VKS guest cluster upgrade fails due to kapp resource ownership conflict

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• Upgrade of VKS guest cluster from 1.32 to 1.33 fails 
• The following error appears in the cluster status description:
  Addon Kapp-Controller is not ready:
kapp: Error: Ownership errors:
- Resource 'configmap/kapp-controller-config (v1) namespace: tkg-system' is already associated with a different label 'kapp.k14s.io/app=####'

Environment

VMware Kubernetes Service (VKS) 

Cause

• The kapp-controller-config ConfigMap in the tkg-system namespace contains stale kapp.k14s.io/app and kapp.k14s.io/association- labels from a previous reconciliation
• The new upgrade process uses a different tracking ID and refuses to modify resources it does not explicitly own

Resolution

1. Set the kubectl context to the affected guest cluster.
2. Strip the conflicting ownership and association labels from the kapp-controller-config ConfigMap:
   • kubectl label configmap kapp-controller-config -n tkg-system kapp.k14s.io/app-
   • kubectl label configmap kapp-controller-config -n tkg-system kapp.k14s.io/association-
3. Restart the tanzu-addons-controller-manager deployment in the supervisor cluster to trigger a fresh reconciliation:
   • kubectl rollout restart deployment tanzu-addons-controller-manager -n ####
4. Retry the upgrade