Broadcom's vcf-cert-tool (KB 445742) fixes expired internal certificates on vCenter, ESX, NSX, Supervisor, VCF Operations and Cloud Proxy from one menu-driven CLI. Supported versions, download and how to run it.
Supervisor stays in Configuring with "ERROR - Configured Core Supervisor Services" and velero or tkg packages in ReconcileFailed because docker-registry.kube-system.svc returns Service Unavailable. The proxy is the cause (KB 411761).
Supervisor control plane and spherelet certificates expire after one year. How to check them, rotate them from vCenter with Broadcom's certmgr tool, persist the new keys, and which certificates certmgr does not cover (KB 322994).
Supervisor deployment or upgrade hangs in Configuring Host Nodes with repeated Apply Solution tasks? The spherelet VIB cannot install because the hosts are not compliant with the vLCM image, sometimes because of legacy BIOS boot (KB 393663).
Kubernetes nodes on vSphere fail to resolve names ending in .local while the DNS server answers fine. Why systemd-resolved sends .local to mDNS, and the lab-only workarounds for TKG, the Supervisor and VKS clusters (KB 317072, KB 323444).
A VKS cluster stays in provisioning, control plane nodes run but workers never power on, and volume creation fails with POST /vsanHealth 503. Why the vCenter vsan-health service matters for CNS and how to fix it (KB 409491).
New vsphere-csi-node pods on a VKS cluster crash with "failed to get VirtualMachines for the node ... Unauthorized"? The CSI controller still uses an old token. Restart the vsphere-csi-controller deployment (KB 411871).
On a vSphere 8 Supervisor with VDS networking, vSphere Pods time out to ClusterIP services: ErrImagePull, CrashLoopBackOff or a stuck Supervisor service install. Why the gateway drops it and how to work around it (KB 312199).
A VKS 3.3+ workload cluster upgrade hangs because an old node never finishes draining: a pinniped kube-cert-agent pod keeps coming back. How to recognize it and fix it with a MachineDrainRule (KB 410900).
NSX native load balancer returns 502 Bad Gateway? Check the header size limits in the HTTP application profile, find the 502 in the Edge LB error and access logs, and verify pool and server-side SSL.