VCF Upgrade Fails at VMSP Cluster Bootstrap with PUBLIC_VSP_CLUSTER_BOOTSTRAP_FAILED_DETAILED
search cancel

VCF Upgrade Fails at VMSP Cluster Bootstrap with PUBLIC_VSP_CLUSTER_BOOTSTRAP_FAILED_DETAILED

book

Article ID: 452428

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

  • Upgrading VMware Cloud Foundation (VCF) fails during the deployment of the VMSP cluster in the bootstrap phase. The deployment halts with the following exact error message: PUBLIC_VSP_CLUSTER_BOOTSTRAP_FAILED_DETAILED.
  • The bootstrap virtual machine is unable to resolve Fully Qualified Domain Names (FQDNs) via DNS, which prevents the bootstrap.sh script from completing successfully. When verbose logging is enabled for bootstrap_task.sh, the /data/vmsp/scripts/bootstrap_task_setup.log concludes with the following lines, indicating a failure to retrieve the vCenter Server SSL fingerprint

+++ openssl s_client -connect <vCenter Server FQDN>:443
+++ openssl x509 -sha1 -fingerprint -noout
+++ awk -F= '{ print $2 }'
++ vc_fingerprint=
+++ sleep 5
+++ openssl s_client -connect <vCenter Server FQDN>:443
+++ openssl x509 -sha1 -fingerprint -noout
+++ awk -F= '{ print $2 }'
++ vc_fingerprint=

  • Network trace captured on the uplink port of the ESXi host running the bootstrap VM shows that no response from the DNS server indicating a drop in the DNS network. 

Environment

VMware Cloud Foundation (VCF) 9.1.x 

Cause

Port 53 is closed on the network segment where the bootstrap VM is deployed. This restriction prevents standard DNS communication, causing the failure when the bootstrap VM attempts to fetch the vCenter Server certificate using OpenSSL via the vCenter Server FQDN

Resolution

  1. Identify the network segment and associated firewall managing the deployed VMSP bootstrap VM.

  2. Open port 53 (TCP/UDP) to allow bidirectional DNS traffic for the bootstrap VM.

  3. Verify standard DNS communication is restored and the bootstrap VM can successfully resolve the vCenter Server FQDN.

  4. Retry the VMSP cluster deployment via SDDC Manager/VCFOPs.

Additional Information

The bootstrap VM will be deleted after a failure until the last scripted re-attempt. The following steps must be executed quickly when the VM's bootstrap deployment completes.

To enable verbose logging for the bootstrap script:

  1. Log in to the bootstrap VM and open /data/vmsp/scripts/bootstrap_task.sh in a text editor.

  2. Locate the following line: set -euo pipefail

  3. Change it to: set -exuo pipefail

Powered by Wolken Software