Platform Services Tile Installation Fails with "connect to server error: bad status"

Products

• VMware Tanzu Application Platform

Issue/Introduction

During the installation of the Tanzu Platform Services tile (e.g., in a Proof of Concept environment with Tanzu Hub), the deployment fails or enters an Execution failed state.

Inspection of the frpc (Fast Reverse Proxy Client) logs located on the ensemble_stitching VM (/var/vcap/sys/log/frpc/frpc.log) reveals errors similar to the following:

2026-08-05 22:16:54.397 [I] [client/service.go:335] try to connect to server...
2026-08-05 22:16:54.429 [W] [client/service.go:338] connect to server error: bad status
2026-08-05 22:16:54.429 [I] [sub/root.go:178] frpc service for config file [/var/vcap/jobs/frpc/config/frpc.toml] stopped
login to the server failed: bad status. With loginFailExit enabled, no additional retries will be attempted

Environment

Product: Tanzu Platform Services Tile / Tanzu Hub

Proxy/Load Balancer: NGINX reverse proxy

 

Cause

The frpc service on the ensemble_stitching VM is configured to use secure WebSockets (wss) or standard WebSockets (websocket) as its underlying transport protocol.

This can be confirmed by checking /var/vcap/jobs/frpc/config/frpc.toml:

# Communication protocol used to connect to server
# supports tcp, kcp, quic, websocket and wss now, default is tcp
transport.protocol = "wss"

When frpc attempts to initiate a WebSocket handshake through the NGINX proxy, the connection fails with bad status because the initial NGINX proxy configuration is missing the required headers to process HTTP Upgrade requests for WebSockets. The proxy handles the connection as standard HTTP, leading to an incompatible response during the handshake.

Resolution

To resolve this issue, update the NGINX reverse proxy configuration (nginx.conf) with the appropriate map and WebSocket upgrade headers.

Configure the Connection Upgrade Map

Inside the http block of nginx.conf, define a dynamic mapping for the $connection_upgrade variable based on the incoming $http_upgrade header:

http {
    # Dynamically set Connection header based on the Upgrade header
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }
    
    # ... rest of http block ...
}

 

Update the Location Block

In the relevant server / location block handling traffic for Tanzu Hub / Platform Services, add Upgrade, and Connection directives:

server {
        listen 80;
        server_name <example.com>;

        location / {
            proxy_pass http://localhost:8080;
            
            # Use the mapped variable here
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            
            proxy_set_header Host $host;
        }
    }

 

Apply Configuration & Verify

• Reload or restart the NGINX proxy service to consume the changes.

• Restart the frpc process on the ensemble_stitching VM and re-run the tile installation in Tanzu Operations Manager.

• Confirm that the frpc process transitions from an Execution failed state to Running.