vCenter Server Update Fails With Error: patch hook 'wcp:Patch' failed with generator didn't stop after throw()

Products

• VMware vCenter Server

Issue/Introduction

During a VMware vCenter Server update, the patching process fails during the wcp component phase. The PatchRunner.log shows that the roles_groups_users patch script fails, resulting in the following error:

Patch hook 'wcp:Patch' failed. Traceback (most recent call last): ... patch_errors.UserError: Failed to apply patch roles_groups_users! Error: generator didn't stop after throw().

This symptom occurs when the update process encounters a conflict with existing Cloud Native Storage (CNS) roles in the vSphere LDAP directory.

Environment

VMware vCenter Server 8.0 Update 3

Cause

The update failure is caused by a metadata mismatch between the existing CNS roles in the LDAP directory and the version required by the update. Specifically, existing roles have a vmwAuthzRoleVersion set to 0, while the update expects vmwAuthzRoleVersion: 2. This mismatch triggers a validation error during the patching of roles_groups_users, causing the update to fail.

Resolution

To resolve this issue, rename the conflicting roles via the vSphere Client to allow the installer to provision fresh, correctly versioned roles.

Prerequisites:

• Take a snapshot of the vCenter Server Appliance before proceeding.

Steps:

1. Rename Conflicting Roles via UI:

   • Log in to the vSphere Client with Administrator privileges.
   • Navigate to Administration > Access Control > Roles.
   • Locate the following three roles:
     • CNS-SUPERVISOR-DATASTORE
     • CNS-SUPERVISOR-SEARCH-AND-SPBM
     • CNS-SUPERVISOR-HOST-CONFIG-STORAGE-AND-CNS-VM
   • For each role, click Edit and rename it by prepending CNS-VANILLA- to the name (e.g., rename CNS-SUPERVISOR-DATASTORE to CNS-VANILLA-CNS-SUPERVISOR-DATASTORE).

2. Restart Services: SSH into the vCenter Server Appliance and restart the vpxd-svcs service to clear cached role information:

   bash

    

   service-control --restart vpxd-svcs

3. Resume Patching: Navigate to the VAMI and Resume the update. The installer will no longer find the original role names and will proceed to recreate them with the correct versioning.

Note: The patch installer may automatically remove the renamed CNS-VANILLA-* roles upon successful completion of the update. If they remain, they can be safely deleted via the vSphere Client.

 

Additional Information

• For detailed LDAP audit procedures if necessary, refer to KB Patching vCenter Server 8.0 U3 may report a failure with "Exception occurred in postInstallHook for wcp:patch"