The Synchronize Inventory Versions for NSX task fails in VCF Operations 9.1.1

Products

• VCF Operations

Issue/Introduction

• The nightly task to 'Synchronize Inventory Versions' fails with the following error:

Please ensure NSX manager is running and reachable. Unable to fetch NSX Manager resource versions with FQDN to complete inventory sync.

Environment

VCF Operations 9.1.1

Cause

• The NSX service account is locked out on the NSX Manager.
• The SDDC Manager services continuously attempt to authenticate using outdated credentials, which immediately re-locks the account upon manual remediation attempts, creating a persistent lockout loop.
• In VCF Operations 9.1.1 the NSX Manager IP address is automatically added to a 'lockout_immune_address' policy to prevent service accounts from being locked.
• If the particular service account is already locked before upgrading to 9.1.1 then this policy is not implemented and must be added manually.

Resolution

1. Perform a snapshot of the SDDC Manager before proceeding.
2. Exempt the SDDC Manager from the NSX lockout policy by executing the following API command from the SDDC Manager:

curl -ks https://<NSX_IP>/api/v1/cluster/api-service -u 'admin:<password>' | jq ".lockout_immune_addresses += [ \"$(hostname -i)\" ]" | curl -ks https://<NSX_IP>/api/v1/cluster/api-service -u 'admin:<password>' -X PUT -H 'Content-Type:application/json' -d @- 

Additional Information

• Note this article is for VCF 9.1.1
• Review the following article if the issue is in VCF 9.0.x or 9.1
• NSX service account disconnected and password rotation failure in SDDC Manager