Disconnect Subscribed vCenter Servers from vSphere+ Cloud Console and Apply License Keys

Products

• VMware vCenter Server
• VMware vCenter Server 8.0

Issue/Introduction

The aim of this article is to facilitate a smoother transition for vSphere+ users  from the current keyless cloud-connected model to a key-based disconnected subscription model, ensuring seamless business continuity throughout the process.

Symptoms:

After Broadcom's acquisition of VMware, our shared goal is to focus and invest in on-premises products as published in earlier blog posts by Krish Prasad and Rick Walsworth.

 vSphere+ users who have connected their vCenter servers to the Cloud Console are encouraged to migrate from SaaS to on-premises deployments to benefit from our product investments and roadmap.

This article helps vSphere+ Cloud users disconnect their vCenter Servers and apply on-premise license keys.

Cause

To support users to remove vSphere+ capabilities in brownfield deployments and move vSphere environment to termed license mode.

Resolution

The proposed solution is to disconnect the vCenter from the GW/Cloud and remove the subscription so that the customer can apply license keys. А vCenter API is available for this.

Note:

• If the vCenter is disconnected, no GW changes are required.
• If the vCenter isn't subscribed to vSphere+ Cloud, then no vCenter changes are necessary either.
• Please ensure downtime is taken for all the VCs that are part of a single vSphere+ Cloud gateway instance & run the script on all of the vCenter Servers to add the appropriate new licenses (available on the Broadcom Support Portal under "My Entitlements")
• Should you have any specific questions regarding specific licenses and/or entitlement, you will need to reach out to Broadcom Global Customer Advocacy (GCA) for non-technical and license questions:
  • Create a Non Technical case for Support Portal / License / Contract related issues

Steps:

1. Obtain the necessary new license keys for: 

NOTE: These licenses are needed during the procedure below when you disconnect/unsubscribe your vCenter infrastructure from vSphere+ Cloud:

• The keys will be available on the Broadcom Support Portal under "My Entitlements".
  or
• Contact Broadcom Global Customer Advocacy for questions around licensing and entitlements.  
  • Create a Non Technical case for Support Portal / License / Contract related issues

 

NOTE: During the following process, the system will transition into an unlicensed state.  To avert any potential side effects, the process of adding the on-premise license keys must remain streamlined. Therefore, it is advised that the customer identifies their on-premise license keys in advance.

vCenter Server licenses will show the product name like: VMware vCenter Server ...

ESXi licenses will show the product name like: VMware vSphere ...

2. Prepare for maintenance and possible downtime.

• Once the script is executed, the vCenter system will transition into an unlicensed state (assigned evaluation licenses valid for 60 days).  To avert any potential side effects, the process of adding the on-premise license keys must remain streamlined. Therefore, it is advised that the customer possesses their on-premise license keys in advance. (see Step 1)
• Ensure we have a snapshot of the vCenter Server.
• If the vCenter Server is part of ELM, take offline snapshot of all the vCenter Servers which are part of the setup.

      NOTE:  Once the script is executed, the vCenter and ESXi hosts will be assigned evaluation licenses valid for 60 days. Users should add their new licenses as soon as possible. 
                   Hosts built more than 60 days before the licensing change will disconnect from the vCenter Server between 0 seconds and one hour of the performing the script.
                   For any disconnected hosts: Reconnect the hosts to vCenter as needed and assign the new license key when prompted while connecting the host.


3. Download the attached delete-subscription.sh file from the attachments section of the iKB.

• Upload the script on the vCenter Server, preferably in /tmp
• Modify the script to be executable using the command: chmod +x delete-subscription.sh.
• Execute the script using this syntax: ./delete-subscription.sh <vc_fqdn>


• Possible errors when running the script:
  • If the error 'bash:  ./delete-subscription.sh: /bin/bash^M: bad interpreter: No such file or directory' is reported when the script is run, it is caused by DOS carriage returns that are added to the script when copying the script file from a Windows-based text editor. 
    To resolve this problem, run the following command and then rerun the script:  sed -i -e 's/\r$//' delete-subscription.sh
    
    
  • If it gets an error running the script with a message of: [priority='ERROR' thread=' ' user=' ' org=' ' trance=' ' ] Response code is: 400. Response: Bad Request., it is due to an invalid character(s) that are used in the local SSO admin password (i.e. [email protected]).
    Change the administrator password if it contains any of the following invalid characters:
    
    • & (ampersand)
    • ; (semicolon)
    • " (double quotation mark)
    • ' (single quotation mark)
    • ^ (circumflex)
    • \ (backslash)
    • % (percentage)
      
      
      

4. Power off the GW to sever the connection from GW to vCenter. This will prevent automatic re-subscription from the GW.

5. Execute the application of license keys to all assets within the virtual environment from the vCenter Web UI.

The assignment of the new licenses should happen in this order:

• Add on-premise license to vCenter.
• Add on-premise licenses to all ESXi hosts.
• Add any relevant licenses to vSAN
• Reconnect those ESXi hosts "if" they were disconnected during this process

6. Delete the GW VM. Do not power it back on.

7. Script will only remove the subscription of vCenter Server with vSphere+. We will need to manually remove all the CloudGateway service accounts (with prefix: CloudServicesGateway) from vCenter Server.

• Login to vCenter Server UI using your administrator SSO credentials.
• Navigate to Administration > Users and Groups > Select the domain you use for your “local SSO".
• Use the Find bar to Filter Users with CloudServicesGateway prefix.  Delete the user accounts.
• Similarly Go to Administration > Global Permission > CloudServicesGateway permissions > Select the permissions > Delete.

Please Note:

• Users running on vSphere 7.x will need to downgrade their new licenses received as they are issued as version 8.x.
• Ensure that the newly received license keys are assigned to the VCs & ESXi hosts at the earliest as once the temp license expires, the hosts will get disconnected from the vCenter.

Fail back Process:
In case of failure, follow below steps to roll back the change:

1. Power on the cloud gateway and validate that the VCs are in connected state on cloud portal.
2. In case VC goes down, power off the VCs and revert the snapshot of all the linked VCs and power them back on and re-validate the connection.
   
   

To license vSAN Witness nodes, please follow the steps below:

With vSphere+, the witness nodes were recognized as ESXi hosts, and licenses were allocated to them accordingly. Therefore, after executing the script, the witness appliance is anticipated to have an evaluation license.

To resolve this issue, it will need to redeploy the witness node and re-add it to the vSAN cluster to ensure it receives the default embedded license.

Deploy Witness Node:

Deploy a new witness appliance by getting the desired Version via the following steps:

1.) Log into the customer portal: https://support.broadcom.com/contact-support.html
2.) On the left side select "My Downloads"
3.) Select "VMware Cloud Foundation" on the upper right corner or the web page (located besides 'Account Name')
4.) In the Product Selection, select "VMware vSAN"
5.) Select the desired Version
6.) Select the section "Drivers & Tools"
7.) Look for desired Version of "VMware vSAN Witness Appliance"
8.) Select the arrow on the right side to expand the entry
9.) Download the desired Version