How to fix Privilege Issues in Data Services Manager (DSM) when operations fail with "InsufficientPrivileges"

Products

• VMware Data Services Manager

Issue/Introduction

DSM Service Accounts are used to interact and manipulate vCenter Objects for DSM.

If the required privileges are missing, the user will not be able to execute various operations which need those privileges.

Environment

VMware Data Services Manager

Cause

If the below privileges are not present the user will not be able to create support bundles successfully.

The following error will be shown:

Status Conditions: hli-pg-a-new-namespace [ { "lastTransitionTime": "2026-05-29T10:19:31Z", "message": "Logs collection was partially successful. No data plane logs were collected.", "observedGeneration": 1, "reason": "PartialSuccess", "status": "True", "type": "Ready" }, { "lastTransitionTime": "2026-05-29T10:19:31Z", "message": "", "reason": "Ready", "status": "True", "type": "ControlPlaneCollection" }, { "lastTransitionTime": "2026-05-29T10:19:31Z", "message": "cluster 'Cluster name': The DSM admin service account is missing the following GuestOperations privileges: VirtualMachine.GuestOperations.ModifyAliases, VirtualMachine.GuestOperations.QueryAliases, VirtualMachine.GuestOperations.Modify, VirtualMachine.GuestOperations.Execute, VirtualMachine.GuestOperations.Query.

Please ensure these privileges are granted to the service account.", "reason": "Ready", "status": "False", "type": "DataPlaneCollection" }

 

Additionally, `vcenterbinding` CR in Gateway will also contain the status showing "InsufficientPrivileges":

Resolution

For versions prior to 9.1.1 (not including version 9.1.1):

Manually add back the privileges via vSphere UI:

 

Click "Edit" and add the missing privileges:

 

For 9.1.1 version and higher (including 9.1.1):

DSM has implemented automatic fix if required privileges are missing. In this case, the user doesn't need to go to the vSphere UI to add the privileges manually.

The fix can be done via either command line approach or DSM UI.

 

Command line approach

Step 1
SSH to the Provider VM and execute the below command:

 

kg create secret generic vc-admin-secret --from-literal=username='[email protected]'  --from-literal=password='<your-admin-password>'
(use your own administrator's password above)

 

Step 2
Edit the vcenterbinding CR to associate this newly created admin secret. Normally visible is:

 

spec:
  vcenterAdminSecret: {}

now change it to:

spec:
  vcenterAdminSecret:
    name: vc-admin-secret

Following the next reconciliation cycle, the missing privileges will be automatically restored. The vcenterAdminSecret field in the vcenterbinding CR will revert to empty ({}), and the manually created secret will be automatically deleted from the system.

 

 

DSM UI
Once the permission drift is detected, you should notice it in DSM UI as well.

In DSM UI,  click "Settings" tab on the left side bar menu, you should see the "Insufficient Privileges" status appeared in "vCenter Configuration" section under "System Settings" tab.

 

Then click "Edit" button of the "vCenter Configuration" section, and fill in the VC admin username and password, that should also enable the platform to finish the auto fix.