Troubleshooting VIC

The version of Admiral included in VMware vSphere Integrated Containers, also known as VMware vSphere Integrated Containers Management Portal, is basically the same like the standalone version of Admiral but it includes also:

• Integration with VMware Platform Services Controller (PSC) for vSphere 6.0 as authentication framework.
• Integration with Harbor, or VMware vSphere Integrated Containers Registry, as default enterprise-class container registry server.

For more information about vSphere Integrated Containers and instructions about how to deploy the VIC appliance, visit the vSphere Integrated Containers page.

Problems

1. PSC registration errors during the setup
2. SsoManager has not been initialized at runtime

1. PSC registration errors during the setup

Symptoms

• The PSC registration process fails.
• The registration logs contain some stack traces with any of these messages:

Exception in thread "main" com.vmware.admiral.auth.idm.psc.saml.sso.admin.SsoAdminClientException: Can not retrieve the SSO SSL certificate chain.
Caused by: java.net.UnknownHostException: xyz

Exception in thread "main" com.vmware.admiral.auth.idm.psc.saml.sso.admin.SsoAdminClientException: General SSO failure. Invalid host, port or tenant.

Exception in thread "main" com.vmware.admiral.auth.idm.psc.saml.sso.admin.SsoAdminClientException: Provided credentials are not valid.

Exception in thread "main" com.vmware.xenon.common.LocalizableValidationException: 'xyz' is required

PSC registration logs can be seen inside the VIC OVA with:

journalctl -u fileserver

Description

Some of the parameters provided for the PSC registration are wrong or missing.

Solution

• Review that all the required parameters are provided.
• Review that all the provided parameters are correct.
• Make sure that the registered PSC instance is accessible from the deployed OVA.
• Try the registration process again.
• After a successful registration, the list of solution users for the PSC instance should contain 3 new solution users, something like:
  • admiral-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (Vic Product Solution User for admiral)
  • engine-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (Vic Product Solution User for engine)
  • harbor-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (Vic Product Solution User for harbor)
• In case of multiple successful registrations, the solution users in use (regarding those 3) will be the newest ones (the ones with longer validity) thus the elder ones can be removed from the PSC instance. But they also appear in the configuration files of the 3 components:
  • Admiral - /etc/vmware/psc/admiral/psc-config.properties
  • Engine - /etc/vmware/psc/engine/psc-config.properties
  • Harbor - /etc/vmware/psc/harbor/psc-config.properties

2. SsoManager has not been initialized at runtime

Symptoms

• The PSC registration process completed successfully.
• The access to Admiral / the Management Portal fails.
• The Admiral logs contain some stack traces with any of these messages:

PscSettings : java.net.UnknownHostException: xyz
java.lang.IllegalArgumentException: PscSettings : xyz
[redirectToSamlSso][Could not generate redirect URL: java.lang.IllegalStateException: SsoManager has not been initialized
   ...

PscSettings : java.net.SocketTimeoutException: connect timed out
java.lang.IllegalArgumentException: PscSettings : connect timed out
[redirectToSamlSso][Could not generate redirect URL: java.lang.IllegalStateException: SsoManager has not been initialized
   ...

Admiral logs can be found inside the VIC OVA in:

/storage/log/admiral/

Description

Some of the parameters provided for the PSC registration are wrong, or they are/were valid during the PSC registration process or from the OVA but not now or from any of the containers running within the OVA (e.g. Admiral or Harbor).

Solution

• Review that all the PSC registration was completed actually successfully, i.e. no error messages in the logs. Or try the registration process again otherwise.
• Make sure that the registered PSC instance is accessible from the deployed OVA and from all the containers running within the OVA (e.g. Admiral or Harbor).
• If Admiral was running while the PSC registration was completed again, Admiral has to be restarted. And the same for Harbor.