"Error creating VC client: failed to login to VC: login as vpxd-extension solution user failed" when trying to run certmgr utility on vCenter Server

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• Attempts to execute any certmgr command in vSphere Kubernetes Service Supervisor fails with the following error:
  
  "Error creating VC client: failed to login to VC: login as vpxd-extension solution user failed (Post "https://<REDACTED_HOSTNAME>/sts/STSService/vsphere.local": Forbidden), and fallback login as wcp service account also failed: failed to read wcp service account password file /var/cache/svcaccounts/wcp/.wcp: open /var/cache/svcaccounts/wcp/.wcp: no such file or directory"


• In the affected vCenter Server, the directory /var/cache/svcaccounts/wcp/.wcp would be missing.

Environment

VMware vCenter Server
VMware vSphere Kubernetes Service

Cause

The vCenter Server is missing the .wcp service account password file. This file contains the secret used by the vpxd-extension solution user to authenticate and log into the Supervisor Cluster. The absence of this file prevents the certmgr utility from authenticating, resulting in the "Forbidden" and "no such file or directory" errors.

Resolution

Restart the vCenter Server services. This action should trigger the recreation of the missing .wcp service account password file and restores the authentication mechanism required for the certmgr utility.