Error: Could not cleanup test failover due to Global.DisableMethods permission failure in VMware Cloud Director Availability (VCDA) deployed on Azure VMware Solution (AVS)

Products

• VMware Cloud Director
• VMware Cloud Director Availability - Disaster Recovery 4.x
• VMware Cloud Director Availability - Migration 4.x

Issue/Introduction

Migration or test failover tasks in VMware Cloud Director Availability (VCDA) fail during the cleanup phase. This issue is specific to environments running on Azure VMware Solution (AVS).

• The VCDA interface shows the error: Could not cleanup test failover.
• The cloud.log on the destination Replication Manager contains the following error: com.vmware.vim.binding.vmodl.fault.NoPermission: privilegeId = Global.DisableMethods on object AuthorizationManager.
• Replications may become stuck in a 'Cleaning up' or 'Error' state.

Environment

• VMware Cloud Director Availability 4.x
• Azure VMware Solution (AVS)
• VMware Cloud Director 10.x

Cause

Azure VMware Solution (AVS) enforces strict security policies on vCenter Server permissions. The service account used by VMware Cloud Director to interact with vCenter is not granted the Global.DisableMethods and Global.EnableMethods privileges. These privileges are required for the lifecycle management of Real-Time (RT) VMs. When VCDA attempts to cleanup these shadow objects, the permission denial from vCenter causes the task to fail.

Resolution

To resolve this issue, ensure that VCDA was deployed using the AVS Run commands to configure the correct permissions in the environment.

VMware Cloud Director Availability in Azure VMware Solution

VMware Cloud Director Availability Run command glossary : Initialize-AVSSite

To workaround this issue, disable the Replication Tracking (RT) VM feature. This forces VCDA to use the Independent Disk placement solution, which does not require the restricted vCenter methods.

1. Log in to the destination Replication Manager appliance via SSH.
2. Create a backup of the configuration file: cp /opt/vmware/h4/cloud/config/application.properties /opt/vmware/h4/cloud/config/application.properties.backup
3. Edit the application.properties file: vi /opt/vmware/h4/cloud/config/application.properties
4. Add or modify the following line: vcd.rt.vms=false
5. Save and close the file.
6. Restart the cloud service for the changes to take effect: systemctl restart cloud.service
7. Manually terminate any stuck tasks and recreate the replications.
8. Ensure the Placement Solution column shows each protection is using the Independent Disk placement solution before attempting a Migration or Failover task.

Note: Disabling RT VMs is a permanent requirement for AVS environments where these specific Global permissions cannot be assigned to the VCD service account.