By Tarsio MoraesIf you are going through the process of upgrading a vSphere 8 brownfield environment to VMware Cloud Foundation (VCF) 9.0.2, you might notice a specific sequence required to complete the final steps for NSX.
In my latest lab scenario, I imported vSphere 8 as a brownfield workload domain to perform the upgrade from 5.2.2 to 9.0.2. The sequence progressed nicely: the vCenter updated, the NSX Manager updated, and the hosts updated. However, you may encounter an expected UI behavior in which the system shows a “false positive”—indicating an upgrade as complete in certain areas, while SDDC Manager temporarily displays the 5.2.2 version for NSX as it waits for the workflow to finalize.
If you are currently observing this and waiting on the “Finalize Upgrade” step for NSX, this post will walk you through the architectural dependencies and how to complete the process smoothly.
The WCP Workload Cluster Dependency
When attempting to finalize the NSX upgrade from the UI, the system may pause and display a status message regarding the WCP workload cluster:
“Upgrade from VCF 5.2 to 9 is unable to complete due to an incompatible WCP workload cluster.”
This notification simply points to the Workload Control Plane (WCP) – specifically, your vSphere Supervisor Cluster. VCF recognizes that your vCenter and NSX Managers are up to date, but it is waiting for the Kubernetes namespaces (the Supervisor Cluster) to transition to the required version. Because of this dependency, the system pauses the finalization of the NSX upgrade to keep everything in sync.
For official documentation on this expected pause, you can reference the Broadcom KB: Upgrade from VCF 5.2 to 9.0 is unable to complete due to an incompatible WCP workload cluster.
The “False Positive” Display: NSX Version Pinning
During the transition from 5.2.2 to 9.0.2, you might experience what looks like a false positive upgrade state. The underlying NSX components (Managers, Edges, Hosts) complete their updates successfully, but the SDDC Manager inventory still pins NSX to the older 5.2.2 version.
This is an expected display behavior. SDDC Manager intentionally pins the version string until the entire WCP dependency is resolved and the finalization step is cleared. You can read more about this specific UI behavior here: NSX is still pinned to the older version.
Timing the Supervisor Update and Lifecycle Manager
Your next step is to navigate to the Supervisor cluster and upgrade the vSphere namespaces to 9.0.2.
After initiating this, the namespace UI will report that it is updated to version 9. However, the NSX upgrade will remain in a pending state. This is perfectly normal: The Supervisor UI reflects the initiated state, but the underlying cluster nodes are actively remediating in the background using vSphere Lifecycle Manager. To ensure optimal compatibility during this phase, it is great practice to understand how vSphere Lifecycle Manager handles these transitions. You can review the specifics here: vSphere Lifecycle Manager compatibility.
To observe the actual progress:
- Navigate to your Cluster Inventory.
- Go to the Updates tab.
- Check the Compliance status.
You will see that the applied solution is in progress. WCP acts as the initiator here, systematically putting each host in the cluster into maintenance mode to apply the Kubernetes updates to all the nodes. The NSX finalization will resume once this rolling update is fully complete across the entire cluster.
Allowing Auto-Remediation to Complete
The key here is simply to let the auto-remediation process complete its cycle.
- Monitor Host Remediation: Watch the cluster as it takes each node in and out of maintenance mode.
- Verify Compliance: Once the process is done, the cluster will show as fully compliant.
- Check Kubernetes Version: You should now see the Supervisor cluster running the updated Kubernetes version (in my case, it successfully transitioned to
1.32.9 v39).
Once the cluster is running and compliant, log back into the NSX Manager. You will notice that the “Finalize Upgrade” step now has a green checkmark. It triggers automatically once the WCP dependency is fulfilled.
When you check your lifecycle management in SDDC Manager, the instance will correctly update and show 9.0.2.0.0. Even better, if you log into VMware Aria Automation, a manual sync isn’t necessary—your NSX instance will be automatically detected and ready to go.
Optimized Sequence for Production Environments
If you are executing this upgrade in a production environment, optimizing the order of operations ensures a seamless workflow.
Based on this sequence, here is the optimal upgrade path:
- Upgrade NSX Manager
- Upgrade vCenter
- Upgrade the Kubernetes/Supervisor Cluster: Do this before updating the ESXi hosts. Ensure the Supervisor is fully updated to the version 9 standard.
- Upgrade the ESXi Hosts: By the time you upgrade the hosts, they will receive the latest Kubernetes versions seamlessly.
Following this order guarantees that when NSX reaches its finalization step, the environment is already prepped and compliant, allowing the VCF 9.0.2 automation to complete the process beautifully.