Upgrade of TKGI fails during upgrade of Harbor

Products

• VMware Tanzu Kubernetes Grid Integrated Edition

Issue/Introduction

During Upgrade of TKGi Management console and the related components and error have been observed during harbor upgrade:

Deploy harbor-container-registry 2.11.0

Failed

failed to config Harbor on ops_man: error while configuring harbor: failed to configure product: request failed: unexpected response: HTTP/1.1 422 Unprocessable Content Content-Length: 77 Cache-Control: private, no-store Connection: keep-alive Content-Security-Policy: script-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; object-src 'none'; Content-Type: application/json; charset=utf-8 Date: Thu, 03 Apr 2025 10:22:00 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Server: Ops Manager Strict-Transport-Security: max-age=63072000; includeSubDomains X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Request-Id: ba831d67-4cdd-48d8-a2ea-d7fca5b6dffa X-Runtime: 0.313597 {"errors":{".properties.auth_mode":["Value cannot be changed after deploy"]}}

 

 

Environment

TKGi 1.19 

TKGi Management console 1.19

Cause

The essence of the error is found int this part:

{"errors":{".properties.auth_mode":["Value cannot be changed after deploy"]}}

We have confirmed that the field in the harbor once configured cannot me modified, and this is the case with the tile 

From the generated manifest from the MC it looks like the harbor auth mode is set to LDAP, but the harbor tile is set with local database.

 

Resolution

Verify under harbor configuration what us configured for authentication - If it is set to LDAP, verify also what is configured under Harbor tile If they does not match, the configuration on the Tile cannot be modified and therefore the change have to be reflected on the TKGi Management console UI 

 

To fix the issue update the harbor setup to use "local" and once the change is applied the manifest does match the original configuration and will complete