VMware Cloud Director 10.6.0.1 Release Notes

VMware Cloud Director 10.6.0.1 \| 6 SEP 2024 \| Build 24250702 (installed build 24250041) Check for additions and updates to these release notes.

VMware Cloud Director 10.6.0.1 | 6 SEP 2024 | Build 24250702 (installed build 24250041)

Check for additions and updates to these release notes.

What's New

Bug fixes and updates

VMware Cloud Director version 10.6.0.1 release provides bug fixes, updates the VMware Cloud Director appliance base OS and the VMware Cloud Director open-source components.
Customized segment profile templates copy to one or more projects

Starting with version 10.4.1, VMware Cloud Director is integrated with NSX projects and NSX projects are aligned with VMware Cloud Director organizations. However, NSX projects supported an incomplete list of networking entities and NSX 4.2 supports over 90% of the required entities with some notable exceptions. The full functionality of the NSX segment profiles was not preserved which caused a feature limitation preventing customized segment profiles from being shared across NSX projects. In VMware Cloud Director 10.6.0.1, you can copy customized segment profile templates created in VMware Cloud Director to all projects. This behavior mimics the existing VMware Cloud Director-driven synchronization of segment profile templates across different NSX Managers. As a tenant administrator, you can copy customized segment profile templates to one or more projects.

Download VMware Cloud Director

You can download VMware Cloud Director 10.6.0.1 from the Broadcom Support Portal.

For more information about registering on the Broadcom Support Portal, see Register for an account on the Broadcom Support Portal and Communities. For product download instructions, see Download Broadcom products and software.

Documentation

To access the full set of product documentation, go to VMware Cloud Director Documentation.

Previous Releases of VMware Cloud Director 10.6.x

VMware Cloud Director 10.6 Release Notes

Resolved Issues

New - Catalog item metadata is not synchronized between published and subscribed catalogs

When you create a catalog, you have the option to publish the catalog so that others can subscribe and gain access to the catalog through catalog synchronization. If the published catalog contains catalog items with metadata, that metadata does not appear on the subscriber side. The problem occurs only with catalog synchronization and not refresh of distributed catalogs.
When performing a catalog synchronization, VMware Cloud Director does not sync the catalog item metadata from the publisher to the subscriber

VMware Cloud Director does not sync newly created metadata from the publishers to the subscribers and the catalog items with metadata do not get populated on the subscriber side. VMware Cloud Director does not sync also the deleted metadata and version numbers from publishers to subscribers until other workflows update the items. As a result, subscribers do not see any updates when syncing.
An LDAP user with both the system administrator and organization administrator roles cannot create RDE instances in a tenant organization

If an LDAP user has both the system administrator and organization administrator roles, creating an RDE instance fails with a 500 server response error.
Upgrading to version 10.6 fails, but VMware Cloud Director reports the upgrade as successful

When you upgrade VMware Cloud Director to version 10.6, the upgrade appears successful, however, some Red Hat Package Manager files (RPMs) are not installed.

Known Issues

Tenant users cannot edit Kubernetes policies

Despite having the necessary rights, if you are logged in as a tenant user, trying to edit the CPU or memory of Kubernetes policies fails with a 403 error saying Forbidden to set right restricted field pvdcComputePolicy, and you cannot redistribute your VDC resources between VM deployments and Kubernetes deployments.

Workaround: System administrators can edit Kubernetes policies.
You cannot create a vApp template if the VM or vApp has a TPM device and if the target catalog is a distributed catalog
You cannot create a vApp template through any of the following operations if the template contains a VM with a TPM device and the target is a distributed catalog.
- Copy a vApp template
- Move a vApp template
- Capture a vApp or VM to a template
- Import a VM from vCenter
Attempting to create a vApp through these operations fails with an error that the operation is not allowed for VMs with TPM devices where the target catalog is a distributed catalog.
Workaround: Upload an OVF which specifies a VM containing a TPM device. See the TPM as a Virtual Device in OVF topic in the VMware vSphere product documentation.
You cannot filter organization and provider VDCs by the granted provider VDC name

As a sub-provider using the VMware Cloud Director Tenant Portal, you cannot filter your organization and provider VDCs by their granted provider VDC name.

Workaround: None.
After decommissioning of a VMware Cloud Director site, distributed catalogs appear as Degraded.

When you decommission a VMware Cloud Director site whose distributed datastore was previously paired with your local site, a set of corresponding heartbeat files are kept in the replicated storage at the peer sites. As a result, your site keeps reporting that the corresponding datastores are not healthy and have Degraded distribution health.
Workaround:
1. In the VMware Cloud Director Tenant Portal, from the Peers datastore grid, for a peer with missing heartbeat for at least 10 minutes, take note of the Name, Site Name, and vCenter string values.
2. Using the vCenter Console or another tool to browse datastore files, visualize the files of the corresponding local distributed datastore.
3. Find all files under the distributedCatalogs folder with names that look like the following:
```
distributedCatalogs/site-vc-22222222-11cc-1b11-1cd1-1a1a1a1aaa11-...
```
4. Display the content of the files, for example:
```
{"siteId":"a2222222-1234-1a11-1a11-a11a1aa111a","siteName":"obsolete-site","vcId":"22222222-11cc-1b11-1cd1-1a1a1a1aaa11","vcName":"obsolete-vc","dsMoref":"datastore-24","dsName":"shared-disk-obsolete"}
```
5. Delete the file which has siteName, vcName, and dsName that match the corresponding strings from Step 1.
6. After approximately 10 minutes, VMware Cloud Director will pick up the change and automatically cleanup the datastore and distributed catalog statuses.
In a multisite deployment, if the other site is with version 10.5.x or earlier, sorting organizations in the Managed By column returns an error

In a multisite deployment, if the other site is with VMware Cloud Director version 10.5.x or earlier, sorting organizations in the Managed By column, fails with the following error.

Bad request: Null property value for 'managedBy.name' on bean class 'class com.vmware.vcloud.rest.openapi.model.Org'

Workaround: Use the filtering option to exclude sites with VMware Cloud Director version 10.5.x or earlier.
When using the CloudAPI to create or update an organization, you cannot set to true the canPublish flag

When using the CloudAPI to create an organization or update an organization enabling it to publish catalogs, the canPublish field remains false, despite you setting the value to true. The legacy API is not affected.

Workaround: Use the VMware Cloud Director UI to activate or deactivate the option to Publish catalog externally for an organization.
When sharing vApps with users, you can navigate to nonexistent pages

When sharing vApps with users, the buttons to go to the previous or next page are available even though you are already on the respective first or last page. As a result, you can navigate to pages that do not exist and do not have content.

Workaround: None.
If you create a vApp network while copying a VM, when you close the Copy VM modal, an infinity spinner appears

When you copy VMs to a target vApp, if you create a new vApp network in the target vApp and connect the source VMs to the newly created target vApp's network, closing the modal causes the spinner to appear, but it does not disappear once the copy operation is completed. This problem occurs only when a new vApp network is created during the copy process and does not occur when you copy VMs without creating a vApp network.

Workaround: Navigating to another page and returning to the VM list reloads the grid and the spinner disappears.
Outgoing connections from VMware Cloud Director through a proxy might fail with a Connection refused error

When setting proxy variables in the /etc/sysconfig/proxy file, the variables must not contain a trailing slash, such as in HTTP_PROXY="http://www.example.com:3128/" The problem occurs in both appliance deployments and Linux installations of VMware Cloud Director.

Workaround: Update the values to exclude the trailing slash. For example, HTTP_PROXY="http://www.example.com:3128"
Deleting an organization in VMware Cloud Director UI fails with a You must delete this Organization's Application Port Profiles before you can delete the organization error
If application port profiles are created on an edge gateway associated with an organization, attempting to delete the organization fails. The issue occurs because VMware Cloud Director deletes the edge gateways before deleting the port profiles, which causes the following error.
```
com.vmware.vcloud.api.presentation.service.InvalidStateException: You must delete this Organization's Application Port Profiles before you can delete the organization.
```
Workaround: Use the VMware Cloud Director API to force delete an organization and to delete the stranded application port profiles associated with it. See Delete Stranded Application Port Profiles from VMware Cloud Director.
Using the VMware Cloud Director API, attempting to delete an item with a secure field from an array in an RDE instance results in the item not being fully deleted

If an RDE type schema contains an array object with items containing secure fields, trying to remove an item of the array from an RDE instance of that type through an RDE PUT call results in all fields in the item being deleted except for the secure fields. The item itself is not removed. The problem occurs when you use VMware Cloud Director API version 37.3 or earlier.

If the RDE instance is in RESOLVED state and if after the update the entity contents of the instance do not match the schema in the RDE type of the instance, the PUT call results in an error response with status code 400 and error message RDE_CANNOT_VALIDATE_AGAINST_SCHEMA. If the entity contents of the instance after the update match the schema in the RDE type of the instance, the call does not return an error despite the item not being fully deleted.

Workaround: To run the RDE update, use VMware Cloud Director API version 38.0 or later.
You cannot edit the metadata of an organization

If you use the VMware Cloud Director API to create two metadata entries for an organization using the same name for the entries, you cannot edit these metadata entries by using the UI because the Save button in the Edit Metadata wizard is not active.

Workaround: Use the VMware Cloud Director API to edit the name of one of the metadata entries.
VM does not receive the DNS Server IP addresses from the DHCP scope that is defined in the vApp network

When you connect a VM to a routed vApp network in DHCP IP mode, the VM does not receive the DNS addresses defined in the DHCP scope.

Workaround: Using NSX Manager, manually configure the DNS servers in the routed vApp network segment.
Attaching a named disk to a VM fails with a java.util.concurrent.ExecutionException: org.hibernate.NonUniqueResultException error message

Attaching a named disk to a VM fails with an error message.

java.util.concurrent.ExecutionException: org.hibernate.NonUniqueResultException: query did not return a unique result:

This happens because VMware Cloud Director records duplicate entries in the in inventory data collected from the vCenter Server instance where the VM resides.

Workaround: To remove the duplicate entries from the inventory data, reconnect to the vCenter Server instance.
You might receive an unable to find valid certification path to request target - PKIX path building failed error when changing the JMX certificate of a cell using the UI

Using the the Service Provider Admin Portal, before you select a certificate as the JMX SSL certificate of a VMware Cloud Director cell, the certificate must be trusted.

Workaround: If the certificate you want to select is self-signed, add it to the trusted certificates of the System organization. See Import Trusted Certificates Using Your VMware Cloud Director Service Provider Admin Portal. If an internal certificate authority signed the certificate, verify that the certificate authority appears in the list of trusted certificates of the System organization. If a well-known certificate authority signed the certificate, no action is necessary.
Activating a cell using the cell management tool command does not update the cell status in the Service Provider Admin Portal

If you use the cell management tool to set the cell status to Active, on the Cloud Cells page of the Service Provider Admin Portal, the status does not appear as active.

Workaround: On the Cloud Cells page of the Service Provider Admin Portal, click the vertical ellipsis next to the cell name, and select Activate. See View and Manage Your VMware Cloud Director Cell Infrastructure.
Fast Cross vCenter vApp instantiation fails when instantiating a template that has VMs with memory

When instantiating a vApp template that has any VMs with memory across vCenter instances, if the conditions are met for VMware Cloud Director to perform a fast cross vCenter instantiation, the instantiation will fail with an INTERNAL_SERVER_ERROR.
Workaround: Deactivate fast cross vCenter instantiations in VMware Cloud Director.
1. Log in to the VMware Cloud Director Service Provider Admin Portal, and in the top navigation bar, click Administration.
2. In the left panel, under Settings, select Feature Flags.
3. Select Fast Cross VC Instantiation Utilizing Shared Storage, and click Disable.
When using the multisite feature, you cannot create and manage VMware Marketplace and Helm chart repository connections from the Service Provider Admin Portal

If you are a service provider and you use the VMware Cloud Director multisite feature, you cannot create and manage VMware Marketplace resources and Helm chart repository resources using the Service Provider Admin Portal.

This issue does not affect tenants.

Workaround: You can use the VMware Cloud Director API to create and manage VMware Marketplace resources and Helm chart repository resources.
Deploying a Helm chart application fails with a Cannot parse "Z" as "-0700" error message

If VMware Cloud Director is running in UTC timezone, attempting to deploy a Helm chart application fail with a Cannot parse "Z" as "-0700" error message.
Workaround:

Option 1: Edit the Content Hub operator on the Kubernetes cluster to use a custom registry. Enter the projects.registry.vmware.com/content_hub/vcd-contenthub-package-repo location as a custom registry and version 1.0.1 as the version of the Content Hub Kubernetes operator package. For information about editing a Kubernetes operator, see Edit a Kubernetes Operator in VMware Cloud Director.

