Identity broker upgrade precheck failing from 9.0 to 9.1

Products

• VCF Operations

Issue/Introduction

• After upgrading VCF Operations to 9.1, the Identity Broker 9.1 upgrade precheck fails with the following error:
  Error: Platform Health Check Error [platform-vc-serviceaccount-http : Unexpected status code: 401 expected: 200, response body: "{\"type\":\"com.vmware.vapi.std.errors.unauthenticated\",\"value\":{\"error_type\":\"UNAUTHENTICATED\",\"challenge\":\"SIGN realm=\\\"##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##\\\",sts=\\\"https://vCenter_FQDN/sts/STSService/vsphere.local\\\", Basic realm=\\\"vCenter\\\"\",\"messages\":[]}}"] [VCFMS-HEALTH-002]Identity Broker still works fine for all configured components.
  
  
• The precheck error might also be flagged by monitoring tools during a routine health check, independent of an upgrade.
  
  
• Identity Broker still works fine for all configured components.

Environment

• VMware Cloud Foundation (VCF) 9.1.x
• VMware Cloud Foundation (VCF) 9.0.x

Cause

The vCenter service account associated with the 9.0.1 VIDB cluster expired, causing the VIDB pre-checks to fail.

Resolution

1. Copy the attached remediation script to any one of the vIDB nodes.
   
   
2. Login to the vIDB node as vmware-system-user via SSH and elevate to root using: sudo -i
   
   
3. Obtain keys to the Kubernetes layer of the VCF Service Runtime
   export KUBECONFIG=/etc/kubernetes/admin.conf
   
   
4. Execute the script and, when prompted, enter the vCenter admin credentials to fix the vCenter service account used by the VCF services Runtime.
   chmod +x /home/vmware-system-user/service-account-remediation.sh
./service-account-remediation.sh
   
   
5. Rerun the upgrade precheck

Note: If the remediation script has '\r' characters, this is likely from being moved between Windows and Linux machines. Run the following command to fix this:
sed -i 's/\r//g' service-account-remediation.sh