Trust pairing connection error and timeout after TCA-CP upgrade or vCenter certificate update

Products

• VMware Telco Cloud Automation
• VMware Telco Cloud Platform

Issue/Introduction

• Following an upgrade of the TCA-CP nodes, or after replacing/updating vCenter Server certificates, the trust status pairing validation layout with the mapped Virtual Infrastructure breaks.
• Virtual Infrastructure shows a state of Connection Error "Connection Error".
• When attempting to use the "Re-establish Trust" tool, the system fetches the current certificate schema but fails to apply the trust adjustments, terminating with an explicit timeout.

Environment

TCA: 3.4

TCP: 5.1

Cause

The upgrade cycle or token authority modification truncates or omits the management cluster's operational context profiles (kubeconfig) inside the working environment directory mappings of the containerized k8s-bootstrapper deployment.

Resolution

Work Around:

To resolve this issue, manually synchronize the Management Cluster context settings within the bootstrapper workspace:

1. Log into the affected TCA-CP node via SSH using administrative credentials.

2. Connect to the k8s-bootstrapper pod runtime shell within the tca-cp-cn namespace:

kubectl -n tca-cp-cn exec -ti $(kubectl -n tca-cp-cn get pods -l app=k8s-bootstrapper -o jsonpath='{.items[0].metadata.name}') -- bash

3. Export the target Management Cluster's specific identity context definition (Replace <REDACTED_MC_NAME> with the literal cluster identifier value for Mgmt Cluster):

export MC_NAME="<REDACTED_MC_NAME>" && curl http://localhost:8888/api/v1/managementcluster/$(curl -s http://localhost:8888/api/v1/managementclusters | jq -r --arg mc ${MC_NAME} '.[] | select(.clusterName=$mc) | .id')/kubeconfig > /tmp/kubeconfig

4. Consolidate and rewrite the primary cluster context configurations into the internal core paths:

cd /opt/vmware/kbs/kbs-tkg254/tanzu/ && KUBECONFIG=.kube/config:/tmp/kubeconfig kubectl config view --merge --flatten > merged_kubeconfig && cp merged_kubeconfig .kube/config && rm -f merged_kubeconfig 

cd /opt/vmware/kbs/kbs-tkg254/tanzu/ && KUBECONFIG=.kube-tkg/config:/tmp/kubeconfig kubectl config view --merge --flatten > merged_kubeconfig && mkdir -p .kube-tkg && cp merged_kubeconfig .kube-tkg/config && rm -f merged_kubeconfig

5. Force-register the proper Tanzu CLI operational profile to complete the environment alignment:

export MC_NAME="<REDACTED_MC_NAME>" && HOME=/opt/vmware/kbs/kbs-tkg254/tanzu/ /opt/vmware/kbs/kbs-tkg254/bin/tanzu context create ${MC_NAME} --kubeconfig /opt/vmware/kbs/kbs-tkg254/tanzu/.kube-tkg/config --kubecontext ${MC_NAME}-admin@${MC_NAME}

6. Return to the TCA user interface and re-trigger the "Re-establish Trust" configuration workflow.

Additional Information

VMware Telco Cloud Automation 3.4 Release Notes mentions the issue and the work around