"Disconnected depot: active" status after registering the Online Depot in VCF Operations
search cancel

"Disconnected depot: active" status after registering the Online Depot in VCF Operations

book

Article ID: 443216

calendar_today

Updated On:

Products

VCF Operations

Issue/Introduction

  • When registering the Online Depot in VMware Cloud Foundation (VCF) 9.1, the validation may complete successfully, but the Software Depot status remains "Disconnected" without specific error messages in the user interface.


  • The message Validation completed successfully. No errors found. appeared after clicking Validate in step 3. Submit the activation code.

  • You confirmed that the activation code from the Business Services Console was used (not the download token used for the previous version).

  • The VCF Installer appliance was able to connect but now that it's inside of VCF Operations it won't connect

  • The vcf-fleet-depot/<node_name>/depot-service-<identifier_string>/download-service/console-log shows the below error:

    InternalServerErrorException: Failed to connect to Broadcom OAuth Authorization server.
    ...
    Caused by: com.vmware.evo.sddc.lcm.depot_auth.exceptions.DepotAccessTokenIOException: java.net.SocketException: Network is unreachable
    ...
    Caused by: java.net.SocketException: Network is unreachable

Environment

  • VMware Cloud Foundation (VCF) 9.1.0
  • VCF Operations 9.1.0

Cause

The firewall protecting the environment blocks network traffic targeted to Broadcom URLs because the necessary URLs are missing from the allow list.

Note: The VCF Installer runs as a standalone bootstrap application packaged inside the SDDC Manager OVA. It has its own lightweight internal file-based repository. Post-deployment, the Software Depot is deployed as a fully containerized microservice (depot-service pod) running on the VCF Management Services Platform (VMSP) Kubernetes cluster which uses IP addresses dynamically assigned from the VCF Services Runtime IP Pool. Firewall rules may not be in place for this shift. 

Resolution

  1. Work with your network security team to add the required URLs to the firewall allow list.
  2. Restart the Software Depot service.

    1. Log in to VCF Operations with an administrative account.
    2. Navigate to Build > Lifecycle > VCF Management > Components and click Software depot.
    3. Click the Actions menu and select Stop service.
    4. Click View details... to monitor the shutdown task.
    5. After Task status: shows Completed, click < Back (or navigate to Build > Lifecycle > VCF Management > Components and click Software depot).
    6. Click the Actions menu and select Start service.
    7. Click View details... to monitor the startup task.
    8. After Task status: shows Completed, navigate to Build > Software Depot and validate that you see Online depot: active.

To check connectivity to the required URLs for the Software Depot

  1. Log in to the VCF Operations node as root via SSH or vSphere console.

  2. Test connectivity with curl to each URL:
    1. curl -s -o /dev/null --cacert /etc/ssl/certs/a3418fda.pem -w "%{http_code}\n" https://dl.broadcom.com

      Expected response: 403

    2. curl -s -o /dev/null --cacert /etc/ssl/certs/3513523f.pem -w "%{http_code}\n" https://eapi.broadcom.com

      Expected response: 500

    3. curl -s -o /dev/null --cacert /etc/ssl/certs/5ad8a5d6.pem -w "%{http_code}\n" https://vvs.broadcom.com

      Expected response: 403

    4. curl -s -o /dev/null --cacert /etc/ssl/certs/3513523f.pem -w "%{http_code}\n" https://vsanhealth.vmware.com

      Expected response: 500

Additional Information

To check connectivity to the required URLs for other functions

  1. Log in to the VCF Operations node as root via SSH or vSphere console.

  2. Test connectivity with curl to each URL:
    1. curl -s -o /dev/null --cacert /etc/ssl/certs/dd8e9d41.pem -w "%{http_code}\n" https://projects.packages.broadcom.com

      Expected response: 302

    2. curl -s -o /dev/null --cacert /etc/ssl/certs/3513523f.pem -w "%{http_code}\n" https://vcsa.vmware.com

      Expected response: 404

    3. curl -s -o /dev/null --cacert /etc/ssl/certs/3513523f.pem -w "%{http_code}\n" https://auth.esp.vmware.com

      Expected response: 404

Note: If a proxy server is required for internet connectivity, see Configure a Proxy Server for VCF Management Services Components and VCF Automation.
Powered by Wolken Software