SDDC Manager Upgrade fails if default SDDC Manager password configuration changed

Products

• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

When upgrading to SDDC Manager 9.1.1 or 9.1.1.0100, during upgrade, SDDC Manager Deployment Drift step fails and in-turn blocking the SDDC Manager upgrade. On the failed SDDC Manager appliance, the following error pattern can be seen in /var/log/vmware/vcf/lcm/thirdparty/upgrades//sddcmanager-migration-app/logs/sddcmanager_migration_app_upgrade.log


####-##-##T##:##:##.####+0000 WARN [vcf_lcm,0000000000000000,0000] [c.v.e.s.o.model.error.ErrorFactory,pool-5-thread-15] [AO3AOB] FAILED_TO_DISABLE_BASIC_AUTH_SDDC_MANAGER Failed to disable Basic Authentication API access on SDDC Manager

Environment

VMware Cloud Foundation 9.1.1.x

Cause

If password of any sddc manager appliance accounts like root, vcf, backup changed more than 90 days ago and default password configuration is changed, configuration restore task incorrectly expires respective accounts during the upgrade. This will block sddc manager upgrade. Default password configuration include Password Length(minlen), Uppercase Letters (ucredit), Lowercase Letters(lcredit), Numeric Characters(dcredit), Special Characters(ocredit) in /etc/security/pwquality.conf, Deny(deny), Fail Interval(fail_interval), Unlock Time(unlock_time) in /etc/security/faillock.conf, Remember(remember) in /etc/security/pwhistory.conf, PASS_MAX_DAYS in /etc/login.defs.

Resolution

 In case of failure, revert to snapshot, and change password of all accounts which were changed more than 90 days ago.