Error on trying to import image from vCenter to SDDC "No vLCM cluster available for import. Select a different workload domain or verify vLCM clusters exist"
search cancel

Error on trying to import image from vCenter to SDDC "No vLCM cluster available for import. Select a different workload domain or verify vLCM clusters exist"

book

Article ID: 443289

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

When performing Image Management > Import Image, the select Workload Domain returns "No vLCM cluster available for import. Select a different workload domain or verify vLCM clusters exist" for some vCenter and not for another.

After getting that error, the list of clusters cannot be selected as it will not populate the clusters of the affected vCenter.

 

These log entries can be seeing on SDDC Manager:

YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.e.s.c.s.a.i.InventoryServiceAdapterImpl,dm-exec-19]  Fetching vCenters data from inventory
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.e.s.c.s.s.ServiceCredentialsHelper,dm-exec-19]  Getting credentials for target type VCENTER, entity ID ########-####-####-####-############ and service type SDDC_MANAGER
YYYY-MM-DDTHH:MM:SS WARN  [vcf_dm,<TASK_ID>,0d20] [c.v.v.c.f.p.n.s.s.CredentialMgmtServiceImpl,dm-exec-19]  Use non-service SSO credentials for vCenter ID ########-####-####-####-############
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.v.c.f.p.n.s.s.CredentialMgmtServiceImpl,dm-exec-19]  Retrieve credentials for id ########-####-####-####-############ entityType PSC credentialType SSO
YYYY-MM-DDTHH:MM:SS INFO  [vcf_dm,<TASK_ID>,0d20] [c.v.v.v.s.v.VlcmClusterServiceImpl,dm-exec-19]  connection info: VCENTER_NAME
YYYY-MM-DDTHH:MM:SS INFO  [vcf_dm,<TASK_ID>,0d20] [c.v.v.v.s.v.VlcmClusterServiceImpl,dm-exec-19]  address=VCENTER_NAME, username=administrator@vsphere.local
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.vcf.vapi.vsphere.VapiRestClient,dm-exec-19]  Executing REST request: Type GET, URL https://VCENTER_NAME/rest/vcenter/cluster
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.v.s.h.VcfRestTemplateHttpClient,dm-exec-19]  Http request connect timeout milliseconds 180000
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.v.s.h.VcfRestTemplateHttpClient,dm-exec-19]  Http request read timeout milliseconds 180000
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.v.s.c.s.SecurityConfigurationServiceImpl,dm-exec-19]  Security config retrieved {"fipsMode":false}
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.v.s.t.DynamicTrustManager,dm-exec-19]  Checking validity of certificate chain CN=VCENTER_NAME, OU=VMware Engineering, O=VCENTER_NAME, L=Palo Alto, ST=California, C=US
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.v.s.t.DynamicTrustManager,dm-exec-19]  Certificate chain CN=VCENTER_NAME, OU=VMware Engineering, O=VCENTER_NAME, L=Palo Alto, ST=California, C=US is valid
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.vcf.vapi.vsphere.VapiRestClient,dm-exec-19]  Successfully executed REST request with body: , and received response with body: {"value":[{"drs_enabled":true,"ha_enabled":true,"name":"CLUSTER_NAME_1","cluster":"domain-#####"},{"drs_enabled":false,"ha_enabled":false,"name":"Image-Cluster","cluster":"domain-#######"},{"drs_enabled":true,"ha_enabled":true,"name":"CLUSTER_NAME_2","cluster":"domain-###"},{"drs_enabled":true,"ha_enabled":true,"name":"CLUSTER_NAME_3","cluster":"domain-###"},{"drs_enabled":true,"ha_enabled":true,"name":"CLUSTER_NAME_4","cluster":"domain-##"}]}
YYYY-MM-DDTHH:MM:SS INFO  [vcf_dm,<TASK_ID>,0d20] [c.v.v.v.s.v.VlcmClusterServiceImpl,dm-exec-19]  all clusters size=5
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.vcf.vapi.vsphere.VapiRestClient,dm-exec-19]  Executing REST request: Type GET, URL https://VCENTER_NAME/api/esx/settings/clusters/domain-#####/enablement/software
YYYY-MM-DDTHH:MM:SS ERROR [vcf_dm,<TASK_ID>,0d20] [c.v.v.v.s.v.VlcmClusterServiceImpl,dm-exec-19]  Error during REST call !
org.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden: "{"error_type":"UNAUTHORIZED","messages":[]}"
        at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:109)
        at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:183)
        at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:137)
        at org.springframework.web.client.ResponseErrorHandler.handleError(ResponseErrorHandler.java:63)
        at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:917)
        at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:866)
        at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:765)
        at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:647)
        at com.vmware.vcf.vapi.vsphere.VapiRestClient.exchange(VapiRestClient.java:156)
        at com.vmware.vcf.vapi.vsphere.VapiRestClient.exchange(VapiRestClient.java:107)
        at com.vmware.vcf.vapi.vsphere.VapiRestClient.exchange(VapiRestClient.java:95)
        at com.vmware.vcf.vimanager.services.vlcm.VlcmClusterServiceImpl.isVlcmEnabled(VlcmClusterServiceImpl.java:219)
        at com.vmware.vcf.vimanager.services.vlcm.VlcmClusterServiceImpl.lambda$getVlcmClustersInVcenter$3(VlcmClusterServiceImpl.java:175)
        at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
        at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
        at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
        at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
        at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
        at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
        at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
        at com.vmware.vcf.vimanager.services.vlcm.VlcmClusterServiceImpl.getVlcmClustersInVcenter(VlcmClusterServiceImpl.java:176)
        at com.vmware.vcf.vimanager.services.vlcm.VlcmClusterServiceImpl.getClusterByDomainId(VlcmClusterServiceImpl.java:115)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:569)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:343)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.interceptor.AsyncExecutionInterceptor.lambda$invoke$0(AsyncExecutionInterceptor.java:115)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at com.vmware.vcf.common.tracing.TraceRunnable.run(TraceRunnable.java:59)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at java.base/java.lang.Thread.run(Thread.java:840)
YYYY-MM-DDTHH:MM:SS DEBUG [vcf_dm,<TASK_ID>,0d20] [c.v.vcf.vapi.vsphere.VapiRestClient,dm-exec-19]  Executing REST request: Type GET, URL https://VCENTER_NAME/api/esx/settings/clusters/domain-#######/enablement/software
YYYY-MM-DDTHH:MM:SS ERROR [vcf_dm,<TASK_ID>,0d20] [c.v.v.v.s.v.VlcmClusterServiceImpl,dm-exec-19]  Error during REST call !
org.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden: "{"error_type":"UNAUTHORIZED","messages":[]}"
        at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:109)
        at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:183)
        at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:137)
        at org.springframework.web.client.ResponseErrorHandler.handleError(ResponseErrorHandler.java:63)
        at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:917)
        at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:866)
        at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:765)
        at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:647)
        at com.vmware.vcf.vapi.vsphere.VapiRestClient.exchange(VapiRestClient.java:156)
        at com.vmware.vcf.vapi.vsphere.VapiRestClient.exchange(VapiRestClient.java:107)
        at com.vmware.vcf.vapi.vsphere.VapiRestClient.exchange(VapiRestClient.java:95)
        at com.vmware.vcf.vimanager.services.vlcm.VlcmClusterServiceImpl.isVlcmEnabled(VlcmClusterServiceImpl.java:219)
        at com.vmware.vcf.vimanager.services.vlcm.VlcmClusterServiceImpl.lambda$getVlcmClustersInVcenter$3(VlcmClusterServiceImpl.java:175)
        at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
        at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
        at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
        at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
        at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
        at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
        at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
        at com.vmware.vcf.vimanager.services.vlcm.VlcmClusterServiceImpl.getVlcmClustersInVcenter(VlcmClusterServiceImpl.java:176)

