Identity broker upgrade precheck failing from 9.0 to 9.1

Products

• VCF Operations

Issue/Introduction

After you upgrade VCF Operations to 9.1, when you try to upgrade Identity Broker to version 9.1, the precheck fails with the following error:

Error: Platform Health Check Error [platform-vc-serviceaccount-http : Unexpected status code: 401 expected: 200, response body: "{\"type\":\"com.vmware.vapi.std.errors.unauthenticated\",\"value\":{\"error_type\":\"UNAUTHENTICATED\",\"challenge\":\"SIGN realm=\\\"##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##\\\",sts=\\\"https://<URL_REMOVED>/sts/STSService/vsphere.local\\\", Basic realm=\\\"vCenter\\\"\",\"messages\":[]}}"] [VCFMS-HEALTH-002]

Identity Broker still works fine for all configured components.

Environment

VCF SSO 9.0

VCF Operations 9.1

Cause

VIDB pre-checks were failing with vCenter service account failure. vCenter service account had expired for the 9.0.1 VIDB cluster

Resolution

To resolve the issue, follow these steps:

1. Copy the attached remediation script to the vIDB node.

   From a machine that can reach the node, copy the script to /tmp:

   scp service-account-remediation.sh vmware-system-user@<node-ip>:/tmp/service-account-remediation.sh

   (You must provide the account password.)

2. Connect to the node and initialize access.

   SSH to the vIDB node as vmware-system-user and provide the password for the account.

   Elevate to root using and obtain keys to the Kubernetes layer of the VCF Service Runtime:

   sudo -i
   export KUBECONFIG=/etc/kubernetes/admin.conf

3. Run the script.

   chmod +x /home/vmware-system-user/service-account-remediation.sh
   /home/vmware-system-user/service-account-remediation.sh

   The script prompts for a vCenter admin account and password. Using those credentials, the script triggers an operation to fix the vCenter service account used by the VCF services Runtime.

4. Rerun the upgrade precheck

Note: If the remediation script has '\r' characters, this is likely from being moved between Windows and Linux machines. Run the following command to fix this:

sed -i 's/\r//g' serviceaccountremediation.sh