NSX password expiration alarms are inconsistent and VCF Operations credential Update or Remediate tasks fail in Password Management

Products

• VMware NSX

Issue/Introduction

In VMware Cloud Foundation (VCF), the automated or manual password update or rotation tasks in SDDC Manager fail to complete.
In VMware NSX UI, the NSX clusters display password expiration alarms information. "Expired" or "Approaching Expiration" alarms. 

Symptoms:

• NSX Manager dashboard reports critical password expiration alarms for NSX.
• NSX Manager GUI shows the account status for Admin and/or Audit as "Never Expires." 
• Password Management tasks in SDDC Manager remain "In Progress" or "Failed."
• operationsmanager.log contains authorization errors: com.vmware.vapi.std.errors.Unauthorized: Unauthorized
• Attempting to Update or Remediate passwords in the Password Management tasks in SDDC Manager fail

Environment

VMware Cloud Foundation 5.x
VMware Cloud Foundation 9.x
VMware NSX

Cause

Stale or orphaned job entries in the SDDC Manager PostgreSQL databases (platform and operationsmanager) create resource locks. When these locks are present, they prevent SDDC Manager from resynchronizing the actual password state from NSX Manager, leading to a persistent alarm state in the management plane.

Resolution

Clear the stale database locks and reset the stuck tasks to allow synchronization to resume.

See Resolution section of KB 339041 for the steps to do this.