trustmanagement service fails to start during VMware vCenter Server 9.1 patch installation

Products

• VMware vCenter Server

Issue/Introduction

1 VMware vCenter Server patch installation from version 9.0.2 to 9.1 fails during the trustmanagement service startup.

2 Executing 'service-control --start vmware-trustmanagement' via SSH fails to start the service.

# /var/log/vmware/trustmanagement/trustmanagement-svcs.log

INFO trustmanagement-svcs threadName="main" logger="com.vmware.vcenter.trustmanagement.service.Main"] FSS initialized.

INFO trustmanagement-svcs threadName="main" logger="com.vmware.vcenter.trustmanagement.service.TrustManagement"] trustmanagement-vlsi.xml

WARNING trustmanagement-svcs threadName="main" logger="org.springframework.context.support.ClassPathXmlApplicationContext"] Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'isAccessLogCreated' defined in class path resource [trustmanagement-vlsi.xml]: Cannot resolve reference to bean 'vlsi-server' while setting bean property 'targetObject'

ERROR trustmanagement-svcs threadName="main" logger="com.vmware.vcenter.trustmanagement.service.Main"] start: TrustManagement Service failed to start
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'isAccessLogCreated' defined in class path resource [trustmanagement-vlsi.xml]: Cannot resolve reference to bean 'vlsi-server' while setting bean property 'targetObject'

3 Reverting the vCenter Server snapshot to version 9.0.2 allows the trustmanagement and all other services to start normally.

Environment

VMware vCenter Server 9.0.2
VMware vCenter Server 9.1

Cause

During the trustmanagement first boot, the system checks all related configuration files under /usr/lib/vmware-trustmanagement/config.
The service fails to start because ssoAppSecretExpiryCheckerScheduler options were previously removed from trustmanagement-vlsi.xml.
This file modification is a known workaround for a separate authentication issue. Since vCenter Server 9.0.2 already contains the permanent fix for the authentication issue,
the trustmanagement-vlsi.xml file must be reverted to its original content before upgrading to 9.1.

Resolution

 

Follow these structured steps to safely rename the file and restart the required services:.

• Take an offline snapshot of the vCenter Server appliance.

• Establish an SSH Session to SDDC Manager Appliance using the vcf service account.
• Switch to the root user by running: su –
• Locate and Rename the Target XML File
  • cd /etc/vmware/vcf/trustmanagement/         (If it is not there, run find / -name trustmanagement.xml to get the exact path).
• Depending on your exact VCF version, application files may reside under /etc/vmware/vcf/ or within the operational subdirectories of operationsmanager.
• Locate the file and switch to its directory (typically under /etc/vmware/vcf/trustmanagement/ or similar service directories):

• Check the directory to see what files are listed there.
• If you already have a trustmanagement-vlsi.xml.bak use the following :
  • cp -p trustmanagement-vlsi.xml trustmanagement-vlsi.xml.backup
• Then rename the file instead of deleting it to ensure you have a fallback backup:
  • mv trustmanagement-vlsi.xml.bak trustmanagement-vlsi.xml
• You should now see these files in that directory

• 
• Restart all agents on SDDC
  • /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh
• Then rerun the vCenter Server 9.1 patch installation
• You can monitor it from vCenter VAMI and from VCF OPS