"No Healthy Upstream" while accessing Aria Automation FQDN and upon performing re-trust with VIDM fails with error "LCMVRAVACONFIG590062"

Products

• VCF Automation

Issue/Introduction

• Accessing the Aria Automation FQDN results in  "No Healthy Upstream" message.

• Re-Trust with VMware Identity Manager task against VMware Aria Automation, the request fails with the following error :

  Error Code: LCMVRAVACONFIG590062
  
  Failed to check VMware Identity Manager root certificate on VMware Aria Automation. Check VMware Aria Suite Lifecycle logs for more details
  
  

Environment

VMware Identity Manager 3.3.7

VMware Aria Automation 8.x

Cause

Replacing the VMware Identity Manager certificate can result in improper configuration of the new certificate information on Aria Automation.

Resolution

Prerequisites

• You must back up all VMware Aria Automation appliances, at the same time - simultaneously for all nodes.
• If you are making the snapshots manually, you must start the snapshots of the second and the third node not more than 40 seconds after you start the snapshots for the first node.
• When you back up the VMware Aria Automation appliance, disable in-memory snapshots and enable quiescing (quiescing is a requirement only for version 8.9 and newer).

Procedure

• Validate the Default Configurator Admin Username, in the global environment on VMware Aria Suite Lifecycle 8.x.
  
• SSH to one of the VMware Aria Automation 8.x nodes.
• Run the following command, considering:
  

  vracli vidm set https://ID1 admin ID2

Note :

• • Replace ID2 with the user found in step 1.
  • Replace ID1 with the Load Balancer VIP for vIDM cluster, in case of 1 node vIDM use the first node FQDN.
  • After running this command the prompt will show you the vIDM certificate SHA256, validate this is the right certificate, and accept it by typing “yes”. 
  • You will be asked to type a password, this is the vIDM admin password.
    
    
•  Restart the services
  

  vracli vidm apply

  
   Monitor the restarting process of the identity services pods, and wait until they are running
  

  kubectl get pods -n prelude -w | grep identity-service