It seems the cpi needs to access the configmap "extension-apiserver-authentication" in namespace kube-system.
When vsphere-cpi is installed other namespaces then the pod does not have permissions to read the ConfigMap in kube-system. For example when installing vsphere-csi Helm Chart with vsphere-cpi.enabled: true
Two different solutions as I see it:
A RoleBinding in kube-system to let the serviceaccount read the ConfigMap
Documentation of vsphere-cpi must be installed in kube-system namespace and thereby remove the option to install vsphere-cpi as part of the vsphere-csi chart.
It seems the cpi needs to access the configmap "extension-apiserver-authentication" in namespace kube-system.
When vsphere-cpi is installed other namespaces then the pod does not have permissions to read the ConfigMap in kube-system. For example when installing vsphere-csi Helm Chart with
vsphere-cpi.enabled: true
Two different solutions as I see it: