Native Log Management Deployment Fails at Create Service Account in VCF Operations

Products

• VCF Operations

Issue/Introduction

• When attempting to deploy the native Log Management instance within VMware Cloud Foundation (VCF) Operations 9.1, the deployment consistently fails at the 'create service account' step. While the service displays as running on the Lifecycle page, the Log Management tab only provides the option to deploy.
• Analysis of the support logs reveals that fleet fails to register the component with Operations, resulting in an HTTP 401 (Unauthorized) error during service account creation:
  

  Failed to create service account for Log management. HTTP Status Code: 401 (Unauthorized). API Response: {"errorMessage":"The parsed JWT indicates it was signed with the 'EdDSA' signature algorithm, but the provided javax.crypto.spec.SecretKeySpec key may not be used to verify EdDSA signatures. Because the specified key reflects a specific and expected algorithm, and the JWT does not reflect this algorithm, it is likely that the JWT was not expected and therefore should not be trusted.

Environment

• VCF Operations 9.1
• Log Management 9.1

Cause

The VSP platform certificate was rotated, but its issuing CA/chain was not integrated into the platform-trust trust-manager bundle. Consequently, internal consumers, such as the Identity Service, fail to establish trust with the VSP node, resulting in an authorization failure during component registration.

Resolution

1. Inject the new platform certificate's CA chain into the source that feeds the platform-trust bundle.

   • VCF 9.1 Software Depot fails with error, "Failed to connect to the authorization server to obtain access token." when using a SSL Inspection proxy

2. Allow trust-manager to re-render the platform-trust bundle so internal consumers (like the Identity Service) trust the VSP node again.

3. Delete all references to the old Log Management cluster.

   • Failed component cleanup during VCF 9.1 installation or upgrade

4. Retry the Log Management deployment.