Option 2:
1. Change the server timezone, on which VMware Cloud Director resides, to non-UTC timezone.
2. Restart the VMware Cloud Director server.
Deploying container applications fails with an Unable to perform this action error message

When deploying a container application, if the description of the application template contains more than 255 characters, the operation fails with an error message.

Unable to perform this action. Contact your cloud administrator.

Workaround: Update the description for the application template to consist of less than 255 characters.
If there are no existing user-created firewall rules on an NSX edge gateway, you might not be able to create a single firewall rule

If there are no existing user-defined firewall rules on an NSX edge gateway and you start the firewall rule creation wizard by clicking New, when you attempt to save the firewall rule that you defined, the wizard becomes suspended in a Please wait... state and the firewall rule is not created.

Workaround: Refresh the page, or click away and back to the Firewall screen, and use the Edit Rules button instead of the New button to start the firewall rule creation wizard.
The VMware Cloud Director quick search does not display results when searching for users, service accounts, and VDC groups

In the Quick Search, entering Users, users/bulk-update, service-accounts, and vdc-groups as a search criteria results in a No results found. message.

Workaround: None.
The VMware Cloud Director appliance database disk resize script might fail if the backing SCSI disk identifier changes

The database disk resize script runs successfully only if the backing database SCSI disk ID remains the same. If the ID changes for any reason, the script might appear to run successfully but fails. The /opt/vmware/var/log/vcd/db_diskresize.log shows that the script fails with a No such file or directory error.
Workaround:
1. Log in directly or by using an SSH client to the primary cell as root.
2. Run the lsblk --output NAME,FSTYPE,HCTL command.
3. In the output, find the disk containing the database_vg-vpostgres partition and make note of its ID. The ID is under the HCTL column and has the following sample format 2:0:3:0.
4. In the db_diskresize.sh script, modify the partition ID with the ID from Step 3. For example, if the ID is 2:0:3:0, in line
```
echo 1 > /sys/class/scsi_device/2\:0\:2\:0/device/rescan
```
  you must change the ID to 2:0:3:0.
```
echo 1 > /sys/class/scsi_device/2\:0\:3\:0/device/rescan
```
5. Аfter saving the changes, manually re-invoke the resize script or reboot the appliance.
Upgrading to VMware Cloud Director 10.4.1 or later fails with a Fix postgres user home directory error
When you try to upgrade to VMware Cloud Director 10.4.1 or later, the upgrade fails. The update-postures-db.log contains the following error.
```
2023-05-15 16:38:01 | update-postgres-db.sh | Fix postgres user home directory
usermod: user postgres is currently used by process 17236
```
Other processes that are logged in as the postgres user on the VMware Cloud Director appliance might block the script that upgrades the PostgreSQL major version from 10 through 14.
Workaround:
1. Before starting the VMware Cloud Director upgrade, find any processes that are logged in as the postgres user on the VMware Cloud Director appliance by running ps -u postgres on the appliance.
2. Stop any process that the command returns by running kill -9 <PID>, where PID is the unique process identifier.
Creating an organization VDC Kubernetes policy with provider gateways that uses IP spaces fails

If you configure an IP space backed provider gateway and you create a VDC and an edge gateway based on the same IP space, an attempt to create a Kubernetes policy for this VDC fails with an error message.

com.vmware.ssdc.util.LMException: Index 0 out of bounds for length 0

This happens because the IP space backed edge gateways are not associated with a primary IP address, which is required for the creation of SNAT by the Kubernetes policy.

Workaround: Create VDC and edge gateways with NSX network provider type and provider gateways that use legacy IP blocks.
When starting the VMware Cloud Director appliance, the message [FAILED] Failed to start Wait for Network to be Configured. See 'systemctl status systemd-networkd-wait-online.service' for details appears

The message appears incorrectly and does not indicate an actual problem with the network. You can disregard the message and continue to use the VMware Cloud Director appliance as usual.

Workaround: None.
Creating an organization VDC template with NSX network provider type and provider gateways that uses IP spaces fails

When you attempt to create an organization VDC template with NSX network provider type and provider gateway that uses IP spaces, the operation fails with the following error. Error:Cannot support external Network that is utilizing IP Spaces. Only external networks with legacy IP blocks are supported.

Workaround: Create organization VDC templates with NSX network provider type and provider gateways that use legacy IP blocks.
Changing the storage policy on a virtual disk of a VM fails with a The operation failed because no suitable resource was found error message

If the virtual disk of a VM resides on a remote vSAN datastore, changing the storage policy of the virtual disk results in an error message.

