Skip to main content

 "Cloud zone insights not available yet, please check after some time" message on Aria Automation

https://knowledge.broadcom.com/external/article?articleNumber=314894


Products

VMware Aria Suite

Issue/Introduction

Symptoms:

  • The certificate for Aria operations has been replaced since it was initially added to Aria Automation as an integration.
  • When accessing the Insights pane under Cloud Assembly -> Infrastructure -> Cloud Zone -> Insights the following message is displayed:

 "Cloud zone insights not available yet, please check after some time."

  • The /var/log/services-logs/prelude/hcmp-service-app/file-logs/hcmp-service-app.log file contains ssl errors similar to:  
    2022-08-25T20:06:43.989Z ERROR hcmp-service [host='hcmp-service-app-xxxxxxx-xxxx' thread='Thread-56' user='' org='<org_id>' trace='<trace_id>' parent='<parent_id>' span='<span_id>'] c.v.a.h.a.common.AlertEnumerationHelper.lambda$synchronizeWithDatabase$12:128 - [<IntegrationName>]: [<UUID>]: Error during enumerating alerts
	javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
		at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[na:na]
		at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:353) ~[na:na]
        at java.base/java.lang.Thread.run(Thread.java:829) ~[na:na]
	Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
		at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439) ~[na:na]
		at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)

     

  • The /var/log/services-logs/prelude/hcmp-service-app/file-logs/hcmp-service-app.log file contains errors similar to:   
    2024-12-04T06:50:48.703Z ERROR hcmp-service [host='hcmp-service-app-7xxxxxx-xxxxx' thread='Thread-1284' user='configadmin' org='<org-id>' trace='<trace_id>' parent='<parent_id>' span='<span_id>] c.v.a.h.p.v.r.ResourcesDomainImpl.lambda$getVropsResourceIdentifier$45:534 - [ID]: Unable to fetch resource's identifier from Aria Operations endpoint
com.vmware.automation.hcmp.exception.ResourceNotFoundException: CloudZone with ID: <Cloud-Zone-ID> not found.
at com.vmware.automation.hcmp.provider.vrops.resources.ResourcesDomainImpl.lambda$getVropsResourceIdentifier$43(ResourcesDomainImpl.java:529) ~[hcmp.jar:8.3.0-SNAPSHOT]

Environment

VMware Aria Automation 8.x

VMware vRealize Automation 8.x

Cause

  • The trust between Aria Automation and Aria operations is broken post replacing certificate of Aria operations.
  • The account used for the Aria Automation and Aria Operations integration lacks the necessary privileges.

Resolution

Scenario 1 : When the trust between Aria Automation and Aria operations is broken post replacing certificate of Aria operations.

The issue is pending resolution.

Workaround:

Note: Prior to performing the workaround best practice dictates you first snapshot Aria Automation nodes.

The certificate stored for Aria operations Integration can be updated via a PATCH API call

1. Obtain the Integration ID and the Username from the UI by opening the respective Aria operations integration within the Aria Automation UI under Infrastructure -> Integrations


 

The Integration id portion of the url is everything after '%2F'

The integration id can also be validated in the web browsers developers tools:

 

2. Obtain a Bearer token following the article Generate an Access Token and Bearer Token in VMware Aria Automation for API Authentication

3.  Capture the new Aria operations certificate in PEM format by running the following command:

openssl s_client -connect <AriaoperationsFQDN>:443 2> /dev/null | openssl x509 | awk 'NF {sub(/\r/, "");  printf "%s\\n",$0;}'

replace <AriaoperationsFQDN> with the actual fully qualified domain name of the Aria operations.

4. Submit a PATCH call to url:

https://<Aria automation FQDN>/iaas/api/integrations/<Aria operations integration ID>?apiVersion=2021-07-15

with body:    

 {
         "privateKeyId": "username",
         "privateKey": "password",
         "certificateInfo": {
             "certificate": "certificate from step 3"
         }
     }

 

A 202 accepted status indicates a successful request:

Note: The issue is not specific to Aria operations Integrations and can affect other integrations types added to Aria Automation. The same resolution steps can be applied to update the certificate stored.

Scenario 2 : The account used for the Aria Automation and Aria Operations integration lacks the necessary privileges.

Ensure that the VMware Aria Automation user used for the Aria Operations integration has both organizational owner and Cloud Assembly administrator permissions.

Configuring VMware Aria Automation with VMware Aria Operations

 

Additional Information

If the account used for the Aria Automation and Aria Operations integration lacks the necessary privileges, Aria Automation Cloud Zone objects will not appear when accessing Aria Operations >> Operations >> Configurations >> Inventory Management.

Comments

Post a Comment

Popular posts from this blog

  Issue with Aria Automation Custom form Multi Value Picker and Data Grid https://knowledge.broadcom.com/external/article?articleNumber=345960 Products VMware Aria Suite Issue/Introduction Symptoms: Getting  error " Expected Type String but was Object ", w hen trying to use Complex Types in MultiValue Picker on the Aria for Automation Custom Form. Environment VMware vRealize Automation 8.x Cause This issue has been identified where the problem appears when a single column Multi Value Picker or Data Grid is used. Resolution This is a known issue. There is a workaround.  Workaround: As a workaround, try adding one empty column in the Multivalue picker without filling the options. So we can add one more column without filling the value which will be hidden(there is a button in the designer page that will hide the column). This way the end user will receive the same view.  
Post a Comment
Read more

57 Tips Every Admin Should Know

Active Directory 1. To quickly list all the groups in your domain, with members, run this command: dsquery group -limit 0 | dsget group -members –expand 2. To find all users whose accounts are set to have a non-expiring password, run this command: dsquery * domainroot -filter “(&(objectcategory=person)(objectclass=user)(lockoutTime=*))” -limit 0 3. To list all the FSMO role holders in your forest, run this command: netdom query fsmo 4. To refresh group policy settings, run this command: gpupdate 5. To check Active Directory replication on a domain controller, run this command: repadmin /replsummary 6. To force replication from a domain controller without having to go through to Active Directory Sites and Services, run this command: repadmin /syncall 7. To see what server authenticated you (or if you logged on with cached credentials) you can run either of these commands: set l echo %logonserver% 8. To see what account you are logged on as, run this command: ...
Post a Comment
Read more
  The Guardrails of Automation VMware Cloud Foundation (VCF) 9.0 has redefined private cloud automation. With full-stack automation powered by Ansible and orchestrated through vRealize Orchestrator (vRO), and version-controlled deployments driven by GitOps and CI/CD pipelines, teams can build infrastructure faster than ever. But automation without guardrails is a recipe for risk Enter RBAC and policy enforcement. This third and final installment in our automation series focuses on how to secure and govern multi-tenant environments in VCF 9.0 with role-based access control (RBAC) and layered identity management. VCF’s IAM Foundation VCF 9.x integrates tightly with enterprise identity providers, enabling organizations to define and assign roles using existing Active Directory (AD) groups. With its persona-based access model, administrators can enforce strict boundaries across compute, storage, and networking resources: Personas : Global Admin, Tenant Admin, Contributor, Viewer Projec...
Post a Comment
Read more