VCF Automation Upgrade to 9.x Fails FIPS Precheck Due to Incorrectly Configured Integration Endpoints
search cancel

VCF Automation Upgrade to 9.x Fails FIPS Precheck Due to Incorrectly Configured Integration Endpoints

book

Article ID: 446198

calendar_today

Updated On:

Products

VCF Automation

Issue/Introduction

During an upgrade to VCF Automation 9.x, the pre-upgrade health check fails with a FIPS compliance error. The upgrade is blocked and cannot proceed.

The error message looks similar to the following in UI:

Precheck failed: com.broadcom.vcfa.upgrade.90.application.check.test-application-01-9x-fips
"One or more configured endpoints or integrations are not accessible in FIPS mode."
"Review /tmp/vcfa-upgrade/logs/fipschecker.log and /tmp/vcfa-upgrade/logs/fips-checks-failed on the source system for details. Configure the failing endpoints to be accessible in FIPS mode."

This issue typically affects environments containing any of the following legacy configurations:

  • An IPAM integration endpoint configured without a TLS certificate (using plain HTTP or an unverified HTTPS endpoint).

  • A vROps (VMware Aria Operations) integration endpoint configured without a TLS certificate.

  • An LDAP directory integration configured using plain LDAP (ldap://) instead of secure LDAPS (ldaps://).

Environment

 VMware Cloud Foundation Automation (VCF Automation)

Cause

VCF Automation 9.x strictly enforces FIPS 140-2 compliance for all external integration endpoints. The pre-upgrade check (test-application-01-9x-fips) validates that every configured integration communicates over a secure, certificate-backed channel.

Legacy integrations created in earlier versions of vRealize Automation / Aria Automation may have been configured before this requirement was strictly enforced, resulting in:

  • IPAM or vROps endpoints using HTTP or HTTPS without proper certificate validation.

  • LDAP directory integrations using the unencrypted ldap:// protocol on port 389.

Because these configurations do not satisfy FIPS requirements, they are flagged as hard blockers.

Resolution

The recommended resolution is to update or recreate each incorrectly configured integration to use a secure, certificate-backed connection before retrying the upgrade.

Fix IPAM / vROps Integration Endpoints

  1. Log in to the VCF Automation UI and navigate to Infrastructure → Integrations.

  2. Locate integrations of type IPAM or vROps that do not have a certificate configured.

  3. Edit each integration, provide a valid TLS certificate (in PEM format), and save.

  4. Re-run the upgrade pre-checks to confirm the issue is resolved.

Fix LDAP Directory Integration

  1. Navigate to Infrastructure → Identity & Access Management → Directories.

  2. Locate the LDAP directory currently using ldap://.

  3. Edit the directory configuration and switch the protocol to ldaps:// with the appropriate port (default: 636).

  4. Provide the LDAP server's CA certificate.

  5. Save the configuration and re-run the upgrade pre-checks.

Note: Coordinate with your LDAP/Active Directory administrator to obtain the correct server certificate and confirm that port 636 is open and accessible from the VCF Automation appliance.

—

Workaround (Skip the Precheck)

If correcting the integration endpoints is not feasible before the upgrade (for example, during a tightly scheduled maintenance window with a hard deadline), the failing FIPS precheck can be explicitly skipped.

Warning: Skipping this precheck means the upgrade will proceed with insecurely configured integrations in place. After the upgrade completes, these integrations must be remediated immediately. Leaving incorrectly configured integrations in a 9.x environment poses a security risk and will cause integration failures in future releases that enforce FIPS at runtime.

Prerequisites

  • SSH access to the VCF Automation appliance with sudo privileges.

  • kubectl access to the prelude namespace (available on the appliance via sudo -i).

Procedure

  1. SSH into the VCF Automation appliance.

  2. Run the following command to create the skip configuration:

    Bash
     
    sudo -i kubectl create configmap vcfa-precheck-skip-config -n prelude --from-literal='skip-config.json={ "precheckIds": ["com.broadcom.vcfa.upgrade.90.application.check.test-application-01-9x-fips" ], "reason": "Approved skip for maintenance window" }'

  3. Verify that the ConfigMap was created successfully:

    Bash
     
    sudo -i kubectl get configmap vcfa-precheck-skip-config -n prelude -o yaml

  4. Retry the upgrade. The FIPS precheck will now be skipped, allowing the upgrade to proceed.

  5. After the upgrade completes, remediate all incorrectly configured integrations as described in the Resolution section above, then delete the workaround ConfigMap:

    Bash
     
    sudo -i kubectl delete configmap vcfa-precheck-skip-config -n prelude

 

Additional Information

  • The skip ConfigMap is strictly scoped to the prelude namespace and applies only to the pre-upgrade validation phase. It does not disable FIPS enforcement at the runtime application level.

  • The workaround ConfigMap is only valid for 24 hours from the time it is created. If the upgrade has not been initiated or completed within that window, the ConfigMap must be deleted and re-created before retrying:

    Bash
     
    sudo -i kubectl delete configmap vcfa-precheck-skip-config -n prelude

    Then, re-run the creation command from Step 2 of the Workaround procedure.

  • If the upgrade is retried multiple times within the 24-hour validity window, the ConfigMap persists across attempts and does not need to be re-created.   

     
     
Powered by Wolken Software