Latest ESXi patches not available in Lifecycle Manager

Products

VMware vCenter Server VMware Cloud Foundation

Issue/Introduction

LCM resync operation fails with error:

A general system error occurred: Download patch definitions task failed while syncing depots.
Error: 'integrity.fault.NoSignatureSiteConnection: Web sites:
http://dl.broadcom.com/<DownloadToken>/PROD/COMP/ESX_HOST/main/vmw-depot-index.xml;http://dl.broadcom.com/<DownloadToken>/PROD/COMP/ESX_HOST/vmtools-main/vmw-depot-index.xml;
hosting the patch definitions and patches cannot be accessed or have no patch data. Check the Internet connectivity.
Lifecycle manager logs shows errors similar to the following:

/var/log/vmware/vmware-updatemgr/vum-server/
YYYY-MM-DD HH:MM:SS WARNING imageService[140692060096064] [Downloader 214] Download failed: ('https://hostupdate.vmware.com/software/VUM/PRODUCTION/addon-main/addon/xxx/xxx-ESXi-x.x.x-Addon-cumulative_metadata.zip',
'/tmp/tmpxxxxxxx_', "HTTPSConnectionPool(host='hostupdate.vmware.com', port=443): Max retries exceeded with url: /software/VUM/PRODUCTION/addon-main/addon/xxx/xxx-ESXi-x.x.x-Addon-cumulative_metadata.zip
(Caused by ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 503 Service Unavailable')))")

Environment

VMware vCenter Server
VMware Cloud Foundation

Cause

The issue occurs because incorrect or incomplete vCenter Server Appliance (VCSA) proxy configurations block vLifecycle Manager from establishing a secure connection to the external Broadcom download depots.

Resolution

To resolve this issue, align the vCenter Server Appliance proxy configuration by completing one of the options below:

Option 1: Configure Proxy via the vCenter Server Management Interface (VAMI)
- Log in to the VAMI interface at `https://<vcenter_fqdn>:5480` using root credentials.
- Navigate to **Networking** > **Proxy**.
- Click **Edit** and enter the proxy settings.
- Ensure both the HTTP and HTTPS proxy protocols point to the identical proxy URL location.
- Save the configuration and verify the depot synchronization.
Option2: Manually Configure Advanced Proxy Settings via CLI (Required for NO_PROXY Exclusions)
- Connect to the vCenter Server Appliance via SSH using root credentials.
- Enable the bash shell by running the command:
  - ```
  shell
```
- Open the proxy configuration file using a text editor:
  - ```
  vi /etc/sysconfig/proxy
```
- Ensure the environment variables are correctly populated with identical case-sensitive server URLs or IP addresses:
  - ```
  HTTP_PROXY="http://<proxy_ip_or_fqdn>:<port>/"
  HTTPS_PROXY="http://<proxy_ip_or_fqdn>:<port>/"
```
- If local network traffic must bypass the proxy to prevent internal sync loops, configure the `NO_PROXY` variable manually within this file:
  - ```
  NO_PROXY="localhost, 127.0.0.1, .<local_domain>"
```
- Save and close the file.
- Restart the VCSA appliance.

Note: Not all possible configuration settings are exposed via VAMI UI. While the graphical interface allows setting a dedicated URLs for HTTP, HTTPS and FTP traffic, there is no way to set any exclusions for traffic to dedicated system to be routed directly, as there is no access to the required NO_PROXY option.

In addition, When configuring proxy settings, it's essential to set both HTTP_PROXY and HTTPS_PROXY variables to the same proxy URL. These environment variables ensure that both HTTP and HTTPS traffic are correctly forwarded through the proxy server..
Proxy configuration is case-sensitive. Ensure the hostname URL for the proxy server is entered correctly or use server IP address instead.