VCF Automation upgrade fails at Reset VCF services runtime password

Products

• VCF Automation

Issue/Introduction

An upgrade of VMware Cloud Foundation (VCF) Automation from version 9.0.2 to 9.1 fails. Upgrade workflow halts during the "Inventory Sync Post Automation upgrade" phase, specifically failing at the "Reset VCF services runtime password" task. Network connectivity checks reveal that port 443 is closed or unresponsive on the VCF Automation (VCFA) nodes. Additionally, Envoy Gateway logs for the VCFA component display a "conflicting algorithm" error.

Error:

Inventory sync post VCF Automation upgrade:

Failed to reset password for VCF services runtime component with type 'VCFA'.

Step post_upgrade_inventory_sync failed. Reference Code: xxxxx. Check logs for details.

Environment

VMware Cloud Foundation (VCF) Automation 9.1

Cause

The custom certificate applied to the VCF Automation environment contains duplicate DNS entries in its Subject Alternative Name (SAN) section. An upstream issue in the Envoy Gateway causes the ingress controller to reject certificates with duplicate SAN entries. This triggers a "conflicting algorithm" error, preventing the Envoy Gateway from listening on port 443, which subsequently blocks the upgrade workflow from communicating with the VCF services runtime

Resolution

RESOLUTION

1. Generate a new valid certificate for VCF Automation that strictly does not contain duplicate subjectAlternativeName (SAN) DNS entries.

2. Manually replace the existing VCF Automation certificate with the newly generated certificate.

3. Verify that the Envoy Gateway services are successfully listening on port 443 and that the "conflicting algorithm" errors have ceased in the logs.

4. Retry the failed VCF Automation upgrade task