Share via

Not able to connect to https://msk8s.api.cdp.microsoft.com. Error returned: action failed after 5 attempts

Saravanan Subbaiah 0 Reputation points
2025-11-19T13:12:50.1+00:00

I am working to install and integrate Azure Local. I received the following error message in the validation steps

Deploy the arc unfractured management component getting below error:

Exception

<Personal information Data>

Azure Local

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sina Salam 26,661 Reputation points Volunteer Moderator
    2025-11-20T13:57:48.9966667+00:00

    Hello Saravanan Subbaiah,

    Welcome to the Microsoft Q&A and thank you for posting your questions here.

    I understand that you are not able to connect to https://msk8s.api.cdp.microsoft.com. Error returned: action failed after 5 attempts.

    The error shows that the appliance VM cannot reach the critical endpoint https://msk8s.api.cdp.microsoft.com, resulting in a TLS handshake timeout.

    The first priority is validating outbound internet reachability from the appliance VM, as this endpoint is mandatory according to Microsoft’s Arc Resource Bridge network requirements – https://aka.ms/AAla73m.

    To resolve this, begin by verifying raw outbound HTTPS connectivity from inside the Appliance VM using: curl https://msk8s.api.cdp.microsoft.com -Verbose If this fails, inspect firewall rules for TLS interception, strict outbound filtering, or SSL proxy requirements. Microsoft clearly states that Arc endpoints must be reachable without HTTPS inspection, because certificate rewriting breaks the TLS handshake – https://learn.microsoft.com/azure/azure-arc/resource-bridge/troubleshoot#network-and-proxy-issues. Additionally, confirm DNS resolution using nslookup msk8s.api.cdp.microsoft.com; misconfigured DNS or reliance on internal-only resolvers commonly causes lookup delays leading to TLS timeouts.

    From there, validate that the Appliance VM’s assigned DNS servers can resolve all required public Microsoft domains and that your environment permits outbound 443 traffic to Arc onboarding endpoints listed in the official requirements – https://learn.microsoft.com/azure/azure-arc/resource-bridge/system-requirements#outbound-connectivity. If your network uses a proxy, ensure the appliance’s cloud agent (azcmagent) is configured accordingly using PowerShell via CLI:

    azcmagent config set proxy.url="http://<proxy>:<port>" and confirm that authentication or whitelisting is not blocking the MSI, extension, or Kubernetes bootstrapping calls.

    Finally, if connectivity checks succeed but deployment continues failing, review any upstream latency, SSL interception devices, or load balancer behavior that could cause handshake delays. