Certificate Collection Fails in VCF Operations 9.1.1 when VCF Operations for Networks is of older version (< 9.1.1)
search cancel

Certificate Collection Fails in VCF Operations 9.1.1 when VCF Operations for Networks is of older version (< 9.1.1)

book

Article ID: 454096

calendar_today

Updated On:

Products

VCF Operations for Networks

Issue/Introduction

  • Post upgrading VMware Aria Operations to version 9.1.1, certificate collection for integrated VMware Aria Operations for Networks  instances stops updating in the VCF Operations Certificate Manager.
  • No certificate expiry details are updated or displayed for the VCF Operations for Network endpoint within the VCF Operations Certificate Manager.
  • The issue occurs silently; no explicit error messages or warnings are surfaced in the user interface.
  • This condition is observed specifically when VCF Operations has been upgraded to version 9.1.1 while the integrated VCF Operations for Network instance remains on a version earlier than 9.1.1.
  • Evidence can be seen from the collector logs only at location /var/log/arkin/collector

    WARN collector 33948 [(82) com.vmware.adapter.management.components.certificate.manager.VrniManager.collect] - [Vrni] No VRNI endpoint found. Skipping certificate collection.
ERROR collector 33948 [(82) com.vmware.adapter.management.components.certificate.manager.VrniManager.propagateInternalCertificateAlerts] - [Vrni] VRNI Endpoint is null, cannot propagate alerts.
ERROR collector 31823 [(80) com.vmware.adapter.management.components.certificate.manager.VrniManager.propagateInternalCertificateAlerts] - [Vrni] Unexpected error while fetching system certificate expiry alerts for host: ##.#.#.###
org.springframework.web.client.HttpClientErrorException$MethodNotAllowed: 405 Method Not Allowed on GET request for "https://##.#.#.###/api/ni/settings/certificates/alerts": "
{"code":405,"message":"HTTP 405 Method Not Allowed"}
at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:115)
at com.vmware.adapter.management.common.certpassword.util.VrniApiClient.callVrniApi(VrniApiClient.java:148)
at com.vmware.adapter.management.components.certificate.manager.VrniManager.propagateInternalCertificateAlerts(VrniManager.java:516)
at com.vmware.adapter.management.components.certificate.CertificateComponent.propagateCertificateAlerts(CertificateComponent.java:519)

Environment

  • VCF Aria Operations
  • VCF Aria Operations for Networks 

Cause

Starting in VCF Operations for Networks 9.1.1, certificate collection utilizes one of two mechanisms:

1. VIM Adapter-based collection (New in 9.1.1): Automatically used when the integrated VCF Operations for Networks instance is running version 9.1.1 or later.

2. Legacy LCM-based collection: Used as a fallback mechanism when VCF Operations for Networks is on a version earlier than 9.1.1.

When VCF Operations for Networks  is on a version below 9.1.1, the VCF Operation falls back to the legacy LCM path. This legacy path strictly requires that both the VCF Operations for Network adapter instance and the primary VIM adapter instance reside on the same VCF Operations cluster node.
If these two adapters reside on different nodes within the cluster, the legacy collection path silently fails to update certificate information.

Resolution

Option 1: Upgrade VCF Operations for Networks (Recommended)

Upgrade VCF  Operations for Networks to version 9.1.1 or higher.

Once VCF Operations for Networks  is upgraded to 9.1.1 or later, VCF Operations natively uses the new VIM Adapter-based collection path, eliminating node placement dependencies and fully resolving the issue.

Option 2: Align Adapter Node Placement (Workaround)

If VCF Operations for Networks must remain on a version earlier than 9.1.1, move the VCF Operations for Network  adapter instance to the same cluster node as the primary VIM adapter to allow the legacy LCM collection path to function:

See Steps below:

  1. Navigate to Administration → Configurations → Inventory Management → Adapter Instances → Infrastructure Management Adapter Instance
  2. Select all instances
  3. EnableIdentifier 3.
    1. Click on Show columns, 
    2. Select Identifier 3, refer to screenshot below for reference.



    3. Click save.
    4. Find the VIM adapter name where Identifier 3 column show "Activated". Collector name is mentioned in braces along with name. Refer to below screensot for reference.



    5. Move the above network adaptor to right collector, see steps mentioned below:
    6. Navigate to Administration → Integration → Network Adapter.
    7. Click Edit to change adapter configuration.
    8. Adjust the collector that matches the collector name on which Primary VIM adapter is running. See screenshots below for reference.





    9. Click Save

 

 

Additional Information

Impacts

  • Functional: Operators cannot view or manage the certificate for "VCF Operations for networks" via the Fleet Certificates UI - it is not listed at all, blocking visibility into expiry status, renewal, and replacement for this component.
  • Customer impact: Any user running mixed-version fleets during/after a partial 9.1.1 rollout would lose certificate visibility for VCF Operations for Networks  with no error surfaced in the UI itself (the failure is silent from the UI's perspective - it just shows no data). This increases risk of an unnoticed certificate expiry for this component.
  • Data loss: None - the certificate itself remains valid and correctly stored; this is a collection/display defect only.
Powered by Wolken Software