Reconfigure VSAN file service domain task fails with unknown reason

Products

• VMware vSAN

Issue/Introduction

- Symptoms in vCenter server Web client reconfigure VSAN file service domain task fails with unknown reason

- in vCenter server /var/log/vmware/vsan-health/vmware-vsan-health-service.log you can see following error:

2025-03-19T06:40:45.809Z INFO vsan-mgmt[08897] [VsanScheduler::_ThreadMain opID=agw-0050730-2add-W52712] Executing itemListHead: ReconfigureFileServiceDomain-dfb4bbb4-15aa-418d-8a64-417dc4d96a1d: func: _ReconfigureDomain, {}, {}
2025-03-19T06:40:45.810Z INFO vsan-mgmt[08897] [VsanHealthUtil::VsanRunTaskFunc opID=agw-0050730-2add-W52712] Start running _ReconfigureDomain for task 'vim.Task:task-628549'
2025-03-19T06:40:45.823Z INFO vsan-mgmt[08897] [VsanPyVmomiProfiler::log opID=agw-0050730-2add-W52712] Profiler:
--- 
2025-03-19T06:40:46.113Z INFO vsan-mgmt[08897] [VsanClusterFileServiceSystemImpl::_ReconfigureDomain opID=agw-0050730-2add-W52712] Calling host fsnode01.example.local reconfigure domain dfb4bbb4-15aa-418d-8a64-417dc4d96a1d ...
2025-03-19T06:40:46.122Z INFO vsan-mgmt[08897] [VsanClusterFileServiceSystemImpl::_RunTasksOnHost opID=agw-0050730-2add-W52712] Running task ReconfigureFileServiceDomain on host fsnode01.example.local ...
2025-03-19T06:55:55.271Z ERROR vsan-mgmt[08897] [VsanHealthUtil::VsanRunTaskFunc opID=agw-0050730-2add-W52712] Failed to run _ReconfigureDomain for task 'vim.Task:task-628549'    <<<
2025-03-19T06:55:55.285Z INFO vsan-mgmt[08897] [VsanScheduler::_ThreadMain opID=agw-0050730-2add-W52712] Job done

- In ESXi  /var/run/log/vsanmgmt.log you can see following error:
2025-03-19T06:53:07.893Z Wa(12) vsand[15502848]: [opID=agw-0050730-2add-W52712-a02e-W2916647 VsanFileServiceSystemImpl::_waitForContainersUp] Container xxx.xxx.xx.xxx got failure: (vmodl.RuntimeFault) {
2025-03-19T06:53:07.893Z Wa(12)[+] vsand[15502848]: msg = 'Failed to startup container fsnode01: set_spn_failed ' <<< 
2025-03-19T06:53:07.893Z Wa(12)[+] vsand[15502848]: }. Keep waiting ..

Environment

VSAN 8.0

Cause

Active directory user account does not have sufficient privileges to set spn in AD server 

 

Resolution

Verify if the spn is existing in AD server
Example output
PS C:\Users\<ad domain user>> setspn.exe -Q <SPN> >>>>> in this case, SPN=nfs/<VSAN FS VM FQDN>
Checking domain DC=***,DC=***
CN=***,CN=Computers,DC=***,DC=***
        cifs/***.***.***
        nfs/***.***.***
        RestrictedKrbHost/***
        HOST/***
        RestrictedKrbHost/***.***.***
        HOST/***.***.***

Existing SPN found!

 

Add Active directory user account sufficient privileges to set spn in AD server. 

Additional Information

SPN (Service Principal Name) is a unique identifier for a service instance. It allows Kerberos authentication to associate a service with a specific account (usually a computer or user account) in the domain.