cluster Nodes Stuck in Provisioned State During SSP Deployment Due to Network Port Block

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

During the Security Services Platform (SSP) deployment wizard at the " Workload Cluster" step, the deployment task fails to progress and eventually times out. The installer interface indicates that only one Control Plane node has reached the Running state (holding the Virtual IP), while all remaining Control Plane and Worker nodes remain stuck in the Provisioned state.

To inspect the logs on the affected nodes, log into the SSP installer via CLI using sysadmin credentials (for SSP 5.1 or later) or root credentials. Run "kubectl get machines -A -o wide" to review the status of all machines. Locate a node in the Provisioned state from the output, then search for its name in the vCenter Server UI to obtain its IP address. SSH into the node using "ssh capv@<NODE_IP_ADDRESS>" and review the cloud-init logs located at /var/log/cloud-init-output.log

Log snapshot:

error execution phase preflight: couldn't validate the identity of the API Server: failed to request the cluster-info ConfigMap: Get "https://:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

Environment

SSP 5.x

Cause

During cluster bootstrapping, all joining control plane and worker nodes must communicate with the primary control plane node via the configured Virtual IP (VIP) on port 6443 (Kubernetes API Server) to fetch cluster initialization metadata (cluster-info ConfigMap).

A network firewall rule  was blocking TCP port 6443 traffic between the provisioned worker/secondary control plane nodes and the primary active control plane VIP, causing connection timeouts.

Resolution

 

• Enable Network Port Access: Ensure that TCP port 6443 is allowed bidirectionally across all SSP control plane nodes, worker nodes, and the Virtual IP (VIP) subnet. Refer to the official VMware vDefend Ports & Protocols documentation for the complete list of required port configurations: https://ports.broadcom.com/view/VMware-vDefend

• Verify Network Connectivity: Once the required ports are enabled, verify connectivity between the nodes. Log into one of the provisioned nodes via SSH and run "nc -vz <TARGET_NODE_IP> 6443" to confirm that the connection completes successfully.

• Retry Platform Deployment: Re-initiate or retry the deployment step directly from the SSP installer UI. With TCP port 6443 accessible, all provisioned nodes will successfully fetch the cluster-info ConfigMap, complete the preflight join process, and transition to the Running state.

 

Additional Information

if issue still persists, please contact Broadcom support team for further troubleshooting