Investigate how to avoid excessive VSphere calls if user is missing appropriate session permissions
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 328
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 9
Description
A few users have reported running into an issue where if the VSphere user is missing ValidateSession permissions as described in the [docs](https://anywhere.eks.amazonaws.com/docs/reference/vsphere/vsphere-preparation/#create-and-define-user-roles), it overloads the VSphere server, failing other calls with a 503 or even bringing down the entire server until the VMs are powered off.
These are the logs we see in the capv controller:
```
session "msg"="unable to check if vim session is active" "error"="ServerFaultCode: Permission to perform this operation was denied."
```
```
session "msg"="unable to get vim client session" "error"="ServerFaultCode: Permission to perform this operation was denied."
```
This is something that may potentially happen even if a user were not to use EKS Anywhere and use Cluster API directly, so will need to create an issue upstream after confirming this.
Contributor guide
Research direction
Start with the capv controller logs and the linked vSphere user-role documentation, focusing on the session checks that produce the permission-denied errors. Confirm how missing ValidateSession permission triggers repeated calls and determine what behavior prevents 503 errors or server overload; also verify whether the issue belongs upstream in Cluster API.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100