SSP - Security Explorer Compute View shows very few VMs being clustered
Article ID: 452088
Updated On:
Products
Issue/Introduction
Very few VMs are clustered correctly in the Security Explorer UI, majority are unclustered.
The 'feature-service-data-service' container logs would show recurring 403 Forbidden API exceptions when attempting to retrieve feature switch information.
Note: If the environment has continuous network traffic or was recently upgraded from a previous SSP version, this issue may not become apparent within the first 30 days.
Environment
SSP 5.2
Cause
The feature-service job responsible for clustering lacks the required RBAC permissions to read the "useflowkeyv2" feature switch setting. As access is denied, the service defaults to querying data using an an older flow key configuration. This reduces the amount of valid flow data processed, resulting in fewer clusters being formed.
Related logs:
Find the feature service pod
k -n nsxi-platform get pod | grep feature-service-flow-feature-creator
feature-service-flow-feature-creator-29776360-5v25j 0/1 Completed 0 137m
feature-service-flow-feature-creator-29776420-fz9fj 0/1 Completed 0 77m
feature-service-flow-feature-creator-29776480-pj2rm 0/1 Completed 0 17m
Check the logs for errors related to featureswitches
k -n nsxi-platform logs feature-service-flow-feature-creator-29776360-5v25j -c feature-service-data-service| grep featureswitches
2026-08-13T00:40:31,470 ERROR [main] c.v.n.p.f.f.c.FeatureSwitchClientImpl: INTELLIGENCE [nsx@4413 comp="nsx-manager" errorCode="INT915300" level="ERROR" logger="FeatureSwitchClientImpl" msgID="INTELLIGENCE" subcomp="manager" threadName="main"] Exception occurred while retrieving feature switch info.\nio.kubernetes.client.openapi.ApiException: Message: class V1Status {\n apiVersion: v1\n code: 403\n details: class V1StatusDetails {\n causes: []\n group: intelligence.nsx.vmware\n kind: featureswitches\n name: null\n retryAfterSeconds: null\n uid: null\n }\n kind: Status\n message: featureswitches.intelligence.nsx.vmware is forbidden: User "system:serviceaccount:nsxi-platform:feature-service-sa" cannot list resource "featureswitches" in API group "intelligence.nsx.vmware" in the namespace "nsxi-platform": RBAC: clusterrole.rbac.authorization.k8s.io "vmware-napp-platform-psp-role" not found
Resolution
To resolve this issue, you must patch the Kubernetes role to grant the feature service get, list, and watch permissions for 'featureswitches' within the 'intelligence.nsx.vmware' API group.
1. Login to SSPI CLI.
2. Patch the role with additional permissions:
k -n nsxi-platform patch role feature-service --type='json' -p='[{"op":"add","path":"/rules/-","value":{"apiGroups":["intelligence.nsx.vmware"],"resources":["featureswitches"],"verbs":["get","list","watch"]}}]'
3. Confirm the permissions have been added to the role.
k -n nsxi-platform get role feature-service -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
annotations:
meta.helm.sh/release-name: intelligence
meta.helm.sh/release-namespace: nsxi-platform
labels:
app.kubernetes.io/managed-by: Helm
name: feature-service
namespace: nsxi-platform
rules:
- apiGroups:
- '*'
resources:
- pods
- services
- configmaps
- statefulsets
- jobs
- deployments
verbs:
- '*'
- apiGroups:
- intelligence.nsx.vmware
resources:
- featureswitches
verbs:
- get
- list
- watch
4. The clustering job is triggered hourly. After one hour, confirm that the latest feature-service job no longer displays the 403 error
k -n nsxi-platform get pod | grep feature-service-flow-feature-creator
k -n nsxi-platform logs <new-feature-service-pod-name> -c feature-service-data-service| grep 403
Feedback
