All groups are not available in the Entities dialog when starting a new recommendation

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Network Detection and Response
• VMware vDefend Firewall

Issue/Introduction

You are running NSX Application Platform (NAPP) version 4.2, and you are unable to find certain group(s) while selecting entities on the Start New Recommendation dialogue.

A group must have at least one of the following membership types to be eligible for context input for a Recommendation.

- VirtualMachine
- VirtualNetworkInterface
- SegmentPort
- Segment
- PhysicalServer
- LogicalSwitch
- LogicalPort

Go to Inventory>> Groups in NSX UI and check if the group(s) have any of the above. If not, the behavior is intended. Update the group members or try a different group. Otherwise, continue to the next section.

Environment

NSX Application Platform 4.2

Cause

The group list API applies a filter to exclude groups without supported member types. During config sync, messages regarding membership types are ignored, so when there are changes to a group's members, the member types will not be updated.

e.g. If a user initially creates a group with only IPs, the member type will be recorded as IP Address in postgres. Later, if the user adds VMs to the group, the member type will still remain IP Address because the group id/path does not change.

Resolution

- Create a background job that runs twice a day (12:00 am and 12:00 pm), to unconditionally add member type VirtualMachine to all groups in postgres. It will allow you to view all groups when you do Select Entities on the Start New Recommendation dialogue. However, this doesn't mean you can use any group as the context input for a Recommendation. The api will still query druid to verify the membership types for the selected group(s), and the request will be rejected if they don't have any supported membership types.

1. Use the following commands to check if the group membership is correctly set in postgres database

SSH to NSX manager as root.

$ GROUP_NAME=<Your Group Name>
$ napp-k exec postgresql-ha-postgresql-0 -- bash -c "export PGPASSWORD=\$POSTGRES_PASSWORD; psql -d pace -c \"select metainfo -> 'groupDisplayName' as group_name, metainfo -> 'membershipTypes' as membership_types from normalizedgroupconfig where metainfo ->> 'groupDisplayName' = '$GROUP_NAME';\""

If the membership types do contain any of the above supported member types by Recommendation, it means our filter api is not working as intended. Raise a new SR for the issue reference this KB and share the output of the above command. Otherwise, go to step 2

2. The below steps should be run on the NSX manager with root access.
Download the attachment workaroundForWrongGroupMemberTypes.tar.gz, transfer it to NSX Manager, and do the following to apply the patch.

    a. Verify the integrity of file (change the directory to where the file is copied)

        $ md5sum workaroundForWrongGroupMemberTypes.tar.gz
    The output should be 7211f90a60802652fe9f453642455599  

    b. Extract the tar

       $ tar xvf workaroundForWrongGroupMemberTypes.tar.gz
   
    c. cd into the folder

       $ cd groupMemberTypePatch
   
    d. Locate your kubeconfig file

       $ alias | grep napp-k
    alias napp-k='kubectl --kubeconfig <Your Kubeconfig File> -n nsxi-platform'

    e. Run the script (Copy the Kubeconfig path from the above step)

      $ ./add_group_member_type.sh --kubeconfig=<Your Kubeconfig File>

    Upon successfuly execution, your terminal should print something like below

    Using cronjob spec cronjob_add_supported_member_type.yaml
  Found clients image: ...
  Updated image url for the cronjob
  cronjob.batch/add-supported-member-type configured
  Successfully created cronjob

3. Once the background periodic job is created. Use the below command to immediately apply the updates. (Otherwise you may need to wait for up to 12 hours until all groups are updated.)

      $ napp-k exec postgresql-ha-postgresql-0 -- bash -c "export PGPASSWORD=\$POSTGRES_PASSWORD; psql -d pace -c \"update normalizedgroupconfig set metainfo = jsonb_insert(metainfo, '{membershipTypes, 0}', to_jsonb('VirtualMachine'::text)) where metainfo ->> 'groupDisplayName' is not null and jsonb_typeof(metainfo -> 'membershipTypes') = 'array' and not metainfo -> 'membershipTypes' ? 'VirtualMachine';\""

- Start a new recommendation from UI and you should see all groups available.

Additional Information

This issue will be resolved in future release.

Note: You will still not see system created(owned) groups in entities dialogue box. This is expected behavior.