After SSPI upgrade, change data center name and re-connect vCenter, new nodes could not get any IPs

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

After SSPI (Security Service Platform Installer) upgrade, after changing the data center name and re-connecting vCenter, new nodes could not get any IPs. "antrea-agent" pods in the "kube-system" on workload cluster are crashing.

The configmap "cloud-config" in "kube-system" on the workload cluster is using datacenter name instead of datacenter moref id reference

Environment

Security Service Platform Installer 5.1

Cause

During the Security Service Platform Installer upgrade, the configmap "cloud-config" will be re-generated using cpi-manifest based on the clusterctl-init.yaml. We are using data center name in the clusterctl-init.yaml and overwrite the cloud-config with datacenter moref id reference during deployment. So re-generated configmap "cloud-config" will still use datacenter name instead of moref id reference. 

In this case, after we change the data center name, antrea-agent could not find the datacenter with the old name stored in the configmap "cloud-config". As a result, it could not assign IP to the new nodes. 

Resolution

Update configmap "cloud-config" in the namespace "kube-system" on the workload cluster with datacenter moref id reference.

The datacenter moref id reference format looks like: Datacenter:<dc-moref-id>.

For example:

After the edit, please wait for the nodes to be recreated. The recreated node will get the IP.

Datacenter moref id reference can be found from vCenter. We can go to vCenter and click the target data center. From the URL, we can see the moref id reference.

For example: