Automation fails with vim.fault.NoPermission System.Read on vCLS VMs in vCenter 8.0 U3

Products

• VMware vCenter Server

Issue/Introduction

• Automation workflows using Ansible VMware collection or PowerCLI fail with a vim.fault.NoPermission (System.Read) exception when querying cluster resources (e.g., Get-DrsClusterGroup).
• This occurs for service accounts assigned the vCenter Administrator role but lacking vCenter Single Sign-On (SSO) Administrators group membership. The error explicitly targets vCLS virtual machine objects.

Environment

vCenter Server 8.0 U3

Cause

Automation tooling lacks explicit filtering for vSphere 8.0 U3 Embedded vCLS (PodCRX) instances. The vCenter Authorization Service enforces hardcoded access restrictions on these system-managed objects, requiring direct SSO Administrators group membership, which standard vCenter RBAC roles do not satisfy.

Resolution

To resolve this issue, implement one of the following methods:

Method 1: Update SSO Group Membership (Short-term Workaround)

1. Log in to the vSphere Client as [e-mail].

2. Navigate to Administration > Single Sign-On > Users and Groups.

3. Select the Groups tab.

4. Select the Administrators group and click Edit.

5. Add the automation service account directly to the SSO Administrators group (e.g., vsphere.local\Administrators).

Method 2: Update Automation Logic (Long-term Resolution)

1. Refactor automation logic within Ansible modules or PowerCLI scripts to explicitly filter out vCLS VMs and the hidden vCLS system folder prior to executing cluster inventory queries.

2. For community or third-party collections (such as the Ansible VMware collection), open an issue with the maintainers to implement this vCLS filtering natively to prevent API sweeps from touching protected objects.

Additional Information

vCLS VMs are missing in the cluster for Non-SSO Administrator users in vSphere 8.0 U3

Discrepancy is observed in the number of vCLS VMs created post VC upgrade to 8.0 U3