Workaround to remove orphaned Rule Analysis UI plugin from NSX

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

If SSP if forced deleted, we skip the Rule Analysis feature deactivation that is required to de-register the Rule Analysis UI plugin from NSX. That plugin continues to show and display an error message.

Environment

SSP 5.x

Cause

Rule Analysis UI plugin not de-registered from NSX

Resolution

1. Confirm the plugin is registered 

curl -sk -u "admin:<password>" \
  "https://<nsx-mgr>/policy/api/v1/ui-controller/remote-ui-plugins" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); [print(p['id']) for p in d['results']]"

Expected sample output (plugin is present):

security-ui
rule-analysis-ui

 

2. Delete the plugin

curl -sk -u "admin:<password>" \
  -X DELETE \
  -H "X-Allow-Overwrite: true" \
  "https://<nsx-mgr>/policy/api/v1/ui-controller/remote-ui-plugins/rule-analysis-ui"

 

Expected output (only security-ui remains):
 

security-ui

Important notes

• Re-registration: The plugin re-registers automatically whenever the rule-analysis deployment starts up. If the rule-analysis service is running and healthy, the plugin will come back after the next pod restart. The delete is only permanent if the rule-analysis deployment is scaled down or uninstalled.
  
  
• Idempotency: Deleting a plugin that no longer exists returns HTTP 200 with an empty body — not a 404. You can safely re-run above Step-2 about "Delete the plugin" without errors.
  
  
• Ownership error without the header: Without X-Allow-Overwrite: true, you will get

{"error_code": 289, "error_message": "Principal 'admin' ... attempts to delete or modify an object it doesn't own. (createUser=napp_platform_egress, allowOverwrite=null)"}