TKGI Pods stuck in Init status due to expired NSX Transport Node certificates

Products

• VMware NSX

Issue/Introduction

• TKGI pods are stuck in Init:0/1 or ContainerCreating status.
• kubectl describe pod shows: plugin type="nsx" failed (add): Failed to receive message header.
• NSX Manager shows ESXi hosts in a Disconnected state with alarms for transport_node_certificate_expired.
• ESXi nsx-node-agent.log contains: errorCode="NCP01004"] nsx_ujo.agent.cni_watcher Unable to retrieve network info.
• NSX Manager ccp.log shows: javax.net.ssl.SSLHandshakeException: Certificate expired for UID=####-####.

Environment

VMware NSX

Cause

The Host Transport Node (TN) certificates expired, causing authentication failures on port 1235.

Resolution

1. Regenerate TN Certificates: Follow the manual procedure in KB: "MPA Disconnected" Alarm For Transport Node causing Transport Node state to be "Disconnected" to empty and regenerate host-cert.pem and host-privkey.pem on affected ESXi hosts.
2. Synchronize Manager Thumbprints: Use nsxcli -c push host-certificate to sync the new certificate with the NSX Manager.
3. If the certificates have already been replaced, and the Host status is still showing as disconnected, restart NSX CCP Service: On all NSX Manager nodes, run:

   /etc/init.d/nsx-ccp restart

4.  If issues persists, on the affected ESXi hosts, restart ESXi cfgAgent to clear stale sessions:

   /etc/init.d/nsx-cfgagent restart

5. Verify Connectivity: Ensure the host status returns to Success/Connected in the NSX UI and pods receive IP addresses.

Additional Information

Related KBs:

TKGI pods stuck in Init status with NSX networking showing error "failed to setup network"

Alarm for CNI health status in NSX-T Manager