vSAN HCL DB Out of Date: Offline all.json Update for vCenter, SDDC Manager and the VCF 9 Installer

Short answer: On a machine with internet access, download https://vvs.broadcom.com/service/vsan/all.json. Then import it where the check runs. In vCenter, use Update From File under the vSAN HCL DB up-to-date health finding. In SDDC Manager, use the Bundle Transfer Utility --vsanHclUpload, or the /v1/vsan-hcl/content API if the precheck stays red. On the VCF 9 Installer, copy the file into its vsan-hcl directory.

Why “vSAN HCL DB up-to-date” fails in air-gapped environments

vSAN checks controllers, drivers, firmware and (for ESA) disks against a local copy of the vSAN hardware compatibility database, a single JSON file. vCenter and SDDC Manager normally fetch it online. Without internet or proxy access the copy goes stale, and three separate consumers complain:

Where	Symptom	Fix location
vCenter (Skyline Health)	vSAN HCL DB up-to-date warning/error	vSphere Client
SDDC Manager (VCF 4.x/5.x/9.x)	vSAN HCL DB on SDDC Manager is out of date. This is a critical error if vSAN HCL DB has not been updated within the last 90.0 day(s).	SDDC Manager appliance
VCF 9 Installer	No vSAN ESA certified disks found on the ESXi Host	Installer appliance

These are independent copies. Updating vCenter does not update SDDC Manager, which is why an upgrade precheck can fail while Skyline Health is green. The HCL DB is one of four hardware checks for VCF 9; the full list is in How to check VCF 9 hardware compatibility.

Step 1: download all.json

Open https://vvs.broadcom.com/service/vsan/all.json on a workstation with internet access and save it as all.json. KB 315556 warns that if the import later fails with Failed to decode the HCL DB, you should copy the raw text from the browser into a file with a .json extension. This avoids encoding problems. Alternatively, the Bundle Transfer Utility can download it:

./lcm-bundle-transfer-util --vsanHclDownload --outputDirectory <output-directory>

Step 2a: update the vSAN HCL DB in vCenter

1. In the vSphere Client go to Cluster > Monitor > vSAN > Skyline Health > Health findings > vSAN HCL DB up-to-date.
2. Click Update From File and select all.json.
3. Click Retest.

Step 2b: update the HCL in SDDC Manager (VCF upgrade precheck)

Copy the file to the SDDC Manager appliance, SSH in as vcf, run su, and upload it with the Bundle Transfer Utility, as described in KB 315556:

/opt/vmware/vcf/lcm/lcm-bundle-transfer-util/bin/lcm-bundle-transfer-util --vsanHclUpload --inputDirectory /path/to/all.json

The VCF 5.1 TechDocs procedure also accepts --sddcMgrFqdn and --sddcMgrUser when you run the tool from another machine.

When the precheck still says out of date

KB 316041 (VCF 5.x and 9.x) describes a case where the upload appears to succeed but the local_data_timestamp in the LCM database’s vsan_hcl_attributes table stays old. The utility can also fail with URI path begins with multiple slashes. Take a snapshot of SDDC Manager first, then work as root:

# check the timestamp SDDC Manager uses
ts=$(psql -h localhost -U postgres -d lcm -t -A -c "select local_data_timestamp from vsan_hcl_attributes;"); date -d@"$ts"

# get a token (fill in an SDDC Manager admin user)
curl -k --location 'https://localhost/v1/tokens' --header 'Content-Type: application/json' --data-raw '{"username":"","password":""}'

# from /home/vcf, where all.json was copied
curl -k -X PUT --location 'https://localhost/v1/vsan-hcl/content' --header 'Authorization: Bearer <access token>' --header 'Content-Type: text/plain' -d@all.json

Run the timestamp query again, then retry the precheck. Always use https://: the KB notes that plain http fails with Failed to connect to port 80.

Step 2c: VCF 9 Installer “No vSAN ESA certified disks found”

KB 412606 explains that this error appears when the installer’s /nfs/vmware/vcf/nfs-mount/vsan-hcl/all.json is more than 90 days old, even if the disks are certified. Copy a fresh all.json to /nfs/vmware/vcf/nfs-mount/ on the installer, then as root:

mv /nfs/vmware/vcf/nfs-mount/all.json /nfs/vmware/vcf/nfs-mount/vsan-hcl
chown vcf_lcm:vcf /nfs/vmware/vcf/nfs-mount/vsan-hcl/all.json

Then click Re-run Validations in the installer UI. For lab hardware that is not on the ESA list at all, a fresh HCL file will not help. See the VCF 9.0.1 option to bypass the vSAN ESA HCL check.

Keep it from coming back

• Make the HCL refresh part of every upgrade runbook. The SDDC Manager check turns critical after 90 days.
• Update vCenter and SDDC Manager from the same file on the same day, so the two health views agree.
• If a proxy is available, configure it in vCenter and SDDC Manager so the online update works.

Further reading

• Original post: vSAN HCL DB Out of Date – Offline Update (vronin.nl)
• Broadcom KB 315556: Updating the vSAN HCL database manually
• Broadcom KB 316041: SDDC Manager precheck error, vSAN HCL DB out of date
• Broadcom KB 412606: VCF 9 installer fails the vSAN ESA HCL check