VM template sync fails when vCenter instances are linked using vCenter grouping in VCF Operations 9.1

Products

• VMware vCenter Server

Issue/Introduction

In VCF 9.1, when vCenter instances are linked using vCenter Groups rather than the deprecated vCenter ELM, you may experience synchronization failures with Virtual Machine templates.

Specifically, this occurs under the following conditions:

• vCenter instances are linked via Operate > Administration > Configurations > vCenter Linking in VCF Operations.
• A content library is created on one of the vCenter instances.
• A VM template is added to the library.
• A new subscription is created.

During the sync process, the VM template fails to synchronize, and you observe one of the following errors in the vSphere Client:

A general system error occurred: Failed to publish library <source library> to subscribed library <target library> on vCenter Server XYZ. Reason: The operation failed due to Permission to perform this operation was denied.

Permission to perform this operation was denied: You do not hold privileges...

Note: VM template synchronization functions correctly if the vCenter instances are linked using the older ELM method.

Environment

VCF 9.1

Cause

When vCenter instances are linked using vCenter Groups in VCF 9.1, the built in Content Library service account is not automatically added to the correct SSO group.
Without this group membership, the account lacks the required cross vCenter permissions to sync VM templates. This causes the synchronization to fail with an "access denied" error.

Resolution

To resolve this issue, you must manually add the Content Library service account to the vSphereClientSolutionUsers group on all linked vCenter instances.

Perform the following steps via SSH on each linked vCenter Server appliance:

• Step 1: Retrieve the Machine ID : Run the following command to get the machine ID for the vCenter instance:

/usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost

 

• Step 2: Add the Content Library User : Using the machine ID retrieved in Step 1, run the following command to add the user to the solution users group. Replace <machine-id> with your output from Step 1, and <vCenter Server SSO administrator login id> with your actual SSO admin account (e.g., [email protected]).

/usr/lib/vmware-vmafd/bin/dir-cli group modify --name vSphereClientSolutionUsers --add content-library-user-<machine-id> --login <vCenter Server SSO administrator login id>

Repeat this process on all remaining vCenter instances in the VCF Operations vCenter group.