How to handle "Tanzu Application Catalog: token expiration notification"

Products

• VMware Tanzu Application Catalog
• VMware Tanzu Application Catalog Subscription

Issue/Introduction

For customers who are using TAC, they may receive the email notification "Tanzu Application Catalog: token expiration notification" and content as below -

Dear Customer,

You are receiving this notice because you have a private Google Artifact Registry configured and hosted for you by Broadcom for your Tanzu Application Catalog artifacts. We are writing to let you know about a change in our key rotation policy that will require your attention.

Since October 2024, all Google Artifact Registries hosted for customers by Broadcom must rotate their access credentials every three months. This change brings us into alignment with Broadcom security policy.

To make this change as smooth as possible, we will send email notifications seven days prior to and on the day of your key expiration. Once your key has expired, you will see a message in the Tanzu Application Catalog user interface that you must regenerate your access key.

If you have any questions or concerns about this change, please submit a support request and we will address them as soon as possible.

Best Regards,
Tanzu Application Catalog Team

Cause

The registry is optional, some customers configured others not. The main change is the tokens did not expire previously and now will expire every 3 months.

Resolution

The hosted registry is the VMware Managed Registry in the TAC portal, screen-shot as below -

For customers who have a hosted registry configured and tokens, they need to regenerate token via Registries -> Managed Registry -> Details -> Credentials. Then, they can create new tokens or revoke existing ones.