Retrieve the service accounts credentials from SDDC Manager

Products

• VMware Cloud Foundation
• VMware SDDC Manager / VCF Installer

Issue/Introduction

This article details the procedure for retrieving ESXi ,NSX Manager and vCenter service account credentials from the SDDC Manager database. This is required for manual credential management or resolving connectivity issues when service accounts are desynchronized. Some of the scenarios are listed below:

• Unable to SSH into an ESXi host or NSX manager with the stored root credentials on SDDC Manager.
  
  
• One or more service accounts (svc-<####>-<####>) for managed components like NSX Manager, vCenter or ESXi host(s) are disconnected on the Password Management page of the SDDC Manager 

Resolution

 

1. SSH into the SDDC Manager with vcf user and use su to elevate to root
   
   
2. Create a token on the SDDC Manager.

   TOKEN=$(curl -d '{"username" : "<sso_username>", "password" : "<sso_password>"}' -H "Content-Type: application/json" -X POST http://127.0.0.1/v1/tokens | jq -r '.accessToken')

   
   The <sso_username> needs to be replaced with [email protected] or admin@local account with the respective password in <sso_password>
   
   
3. Pull the credential details for all the service accounts from SDDC Manager using the TOKEN.

   curl -k -X GET -H "Authorization: Bearer "$TOKEN"" --insecure 'https://localhost/v1/system/credentials/service' | json_pp | less

   
   Sample output

   {
         "serviceType" : "SDDC_MANAGER",
         "entityId" : "9189####-####-####-####-########8251",
         "username" : "svc-vcf-####-##",
         "id" : "688d####-####-####-####-########ad5e",
         "entityType" : "ESXI",
         "targetType" : "ESXI",
         "serviceId" : "2f7a####-####-####-####-########cb79",
         "secret" : "##############",
         "credentialType" : "SSH",

4. Locate the secret value in the output for the desired svc account (svc-<####>-<####>) and user serviceType and entityType (e.g., ESXI or NSX).

Additional Information

Once the service account password for the desired component has been retrieved, utilize it to connect to the desired component(ESX, NSX, vcenter and so on) to clear out a root lockout or to reset the root password.