vRO Integration Fails with Error "Error receiving new client token for 'vro-gateway-serviceaccount'"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When attempting to integrate an external Aria Automation Orchestrator (vRO) instance in VMware Cloud Foundation Automation (VCFA), the integration fails with the following error:

Operation on cloud account of type 'vro' failed:Error receiving new client token for 'vro-gateway-serviceaccount', orgId: <OrgID>

Environment

VCF Automation 9.0

Cause

The error occurs when an organization is deleted without first removing its associated vRO integration endpoint. This leaves stale data in the provisioning service database. When attempting to add a new integration for the same Orchestrator instance, this stale entry interferes with the new data, causing API calls to reference a removed organization ID.

Resolution

The stale vRO integration data must be manually removed from the provisioning service database.

Important: Please create a backup of your VCFA environment before carrying out the following steps.

Steps:

1. Connect to the VCFA appliance via SSH.

2. Open a Bash terminal to the PostgreSQL DB container:

   kubectl -n prelude exec -it vcfapostgres-0 -- bash

3. Connect to the database as the postgres user:

   psql -U postgres

4. List existing databases:

   \l

Confirm the existence of provisioning_db.

5. Connect to the provisioning service database:

   \c provisioning_db;

6. Enable expanded display for better readability:

   \x

7. Identify the stale vRO endpoint by running:

   select id,name,custom_properties,endpoint_properties from endpoint_state where endpoint_type='vro' and org_auth_link='/tenants/organization/<OrgID>';

8. Validate the output:

   Ensure the name matches the integration.
   Check custom_properties / endpoint_properties for the hostName key matching the vRO instance URL.
   Note the id of the stale integration.

9. Delete the stale integration:

   delete from endpoint_state where id='<ID_FROM_PREVIOUS_STEP>';

10. Re-attempt the vRO integration from the VCFA UI.

Additional Information

Even after completing the configuration steps, the vRO (vRealize Orchestrator) interface may remain stuck at the Orchestrator UI loading page. This is a known issue in VMware Cloud Foundation 9.0, where an external VCF Operations Orchestrator with a self-signed certificate fails to load within the VCF Automation tenant. The issue occurs because the browser does not automatically trust the orchestrator’s certificate, causing the page to display a spinner until it times out. As a workaround, navigate to the VCF Operations Orchestrator deployment in a separate browser tab, accept and trust the self-signed certificate, and then refresh the VCF Automation page. The Orchestrator UI should load successfully after performing these steps. More details can be found in the VCF 9.0 known issues documentation.