WCP service fails to start in vCenter Server due to incorrect entry for the reverse HTTP proxy port in /etc/vmware/wcp/wcpsvc.yaml

Products

• VMware vCenter Server
• VMware vCenter Server 7.0
• VMware vCenter Server 8.0

Issue/Introduction

This article provides a solution to the specific issue outlined under "Symptoms".

Symptoms:

• The WCP (Workload Control Plane) service fails to start
• As a result, you cannot set any ESXi host in maintenance mode using vCenter Server
• wcp core dump files are written in /var/core
• /var/log/vmware/wcp/wcpsvc.log contains the following entries:

[YYYY-MM-DDTHH:MM:SS]Z error wcp [opID=vapi] Security Context missing in the request 
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] SecurityContext not passed in the request. Creating an empty security context
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] opId was not present for the request 
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Handling new request with input {"STRUCTURE":{"operation-input":{}}} 
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Service specific authorization scheme for com.vmware.vapi.std.introspection.service not found. 
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Service specific authorization scheme for com.vmware.vapi.std.introspection.service not found. 
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Could not find package specific auth scheme for com.vmware.vapi.std.introspection.service 
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Authn scheme Id is not provided but NO AUTH is allowed hence invoking the operation 
[YYYY-MM-DDTHH:MM:SS]Z error wcp [opID=vapi] SecurityCtx doesn't have property AUTHN_IDENTITY
[YYYY-MM-DDTHH:MM:SS]Z error wcp [opID=vapi] Invalid authentication result 
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Skipping authorization checks, because there is no authentication data for: com.vmware.vapi.std.introspection.service.list
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Searching for service com.vmware.vapi.std.introspection.service 
[YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Searching for operation list [YYYY-MM-DDTHH:MM:SS]Z debug wcp [opID=vapi] Validating input

• /var/log/vmware/wcp/wcpstdstream.log.stderr log contains the following entries:

Starting service process with pid: 12360.
time="YYYY-MM-DDTHH:MM:SSZ" level=info msg="registering actuator TKG Content Library Creation"
time="YYYY-MM-DDTHH:MM:SSZ" level=info msg="registering actuator Entity Permissions"
time="YYYY-MM-DDTHH:MM:SSZ" level=info msg="registering actuator CPVM Creation"
time="YYYY-MM-DDTHH:MM:SSZ" level=debug msg=" [BEGIN] [main.main:204] main"
time="YYYY-MM-DDTHH:MM:SSZ" level=debug msg=" [ END ] [main.main: 204] [1.338515ms] main"
panic: Invalid config file /etc/vmware/wcp/wcpsvc.yaml: yaml: unmarshal errors:
line 19: cannot unmarshal !! map into int

Environment

VMware vCenter Server 7.0.x
VMware vCenter Server 8.0.x

Cause

This issue is caused by an incorrect entry for the reverse HTTP proxy port in /etc/vmware/wcp/wcpsvc.yaml

 

In essence, the reverse HTTP proxy acts as the critical gateway for WCP's network interactions. Any misconfiguration in its port definition within wcpsvc.yaml directly compromises its ability to establish network listeners, route traffic, and communicate with its own components and external clients, thus preventing the entire WCP service from successfully starting and becoming operational.

Resolution

The following points address and resolve the issue:

1. Connect to the VCSA using SSH using the root username and password.

2. Create a backup of the "wcpsvc.yaml" file:

# cp /etc/vmware/wcp/wcpsvc.yaml /etc/vmware/wcp/wcpsvc.yaml.bak

3. Edit the "wcpsvc.yaml" file using vi:

# vi /etc/vmware/wcp/wcpsvc.yaml

4.  Find and change the follow entry using the insert command pressing "i":

rhttpproxy_port: {rhttpproxy.ext.port2}

    to
 
rhttpproxy_port: 443

5.  Exit insert mode by pressing "esc" and then save the file by pressing ":wq!":

Example output shown in the following screenshot:
 

 

Note: Please ensure that there is a space between the colon (":") and "443"
 

6. To apply this change, restart the WCP service:

# service-control --restart wcp