VKS Guest Clusters fail to pull Vault Injector sidecar image (ErrImagePull / DNS Resolution Error on .kube-system.svc.cluster.local) in Secret store service
search cancel

VKS Guest Clusters fail to pull Vault Injector sidecar image (ErrImagePull / DNS Resolution Error on .kube-system.svc.cluster.local) in Secret store service

book

Article ID: 452236

calendar_today

Updated On:

Products

VMware Cloud Foundation VMware vSphere Kubernetes Service

Issue/Introduction

  • In a VMware Cloud Foundation (VCF) 9.1 environment configured with vSphere Kubernetes Service (VKS) 3.7.0 and an external or Regional Harbor registry, pods utilizing the Vault Injector add-on (v1.7.4) fail to initialize and enter an ErrImagePull or ImagePullBackOff state. 
  • Checking the pod events via kubectl describe pod <pod-name> reveals the following DNS resolution failure during sidecar image acquisition:

Environment

  • VMware Cloud Foundation (VCF) 9.1
  • vSphere Kubernetes Service (VKS) 3.7.0

Cause

  • Supervisor-Internal Domain Routing: By default, the injected sidecar sets AGENT_INJECT_VAULT_IMAGE to an internal Supervisor proxy URL (mgmt-image-proxy.kube-system.svc.cluster.local). VKS Guest Clusters operate in isolated networking namespaces and cannot resolve Supervisor-internal.kube-system.svc.cluster.local DNS domains.

Resolution

Permanent Fix

This issue is officially resolved in VCF 9.1.1 / VKS 3.7.1. Upgrading to release 9.1.1 automatically resolves the proxy domain mapping and registry endpoints for Regional Harbor deployments.

Workarounds (VCF 9.1)

If an immediate upgrade to VCF 9.1.1 is not feasible, implement one of the following validated workarounds:

Option 1: Override Vault Agent Image via Pod Annotation (Recommended)

Override the default sidecar image path and configure the required Vault agent annotations at the application workload level to point directly to your accessible Regional Harbor image repository.

Add the annotation to your application's Pod specification :

Option 2: Direct Service Installation from vCenter Server

Rather than relying on guest cluster automated package synchronization in VCF 9.1, install/deploy the Vault Injector service directly through the vCenter Server (VC) Management UI / Supervisor Services catalog. This ensures registry proxy bindings are properly assigned to external endpoints.

Powered by Wolken Software