FIPS endpoint compatibility pre-check fails while upgrading VCF Automation 9.0.2 to version 9.1

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Upgrade from VCF Automation 9.0.2 to 9.1 fails at FIPS endpoint compatibility pre-check with the below error:

One or more configured endpoints or integrations are not accessible in FIPS mode. [com.broadcom.vcfa.upgrade.90.application.check.test-application-01-9x-fips]

• In the /tmp/vcfa-upgrade/logs/fips-checks-failed on VCF Automation, errors related to VCF Operations are seen

(example.com is the FQDN for VCF Operations)

{example.com=org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
        at org.bouncycastle.jsse.provider.ProvSSLSocketDirect.checkServerTrusted(ProvSSLSocketDirect.java:135)
        at org.bouncycastle.jsse.provider.ProvTlsClient$1.notifyServerCertificate(ProvTlsClient.java:381)
Caused by: java.security.cert.CertPathBuilderException: Unable to find certificate chain.
        at org.bouncycastle.jcajce.provider.PKIXCertPathBuilderSpi_8.engineBuild(Unknown Source)
        at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
        at

Environment

• VCF Automation 9.0.2
• VCF Operations 9.0.2 

Cause

VCF Operations was added without a certificate validation in the source 8.x Automation.

Resolution

• Run the below command on VCF Automation to skip the pre-check

sudo -i kubectl create configmap vcfa-precheck-skip-config \  -n prelude \  --from-literal='skip-config.json={    "precheckIds": [      "com.broadcom.vcfa.upgrade.90.application.check.test-application-01-9x-fips"    ],    "reason": "Approved skip for maintenance window"  }'

• Retry the VCF Automation upgrade again from VCF Operations