Error: "null" while Integrating Tanzu Kubernetes Grid (TKG) using Kubernetes Management Pack in VMware Aria Operations

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• While configuring the monitoring for Tanzu Kubernetes Grid (TKG) in VMware Aria Operations using the Kubernetes Management Pack, You may encounter the following error during the validate connection test:
  
  Error null


  
  
• The /storage/log/vcops/log/adapters/kubernetesAdapter/kubernetesAdapter_<internalid>.log file reports below exceptions
  
  ####-##-#####:34:47,627+0000 WARN  [Collector worker thread 25] (398) com.vmware.vcops.adapter.utils.KubernetesRestClient.performGetJson - Api call to /api/v1/nodes failed on https://<supervisorVIP>:6443. Exception - javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors.
####-##-#####:34:47,629+0000 WARN  [Collector worker thread 25] (398) com.vmware.vcops.adapter.utils.KubernetesRestClient.performGetJson - Retrying...
####-##-#####:34:47,638+0000 WARN  [Collector worker thread 25] (398) com.vmware.vcops.adapter.utils.KubernetesRestClient.performGetJson - Api call to /api/v1/nodes failed on https://<supervisorVIP>:6443. Exception - javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors.
####-##-#####:34:47,638+0000 ERROR [Collector worker thread 25] (398) com.vmware.vcops.adapter.utils.KubernetesRestClient.performGetJson - Api call /api/v1/nodes failed after 2 retries
####-##-#####:34:47,638+0000 ERROR [Collector worker thread 25] (398) com.vmware.vcops.adapter.dataprovider.KubernetesDataProvider.createResourceManagers - Error in fetching nodes/pods/namespaces
####-##-#####:34:47,638+0000 ERROR [Collector worker thread 25] (398) com.vmware.vcops.adapter.dataprovider.KubernetesDataProvider.collect - Couldn't find any objects in the target environment. Please make sure that the adapter settings are correct.

Environment

VMware Aria Operations 8.18.x

Cause

The certificate thumbprint received from vSphere supervisor cluster does not match with any of the trusted entries in Aria Operations, indicating that the vSphere supervisor cluster's root CA certificate has either not been imported or is not trusted by Aria Operations

Resolution

To resolve this issue, follow these steps:

1. Import the Supervisor Cluster Root CA Certificate:

   • Copy the the ca.crt file from the /etc/Kubernetes/pki/ directory on the Supervisor control plane node and convert the certificate into .PEM format using the following command:
     openssl x509 -in ca.crt -out ca.pem

   • After that, import the root CA certificate (ca.pem) into Aria Operations.

2. Configure Adapter Settings:

   • Edit the adapter configuration by navigate to  Data Sources → Integrations → Kubernetes.
   • Ensure that the Primary URL section contains the URL of the API server of the Control Plane of the Management Cluster (Supervisor IP (VIP)) 
   • Use the Test Connection option to accept the certificate when prompted to save the settings.

3. Wait for Collection Cycles:

   • Wait for 2-3 collection cycles until the adapter instance is in a data-receiving state.
   • This allows the system to stabilize and ensures that the integration is functioning properly.

 

Additional Information

Refer to the Configure Integration with Tanzu Kubernetes Grid documentation for more information.