Workaround for alarms not getting raised/resolved on Security Services Platform (SSP)

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

In the Security Services Platform (SSP), users may encounter one or both of the following issues:

1. If licensing-related alarms were triggered prior to ingress certificate rotation, they will not be resolved even after connectivity between the SSP and the License Hub is restored.
2. If connectivity between the SSP and the License Hub is lost following ingress certificate rotation, new licensing-related alarms will fail to trigger.

These issues prevent users from knowing if there is a connectivity issue between SSP and License Hub.

Below are the alarms that are impacted:

1. License refresh failed
2. Usage reporting failed

Environment

vDefend Security Services Platform (SSP) = 5.2

Cause

Perform Ingress Cert Rotation on SSP.

Resolution

Steps:

1. Copy the attached script (fix_licensing_client_service_truststore.sh) to the SSP Installer (SSPI) VM. 

2. Make it executable and run it as sysadmin (No root/sudo needed - it only needs kubectl access to the workload cluster):

chmod +x fix_licensing_client_service_truststore.sh
./fix_licensing_client_service_truststore.sh                  # single SSP instance
./fix_licensing_client_service_truststore.sh --ssp <name>     # multiple SSP instances

3. Verify: The script prints "Done. NAPP_PLATFORM_INGRESS is now trusted and licensing-client-service has restarted." on success. You can additionally confirm no more TLS errors with:

kubectl logs -n nsxi-platform deploy/licensing-client-service | grep -i "unknown authority" --> single ssp-instance

k logs -n nsxi-platform deploy/licensing-client-service --ssp <instance-name> | grep -i "unknown authority" --> for multiple ssp-instances

4. Re-running is safe - it's idempotent; if the tag is already present it does nothing.

Additional Information

If you encounter alarms on vDefend License Hub aswell, you may refer to the KB: Workaround for alarms not getting raised/resolved on License Hub (LH) after ingress certificate rotation