"Create VC Service Users for AVI Load Balancer Failed" error during NSX Advanced Load Balancer deployment in VCF Operations

Products

• VCF Operations

Issue/Introduction

• Deploying NSX Advanced Load Balancer(Avi) from VCF Operations fails at the step "Create VC Service Users for AVI Load Balancer".
• The NSX Manager is shared between the management domain and workload domains.
• SDDC Manager reports below error in /var/log/vmware/vcf/domainmanager/domainmanager.log:
  
  error_message=409 Conflict on POST request for "https://<AVI Load Balancer IP>/api/cloudconnectoruser": "{"error": "Cloud connector user with this Name and Tenant ref already exists."}", httpStatus=BAD_REQUEST, error_code=500016, module_name=Policy

Environment

VCF Operations 9.1.0
NSX Advanced Load Balancer 32.1.1

Cause

During Avi deployment, SDDC Manager creates a dedicated vCenter service user account and associated credentials in Avi for each vCenter instance.

This issue occurs when a workload domain vCenter FQDN contains the management domain vCenter FQDN as a substring, for example: 

• Management domain vCenter FQDN: vcenter.domain.com
• Workload domain vCenter FQDN: workloadvcenter.domain.com

When looking up vCenter details, the SDDC Manager Data Service executes a query using a substring/contains filter instead of an exact match. Consequently, both vCenters match the search query, causing SDDC Manager to generate identical usernames for both domains.

The first user account is created successfully, but the second account request fails with a 409 Conflict error in Avi due to the duplicate username.

Resolution

A fix for the issue will be included in future SDDC Manager version.

To complete the Avi deployment, apply either of the below workaround to avoid the issue:

1. Change the FQDN of the vCenter in workload domain to a different name without containing management domain vCenter FQDN as substring following: Changing the vCenter FQDN in VMware Cloud Foundation 9.1.
2. Remove the affected workload domain whose vCenter FQDN contains the management vCenter FQDN substring. This requires migrating all workloads off the workload domain prior to the action.