The operation failed because no suitable resource was found

Workaround: To move the VM to a different storage policy, change the virtual disk storage policy to VM default policy and then change the VM storage policy to the desired storage policy.
VMware Cloud Director shows an empty value for the IOPS limit for a VM disk with VC-IOPS enabled storage policy

If you apply a VC-IOPS enabled storage policy with custom reservation, limit, and shares, on a VM disk, VMware Cloud Director displays the values for IOPS reservations, but displays the IOPS limit as empty. This happens because vCenter Server 8U1 introduces a new mechanism for Storage I/O Control (SIOC) which no longer sets the IOPS limit as a VM disk property.

Workaround: None.
You cannot create a deactivated organization using the legacy VMware Cloud Director API
Attempting to use the legacy VMware Cloud Director API organization creation endpoint POST [vcd_public_endpoint]/api/admin/orgs to create a deactivated organization results in a 400 BadRequestException containing the following snippet:
```
<Error ... stackTrace="com.vmware.vcloud.api.presentation.service.BadRequestException: Unexpected error.&#10;unexpected end of subtree
```
Workaround: Use the VMware Cloud Director OpenAPI endpoint to create a disabled organization. Alternatively, you can use the UI, OpenAPI, or legacy API to create an enabled organization and disable it after creation.
You cannot select Tanzu Kubernetes version 2.0 or later when creating a TKGs cluster

As a tenant, when attempting to create a TKGs cluster, you cannot select a Tanzu Kubernetes cluster version 2.0 and later.

Workaround: To offer and use Tanzu Kubernetes 2.0 and later, use VMware Cloud Director Container Service Extension 4.0.
Migrating VMs between organization VDCs might fail with an insufficient resource error

If VMware Cloud Director is running with vCenter Server 7.0 Update 3h or earlier, when relocating a VM to a different organization VDC, the VM migration might fail with an insufficient resource error even if the resources are available in the target organization VDC.

Workaround: Upgrade vCenter Server to version 7.0 Update 3i or later.
The VMware Cloud Director Tenant Portal UI does not display the IOPS limits and reservations for a vSAN storage policy

vSAN manages itself the IOPS limits on vSAN storage policies. As a result, the VMware Cloud Director Tenant Portal UI does not display the IOPS reservations and limits for a vSAN storage policy and you cannot modify their values.

Workaround: None.
VMware Cloud Director appliance upgrade fails with an invalid version error when FIPS mode is enabled

For VMware Cloud Director versions 10.3.x and later, when FIPS mode is enabled, VMware Cloud Director appliance upgrade fails with the following error.

Failure: Installation failed abnormally (program aborted), the current version may be invalid.
Workaround:
1. Before you upgrade the VMware Cloud Director appliance, deactivate FIPS Mode on the cells in the server group and the VMware Cloud Director appliance. See Activate or Deactivate FIPS Mode on the VMware Cloud Director Appliance.
2. Verify that the /etc/vmware/system_fips file does not exist on any appliance.
3. Upgrade the VMware Cloud Director appliance.
4. Enable FIPS mode again.
You can't view and edit the license type for your previously registered NSX Advanced Load Balancer Controller instances in the VMware Cloud Director API

You can't view and edit the license for your previously registered NSX Advanced Load Balancer Controller instances in the VMware Cloud Director API. This happens because in VMware Cloud Director 10.4, the Controller license type was replaced by a selection between a Standard and a Premium feature set at the Service Engine Group level to provide more flexibility.

Workaround: Use the supportedFeatureSet path for service engine groups and on edge gateways to activate and deactivate the available features.
You cannot create and use VMware Cloud Director VDC templates in VMware Cloud Director service environments that use VMware Cloud on AWS network pools

If you are using only a provider network pool that is backed by VMware Cloud on AWS for your provider VDC, you cannot create a VDC template and instantiate a VDC from a template. This happens because creating and instantiating VDC templates is supported only for provider VDCs backed by NSX-T Data Center and by NSX Data Center for vSphere. You can use VMware Cloud Director VDC templates with on-premises, Microsoft Azure VMware Solution, Oracle Cloud VMware Solution, or Google Cloud VMware Engine SDDCs.

