Adding a VxRail ESA clusters using WFO script fails with error " The provided customer-managed VMware vCenter Server root credential for vLCM enablement cluster is invalid"

Products

• VMware SDDC Manager

Issue/Introduction

• Unable to add an ESA VxRail cluster to an existing  (VCF) workload domain. During the validation phase of the WFO script, the process fails with the error: "The provided customer-managed VMware vCenter Server root credential for vLCM enablement cluster is invalid."
• /var/log/vmware/vcf/domainmanager/domainmanager.log
  

  INFO  [vcf_dm,69fb66268cec22dd757241f02d5a2b4e,3296] [c.v.v.secure.http.HttpClientService,dm-exec-12]  Response Body: {"id":"3dcf7279-d547-43f4-bed6-93338c297302","state":"STARTED","owner":"Day1BringUp","extension":{"stage":"","guidelines":[],"validation":{"cursory":{"errors":{"fields":[],"generals":[]},"warnings":{"fields":[],"generals":[]}},"thorough":{"errors":{"fields":[{"path":"vcenter.accounts.management.username","messages":["Cannot log into VMware vCenter Server using the provided user credentials."]},{"path":"vcenter.accounts.management.password","messages":["*****"]},{"path":"vcenter.accounts.root.username","messages":["The provided customer-managed VMware vCenter Server root credential for vLCM enablement cluster is invalid."]},{"path":"vcenter.accounts.root.password","messages":["*****"]}],"generals":[]},"warnings":{"fields":[],"generals":[]}}},"steps":[{"id":"vxm_system_services_stop","name":"VxRail Manager service stop","path":"vxm_system_services_stop","state":"COMPLETED","start_time":1778083386301,"end_time":1778083386336},{"id":"cursory_validator","name":"Cursory Validator","path":"cursory_validation.cursory_validator.cursory_validator","state":"COMPLETED","start_time":1778083386404,"end_time":1778083386540},{"id":"cursory_validation_report","name":"Cursory Validation Report","path":"cursory_validation_report","state":"COMPLETED","start_time":1778083386645,"end_time":1778083386696},{"id":"vc_certs_generate","name":"Generate VMware vCenter Server certification","path":"general_thorough_validation.thorough_group_validator.vc_certs_generate.external.vc_certs_generate","state":"COMPLETED","start_time":1778083387030,"end_time":17780833908
  ERROR [vcf_dm,69fb66268cec22dd757241f02d5a2b4e,3296] [c.v.v.v.c.f.a.WaitForVxRailFirstRunToComplete,dm-exec-12]  VxRail first run workflow is failed, errors : {vcenter.accounts.root.username=[The provided customer-managed VMware vCenter Server root credential for vLCM enablement cluster is invalid.], vcenter.accounts.root.password=[The provided customer-managed VMware vCenter Server root credent
  ial for vLCM enablement cluster is invalid.]}
  ERROR [vcf_dm,69fb66268cec22dd757241f02d5a2b4e,3296] [c.v.e.s.o.model.error.ErrorFactory,dm-exec-12]  [AIF63S] VXRAIL_FIRST_RUN_FAILED VxRail first run workflow is failed, errors : {vcenter.accounts.root.username=[The provided customer-managed VMware vCenter Server root credential for vLCM enablement cluster is invalid.], vcenter.accounts.root.password=[The provided customer-managed VMware vCenter Server root credential for vLCM enablement cluster is invalid.]}com.vmware.evo.sddc.orchestrator.exceptions.OrchTaskException: VxRail first run workflow is failed, errors : {vcenter.accounts.root.username=[The provided customer-managed VMware vCenter Server root credential for vLCM enablement cluster is invalid.], vcenter.accounts.root.password=[The provided customer-managed VMware vCenter Server root credential for vLCM enablement cluster is invalid.]}
          at com.vmware.vxrail.vcf.clustermanager.fsm.actions.WaitForVxRailFirstRunToComplete.pollVxRailFirstRun(WaitForVxRailFirstRunToComplete.java:226)
          at com.vmware.vxrail.vcf.clustermanager.fsm.actions.WaitForVxRailFirstRunToComplete.pollVxRailFirstRun(WaitForVxRailFirstRunToComplete.java:271)
          at com.vmware.vxrail.vcf.clustermanager.fsm.actions.WaitForVxRailFirstRunToComplete.pollVxRailFirstRun(WaitForVxRailFirstRunToComplete.java:271)

  
  
  

Cause

The root cause is a credential mismatch for the vCenter root account within the input JSON file used by the WFO script.

Resolution

To resolve this issue, the JSON input file must be synchronized with the active vCenter credentials:

1. Retrieve Current Credentials:
   • Log into the SDDC Manager via SSH as the vcf user.
   • Run the command: 
     lookup_passwords
   • Identify the current root and management passwords for the target vCenter Server. For more info on lookup_passwords 
2. Validate account access:
   • Log into the vCenter VAMI (https://<VC-IP>:5480) using the root account with the password retrieved in Step 1.
3. Update the Input JSON:
   • Locate the bring-up JSON file used by the WFO script.
   • Update the following fields with the verified passwords:
     • vcenter.accounts.management.password
     • vcenter.accounts.root.password
4. Perform a Dry Run:
   • Execute the WFO script