Tag VIC appliance VM failed

[sguyennet]

For bug reports, please include the information below:

VIC Product version:

OVA version (e.g. vic-v1.2.3-aaaaaaa.ova)

vic-v1.2.1-4104e5f9.ova

Deployment details:

Environment where the OVA is deployed

vSphere 6.5 environement

Steps to reproduce:

Browse to http://vic_fqdn
Register the appliance with the PSC.

Actual behavior:

Display the error message "Failed to locate VIC Appliance. Please check the vCenter Server provided and try again".

The tag is not created on the VIC appliance VM.

Expected behavior:

The tag is created.

Additional details as necessary:

The password for the SSO administrator user contains a ":" character.
This is what trigger the issue. I believe this is due to the Login function in rest_client.go.

https://github.com/sguyennet/vic-product/blob/master/installer/vendor/github.com/vmware/vic/pkg/vsphere/tags/rest_client.go

[andrewtchin]

Workaround is to change the vCenter password. Lowering priority.

[AngieCris]

When attaching the tags, we're sending http POST request to vSphere automation API session endpoint (https://VC_IP/rest/com/vmware/cis/session), with the VC login creds in the request header. However, when the admin password of the VC contains a colon, the POST request fails with status code 401 Unauthorized. Therefore the tag failed to attach.

To confirm this, I wrote a separate go program that simply sends a HTTP POST request to the session endpoint of a running VC with password containing a colon. The request fails with status 401. However, testing with a VC with password not containing a colon, the POST request succeeds with status 200.

I posted to bugzilla reporting this bug on vSphere automation API: https://bugzilla.eng.vmware.com/show_bug.cgi?id=2013306
Will update here if it gets fixed.

[andrewtchin]

This issue will be moved to not ready at the end of this sprint pending results of engaging with vSphere team. Once the vSphere issue is resolved we can see if this is resolved.

[AngieCris]

Confirmed it's a bug on VAPI. Will update here once it's fixed.

(https://bugzilla.eng.vmware.com/show_bug.cgi?id=2013306)

[AngieCris]

According to the VAPI team, it's fixed in VC 6.7 but still a bug for earlier builds. The VC I tested against has version 6.5. The bug is nominated to be fixed for 6.5 u2 release next year.
(https://bugzilla.eng.vmware.com/show_bug.cgi?id=2013306)

For now let's update the documentation and specify that appliance registration will fail and the appliance VM will not be successfully tagged if the target VC has admin password that contains a colon.
@stuclem I've added a kind/note tag to this ticket. Can you grab it and update the doc accordingly? Thanks.

[stuclem]

Thanks @AngieCris - I'll keep this in the release notes. If you think that it merits a mention in the core docs, I'll add a note there too.

[AngieCris]

@stuclem Just in the release note should be fine. Thanks!

[stuclem]

Attempted writeup for release notes:

• Tagging the appliance fails. #1080
  When registering the appliance with the Platform Services Controller, registration fails with the error Failed to locate VIC Appliance. Please check the vCenter Server provided and try again. This issue occurs if the vCenter Single Sign-On password contains a colon (:).

  Workaround: Change the vCenter Single Sign-On password.

@andrewtchin @AngieCris is this OK?

[AngieCris]

According to the updates in the bugzilla ticket https://bugzilla.eng.vmware.com/show_bug.cgi?id=2013306, the bug is fixed in vSphere 6.5u2 and vSphere 6.7. But for vSphere 6.5u1, the issue still exists.
@andrewtchin Should we say sth along the lines of "For some vSphere versions, the issue occurs but for others it doesn't"?

[andrewtchin]

Sure the doc can call out the applicable vSphere version

[AngieCris]

@stuclem Can you mention in the note that the issue is fixed for vSphere versions 6.5u2 and later, but still exists for earlier vSphere versions? Thanks.

[stuclem]

@AngieCris I don't think that we can mention that it's fixed in 6.5u2 or 6.7 as those releases are not out publicly yet. I updated the RN as follows:

• Tagging the appliance fails. #1080
  When registering the appliance with the Platform Services Controller, registration fails with the error Failed to locate VIC Appliance. Please check the vCenter Server provided and try again. This problem results from an issue in vSphere 6.5u1, and occurs if the vCenter Single Sign-On password contains a colon (:).

  Workaround: Change the vCenter Single Sign-On password. The issue will be fixed in a future vSphere release.

Is this OK? Thanks!

[andrewtchin]

I think we can close this once the doc issues are resolved since this is not a bug in vic-product, @AngieCris let me know if you disagree

[AngieCris]

@stuclem Thanks! Looks good to me.

[AngieCris]

Included in release note. Close this issue.

[AngieCris]

@stuclem one small suggestion: since there're multiple other reasons for tagging to fail, it might help mentioning password in the title:

• Tagging the appliance fails when vCenter password contains colon. #1080

[stuclem]

Fixed the RN. Thanks @AngieCris .

[stuclem]

@AngieCris is this fix in 1.3.1? Thanks!

[AngieCris]

@stuclem I don't think so...If the customer uses VC 6.5u1 then the problem still exists. Do we want to add the note in 1.3.1 release notes as well?

[stuclem]

@AngieCris apologies for the delay in replying - this is in the RNs for 1.3.1 already, carried over from 1.3.0.