Unable to configure Hard Tenancy since Region creation failed

Products

• VMware Cloud Foundation
• VMware NSX
• VCF Automation

Issue/Introduction

When attempting to configure hard tenancy in VCF Automation, the initial region creation step fails with the following error:

Cannot create or update Region '<region-id>' because the following zones of the specified supervisors do not have a network stack configured: <zone-id>. Please ensure the NSX Manager version is at least 9.1.0 and that the supervisor inventory has been refreshed

Environment

VMware Cloud Foundation

VMware NSX

VCF Automation

Cause

A multi-node concurrency race condition between NSX Manager nodes causes the policy engine to leave a vSphere zone's network stack in an unconfigured (NONE) state.

Resolution

Details of Workarounds

 

Manual workaround steps:

1. Identify the NSX Zone ID for the affected vSphere zone (zone1).

2. Find the TransportNodeCollection(s) associated with the zone's clusters.

3. Get the TransportNodeProfile linked to each TransportNodeCollection.

4. Trigger zone state re-computation by updating the TransportNodeProfile (minor description change).

5. Verify the zone's network stack is no longer in an invalid state.

6. Force realization refresh for the affected zone via the troubleshooting API.

7. Retry the Region Creation workflow.

Automated recovery steps:

 

The automated script (workaround_script_for_zone_network_stack.py) is attached to this article.

 

Detailed Steps with API payloads:

 

Note: The affected zone in this example is "zone1". The steps below use "zone-test" as the example zone — substitute zone1 (and its corresponding NSX Zone ID) wherever zone-test appears.

 

Step 1: Get the NSX Zone ID for the affected zone (zone1)

 

GET https://<NSX>/api/v1/fabric/zones

 

Find the entry where display_name matches zone1. Note the external_id — this is the NSX Zone ID used in subsequent steps.

 

Example response entry for zone-test (same structure as zone1):

 

{

  "cm_local_id": "zone-test",

  "origin_id": "f77d20fe-c38a-4d68-9197-796eed84ae39",

  "external_id": "f77d20fe-c38a-4d68-9197-796eed84ae39:zone-test",

  "resource_type": "Zone",

  "display_name": "zone-test"

}

NSX Zone ID for “zone-test”: f77d20fe-c38a-4d68-9197-796eed84ae39:zone-test

 

Step 2: Identify the TransportNodeCollection for the zone cluster

 

GET https://<NSX>/policy/api/v1/infra/zones/<nsx-zone-id>/members

 

Example (using zone-test):

GET https://<NSX>/policy/api/v1/infra/zones/f77d20fe-c38a-4d68-9197-796eed84ae39:zone-test/members

 

From the response, note the host_transport_collection_path for each member cluster:

 

{

  "network_stack": "NONE",

  "results": [

    {

      "host_transport_collection_path": "/infra/sites/default/enforcement-points/default/transport-node-collections/TNC-1",

      "member_type": "VcCluster",

      "display_name": "Cluster1_DC1_VC1"

    }

  ]

}

 

Step 3: Get the TransportNodeProfile path

GET https://<NSX>/policy/api/v1/infra/sites/default/enforcement-points/default/transport-node-collections/<tnc-id>

 

Example:

GET https://<NSX>/policy/api/v1/infra/sites/default/enforcement-points/default/transport-node-collections/TNC-1

 

Note the transport_node_profile_id from the response:

{

  "transport_node_profile_id": "/infra/host-transport-node-profiles/TNP-1"

}

 

Step 4: Trigger zone state re-computation by updating the TransportNodeProfile

First, fetch the current profile:

GET https://<NSX>/policy/api/v1/infra/host-transport-node-profiles/<tnp-id>

 

Example:

GET https://<NSX>/policy/api/v1/infra/host-transport-node-profiles/TNP-1

 

Then PUT the full response body back, changing only the description field (append any minor change). Keep _revision value from the GET response unchanged.

 

PUT https://<NSX>/policy/api/v1/infra/host-transport-node-profiles/<tnp-id>

Example:

{  "description": "updated-workaround-v1",

  "_revision": 2

"... rest of fields unchanged ..."

}

 

Step 5: Verify zone network stack is no longer NONE

 

GET https://<NSX>/policy/api/v1/infra/zones/<nsx-zone-id>/members

 

Example:

GET https://<NSX>/policy/api/v1/infra/zones/f77d20fe-c38a-4d68-9197-796eed84ae39:zone-test/members

 

Confirm network_stack is not NONE:

{ "network_stack" : "VLAN_BACKED_VPC”   << updated to valid state. }

If network_stack is still NONE, repeat Step 4 for other TNC/TNP pairs associated with the zone's clusters.

 

Step 6: Force realization refresh for the affected zone

POST https://<NSX>/policy/api/v1/troubleshooting/infra/tree/realization?action=invoke_providers

{

  "paths": [

    "/infra/zone-span-tnc-members/<nsx-zone-id>"

  ]

}

 

Example (using zone-test):

{

  "paths": [

    "/infra/zone-span-tnc-members/f77d20fe-c38a-4d68-9197-796eed84ae39:zone-test"

  ]

}

If multiple zones are affected, include all zone paths in the paths array.

 

Step 7: Retry the Region Creation workflow

Retry the region creation in VCF Automation. The workflow should now complete successful