False positive for "Identity Broker is not reachable" and "Identity broker is unhealthy" alerts

Products

• VCF Operations
• VMware Cloud Foundation

Issue/Introduction

• Under Manage > Fleet Management > Identity & Access > VCF SSO Overview > [Identity Broker] > Overview > SSO Coverage > VCF INSTANCES, the Status of the VCF Instance flaps between Configured / Not Eligible.

• Identity Broker regularly shows not healthy and then healthy again

• VCF Ops was upgraded from 9.0 to 9.1

Environment

VCF Ops: 9.1

VCF: 9.1

Cause

• VCF 9.1 only allows for one external VCF external identity Broker instance (VIDB) per VCF Operations instance. 
• After the upgrade from 9.0 to 9.1, a stale VIDB instance is left over within the VCF Op database which false triggers the VCF Ops alerts.

Resolution

This is a known issue within VCF Ops 9.1.

Workaround

1. SSH into the VCF Ops primary node.

2. Query the VCF Ops database for the number of external VIDB instances:

   • su - postgres -c "/opt/vmware/vpostgres/current/bin/psql -p 5433 -d vcopsdb -Atc 'SELECT * FROM kv_sso_current_idp_config;'" | grep-ic "external"

3. If the result is more than 1, use the following command to truncate the impacted table:

   • truncate table kv_sso_current_idp_config;

4.  Exit the VCF Ops database:

   • exit

5. Allow 24 hours for the "Identity Broker is not reachable" and "Identity broker is unhealthy" alerts to self-resolve.