Backup from VCF Management fails for vIDB component due to missing SAN in certificate

Products

• VCF Operations

Issue/Introduction

• In VMware Cloud Foundation 9.1, backups initiated from VCF Management for the vIDB component fail.
• The following error message is observed in the task console:

  Database backup failed for component vidb. Please retry the operation or contact support if the issue persists.

• When investigating the certificate details of the Postgres instance using the following command:

  kubectl exec -n vidb-external vidb-postgres-instance-0 -c postgres -- cat /tls/tls.crt | openssl x509 -noout -text

• The Subject Alternative Name (SAN) field is expected to include:

  DNS:vidb-postgres-instance.vidb-external.svc
  DNS:vidb-postgres-instance.vidb-external.svc.cluster.local
  DNS:vidb-postgres-instance-pooler.vidb-external.svc
  DNS:vidb-postgres-instance-pooler.vidb-external.svc.cluster.local
  DNS:pgbackup-vidb-postgres-instance.vidb-external.svc.cluster.local

  In affected environments, the entry DNS:pgbackup-vidb-postgres-instance.vidb-external.svc.cluster.local is missing from the certificate.

Environment

VMware Cloud Foundation 9.1

Cause

The backup failure occurs because the Postgres certificate lacks the necessary Subject Alternative Name (SAN) required for the backup sidecar to communicate securely within the cluster.

This prevents the backup process from authenticating correctly with the database instance.

Resolution

Recover the secret by following these steps:

1. Connect to VMSP appliance via SSH following the procedure in Establish an SSH Connection to a VCF Services Runtime Instance
2. Delete existing secret: Trigger a regeneration by deleting the current Postgres certificate secret:

   kubectl delete secret vidb-postgres-instance-postgres-cert-secret -n vidb-external

3. Wait approximately 5 minutes for the system to automatically recreate the secret and rotate the certificate.
4. Verify SAN entry: Run the following command to verify the new certificate:

   kubectl exec -c postgres vidb-postgres-instance-0 -n vidb-external -- cat /tls/tls.crt | openssl x509 -noout -text

5. Verify secret vidb-postgres-instance-postgres-cert-secret is created:

   kubectl get secret -n vidb-external

6. Retry backup for component vidb.

If secret vidb-postgres-instance-postgres-cert-secret is not created automatically:

Please refer to Pods in namespace "vidb-external" failed to start due to missing secret "vidb-postgres-instance-postgres-cert-secret for further analysis and resolution.