VxRail：如果 DNS 伺服器沒有回應 AAAA 查詢，升級到 VxRail 8.0 會失敗

VxRail 升級期間觀察到下列升級失敗： 

• 目標 vCenter 上的 VAMI： 

The pre-upgrade check failed due to the following issue:

This operation is not allowed in the current state as operation 'None' is already in progress.

• ESXi 主機中斷連線：

2025-04-11T08:42:52.909Z warning vpxd[05842] [Originator@6876 sub=IO.Connection opID=608ec71c] 
Address resolution took too long; <resolver p:0x00007f22c41bd740, 'ESXi FQDN:443', next:(null)>, async: true, duration: 250136msec
 
2025-04-11T08:42:52.909Z warning vpxd[15852] [Originator@6876 sub=IO.Connection opID=608ec71c] 
Failed to resolve address; <resolver p:0x00007f22e4078d30, 'ESXi FQDN:443', next:(null)>, e: 125(Operation canceled), async: true, duration: 220136msec
 
2025-04-11T08:42:52.910Z warning vpxd[05842] [Originator@6876 sub=HttpConnectionPool-000001 opID=608ec71c] 
Failed to get pooled connection; <cs p:00007f22c431aeb0, TCP:ESXi FQDN:443>, (null), duration: 250137msec, N7Vmacore17CanceledExceptionE(Operation was canceled)

升級失敗是由 AAAA 查詢超時引起的，因為 DNS 伺服器沒有回應。

• 意外輸出： 

vxrailmanager:/home/mystic # dig @[DNS server IPv4 address] [vCenter FQDN] AAAA
;; communications error to [DNS server IPv4 address]#53: timed out
;; communications error to [DNS server IPv4 address]#53: timed out
;; communications error to [DNS server IPv4 address]#53: timed out

; <<>> DiG 9.18.33 <<>> @[DNS server IPv4 address] [vCenter FQDN] AAAA
; (1 server found)
;; global options: +cmd
;; no servers could be reached

如 VMware 文章「在目前狀態下不允許此作業，因為操作『無...」  中所述，即使不存在 AAAA 記錄，DNS 伺服器也必須傳回：

 RCODE 0 (status: NOERROR) 和 an empty answer section (ANSWER: 0) 用於 AAAA 查詢。

 vSphere 8.0 要求 DNS 伺服器符合負 AAAA 回應的 RFC 4074 行為。

• 摘自 VMware 文章「在目前狀態下不允許此作業，因為操作『無』...」 ： 

Note:  To avoid upgrade or install failures in vSphere 8.0, your DNS server must comply with RFC 4074 behavior for negative AAAA responses:
       It must return RCODE = 0 and an empty answer section for AAAA queries when there is no IPv6 record, rather than NXDOMAIN or other errors.

• 摘自 RFC 4074： 

Suppose that an authoritative server has an A RR but has no AAAA RR for a host name.
Then, the server should return a response to a query for an AAAA RR of the name with the response code (RCODE) being 0 (indicating no error) and with an empty answer section.

• 預期輸出： 

vxrailmanager:/home/mystic # dig @[DNS server IPv4 address] [vCenter FQDN] AAAA

; <<>> DiG 9.18.33 <<>> @[DNS server IPv4 address] [vCenter FQDN] AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11980                 <======  RCODE 0 (status: NOERROR) is returned;
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1      <======  An empty answer section (ANSWER: 0) is also returned; therefore, the DNS server does comply with RFC 4074 behavior for negative AAAA responses.

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;[vCenter FQDN].	IN	AAAA

;; Query time: 0 msec
;; SERVER: [DNS server IPv4 address]#53([DNS server IPv4 address]) (UDP)
;; WHEN: Thu Jul 10 01:37:19 UTC 2025
;; MSG SIZE  rcvd: 57

• 摘自 RFC 1035： 

--------------------------------------------------------------------
RCODE (Response CODE)   The values have the following interpretation
--------------------------------------------------------------------
0                       No error condition                          
1                       Format error                                
2                       Server failure                              
3                       Name Error                                  
4                       Not Implemented                             
5                       Refused                                     
--------------------------------------------------------------------