Manually Synchronize WCP Roles
search cancel

Manually Synchronize WCP Roles

book

Article ID: 319396

calendar_today

Updated On:

Products

VMware vSphere ESXi VMware vSphere Kubernetes Service

Issue/Introduction

This KB will provide steps to add back the required Roles to vCenter for WCP service to operate normally

Symptoms:
The following Roles are built for use by the WCP service on vCenter:
 
Role name in vmdirRole Name in vSphere Web client
WorkloadStorageManagementWorkload Storage Manager
vSphereKubernetesManagervSphere Kubernetes Manager
SupervisorServiceClusterSupervisor Cluster Operator
SupervisorServiceRootFolderSupervisorService RootFolder Operator
SupervisorServiceGlobalSupervisor Operator
VMOperatorControllerVMOperator Controller
VMOperatorControllerGlobalVMOperator Controller Manager
VMServicesAdministratorVM Services Administrator
NsxAuditorNSX Auditor
NsxViAdministratorNSX VI Administrator
NsxAdministratorNSX Administrator


If these roles are removed, don't exist for some reason, or are misnamed (contain spaces in VMDIR) users will encounter numerous different errors related to access and capabilities in the WCP configuration. VCSA updates may also fail due to validation errors when checking for these users.

Environment

VMware vSphere 8.0 with Tanzu
VMware vSphere 7.0 with Tanzu

Resolution

1. Connect to vCenter via SSH

2. Create a /usr/lib/vmware-wcp/py-modules/roles.py file and import config using the following command (ensure you copy the entire text from cat to the last EOF line):
 

# cat <<EOF >>/usr/lib/vmware-wcp/py-modules/roles.py
import featureState
from roles_groups_users_utils import Authz

if __name__ == "__main__":
    authz_patch = Authz()

authz_patch.ensure_roles_exist('/usr/lib/vmware-wcp/roles.xml')
EOF


3. Set the Python path with the following command:

# export PYTHONPATH="${PYTHONPATH}:/usr/lib/vmware/site-packages"

4. Run the python script to recreate roles using the following command:


# python /usr/lib/vmware-wcp/py-modules/roles.py

 
 

Example Output:
​​​
# python /usr/lib/vmware-wcp/py-modules/roles.py
[YYYY-MM-DDTHH:MM:SS]  Role id 1004, name WorkloadStorageManagement - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1005, name vSphereKubernetesManager - added
[YYYY-MM-DDTHH:MM:SS]  Role id 1007, name SupervisorServiceCluster - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1008, name SupervisorServiceRootFolder - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1009, name SupervisorServiceGlobal - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1021, name VMOperatorController - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1022, name VMOperatorControllerGlobal - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 0, name VMServicesAdministrator - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 0, name NsxAuditor - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 0, name NsxViAdministrator - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 0, name NsxAdministrator - already exists



Powered by Wolken Software