Error: "The entity ###### is undergoing maintenance operations" message when attempting to perform actions on a vApp VM with an Organization user

Products

• VMware Cloud Director

Issue/Introduction

• Attempting to perform actions against a vApp or VM as an Organization level user in the Cloud Director Tenant UI.
• Many operations on the vApp or VM, for example the Edit options, are greyed out.
• On screens where the VM power operations are available, attempting them fails with a message of the form:

The entity ###### is undergoing maintenance operations

• When editing the VM through API, the following message is displayed in the response:

[ UUID ] The entity ###### is undergoing maintenance operations." majorErrorCode="409" minorErrorCode="INVALID_STATE"

• Attempting to perform actions as a System level administrator user succeeds without issue.
• Attempts to execute POST exitMaintenanceMode API fails with a HTTP 403 response like this:
  
  This operation is denied." majorErrorCode="403" minorErrorCode="ACCESS_TO_RESOURCE_IS_FORBIDDEN"

Environment

VMware Cloud Director 10.x

Cause

This message is returned when a vApp has been placed in maintenance mode. When a vApp is in maintenance mode, it is read-only to Organization level users and only System users can modify it.

More details on maintenance mode for vApps is available in the Cloud Director API enterMaintenanceMode documentation.

Resolution

To allow Organization users to perform operations on the vApp again disable maintenance mode.
This can be done by using the Cloud Director API's exitMaintenanceMode operation against the vApp in question.

Example steps to exit maintenance mode for a vApp as an Organization user would be as follows:

1. Retrieve the UUID of the vApp which is in maintenance mode, this can be seen in the URL in a browser after opening the vApp in the Cloud Director Tenant portal.

Example URL:
https://[Cloud Director FQDN]/tenant/ExampleOrg/vdcs/<VDC_UUID>/vapp/vapp-<VAPP_UUID>/general

vApp UUID:
vapp-########-####-####-####-########

2. Using the vApp UUID construct the URL for the exit maintenance mode operation for the vApp.

Example URL:
https://[Cloud Director FQDN]/api/vApp/vapp-########-####-####-####-########/action/exitMaintenanceMode

3. Log into the Cloud Director API as a System Administrator:

Request:
POST  https://[Cloud Director FQDN]/cloudapi/1.0.0/sessions/provider

Request Headers:
Accept:application/json;version=37.2
Authorization:Basic (Encoded username@system / password)

        NOTE: the API version in the Accept header is based on the Cloud Director version.

4. Copy the value of the response header X-VMWARE-VCLOUD-ACCESS-TOKEN which is our login Bearer token used for further requests.

Response Headers:
X-VMWARE-VCLOUD-ACCESS-TOKEN:##################

5. Using the constructed URL in step 2 and the authorization bearer token from step 4, send the API call to exit the vApp from maintenance mode:

Request:
POST  https://vcloud.example.com/api/vApp/vapp-########-####-####-####-########/action/exitMaintenanceMode

Request Headers:
Accept:application/json;version=37.2
Authorization:Bear #################

6. With the vApp out of maintenance mode Organization users should be able to perform operations.

Additional Information

For more information on connecting to the Cloud Director API see, How to establish an API connection VMware Cloud Director.