Manually synchronize WCP roles
search cancel

Manually synchronize WCP roles

book

Article ID: 319396

calendar_today

Updated On:

Products

VMware vSphere ESXi VMware vSphere Kubernetes Service

Issue/Introduction

This KB provides the steps required to restore the necessary roles in vCenter to allow the WCP service to operate normally.

The following roles are built for use by the WCP service on vCenter:

Role Name in VMDIRRole Name in vSphere UI
WorkloadStorageManagementWorkload Storage Manager
vSphereKubernetesManagervSphere Kubernetes Manager
SupervisorServiceClusterSupervisor Cluster Operator
SupervisorServiceRootFolderSupervisorService RootFolder Operator
SupervisorServiceGlobalSupervisor Operator
VMOperatorControllerVMOperator Controller
VMOperatorControllerGlobalVMOperator Controller Manager
VMServicesAdministratorVM Services Administrator
NsxAuditorNSX Auditor
NsxViAdministratorNSX VI Administrator
NsxAdministratorNSX Administrator

If these roles are removed, do not exist for any reason, or are incorrectly named, such as containing spaces within VMDIR, users may encounter a variety of errors related to access and functionality within the WCP configuration. VCSA updates may also fail during the validation process if the expected roles or users cannot be located or validated.

Environment

  • VMware vSphere 8.0 with Tanzu
  • VMware vSphere 7.0 with Tanzu

Resolution

  1. SSH to the vCenter via root
  2. Create the roles.py file on vCenter
    1. Create the file:
      vi /usr/lib/vmware-wcp/py-modules/roles.py
    2. Paste the following into the new roles.py file.
      import featureState
from roles_groups_users_utils import Authz

if __name__ == "__main__":
    authz_patch = Authz()

authz_patch.ensure_roles_exist('/usr/lib/vmware-wcp/roles.xml')
    3. Exit the vi editor by hitting the ESC key, followed by :wq!, and finally the Enter key.

  3. Set the python path:
    export PYTHONPATH="${PYTHONPATH}:/usr/lib/vmware/site-packages"
  4. Run the newly created python script to recreate the roles:
    python /usr/lib/vmware-wcp/py-modules/roles.py

    Example Output

    python /usr/lib/vmware-wcp/py-modules/roles.py
[YYYY-MM-DDTHH:MM:SS]  Role id 1004, name WorkloadStorageManagement - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1005, name vSphereKubernetesManager - added
[YYYY-MM-DDTHH:MM:SS]  Role id 1007, name SupervisorServiceCluster - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1008, name SupervisorServiceRootFolder - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1009, name SupervisorServiceGlobal - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1021, name VMOperatorController - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 1022, name VMOperatorControllerGlobal - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 0, name VMServicesAdministrator - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 0, name NsxAuditor - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 0, name NsxViAdministrator - already exists
[YYYY-MM-DDTHH:MM:SS]  Role id 0, name NsxAdministrator - already exists
Powered by Wolken Software