VKS Supervisor Enablement Fails with "overlapping subnets must use the same network mode"

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• The VKS Supervisor Cluster enablement wizard fails during the validation phase, preventing cluster deployment.
• The vCenter UI displays the following error message: Networks [PortGroup1] and [PortGroup2] which have overlapping subnets must use the same network mode.

Environment

vSphere Kubernetes Service 9.x

Foundation Load Balancer

Cause

This validation error triggers when both the Management Network and the Workload Network are configured to use the exact same Layer 3 IP subnet (sharing the identical gateway and subnet mask) but are assigned to distinct, separate Layer 2 distributed port groups.

VKS architecture strictly prohibits mapping different distributed port groups to identical subnets. This conflicting configuration prevents the underlying Kubernetes control plane from establishing a deterministic routing table, making it impossible for Supervisor VMs to reliably route and distinguish between Management and Workload traffic. The wizard intentionally blocks this state to prevent a broken cluster deployment.

Resolution

To clear the validation error and proceed with enablement, apply one of the following network designs based on your architectural requirements:

Option 1: Shared VLAN and Subnet (Collapsed Topology) If your environment is designed for Management and Workload traffic to run on the exact same VLAN:

1. Navigate back to the Management Network configuration tab within the enablement wizard.
2. Select the exact same distributed port group that is currently assigned to the Workload Network.
3. Verify that the assigned IP address pools for each network are strictly non-overlapping (e.g., assigning IP addresses .10–.20 for Management, and .50–.100 for Workloads within the shared subnet).

Option 2: Isolated VLANs and Subnets (Segregated Topology) If your environment requires logical isolation between Management and Workload traffic:

1. Navigate to the Workload Network configuration tab within the enablement wizard.
2. Assign a completely distinct, non-overlapping Layer 3 IP subnet for the Workload traffic.
3. Ensure this new subnet utilizes its own dedicated gateway and maps to a distinct distributed port group backed by a separate VLAN.

Applying either configuration will establish unambiguous Layer 3 routing for the control plane and immediately satisfy the validation checks.

Additional Information

Please refer to Broadcom doc for more information: https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-0/vsphere-supervisor-installation-and-configuration/deploying-vsphere-supervisor-with-foundation-load-balancer/requirements-for-deploying-vsphere-supervisor-with-foundation-load-balancer.html