Deletion of Identity Broker from VCF Operations 9.1

Products

VMware Cloud Foundation VCF Operations

Issue/Introduction

In VCF Operations 9.0, it allows deletion of VCF Identity Broker appliance from the Fleet Management > Lifecycle > Components page. However, in VCF Operations 9.1 such an option is unavailable.
To delete the Identity Broker, use the delete_vidb.py script attached to this KB.
- If the Identity Broker is older than version 9.1, it is deleted from Fleet lifecycle and VCF Operations resources only; the corresponding VIDB deployment from vCenter is not deleted.
- If the Identity Broker is version 9.1, it is also deleted from the VCF Services Runtime.
This script clears the SSO configuration made on the Identity Broker that it is deleting.
The data related to Identity Broker is stored in several places. This script removes it from all of them, in order:
1. VCF Operations SSO / identity provider configuration (reset).
2. VCF Operations resource (external Identity Broker registration).
3. VCF Operations component manager.
4. Fleet lifecycle.
5. VCF Services Runtime (VSP).

Environment

VCF 9.0.x (Identity broker in 9.0.x version, however, VCF Operations should be in 9.1.x version)
VCF 9.1

Resolution

Warning: This script removes the Identity Broker from multiple systems. Do not interrupt the script once it has started.

When to use this script

Use this script only as a last resort when the Identity Broker is in an unrecoverable state and must be completely removed and reinstalled.

Before you run this script:

Try to repair the existing Identity Broker first. If the Identity Broker is experiencing issues, investigate and resolve the root cause.
Do not use this script as a routine upgrade mechanism. This script is not a way to upgrade an Identity Broker by removing an older version and installing a newer one. It permanently removes the Identity Broker's SSO configuration — this is a destructive operation that cannot be undone. After running this script, you must re-configure SSO from scratch on the newly installed Identity Broker.

Run this script only when:

The Identity Broker is irrecoverably broken and cannot be fixed in place.
You need to remove all traces of the existing Identity Broker from VCF Operations, Fleet, and VCF Services Runtime before installing a fresh one.

Prerequisites

The script can be run from any system that has Python 3 installed and network access to the VCF Operations, Fleet, and VCF Services Runtime endpoints.
The script is self-contained and uses only the Python standard library — no additional packages need to be installed.
Gather the following values (available from VCF Operations UI -> Build -> Lifecycle -> VCF Management -> Components):

The Identity Broker FQDN (for example, identity-broker.example.com).
The Fleet LCM FQDN.
The VCF Services Runtime FQDN.
VCF Operations admin credentials and VCF Services Runtime credentials.

Note: Use username admin for <vcf-services-runtime-username>; the password of vmware-system-user is the same as the admin password.

Warning: Prior to deletion, verify that you have a backup of any critical component data which needs to be retained.

Script usage

python3 delete_vidb.py \
--vidb-fqdn <vidb-fqdn> \
--fleet-fqdn <fleet-lcm-fqdn> \
--vcf-services-runtime-fqdn <vcf-services-runtime-fqdn> \
--vcf-services-runtime-username <vcf-services-runtime-username> \
--vcf-operations-fqdn <vcf-operations-fqdn> \
--vcf-operations-username <vcf-operations-username>Replace each placeholder (such as <vidb-fqdn>) with the actual value for your environment.

Script Parameters

Parameter	Short	Required	Description
`--vidb-fqdn`	`-vf`	Yes	FQDN (host) of the Identity Broker component to be deleted.
`--fleet-fqdn`	`-ff`	Yes	Fleet LCM FQDN.
`--vcf-services-runtime-fqdn`	`-vsrf`	Yes	VCF Services Runtime FQDN.
`--vcf-services-runtime-username`	`-vsru`	Yes	VCF Services Runtime username.
`--vcf-services-runtime-password`	`-vsrp`	No	VCF Services Runtime password. Prompted in the console if not provided.
`--vcf-operations-fqdn`	`-vof`	Yes	VCF Operations FQDN.
`--vcf-operations-username`	`-vou`	Yes	VCF Operations username.
`--vcf-operations-password`	`-vop`	No	VCF Operations password. Prompted in the console if not provided.
`--force-delete`	`-fd`	No	Skip the confirmation prompt before delete.

Running the script

Copy delete_vidb.py to a host with Python 3 and network access to the required endpoints.
Run the script with the required parameter

python3 delete_vidb.py \
--vidb-fqdn <vidb-fqdn> \
--fleet-fqdn <fleet-lcm-fqdn> \
--vcf-services-runtime-fqdn <vcf-services-runtime-fqdn> \
--vcf-services-runtime-username <vcf-services-runtime-username> \
--vcf-operations-fqdn <vcf-operations-fqdn> \
--vcf-operations-username <vcf-operations-username>
When prompted, enter the passwords for the VCF Services Runtime user and the VCF Operations user. The script authenticates against both platforms up front, so any incorrect password is reported before any deletion is attempted.
Review the confirmation prompt that lists every location to be cleaned up, and enter y to proceed (or n to abort). Use --force-delete to skip this prompt for unattended runs.
The script tries to reset SSO and waits for up to 30 minutes till SSO configuration is reset. If the SSO configuration is not removed within 30 minutes, the script fails and asks you to manually delete the SSO configuration on the given Identity Broker and retry.

Note: Power off the VCF Identity Broker 9.0.x virtual machines from the vSphere Client after the script completes.

Sample script execution result

The script logs each stage and its completion, for example:

Authenticating with VCF Services Runtime (...)...
VCF Services Runtime authentication successful.
Authenticating with VCF Operations (...)...
VCF Operations authentication successful.

About to remove Identity Broker '{self.vidb_fqdn}' and its SSO configuration from all required locations.

WARNING: This removes the Identity Broker from multiple systems. Do not interrupt the script once it has started.
Proceed with cleanup? (y/n): y

=== Step 1: VCF Operations SSO and resource cleanup ===
...
[INFO] Step 1 completed: VCF Operations SSO and resource cleanup.

=== Step 2: VCF Operations component manager cleanup ===
...
[INFO] Step 2 completed: VCF Operations component manager cleanup.

=== Step 3: Fleet and VCF Services Runtime cleanup ===
...
[INFO] Step 3 completed: Fleet and VCF Services Runtime cleanup.

[INFO] Identity Broker cleanup completed successfully.

Attachments

delete_vidb.py get_app