VCFA upgrade prechck fails for SSH connectivity of the vmware-system-user

Products

• VCF Operations
• VCF Automation

Issue/Introduction

• When running a precheck under Build - Lifecycle - VCF Management - Upgrade in VCF Operations it fails with the following error message:
  
  SSH connection failed to server <VCFA_FQDN> [VCFMS-PRECHECK-IMPORT-SSH-004]"

 

Environment

Product: VCF 9.1
Component: VCF Operations 9.1, VCF Automation 9.0.x

Cause

As part of the precheck workflow a pod-hosted script 'component-action-import-connectivity-xxxx-execute-script-xxxxxxxxx' is run in the vmsp-platform namespace that tests SSH connectivity to the VCF Automation appliance This script retrieves the vmware-system-user password from the vcf-iam-vcfa-admin secret in the vcf-sddc-lcm namespace.

The password being used as part of the precheck is incorrect or contains unsupported special characters.

Resolution

Confirmation

Firstly, verify the issue is matches. 

1. SSH to the Control Plane node of the VMSP cluster as vmware-system-user.
2. Switch to root (you will be prompted to re-enter the vmware-system-user password
   

   sudo -i

3. List the 20 most recently created pods in the vmsp-platform namespace to locate the component-action-import-connectivity pod (it should be in an Error state):
   

   kubectl get pods -n vmsp-platform --sort-by=.metadata.creationTimestamp | grep -iv running | tail -20

4. Grab the exact pod name from the previous step (e.g., component-action-import-connectivity-####-execute-script-####) and check its logs:

   kubectl logs component-action-import-connectivity-xxxx-execute-script-xxxxxxxxx -n vmsp-platform:

5. Look for an output similar to this. Note the task-import secret name at the end:
   
   2026/05/25 09:31:21 INFO {secret_id} Checking SSH connection
2026/05/25 09:31:57 ERROR {secret_id} SSH: Failed to connect to <VCFA-FQDN>
2026/05/25 09:31:50 INFO {secret_id} Attempting to update precheckMessages in secret task-import-{secret_id}
2026/05/25 09:31:50 INFO {secret_id}Successfully updated precheckMessages in secret task-import-{secret_id}

 

Resolution

Once confirmation of the SSH failure is achieved, proceed with the following steps to update the credentials.

1. Log into all VCFA nodes and set a simpler password for the vmware-system-user.
2. The secret for the VCFA password is kept in the vcf-sddc-lcm namespace in the vcf-iam-vcfa-admin secret
3. List the attributes of this secret:
   

   kubectl get secret vcf-iam-vcfa-admin -o yaml -n vcf-sddc-lcm
   

4. Note the clientSecret hash value, output will be similar to below (truncated):
   

   piVersion: v1
   data:
   clientId: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
   clientSecret: ########################
   kind: Secret
   metadata:
   annotations:
   

5. Create a hash of the simpler password previously configured on the VCFA nodes:
   

   echo <new_password_here> | base64 -w 0

6. Edit the vcf-iam-vcfa-admin secret and replace the hash value for clientSecret with the newly generated hash:
   

   kubectl edit secret vcf-iam-vcfa-admin -n vcf-sddc-lcm

7. Reconfigure the vmware-system-user in the VCF Operations UI: Navigate to

   Build -> Lifecycle -> VCF Management -> Upgrade

8. Click the Actions ellipsis (...) and select Reconfigure.
9. Enter the new password.
10. Run the precheck again to confirm the SSH connectivity issue is resolved.