Why does the Network status show an NHC009 error?

Virtual Private Cloud

When you check the status of your cluster's health by running the ibmcloud ksks cluster health issues --cluster <CLUSTER_ID>, you see an error similar to the following example.

ID       Component   Severity   Description
NHC009   Network     Error      The IAM token exchange request failed.

VPC operations rely on IAM API keys for authentication. If the used API key is invalid, expired, or disabled, that can lead to this error.

Review and update your IBM Cloud API key used for the IBM Cloud Kubernetes Service.

1. Find out which API key is used. Check the resource group of your cluster by running the following command:

   ibmcloud ks cluster get --cluster <Cluster_ID>
   

2. To find the associated API key (ApiKey_ID) run the following command and look for the Required API key for IBM Cloud Kubernetes Service for resource group, and save it for later:

   ibmcloud iam api-key --uuid containers-kubernetes-key
   ```3. Verify whether the key is disabled or not by running:
   ```sh {: pre}
   ibmcloud iam api-key --activity <ApiKey_ID>
   ```4. If necessary, you can reset the API key used for the IBM Cloud Kubernetes Service by running:
   ```sh {: pre}
   ibmcloud ks api-key reset
   

3. Or if the API key disabled, enable it by running:

   ibmcloud iam api-key-enable <ApiKey_ID>
   

4. For detailed steps, see Setting the cluster credentials and Managing IAM access, API keys, trusted profiles, service IDs, and access groups.

5. After fixing the API key issue you have to wait maximum 30 minutes to see if the warning is resolved.

6. If the issue persists, contact support for further assistance. Open a support case. In the case details, be sure to include any relevant log files, error messages, or command outputs.