An upgrade of VMware Cloud Foundation (VCF) Automation from version 9.0.2 to 9.1 fails. Upgrade workflow halts during the "Inventory Sync Post Automation upgrade" phase, specifically failing at the "Reset VCF services runtime password" task. Network connectivity checks reveal that port 443 is closed or unresponsive on the VCF Automation (VCFA) nodes. Additionally, Envoy Gateway logs for the VCFA component display a "conflicting algorithm" error.
Error:
Inventory sync post VCF Automation upgrade:
Failed to reset password for VCF services runtime component with type 'VCFA'.
Step post_upgrade_inventory_sync failed. Reference Code: xxxxx. Check logs for details.
VMware Cloud Foundation (VCF) Automation 9.1
The custom certificate applied to the VCF Automation environment contains duplicate DNS entries in its Subject Alternative Name (SAN) section. An upstream issue in the Envoy Gateway causes the ingress controller to reject certificates with duplicate SAN entries. This triggers a "conflicting algorithm" error, preventing the Envoy Gateway from listening on port 443, which subsequently blocks the upgrade workflow from communicating with the VCF services runtime
Generate a new valid certificate for VCF Automation that strictly does not contain duplicate subjectAlternativeName (SAN) DNS entries.
Manually replace the existing VCF Automation certificate with the newly generated certificate.
Verify that the Envoy Gateway services are successfully listening on port 443 and that the "conflicting algorithm" errors have ceased in the logs.
Retry the failed VCF Automation upgrade task