Unable to activate features on SSP - No Valid license available banner message seen.
search cancel

Unable to activate features on SSP - No Valid license available banner message seen.

book

Article ID: 393412

calendar_today

Updated On:

Products

VMware vDefend Firewall with Advanced Threat Prevention VMware vDefend Firewall

Issue/Introduction

Onboarding the NSX Manager to the Security Services Platform (SSP) fails because of a stale or unreachable helm registry configured on NSX.

Symptoms

  • In the SSP-UI, under NSX Managers -> Connectivity Agent -> View Details, both Infrastructure Sync and Inventory Sync are in a DOWN/Unknown state after onboarding the NSX manager.

  • A banner appears at the top of the screen stating: "No valid license available".

  • The Readiness status shows "Not Ready".

  • Restarting the proton service does not resolve the issue.

  • When checking the logs from the SSP-Installer VM via SSH (root credentials), reconciler errors are visible.

How to Check Live Logs:

  1. SSH into the SSP-Installer VM using root credentials and run:

    k -n nsxi-platform get pods | grep site-service

  2. Copy the site-service pod name from the output and run:

    k -n nsxi-platform logs <site-service-pod-name-copied> | grep -i "reconciler error"

Impact

  • Features cannot be activated.

Environment

 

  • vDefend Security Services Platform: 5.0

  • NSX: 4.2.0.x, 4.2.1.x

 

Cause

A stale or unreachable helm registry configured on NSX causes a conflict when onboarding it to the Security Services Platform.

  • Support Bundle Log Location: /var/log/ssp/supportbundle/*/site-service-*.log

  • Live Command: k logs deploy/site-service -n nsxi-platform

Depending on your environment, you may see one of the following three log patterns:

1. Not Reachable (Private or Public repo is no longer reachable)

2025-04-03T15:18:31.235Z        ERROR   Reconciler error        {"request": {"name":"ee9c8efa-03af-495f-865b-4f602b1d7151","namespace":"nsxi-platform"}, "reconcileID": "d04c820c-9785-4177-a6e9-cec29231d2de", "error": "subreconciler reconcileSetPlatformDeploymentConfig failed: failed to set fields in PlatformDeploymentConfig: error while executing API call to https://nsx-ee9c8efa-03af-495f-865b-4f602b1d7151/policy/api/v1/infra/sites/default/napp/deployment/platform: {\n  \"httpStatus\" : \"BAD_REQUEST\",\n  \"error_code\" : 46011,\n  \"module_name\" : \"NAPP\",\n  \"error_message\" : \"Helm add repo operation failed. Error: looks like https://projects.registry.vmware.com/v2/nsx_application_platform/helm-charts/ is not a valid chart repository or cannot be reached: Get https://projects.registry.vmware.com/v2/nsx_application_platform/helm-charts/index.yaml: dial tcp: lookup projects.registry.vmware.com on ab.cd.ef.gh:53: server misbehaving\\\\n\"\n}"} sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler         external/io_k8s_sigs_controller_runtime/pkg/internal/controller/controller.go:324 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem         external/io_k8s_sigs_controller_runtime/pkg/internal/controller/controller.go:265 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2         external/io_k8s_sigs_controller_runtime/pkg/internal/controller/controller.go:226

2. Repo Not Found (Non-OCI)

ERROR\tReconciler error\t{\"request\": {\"name\":\"1d2176d3-2dc4-4739-af49-ee151043b3f8\",\"namespace\":\"nsxi-platform\"}, \"reconcileID\": \"a346ef90-49db-4f6e-9d80-88494ef01fb1\", \"error\": \"subreconciler reconcileSetPlatformDeploymentConfig failed: failed to set fields in PlatformDeploymentConfig: error while executing API call to https://nsx-1d2176d3-2dc4-4739-af49-ee151043b3f8/policy/api/v1/infra/sites/default/napp/deployment/platform: {\\n  \\\"httpStatus\\\" : \\\"BAD_REQUEST\\\",\\n  \\\"error_code\\\" : 46011,\\n  \\\"module_name\\\" : \\\"NAPP\\\",\\n  \\\"error_message\\\" : \\\"Helm add repo operation failed. Error: looks like https://projects.registry.vmware.com/chartrepo/nsx_application_platform is not a valid chart repository or cannot be reached: failed to fetch https://projects.registry.vmware.com/chartrepo/nsx_application_platform/index.yaml : 404 \\\\\\\\n\\\"\\n}\"}"

3. Certificate Error (Private harbor repository certificate changed or expired)

2025-04-03T15:22:04.880Z        ERROR   Reconciler error        {"request": {"name":"ee9c8efa-03af-495f-865b-4f602b1d7151","namespace":"nsxi-platform"}, "reconcileID": "f0abc6f0-99dc-44b3-9cb4-5cb8a043a0d0", "error": "subreconciler reconcileSetPlatformDeploymentConfig failed: failed to set fields in PlatformDeploymentConfig: error while executing API call to https://nsx-ee9c8efa-03af-495f-865b-4f602b1d7151/policy/api/v1/infra/sites/default/napp/deployment/platform: {\n  \"httpStatus\" : \"BAD_REQUEST\",\n  \"error_code\" : 46011,\n  \"module_name\" : \"NAPP\",\n  \"error_message\" : \"Helm add repo operation failed. Error: looks like https://projects.registry.vmware.com/v2/nsx_application_platform/helm-charts/ is not a valid chart repository or cannot be reached: Get https://projects.registry.vmware.com/v2/nsx_application_platform/helm-charts/index.yaml: tls: failed to verify certificate: x509: certificate signed by unknown authority\\\\n\"\n}"} sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler         external/io_k8s_sigs_controller_runtime/pkg/internal/controller/controller.go:324 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem         external/io_k8s_sigs_controller_runtime/pkg/internal/controller/controller.go:265 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2         external/io_k8s_sigs_controller_runtime/pkg/internal/controller/controller.go:226

Resolution

Resolution

Note: This issue is officially fixed in the next release of SSP (SSP 5.1).

For Non-Airgapped Environments:

If your NSX Manager is not airgapped, execute the following API call directly on the NSX manager to remediate the issue:

curl --location --request PUT 'https://<nsx-manager-ip>/policy/api/v1/infra/sites/default/napp/deployment/registry/reset' -u admin --insecure

When prompted, enter the host password for the admin user.

Troubleshooting:

If onboarding still fails after the step above, or if the API returns an error similar to:

JSON
 
{ 
  "httpStatus": "BAD_REQUEST", 
  "error_code": 46014, 
  "module_name": "NAPP", 
  "error_message": "Helm search chart operation failed. Exception occurred while calling get tags. Please refer to logs for more details." 
}

Please raise a support ticket with Broadcom for further remediation steps.

This issue is tracked internally through #3506095

Powered by Wolken Software