False positive "VCF Operations instance lifecycle password has expired" alert in VCF Operations

Products

• VCF Operations

Issue/Introduction

1. In VCF Operations, the following alert is triggered on the SDDC Manager App Object:
   

   VCF Operations instance lifecycle password has expired

2. The VCF Operations UI (Manage > Passwords > VCF Instances > VCF Instance) displays 'No Expiry' for all SDDC Manager accounts.
3. The property 'VCF Management Information | VCF Password Management Information | No. of Days to Expire' on the SDDC Manager App Object has a negative value and stops updating.
4. Checking the password expiry on the SDDC Manager using the chage command reports 'Password Expires: Never' for vcf, backup, and root accounts.

Environment

• VCF Operations 9.1.1
• SDDC Manager 9.1.1

Cause

1. This issue occurs when the password expiration for local OS accounts on the SDDC Manager is set using the command chage -M -1 <username>.
2. This configuration omits a required password expiry attribute from the SDDC Manager API response and causes VCF Operations to retain old data.

Resolution

"Never Expire" is not a supported architectural state for core SDDC components within the automated lifecycle management engine. If this is a requirement, update the password expiration policy for all the SDDC Manager local accounts(root, vcf, backup) to a valid future date.

1. Establish an SSH connection to the SDDC Manager instance.
2. Execute the following command for each account (e.g., root, vcf, backup):
   

   chage -M 99999 <username>

   Note: Setting the value to 99999 will configure the password to never expire, but this can be any positive number as per your requirement. 
3. Verify the settings using the command:

   chage -l <username>

4. Allow approximately six hours for the next scheduled metric collection cycle. The "No. of Days to Expire" metric will automatically update to a positive value, and the alert will clear.

Note: If the alert persists after the metric collection cycle, set the SDDC Manager App object in VCF Operations to "Maintenance Mode" and then exit it to force a manual refresh.

Additional Information

Configuring Password Expiration and Rotation in VMware Cloud Foundation (VCF) 9.x