Management Console shows incorrect or missing cluster information

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We have configured a MC for our cluster and all seemed to go well but the Synced field still has a red exclamation mark

and the details of the appliances in the cluster, such as Replication, Disk Free, Disk Size and Version are missing:

 

 

Cause

The cluster was missing the MCApiKey-XXX target account of type "API Key". This account is not only used for communication between the cluster and the Management Console, using the account defined on the Management Console appliance, but also for intra-cluster communication, which depends on this key to exist in the cluster itself. This is because the cluster nodes send their status to an aggregator node, and only the aggregator node sends information to the MC.

This key should be defined in PAM by default, but may be missing in environments with a long upgrade history.

Environment

Release : It could affect any supported release as of June 3, 2022, with 4.0.2 and 4.1.0 being the latest releases.

Component : PRIVILEGED ACCESS MANAGEMENT

Resolution

Create the missing target account by adding it as API key to user MCApiUser. The problem on the MC may not disappear until the credential management service is restarted, e.g. when nodes get rebooted, or when the cluster is stopped/started. If trying to add the key from the PAM UI as shown below fails with a PAM-CMN-4814 error, please see KB 244168 for a solution using the Rest API.

Additional Information

There is another problem in releases 3.4.6, 4.0.0-4.0.2 and 4.1.0, i.e. all releases supported as of June 3, 2022, where the MC reports a conflict and the list of nodes shows multiple aggregators. This happens when the original aggregator node reboots while the cluster is running, e.g. when a hotfix is applied. A fix to this problem is included in 4.0.3 and will be included in the 4.1.1 maintenance release, and future releases.