NodePolicy Settings Fail to Apply to New Control-Plane Nodes During Workload Cluster Upgrades

Products

• VMware Telco Cloud Automation
• VMware Telco Cloud Platform

Issue/Introduction

• When deploying a NodePolicy to workload cluster control-plane nodes, the policy applies correctly to existing nodes. However, when a new control-plane node is deployed (e.g., during a cluster upgrade), the new node does not receive the required settings from the NodePolicy.

• The vmconfig-operator and nodeconfig-operator controllers on the management cluster fail to reconcile the NodePolicy for the newly created nodes.

• Restarting the vmconfig-operator pod on the management cluster temporarily resolves the issue, allowing the NodePolicy to apply to new nodes.

• The NodePolicy status incorrectly displays old nodes that have already been deleted.

Environment

TCA 3.4

TCP 5.1

Cause

NodePolicy is not supported for use with control plane nodes. Because the functionality is unsupported for this node type, the configuration controllers fail to properly reconcile the policy lifecycle on newly provisioned control-plane nodes.

Resolution

To achieve the desired configuration goals without using an unsupported NodePolicy, leverage native deployment configurations. An example of some configurations that can be applied without using NodePolicy configurations:

1. chronyd Configuration: Use the files field to write the chrony.conf content directly to the node. Combine this with postKubeadmCommands to enable and start the chronyd service.

2. Root CA Trust on Photon OS: Use the files field to place the CA certificate on the node. Add a postKubeadmCommands entry to run the Photon OS certificate trust-refresh step.

   • For updating the Root CA certificate trust, refer to KB 323913.

3. SSH Public Keys for CAPV: Utilize the dedicated kubeadmConfigSpec.users field to specify the username and sshAuthorizedKeys directly.

   • For implementing SSH keys, refer to KB 327478.