VMware Cloud on AWS (VMC) Cloud Accounts in Aria Automation fail data collection and validation. The account is marked "Unavailable for deployment."

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

VMware Cloud on AWS (VMC) Cloud Accounts in Aria Automation fail data collection and validation. The account is marked "Unavailable for deployment."

• Cloud account health check fails for endpoint types vsphere and nsxp.
• Error message in the UI or logs: FAILED with Failed to validate credentials. Error: Error for endpoint type 'vsphere': Failed to validate resource Error for endpoint type 'nsxp': Failed to validate credentials. AdapterReference: http://provisioning-service.prelude.svc.cluster.local:8282/provisioning/nsxp/endpoint-config-adapter. Error: Retries exhausted for 'Executing getAuthToken' from referer http://####:8282/provisioning/nsxp/endpoint-config-adapter
• Image synchronization and direct login to NSX Manager succeed, but deployment validation fails.

 

Environment

• VMware Aria Automation 8.18.x
• VMware Cloud on AWS (VMC)

Cause

The issue occurs due to a mismatch or stale certificate/credential mapping within the Aria Automation provisioning service's internal endpoint registry. This prevents the nsxp adapter from successfully obtaining an authentication token for the VMC SDDC.

Resolution

 Manually patch the VMC Cloud Account endpoints using the Aria Automation API.

1. Retrieve the underlying associated vSphere  and NSX  with VMC on AWS endpoint using the following API with associated cloud accounts vSphere and NSX. 
   
   GET https://{vRA-root-uri}/provisioning/uerp/resources/endpoints/<VMC-endpoint-ID>

2. Get the Certificate for vSphere and NSX cloud with the below CLI commands:

   • openssl s_client -connect <vCenter_FQDN>:443 2> /dev/null | openssl x509 | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}'

   • openssl s_client -connect <NSX_FQDN>:443 2> /dev/null | openssl x509 | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}'

3. Retrieve the vSphere cloud account to double-check you are updating the correct one:
   
   GET https://{vRA-root-uri}/provisioning/uerp/resources/endpoints/<vsphere-cloud-account-id>

4. Update the vSphere cloud account with the valid certificate and credentials (provide the password for privateKey value, and username for privateKeyId) using
   
   PATCH https://{vRA-root-uri}/provisioning/uerp/resources/endpoints/<vsphere-cloud-account-id> 

   with raw JSON body:

           {
         "endpointProperties": {
              "certificate": "<vCenter-certificate-from step 2",
              "privateKeyId": "[email protected]",
              "privateKey": "xxxx"
         },
         "customProperties": {
              "certificate": ""<vCenter-certificate-from step 2"
         }
    }
  

   
   
   

5. Retrieve the underlying NSX cloud account:
   
    GET https://{vRA-root-uri}/provisioning/uerp/resources/endpoints/<NSX-cloud-account-id>

6. Update the NSX cloud account : 
   
   PATCH https://{vRA-root-uri}/provisioning/uerp/resources/endpoints/<NSX-cloud-account-id>
   
   

   with raw JSON body:

           {
         "endpointProperties": {
              "certificate": "<NSX-certificate-from step 2",
              "privateKeyId": "[email protected]",
              "privateKey": "xxxx"
         },
         "customProperties": {
              "certificate": ""<NSX-certificate-from step 2"
         }
    }
     

7. On the Aria Automation UI, navigate to the VMC on AWS cloud account, apply the API token ID, enter the user credentials to validate, and click save.