ESXi service account shows as Disconnected in SDDC Password Management after workload domain is decommissioned.

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

After a workload domain is decommissioned from SDDC Manager or if an ESXi host is removed via vCenter instead of SDDC,  the ESXi service account (svc-vcf-esxiXXXX) does not get removed. The account persists in the SDDC Manager UI and is displayed as "Disconnected" in Password Management.

 

Environment

VMware Cloud Foundation 5.x
VMware Cloud Foundation 9.x

Cause

The automated decommission workflow fails to purge the associated service account credential entry from the SDDC Manager database.

Resolution

Manually remove the stale services account user:

1. Take a snapshot of the SDDC manager VM.
2. SSH to the SDDC Manager as vcf and switch to root.
3. Generate a Token
   
   TOKEN=$(curl -H 'Content-Type:application/json' https://localhost/v1/tokens -d '{"username" : "<sso_user>","password":"<sso_password>"}' -k | jq -r '.accessToken')


4. Fetch credentials for resource type ESXI
   
   curl -k -X GET "https://localhost/v1/credentials?resourceType=ESXI" -H "Authorization: Bearer $TOKEN" | jq '.elements[] | {id, username, modificationTimestamp}'
   
   Sample of output
   
   {
  "id": "ea######-####-####-####-d##########0",
  "username": "svc-vcf-esxixxx",
  "modificationTimestamp": "2025-01-08T18:43:17.863Z"
}


5. Delete the stale credential
   
   curl -k -X DELETE "https://localhost/v1/system/credentials/<stale_id_from_Step_4 >" -H "Authorization: Bearer $TOKEN"