Domain Deletion Fails Due to Stale VPC References Blocking NSX Edge Cluster Removal

Products

VMware NSX VMware vSphere Kubernetes Service

Issue/Introduction

When attempting to delete a domain, the deletion process fails. This occurs because the NSX Edge cluster cannot be deleted due to active dependencies and stale references.

Removal of VPC kube-system_#####
{
"httpStatus": "BAD_REQUEST",
"error_code": 500030,
"module_name": "Policy",
"error_message": "The object path=[/orgs/default/projects/projectname-####-0#/vpcs/kube-system_#####] cannot be deleted as either it has children or it is being referenced by other objects path=[/orgs/default/projects/projectname-####-0#/vpcs/kube-system_#####/groups/vcf-cluster-cca#####-####-####-####-969adfe#####-projectname-####-0#-kube-system_#####-VIPS,/orgs/default/projects/projectname-####-0#/vpcs/kube-system_#####/attachments/default,/orgs/default/projects/projectname-####-0#/vpcs/kube-system_#####/groups/vcf-cluster-cca#####-####-####-####-969adfe#####-projectname-####-0#-kube-system_#####-DataNics]"
}

Removal of VPC vmware-system-supervisor-services-vpc_#####
{
"httpStatus": "BAD_REQUEST",
"error_code": 500030,
"module_name": "Policy",
"error_message": "The object path=[/orgs/default/projects/projectname-####-0#/vpcs/vmware-system-supervisor-services-vpc_#####] cannot be deleted as either it has children or it is being referenced by other objects path=[/orgs/default/projects/projectname-####-0#/vpcs/vmware-system-supervisor-services-vpc_#####/groups/vcf-cluster-cca#####-####-####-####-969adfe#####-projectname-####-0#-vmware-system-supervisor-services-vpc_#####-DataNics,/orgs/default/projects/projectname-####-0#/vpcs/vmware-system-supervisor-services-vpc_#####/groups/vcf-cluster-cca#####-####-####-####-969adfe#####-projectname-####-0#-vmware-system-supervisor-services-vpc_#####-VIPS,/orgs/default/projects/projectname-####-0#/vpcs/vmware-system-supervisor-services-vpc_#####/attachments/default]"
}

Environment

VMware NSX

VMware vSphere Kubernetes Service

Cause

The Tier-0 (T0) Gateway associated with the Edge cluster retains stale entries linked to Virtual Private Clouds (VPCs), such as vmware-system-supervisor-services-vpc_##### and kube-system_#####.

Because these VPCs still contain child objects (attachments, groups, ports, or subnets) or are referenced by other entities, the NSX policy blocks their removal, subsequently halting the Edge cluster and domain deletion.

Resolution

This article can be used only if NSX cleanup process fails and if there are no production on VPCs.

To successfully delete the domain, you must manually remove the stale child resources of the VPCs via the NSX Policy API before removing the T0 Gateway and Edge cluster.

NOTE: Add the headers:

Step 1: Clean up `vmware-system-supervisor-services-vpc_#####`

Execute the following DELETE API requests sequentially to clear attachments and groups:

DELETE https://<nsx-mgr-fqdn>/policy/api/v1/orgs/default/projects/projectname-####-0#/vpcs/vmware-system-supervisor-services-vpc_#####/attachments/default

DELETE https://<nsx-mgr-fqdn>/policy/api/v1/orgs/default/projects/projectname-####-0#/vpcs/vmware-system-supervisor-services-vpc_#####/groups/vcf-cluster-cca#####-####-####-####-969adfe#####-projectname-####-0#-vmware-system-supervisor-services-vpc_#####-VIPS

DELETE https://<nsx-mgr-fqdn>/policy/api/v1/orgs/default/projects/projectname-####-0#/vpcs/vmware-system-supervisor-services-vpc_#####/groups/vcf-cluster-cca#####-####-####-####-969adfe#####-projectname-####-0#-vmware-system-supervisor-services-vpc_#####-DataNics 

Step 2: Clean up `kube-system_#####`

Execute the following DELETE API requests sequentially to clear underlying ports, subnets, attachments, and groups:

DELETE https://<nsx-mgr-fqdn>/policy/api/v1//orgs/default/projects/projectname-####-0#/vpcs/kube-system_#####/groups/vcf-cluster-cca#####-####-####-####-969adfe#####-projectname-####-0#-kube-system_#####-VIPS

DELETE https://<nsx-mgr-fqdn>/policy/api/v1/orgs/default/projects/projectname-####-0#/vpcs/kube-system_#####/attachments/default

DELETE https://<nsx-mgr-fqdn>/policy/api/v1/orgs/default/projects/projectname-####-0#/vpcs/kube-system_#####/groups/vcf-cluster-cca#####-####-####-####-969adfe#####-projectname-####-0#-kube-system_#####-DataNics

(Note: Replace <nsx-mgr-fqdn> with your actual NSX Manager IP or Hostname).

Step 3: Complete Deletion Sequence

Once the child objects are deleted and the VPCs are successfully cleared, proceed with the decommissioning process in this specific order:

Delete the Tier-0 (T0) Gateway.
Delete the NSX Edge Cluster.
Retry the Domain/WCP Cluster deletion workflow.

Additional Information

Reference article: https://knowledge.broadcom.com/external/article/388941