 

vCenter update manager log will have these entries:

YYYY-MM-DDTHH:MM:SS info vmware-vum-server[12755] [Originator@6876 sub=Default] [SessionHandler 63] ExtractSessionInfo vmacoreSessionId: ########-####-####-####-############
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[12755] [Originator@6876 sub=Default] [SessionHandler 96] ExtractSessionInfo: username:Administrator, domain:VSPHERE.LOCAL, isAdministrator:true
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[12755] [Originator@6876 sub=VumVapi::Utils] [VapiMiscUtil 140] Activation opId: ########-####-####-####-############
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[12755] [Originator@6876 sub=VumVapiAuthzFilter opID=########-####-####-####-############] [RequireAdminUserAuthz 362] RequireAdminUserAuthz::Invoke Method is com.vmware.esx.settings.clusters.enablement.software.get
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[12755] [Originator@6876 sub=VumVapiAuthzFilter opID=########-####-####-####-############] [RequireAdminUserAuthz 366] RequireAdminUserAuthz::Invoke Service ID is com.vmware.esx.settings.clusters.enablement.software
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[12755] [Originator@6876 sub=VumVapiAuthzFilter opID=########-####-####-####-############] [RequireAdminUserAuthz 405] RequireAdminUserAuthz::Invoke Method authorization is true
...
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[30026] [Originator@6876 sub=VumVapiPrivilegeChecker opID=########-####-####-####-############] [PrivilegeCheckerImpl 232] Resource:domain-####, is CLUSTER MoId
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[30026] [Originator@6876 sub=IntegrityAuthzServiceHelper opID=########-####-####-####-############] [AuthzServiceHelper 62] Entity Priv Result: Entity:domain-####
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[30026] [Originator@6876 sub=IntegrityAuthzServiceHelper opID=########-####-####-####-############] [AuthzServiceHelper 69] Entity Priv Result: PrivId:VcIntegrity.lifecycleSettings.Read, PrivValue:false
YYYY-MM-DDTHH:MM:SS info vmware-vum-server[30026] [Originator@6876 sub=IntegrityAuthzServiceHelper opID=########-####-####-####-############] [AuthzServiceHelper 186] User: Administrator@VSPHERE.LOCAL does not have Privilage: VcIntegrity.lifecycleSettings.Read on entity:domain-####

 

 

 

Environment

SDDC Manager 5.2.x

vCenter Server Appliance 8.0.x

 

Cause

vCenter permissions for the user "Administrator" were changed and the permissions are not enough for the SDDC Manager to read the information from the vCenter clusters.

Resolution

Correct the permissions of Administrator in the vCenter to be set with the default ones.

The default permissions for the Administrator user and Administrators group are set as following:

  • User/Group: VSPHERE.LOCAL\Administrator
  • Role: Administrator
  • Defined In: This object and its children

 

  • User/Group: VSPHERE.LOCAL\Administrators
  • Role: Administrator
  • Defined In: Global Permission

 

Note: If a child object has a new permission added for the user Administrator or group Administrators, that permission will break the chain of permissions to be inherited from the defaults, therefore, it is necessary to remove that extra permission adjustment to allow the inheritance flows normally.

 

Powered by Wolken Software