Short answer: if enabling or upgrading vSphere Supervisor fails with “A general system error occurred: Solution specification in the image are incompatible with hosts …”, check the cluster’s vSphere Lifecycle Manager remediation settings. When Enforce Live Patch is on, remediations that need maintenance mode or a reboot are blocked, and on TPM-enabled hosts every remediation is. Turn off Enforce Live Patch for the cluster and retry. This is a documented, supported change (Broadcom KB 412238).
Symptoms
- Supervisor enablement on a vLCM image-managed cluster fails, or the Apply Solution task of a Supervisor upgrade hangs while updating the ESX hosts.
- The task shows:
A general system error occurred: Solution specification in the image are incompatible with hosts '<host1>, <host2>' - The Lifecycle Manager log shows that the image is eligible for Live Patch, but Live Patch is not supported on a host with TPM enabled.
Broadcom KB 412238 lists vSphere 8.x and 9.x as affected.
Why Enforce Live Patch blocks Supervisor
When you enable or upgrade Supervisor, a solution component is added to the cluster’s vLCM image and then applied to every host. Live Patch lets vLCM patch a host without maintenance mode or a reboot, but only when the specific change qualifies and the host meets the prerequisites. With enforcement on, vLCM rejects any remediation that can’t be done as a live patch. According to the Live Patch documentation, the prerequisites are:
| Requirement | Detail |
|---|---|
| Versions | vCenter and all hosts on 8.0 Update 3 or later |
| Cluster management | vLCM single image (not baselines) |
| DRS | Enabled |
| Parallel remediation | Disabled (live patches go host by host) |
| Hardware | Not supported on hosts with TPM devices or DPUs |
| VMs | VMs that can’t use Fast Suspend and Resume (for example FT, DirectPath I/O, shared-disk clustering) must be migrated or power-cycled |
If your hosts use TPM 2.0 (for example for host attestation or encryption), the TPM restriction is the one you are most likely to hit.
Fix: disable Enforce Live Patch on the cluster
- In the vSphere Client, select the cluster and open Updates > Image.
- In the remediation settings card, click Edit.
- Clear Enforce Live Patch and save. The cluster now overrides the global setting. If the global vLCM remediation settings enforce Live Patch for all clusters, change it there instead.
- Run the image compliance check again, then retry Supervisor enablement, or rerun the failed upgrade task.
Broadcom documents the override in How to Configure the vSphere Lifecycle Manager Remediation Settings.
What you give up
With enforcement off, vLCM goes back to normal remediation. Hosts enter maintenance mode, DRS evacuates the VMs, and hosts reboot when the update needs it. On TPM-equipped clusters, live patching never applied in the first place, so you lose nothing there. You can turn enforcement back on after Supervisor is running, but it can block the next Supervisor upgrade in the same way. On Supervisor clusters it is simpler to leave it off.
Related checks before enabling Supervisor
- Keep the cluster image compliant, with no pending host remediation, before you start.
- Make sure vCLS is healthy and DRS is fully automated. See Introduction to vSphere Clustering Service (vCLS).
- Check host certificate status. See ESXi host certificate status alert.
Further reading
- William Lam: Quick Tip – Disable ESX Live Patching enforcement to enable vSphere Supervisor Service (hit in a VCF 9.0 lab)
- Broadcom KB 412238: Apply Solution task hangs due to Enforce Live Patch
- Broadcom KB 419942: Prerequisites for vLCM Live Patching
