vRA/O 8.x – A deployment issue

In some cases there is a problem that occurs with the setup of vRA/O 8.0 and 8.0.1 at least. I have come across the problem in two cases (This seems to have been resolved in version 8.1).

  1. Installing vRA via the Easy installer
  2. Installing stand alone vRO instances

In the cases of case number 1 you get an error like this, LCMVRAVACONFIG590003,  during the installation:


In case 2 you will get a message that says “bad gateway” when going to the orchestrator client or the control center.

The source of is the same, basically the product has been released with a password that expired. In order to fix it VMware released a kb article.  You will need the root account and a terminal program, like putty or SecureCRT.

Confirm the problem

1: Connect to the vRA/O host via ssh.

2: To confirm the problem, run the following command: kubectl -n prelude get pods


That will show you the last line where the vco pod is broken.

3: To confirm that the password is in deed the issue run this command: kubectl -n prelude logs <vco app-id> -c install-rpms |grep password

This will give you an output like this. (The VMware kb don’t use the |grep password but I find it makes it easier to confirm the problem.


Fix the problem

1: Change folder to /opt/charts/vco/templates/ and run the following command to take a backup of the yaml file: cp deployment.yaml /tmp/deployment.yaml

2: Edit the yaml file and search for init_run.sh, using your favorite editor, for me it’s vim


Remove the line and replace it with the line from the kb (Remember to keep the format of the yaml file and single line (see screenshot):


– “sed -i ‘s/root:.*/root:x:18135:0:99999:7:::/g’ /etc/shadow && sed -i ‘s/vco:.*/vco:x:18135:0:99999:7:::/g’ /etc/shadow && /init_run.sh”


3: Save the file

4: In case of Lifecycle Manager you can go back there and re-run the job. It should now complete. In case of vRO where the appliance is already deployed you can go to the folder /opt/scripts and run the ./deploy.sh (The script will take around 4-5 minutes to run depending on your system at least in my experience).

In LCM you can press the retry button:lcm-error

After you resubmit the job vRA/O will kill off all the pods and clean the environment and try again. (If you stay connected in the shell you can see part of the process, below you can see all the pods being terminated until there are none left):



After that the pods start getting created again:


After a while we should also see that the vco pod having been created properly this time:


Anyway let the process continue, there are other pods to be initiated. All of them should at the end be running.

After that it’s a short while to the finish line: