VMware Encryption Management service becomes unhealthy with error "The VCF Automation Tenant Manager entity Encryption Management Admin already exists"

Products

• VCF Automation

Issue/Introduction

After upgrade / second installation of the VMware Encryption Management service Global Role reconciliation fails and the service remains in an unhealthy state.
The following symptoms may be observed. All of these symptoms are typically present together:

1. The Encryption Management service (Global Role) shows an unhealthy/error status in VCF Automation after an upgrade.
2. The Global Role "Encryption Management Agent" is not visible in the VCF Automation UI or via the Cloud API globalRoles endpoint.
3. Error in UI details or logs:

   endpoint https://tenant-manager.prelude.svc.cluster.local:443/cloudapi/1.0.0/globalRoles failed:
   {"minorErrorCode":"BAD_REQUEST","message":"The VCF Automation Tenant Manager entity Encryption Management Admin already exists.", ...}

Environment

• VCF Automation 9.1.0.0
• VCF Automation 9.1.1.0

Cause

1. This issue occurs when the affected service (for example, VMware Encryption Management) was previously uninstalled from VCF Automation and the uninstall did not complete cleanly.
2. During uninstall, the API calls to delete the associated RDE (Runtime Defined Entity), Service Account, and Global Role are issued concurrently. If the Global Role has been published to a large number of organizations, unpublishing it from all of them can take longer than the deletion of the RDE's underlying rights. As a result, the Global Role's role and org-member ("proxy") database entries can be deleted before the role is fully unpublished from every organization, leaving orphaned proxy role entries behind for that role name.
3. When VCF Automation is later upgraded (or the service is reinstalled), the installation attempts to recreate the Global Role. Because the leftover, orphaned proxy role entries still exist in the Tenant Manager database under the same role name, the creation request is rejected with an "entity already exists" error — even though the Global Role itself is not visible in the UI or via the API.

Resolution

This issue is being reviewed and a permanent fix is planned for a future release.

To workaround the issue orphaned database entries for the affected role can be removed directly from the Tenant Manager database, contact Broadcom Technical Support and note this Knowledge Article ID (453499) in the problem description.

• For more information, see How to Submit a Support Request

Note: Modifying the Tenant Manager database directly should be done with caution. Ensure a database backup exists before performing the deletion.

Additional Information

Note: For defects and enhancements subscribe to the article to be updated on fix status.