Harbor endpoint unauthenticated in TCA due to duplicate repository extensions

Products

• VMware Telco Cloud Automation
• VMware Telco Cloud Platform

Issue/Introduction

• In Telco Cloud Automation (TCA), the Harbor endpoint displays an "Unauthenticated" state after migrating to an internal root and intermediate CA. The tca-extension-platform, tca-cert-obs, and repo-inventory sync repeatedly fail TLS validation against Harbor every ~5 minutes with:
  x509: certificate signed by unknown authority error.
• The tca-app logs display the following error:
  Unable to execute POST request to https://<REDACTED_HOSTNAME>/telco/api/caas/v2/clusters/currentState/query permanently. Cause: java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Environment

TCA: 3.4

TCP: 5.1

Cause

The issue is caused by the presence of two independent, active Harbor repository extensions registered for the same server and service account in the TCA-CP database. Certificate-observability aggregates all extensions for the same host and port into one record and probes each independently. The duplicate entry containing an empty trusted certificate fails TLS validation on every cycle (falling back to system CAs which do not trust Harbor's internal CA), causing recurring failures that flip the overall endpoint state to unauthenticated.

Resolution

This issue requires backend database modifications to resolve safely. Please contact Broadcom Support and reference this Knowledge Base article.