Workaround: None.
Creating a new VM with encrypted vSAN storage policy fails with an Invalid storage policy for encryption operation error message

When creating a new VM, if you specify the storage policy of the VM as vSAN encrypted and the storage policy for the VM hard disk as both non-encrypted and non-vSAN, the operation fails with an error message.

Invalid storage policy for encryption operation
Workaround:
1. Specify the storage policies for the VM and the VM hard disk as vSAN encrypted.
2. After the VM deploys successfully, update the hard disk storage policy for the VM to non-encrypted and non-vSAN. For information, see Edit Virtual Machine Properties.
You cannot connect to VMware Cloud Director through VMware OVF Tool version 4.4.3 or earlier

When you attempt to connect to VMware Cloud Director through OVF Tool version 4.4.3 or earlier, this results in the following error. Error: No supported vCloud version was found. This happens because of an API behavior change in VMware Cloud Director 10.4 where the API does not return links to all the VDCs in an organization.

Workaround: Upgrade to OVF Tool 4.5.0. See VMware OVF Tool Release Notes.
You are unable to log in to VMware Cloud Director by using VMware PowerCLI 12.7.0 or earlier

When you attempt to log in to VMware Cloud Director by using VMware PowerCLI version 12.7.0 or earlier, this results in the following error. NOT_ACCEPTABLE: The request has invalid accept header: Invalid API version requested. This happens because VMware PowerCLI earlier than 13.0.0 do not support VMware Cloud Director API versions later than 33.0. See VMware Product Interoperability Matrix.

Workaround: Upgrade VMware PowerCLI to version 13.0.0.
VMware Cloud Director displays the old version for an upgraded vCenter Server instance

After you upgrade a vCenter Server instance to a newer version, in the list of vCenter Server instances, VMware Cloud Director still displays the old version for the upgraded instance.

Workaround: Reset the connection between the vCenter Server instance and VMware Cloud Director. See Reconnect a vCenter Server Instance in VMware Cloud Director Service Provider Admin Guide.
Refreshing the LDAP page in your browser does not take you back to the same page

In the Service Provider Admin Portal, refreshing the LDAP page in your browser takes you to the provider page instead of back to the LDAP page.

Workaround: None.
Mounting an NFS datastore from NetApp storage array fails with an error message during the initial VMware Cloud Director appliance configuration

During the initial VMware Cloud Director appliance configuration, if you configure an NFS datastore from NetApp storage array, the operation fails with an error message.

Backend validation of NFS failed with: is owned by an unknown user

Workaround: See VMware knowledge base article 93252.
The synchronization of a subscribed catalog times out while synchronizing large vApp templates

If an external catalog contains large vApp templates, synchronizing the subscribed catalog with the external catalog times out. The issue occurs when the timeout setting is set to its default value of five minutes.

Workaround: Using the manage-config subcommand of the cell management tool, update the timeout configuration setting.

./cell-management-tool manage-config -n transfer.endpoint.socket.timeout -v [timeout-value]
In an IP prefix list, configuring any as the Network value results in an error message

When creating an IP prefix list, if you want to deny or accept any route and you configure the Network value as any, the dialog box displays an error message.

"any" is not a valid CIDR notation. A valid CIDR is a valid IP address followed by a slash and a number between 0 and 32 or 64, depending on the IP version.

Workaround: Leave the Network text box blank.
The vpostgres process in a standby appliance fails to start

The vpostgres process in a standby appliance fails to start and the PostgreSQL log shows an error similar to the following. FATAL: hot standby is not possible because max_worker_processes = 8 is a lower setting than on the master server (its value was 16). This happens because PostgreSQL requires standby nodes to have the same max_worker_processes setting as the primary node. VMware Cloud Director automatically configures the max_worker_processes setting based on the number of vCPUs assigned to each appliance VM. If the standby appliance has fewer vCPUs than the primary appliance, this results in an error.

Workaround: Deploy the primary and standby appliances with the same number of vCPUs.
Upgrading the VMware Cloud Director appliance might result in an Connection to sfcbd lost error message

If you upgrade the VMware Cloud Director appliance, the upgrade operation might report an error message.

Connection to sfcbd lost. Attempting to reconnect

Workaround: You can ignore the error message and continue with the upgrade.
When using FIPS mode, trying to upload OpenSSL-generated PKCS8 files fails with an error

OpenSSL cannot generate FIPS-complaint private keys. When VMware Cloud Director is in FIPS mode and you try to upload PKCS8 files generated using OpenSSL, the upload fails with a Bad request: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: ... not available: No such algorithm: ...error or salt must be at least 128 bits error.

