Error: "future must be done" - vCenter Content Library deployment fails from Aria Automation

Products

• VMware vCenter Server

Issue/Introduction

When you deploy a virtual machine from a vCenter Content Library using VMware Aria Automation (VRA), the deployment fails with the following error:

Provisioning operation failed. Cannot deploy library item <UUID> ( com.vmware.vdcs.util.unhandled_error An error occurred: future must be done)

This occurs when the vCenter Content Library service encounters stale vAPI session data, causing authentication failures during the OVF transfer process. Aria Automation is unable to retrieve the library item, and the provisioning workflow fails.

The following entries in the vCenter Content Library service log confirm this issue:

Log path: /var/log/vmware/content-library/cls.log

SessionManagerImpl | Session <UUID> not found in session store, returning null.

SessionAuthnHandlerImpl | Unauthenticated error while attempting to retrieve valid vAPI session. This is non-fatal and the operation will be retried.

AuthenticationFilter | Authentication failed
com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated (com.vmware.vapi.std.errors.unauthenticated)

When the Content Library transfer service attempts to stream the OVF from the datastore via the /ds/vapi endpoint, the connection pool returns invalid clients:

ResourceModelClientPoolableObjectFactory | ...client is invalid: com.vmware.vapi.std.errors.Unauthenticated

Additional symptoms reported:

• Issue affects deployments of both Linux and Windows templates
• Failures occur in production environment
• Issue began on a specific date without configuration changes

Environment

• vCenter Server 8.0
• VMware Aria Automation

Cause

 

The vCenter Content Library service maintains a pool of authenticated vAPI connections for streaming content from datastores. Under normal operation, when sessions expire or are invalidated, the connection pool refreshes its credentials.

In this condition, the session references held by the Content Library transfer service's connection pool became inconsistent with the vAPI session store. The pool continued to use session identifiers that no longer existed in the store, causing repeated authentication failures. The connection pool did not self-heal, and the retry mechanism was unable to re-establish valid sessions.

The specific trigger for this state inconsistency was not identified. Restarting only the vmware-vapi-endpoint service does not resolve the issue because the stale connection pool resides in the Content Library service, not the vAPI endpoint. A full vCenter reboot reinitializes all services and their connection pools in proper startup order, clearing the invalid session state.

Resolution

Workaround

Restarting only the vmware-vapi-endpoint service does not resolve this issue. A full vCenter Server Appliance cold boot is required to clear the stale connection pool state.

1. Shut down the vCenter Server Appliance using one of the following methods:

   CLI method:

   1. Log in to the vCenter Server Appliance console or SSH session.
   2. Run the shutdown command:

      shutdown -h now
      

   UI method:

   1. Open a browser and navigate to the VAMI: https://<vcenter-fqdn>:5480
   2. Log in as root.
   3. Click Actions in the top right.
   4. Select Shutdown.
   5. Enter an optional shutdown reason and click Shutdown.

2. Wait for the appliance to fully power off.

3. Power on the appliance from the ESXi host client or vSphere Client managing the VCSA.

4. Wait for all vCenter services to start completely.

5. Verify all services are running and healthy:

   service-control --status --all
   

   All required services should show as RUNNING.

6. Log in to the vSphere Client and confirm the Content Library is accessible.

7. Retry the VM deployment from Aria Automation.

8. Verify the deployment completes successfully.

Additional Information

 

If the issue persists after rebooting vCenter, or if logs show certificate validation errors, see the following articles:

• KB 316619 — "Signing certificate is not valid" or "No healthy upstream" error (expired STS certificate)
• KB 394085 — Content library creation failed with "AuthenticationException" (certificate trust chain issue)
• KB 52052 — vAPI Endpoint service fails to start (CRL store issue)