VCF Automation upgrade fails at Reset VCF services runtime password

Products

• VCF Automation

Issue/Introduction

• VMware Cloud Foundation (VCF) Automation upgrade from version 9.0.2 to 9.1 fails and halts during the "Inventory Sync Post Automation upgrade" phase, specifically failing at the "Reset VCF services runtime password" task

• Upgrade progresses until "Perform Component Upgrade / Install Component Service on 9.1 Cluster" and remains running for approximately 6 hours
• Task fails with: Task timed out after 6h0m19s Install Component Service on 9.1 Cluster. Status: Failed Step vmsp_upgrade_vcfa failed.

• Network connectivity checks reveal that port 443 is closed or unresponsive on the VCF Automation (VCFA) nodes

• Envoy Gateway logs for the VCFA component display a "conflicting algorithm" error

Error:

Inventory sync post VCF Automation upgrade:
Failed to reset password for VCF services runtime component with type 'VCFA'.
Step post_upgrade_inventory_sync failed. Reference Code: xxxxx. Check logs for details.

Environment

VMware Cloud Foundation (VCF) Automation 9.1

Cause

The custom certificate applied to the VCF Automation environment contains duplicate DNS entries in its Subject Alternative Name (SAN) section. An upstream issue in the Envoy Gateway causes the ingress controller to reject certificates with duplicate SAN entries. This triggers a "conflicting algorithm" error, preventing the Envoy Gateway from listening on port 443, which subsequently blocks the upgrade workflow from communicating with the VCF services runtime

Resolution

1. Generate a new valid certificate for VCF Automation that strictly does not contain duplicate subjectAlternativeName (SAN) DNS entries.

2. Manually replace the existing VCF Automation certificate with the newly generated certificate.

3. Verify that the Envoy Gateway services are successfully listening on port 443 and that the "conflicting algorithm" errors have ceased in the logs.

4. Retry the failed VCF Automation upgrade task