How to Access the VMware Supervisor Control Plane from vCenter CLI and Restart AKO

Last updated: October 2026

In this lesson, we will look at how to Access the VMware Supervisor Control Plane from vCenter CLI and restart AKO.

Understanding The Subject Matter

In VMware vSphere with Kubernetes (Supervisor Cluster), some administrative tasks may require access to the Supervisor Control Plane VM. One example is troubleshooting the Antrea Kubernetes Operator or Avi Kubernetes Operator (AKO) integration when normal Kubernetes management commands are unavailable or access is restricted.

In this guide, we will walk through how to access the vCenter Server Appliance (VCSA) using the root account, retrieve the Supervisor Control Plane VM connection details using VMware’s decryptK8Pwd.py utility, and connect to the Supervisor Control Plane VM.

This procedure was used during troubleshooting to gain access to the Supervisor Control Plane VM and restart AKO.

Environment: VMware vSphere with Supervisor Cluster
Access method: SSH from a management jump host to vCenter, followed by SSH to the Supervisor Control Plane VM
Privileges required: Authorized vCenter appliance root access and the appropriate Supervisor VM credentials

Prerequisites

Before proceeding, ensure that you have:

• Authorized SSH access to the vCenter Server Appliance.
• The root credentials for the vCenter Server Appliance.
• Network connectivity from vCenter to the Supervisor Control Plane VM.
• A valid operational reason to access the Supervisor Control Plane VM.
• A maintenance or troubleshooting plan appropriate for your production environment.

Without further ado, let’s get to action.

ACTION TIME

Step By Step Guide of How to Access the VMware Supervisor Control Plane from vCenter CLI

Step 1: SSH into the vCenter Server Appliance

[tekneed_Victor@jump01 ~]$ ssh root@<VCENTER_IP>

[tekneed_Victor@jump01 ~]$ ssh root@10.10.10.14
root@PROD-VCENTER01 [ ~ ]#

Step 2: Retrieve the Supervisor Control Plane VM credentials

root@PROD-VCENTER01 [ ~ ]# /usr/lib/vmware-wcp/decryptK8Pwd.py


Read key from file

Connected to PSQL

Cluster: domain-d345247:5557fdtt-hf54-7uh5-y653-hg4214hfd34
IP: 10.10.19.12
PWD: 5g7*#90h^*_4

Step 3: SSH into the Supervisor Control Plane VM

root@PROD-VCENTER01 [ ~ ]# ssh root@10.10.19.12
The authenticity of host '10.10.19.12 (10.10.19.120)' can't be established.
ECDSA key fingerprint is SHA256:hyffffrtt566gffh668gggffff67766g5v.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.19.12' (ECDSA) to the list of known hosts.

(root@10.10.19.12) Password:
Last login: Wed Oct  7 17:41:22 2026 from 10.10.10.12
 00:35:41 up 33 days,  1:31,  0 user,  load average: 2.12, 1.27, 1.12

23 Security notice(s)
Run 'tdnf updateinfo info' to see the details.
root@67779877t5755568fdege57775fcdf [ ~ ]#

Step 4: Confirm the AKO pod

root@67779877t5755568fdege57775fcdf [ ~ ]# kubectl get pods -n vmware-system-ako

NAME                                                        READY   STATUS             RESTARTS         AGE
vmware-system-ako-ako-controller-manager-5649-34   1/1     Running   23 (2m23s ago)   33d

Step 5: Restart the AKO pod

root@67779877t5755568fdege57775fcdf [ ~ ]# kubectl delete pods -n vmware-system-ako vmware-system-ako-ako-controller-manager-5649-34

Troubleshooting considerations

SSH connection fails

Confirm that the returned IP is reachable from the vCenter appliance and that SSH access is permitted. Network restrictions, firewall rules, and changes between vSphere versions may affect connectivity.

Authentication fails

Check that you copied the correct password and that you are connecting to the IP returned by the utility. Do not repeatedly attempt authentication with guessed credentials.

AKO does not recover

A successful SSH session does not establish that AKO itself is healthy. Inspect the relevant component status and logs, and investigate its underlying dependencies before attempting further restarts.

Normal Kubernetes commands are unavailable

The Supervisor Control Plane VM’s operating-system shell is not necessarily configured as a general-purpose Kubernetes administration workstation. Use the supported management interfaces and documented procedures for your specific vSphere release whenever possible.

Conclusion

This procedure demonstrates a low-level access path for troubleshooting a VMware Supervisor environment:

1. SSH from the management jump host into the vCenter Server Appliance as root.
2. Run /usr/lib/vmware-wcp/decryptK8Pwd.py to retrieve the Supervisor control-plane connection details.
3. Use the returned IP address and password to SSH into the Supervisor Control Plane VM.
4. Perform the authorized troubleshooting task and verify recovery.

Although this method can be useful during specific incidents, direct access to the Supervisor Control Plane VM should be treated as a privileged administrative operation. Prefer supported vSphere and Kubernetes management interfaces for routine administration, and verify the supported recovery procedure before modifying internal Supervisor components.