress.