Cloud Director managed vApp VMs in Reservation model Organization VDCs become unresponsive due to their memory limit being set to zero

Products

• VMware Cloud Director

Issue/Introduction

Symptoms:

• After powering on a vApp VM in Cloud Director the guest OS fails to boot successfully and is generally unresponsive.
• The vApp VM is deployed in a Reservation model Organization VDC.
• The vApp VM is deployed from a vApp Template VM from a Catalog which is not backed by a Reservation model Organization VDC.
• The issue does not occur when deploying vApp VMs in Allocation Pool, Pay-As-You-Go, or Flex model Organization VDCs.
• The issue does not occur when deploying vApp VMs as a System Administrator user, only Tenant users within the Organization are affected.
• At the vSphere level the VM's memory limit is set to zero.

Environment

VMware Cloud Director for Service Provider 10.x

Cause

If a source vApp Template VM is located in a Catalog backed by a non-Reservation model Organization VDC, and the source vApp Template VMs have a memory limit set to zero then this issue can occur.
When a Tenant user in an Organization attempts to deploy a new vApp VM from this vApp Template VM in a Reservation model Organization VDC the deployed vApp VMs are not updated with a valid memory limit and retain the zero value.
This occurs due to an issue where the Tenant user in an Organization currently requires their Role to have the "Edit VM CPU and Memory Reservation / Limit / Shares in all VDC types" Right.
Without it the the memory limit cannot be updated to a valid value and remains at zero.

Resolution

This is a known issue affecting Cloud Director 10.x.
It is resolved in the 10.1.3 release of Cloud Director as outlined in the release notes, VMware Cloud Director 10.1.3 Release Notes.

Workaround:

To workaround the issue add the "Edit VM CPU and Memory Reservation / Limit / Shares in all VDC types" Right to the affected Organization and user Roles.
To assign the "Edit VM CPU and Memory Reservation / Limit / Shares in all VDC types" Right to an Organization we can use the Rights Bundle functionality outlined in the Cloud Director documentation here, Managing Rights Bundles.
Once the Right is available within the affected Organization we can add the "Edit VM CPU and Memory Reservation / Limit / Shares in all VDC types" Right to the user Roles to make it available to the users as per the Cloud Director documentation here, View and Edit a Global Tenant Role.

Example steps using the "Default Rights Bundle" to add the RIght to Organizations would be as follows:

1. Log into the Cloud Director Provider UI as a System Administrator and navigate to Administration > Tenant Access Control > Rights Bundles.
2. Edit the "Default Rights Bundle" to include the "Edit VM CPU and Memory Reservation / Limit / Shares in all VDC types" Right under the Compute > vApp section.
3. Delete any "Legacy Rights Bundles" for the Organizations as these will stop the use of the "Default Rights Bundle" for those Organizations.
4. Publish the "Default Rights Bundle" to all Tenants or a subset of Tenants as desired.
5. Still within the Cloud Director Provider UI as a System Administrator navigate to Administration > Tenant Access Control > Global Roles.
6. Edit Global Roles in use by affected Organization Users and add the "Edit VM CPU and Memory Reservation / Limit / Shares in all VDC types" Right.
7. Publish these Global Roles to the affected Tenants.
8. Confirm within the Organizations' Tenant UIs, under Administration > Access Control > Roles that the published Roles include the "Edit VM CPU and Memory Reservation / Limit / Shares in all VDC types" Right under the Compute > vApp section.
9. Log in as Tenant users to the Cloud Director Tenant UIs for the affected Organizations and confirm that the correct limits are seen after deploying vApp VMs from vApp VM Templates.