pkgi reconcile failed during service installation in VCFA Service Management
Article ID: 451149
Updated On:
Products
Issue/Introduction
When attempting to install a service via VCFA 9.1 Service Management, the installation fails with a 'Reconcile failed' error visible in the pkgi status.
Checking the pkgi status on the Supervisor cluster reveals errors similar to the following:
# kubectl get pkgi -n vmware-system-supervisor-services...svc-auto-attach.vksm.broadcom.com auto-attach.vksm.broadcom.com 0.2.0 Reconcile failed: Error (see .status.usefulErrorMessage for details) ##d
# kubectl get pkgi -n vmware-system-supervisor-services svc-auto-attach.vksm.broadcom.com -o yaml
usefulErrorMessage: "vendir: Error: Syncing directory '0':\n Syncing directory '.' with imgpkgBundle contents:\n Fetching image:\n Error while preparing a transport to talk with the registry:\n Unable to create round tripper:\n \ Get \"https://mgmt-image-proxy.kube-system.svc.cluster.local/v2/\":\n \ Gateway Timeout; GET http://mgmt-image-proxy.kube-system.svc.cluster.local/v2/: unexpected status code 504 Gateway Timeout: <HEAD><TITLE>Unknown Host</TITLE></HEAD>\n<BODY BGCOLOR=\"white\" FGCOLOR=\"black\"><H1>Unknown Host</H1><HR>\n<FONT FACE=\"Helvetica,Arial\"><B>\nDescription: Unable to locate the server named \"<em>mgmt-image-proxy.kube-system.svc.cluster.local</em>\" --- the server does not have a DNS entry. Perhaps there is a misspelling in the server name, or the server no longer exists. Double-check the name and try again.</B></FONT>\n<HR>\n<!-- default \"Unknown Host\" response (504) -->\n</BODY>\n..."
"Custom proxy settings on this Supervisor" is configured for Supervisor Proxy Configuration.
Environment
VCFA 9.1
Cause
The Supervisor cluster proxy configuration does not include the necessary internal exemptions for local Kubernetes communication. Requests to internal services (such as mgmt-image-proxy.kube-system.svc.cluster.local) are incorrectly routed through the external proxy, resulting in a 504 Gateway Timeout because the external proxy cannot resolve the internal DNS.
Resolution
To resolve this, update the Supervisor proxy configuration to include essential internal exemptions, specifically .cluster.local and local private network ranges.
Step 1: Retrieve the proxy configuration Use the following commands to fetch the current configuration. Replace placeholders (<IP address>, <SSO user name>, <password>, <cluster_id>) with specific environment details.
vc_address=<IP address>cluster_id=domain-c<number>session_id=$(curl -ksX POST --user '<SSO user name>:<password>' https://$vc_address/api/session | xargs -t)curl -k -X GET -H "vmware-api-session-id: $session_id" -H "Content-Type: application/json" https://$vc_address/api/vcenter/namespace-management/clusters/$cluster_id | jq > proxy_data.json
Step 2: Modify the configuration Open proxy_data.json and trim the file to retain only the necessary JSON structure. Update the no_proxy_config field. The following example highlights the required changes:
Example modification for proxy_data.json (10.0.0.0/8 and 172.16.0.0/12 represent private IP addresses used in the deployment. Add the VCFA FQDN suffix to no_proxy_config in addition to .cluster.local):
Step 3: Apply the updated configuration Use the following command to patch the Supervisor cluster with the updated proxy settings:
curl -k -X PATCH -H "vmware-api-session-id: $session_id" -H "Content-Type: application/json" -d@proxy_data.json https://$vc_address/api/vcenter/namespace-management/clusters/$cluster_id
Once the patch is applied, the pkgi reconcile process will automatically retry and should succeed.
Additional Information
Feedback