Workaround: Deactivate the FIPS mode to upload the PKCS8 files.
Creation of Tanzu Kubernetes cluster by using the Kubernetes Container Clusters plug-in fails

When you create a Tanzu Kubernetes cluster by using the Kubernetes Container Clusters plug-in, you must select a Kubernetes version. Some of the versions in the drop-down menu are not compatible with the backing vSphere infrastructure. When you select an incompatible version, the cluster creation fails.

Workaround: Delete the failed cluster record and retry with a compatible Tanzu Kubernetes version. For information on the incompatibilities between Tanzu Kubernetes and vSphere, see Updating the vSphere with Tanzu Environment.
If you have any subscribed catalogs in your organization, when you upgrade VMware Cloud Director, the catalog synchronization fails

After upgrade, if you have subscribed catalogs in your organization, VMware Cloud Director does not trust the published endpoint certificates automatically. Without trusting the certificates, the content library fails to synchronize.

Workaround: Manually trust the certificates for each catalog subscription. When you edit the catalog subscription settings, a trust on first use (TOFU) dialog box prompts you to trust the remote catalog certificate.

If you do not have the necessary rights to trust the certificate, contact your organization administrator.
After upgrading VMware Cloud Director and enabling the Tanzu Kubernetes cluster creation, no automatically generated policy is available and you cannot create or publish a policy

When you upgrade VMware Cloud Director to version 10.3.1 and vCenter Server to version 7.0.0d or later, and you create a provider VDC backed by a Supervisor Cluster, VMware Cloud Director displays a Kubernetes icon next to the VDC. However, there is no automatically generated Kubernetes policy in the new provider VDC. When you try to create or publish a Kubernetes policy to an organization VDC, no machine classes are available.

Workaround: Manually trust the corresponding Kubernetes endpoint certificates. See VMware knowledge base article 83583.
Entering a Kubernetes cluster name with non-Latin characters deactivates the Next button in the Create New Cluster wizard

The Kubernetes Container Clusters plug-in supports only Latin characters. If you enter non-Latin characters, the following error appears.

Name must start with a letter and only contain alphanumeric or hyphen (-) characters. (Max 128 characters).

Workaround: None.
NFS downtime can cause VMware Cloud Director appliance cluster functionalities to malfunction

If the NFS is unavailable due to the NFS share being full, becoming read only, and so on, can cause appliance cluster functionalities to malfunction. HTML5 UI is unresponsive while the NFS is down or cannot be reached. Other functionalities that might be affected are the fencing out of a failed primary cell, switchover, promoting a standby cell, and so on. For more information about setting up correctly the NFS shared storage, see Preparing the Transfer Server Storage for the VMware Cloud Director Appliance.
Workaround:
- Fix the NFS state so that it is not read-only.
- Clean up the NFS share if it is full.
Trying to encrypt named disks in vCenter Server version 6.5 or earlier fails with an error

For vCenter Server instances version 6.5 or earlier, if you try to associate new or existing named disks with an encryption enabled policy, the operation fails with a Named disk encryption is not supported in this version of vCenter Server. error.

Workaround: None.
A fast-provisioned virtual machine created on a VMware vSphere Storage APIs Array Integration (VAAI) enabled NFS array, or vSphere Virtual Volumes cannot be consolidated

In-place consolidation of a fast provisioned virtual machine is not supported when a native snapshot is used. Native snapshots are always used by VAAI-enabled datastores, as well as by vSphere Virtual Volumes. When a fast-provisioned virtual machine is deployed to one of these storage containers, that virtual machine cannot be consolidated.

Workaround: Do not enable fast provisioning for an organization VDC that uses VAAI-enabled NFS or vSphere Virtual Volumes. To consolidate a virtual machine with a snapshot on a VAAI or a vSphere Virtual Volumes datastore, relocate the virtual machine to a different storage container.
If you add an IPv6 NIC to a VM and then you add an IPv4 NIC to the same VM, the IPv4 north-south traffic breaks

Using the HTML5 UI, if you add an IPv6 NIC first or configure an IPv6 NIC as the primary NIC in a VM, and then you add an IPv4 NIC to the same VM, the IPv4 north-south communication breaks.

Workaround: First you must add the IPv4 NIC to the VM and then the IPv6 NIC.