Error: "Unable to create replica placeholder disk..." when configuring a replication for an encrypted VM

Products

• VMware Cloud Director

Issue/Introduction

• When configuring a replication for an encrypted VM in VMware Cloud Director Availability (VCDA), the task fails and you see an error similar to:
  
  Unable to create replica placeholder disk '[<datastore-name>] C4-########-####-####-####-########2868/<vm-name>.vmdk'.
  
  
• In the /opt/vmware/h4/cloud/log/cloud.log file on the destination Cloud Director Replication Management Appliance, you see entries similar to:
  
  2024-08-21 14:03:26.433  WARN - [UI-########-####-####-####-########1367-r1155-wX-OH-xR-EU] [job-81] c.v.h.c.e.ExceptionConversionService     : Unable to convert exception. Using fallback exception instead.

com.vmware.vim.binding.vmodl.fault.SystemError: A general system error occurred: Key locator error
        at jdk.internal.reflect.GeneratedConstructorAccessor567.newInstance(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499)
        ...

2024-08-21 14:03:26.433 ERROR - [UI-########-####-####-####-########1367-r1155-wX-OH-xR-EU] [job-81] com.vmware.h4.jobengine.JobExecution     : Task ########-####-####-####-########c3d9 (WorkflowInfo{type='setupDestination', resourceType='replication', resourceId='H4-########-####-####-####-########0ea6', isPrivate=false, resourceName='null'}) has failed

com.vmware.h4.replicator.api.exceptions.FailedToCreateReplicaPlaceholderDiskException: Unable to create replica placeholder disk '[<datastore-name>] C4-########-####-####-####-########2868/<vm-name>.vmdk'.
        at com.vmware.h4.replicator.replication.util.DiskHelper.lambda$makeDisk$1(DiskHelper.java:183)
        at com.vmware.h4.replicator.util.MonitorBackedTaskHelper.awaitSuccess(MonitorBackedTaskHelper.java:60)
        at com.vmware.h4.replicator.util.MonitorBackedTaskHelper.awaitSuccess(MonitorBackedTaskHelper.java:48)
        ...
  
  
• This issue occurs when you are replicating encrypted VMs between two VMware Cloud Director (VCD) sites with the VMware Cloud Director Encryption Management (VCDEM) add-on.

Environment

• VMware Cloud Director Availability 4.x
• VMware Cloud Director 10.x
• VMware Cloud Director Encryption Management 1.1.0
• VMware Cloud Director Encryption Management 1.2.1

Cause

This issue occurs because the the key provider published for the source and destination Organizations using VMware Cloud Director Encryption Management have different names and one of the requirements for the replication of encrypted VMs in VMware Cloud Director Availability is that the source and destination KMS names match.

Resolution

• This issue is resolved in VMware Cloud Director Encryption Management 1.2.0, available at Broadcom Downloads.
• In VMware Cloud Director Encryption Management 1.2.0, you can publish a key provider with a custom name allowing you to manually configure the source and destination with matching KMS names. 
• Please note that if you're using version 1.2.1 you may encounter similar issues with this functionality.
• This is a known issue that Broadcom Engineering is actively addressing. We recommend subscribing to the related KB article to stay
  informed about future updates.

 

Additional Information

The custom name option was not available in version 1.1.0 and was introduced starting with version 1.2.0 through the publish with custom name feature.

For more information about the prerequisites for replicating encrypted VMs in VMware Cloud Director Availability, see Create a replication for encrypted virtual machines.

For more information about the changes in VMware Cloud Director Encryption Management 1.2.0, see What's new in VMware Cloud Director Encryption Management 1.2.