How to fix Privilege Issues in Data Services Manager (DSM) when operations fail with "InsufficientPrivileges"

Products

• VMware Data Services Manager

Issue/Introduction

VMware Data Services Manager (DSM) Service Accounts are used to interact with and manipulate vCenter objects.

If the required privileges are missing, certain operations which are dependent on those privileges will fail to be executed.

 

For example, if the "Guest Operations" privileges are missing (as shown in the "unchecked" state), you will not be able to create support bundles.

"Create Support Bundle" flow failed to be executed end to end.

 

 

Note for Upgrades from Pre-9.1.1 Versions:
When upgrading to version 9.1.1, you may encounter a permission drift issue. This will trigger the following error message in the user interface

 

and the VCenterPermissionsReady condition status of the VCenterbinding CR will display as False(`Ready` condition of VCenterbinding CR might be OK since it is a separate condition), and show the same error message with which detailed privileges are missing

 

This behavior occurs because the 9.1.1 release introduces:

• A new automatic permission verification mechanism.
• Additional required permissions to enhance system functionality(such as support bundle)

Environment

VMware Data Services Manager

Cause

The required vCenter privileges for that specific operation or task are missing from the service account.

Resolution

For versions prior to 9.1.1(excluding 9.1.1)
Manually restore the privileges via the vSphere UI:

• Navigate to the service account role settings.
• Click Edit and add the missing privileges (using the Support Bundle privileges listed above as an example).

 

 

For 9.1.1 version and higher (inclusive):

 

DSM features an automatic remediation mechanism for missing privileges, eliminating the need to manually add them via the vSphere UI.

The fix can be done via command line.

 

Command line approach

Step 1
SSH to the Provider VM and execute the below command to create an admin secret:

 

kg create secret generic vc-admin-secret --from-literal=username='[email protected]'  --from-literal=password='<your-admin-password>'

Note: For DSM to automatically clean up this secret later, the name must use the prefix `dsm-internal-vcenter-secret-`. Replace <your-admin-password> with your actual vCenter administrator password.

 

Step 2
Edit the vcenterbinding CR to associate this newly created admin secret.

 

spec:
  vcenterAdminSecret: {}

 

Update this section to reference the new secret:

 

spec:
  vcenterAdminSecret:
    name: vc-admin-secret

Following the next reconciliation cycle, the missing privileges will be automatically restored. The vcenterAdminSecret field in the vcenterbinding CR will revert to empty ({}), and the manually created secret will be automatically deleted from the system.