After you upgrade VCF Operations to 9.1, when you try to upgrade Identity Broker to version 9.1, the precheck fails with the following error:
Error: Platform Health Check Error [platform-vc-serviceaccount-http : Unexpected status code: 401 expected: 200, response body: "{\"type\":\"com.vmware.vapi.std.errors.unauthenticated\",\"value\":{\"error_type\":\"UNAUTHENTICATED\",\"challenge\":\"SIGN realm=\\\"##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##\\\",sts=\\\"https://<URL_REMOVED>/sts/STSService/vsphere.local\\\", Basic realm=\\\"vCenter\\\"\",\"messages\":[]}}"] [VCFMS-HEALTH-002]Identity Broker still works fine for all configured components.
VCF SSO 9.0
VCF Operations 9.1
VIDB pre-checks were failing with vCenter service account failure. vCenter service account had expired for the 9.0.1 VIDB cluster
To resolve the issue, follow these steps:
From a machine that can reach the node, copy the script to /tmp:
scp service-account-remediation.sh vmware-system-user@<node-ip>:/tmp/service-account-remediation.sh
(You must provide the account password.)
SSH to the vIDB node as vmware-system-user and provide the password for the account.
Elevate to root using and obtain keys to the Kubernetes layer of the VCF Service Runtime:
sudo -i
export KUBECONFIG=/etc/kubernetes/admin.confchmod +x /home/vmware-system-user/service-account-remediation.sh
/home/vmware-system-user/service-account-remediation.shThe script prompts for a vCenter admin account and password. Using those credentials, the script triggers an operation to fix the vCenter service account used by the VCF services Runtime.
sed -i 's/\r//g' serviceaccountremediation.sh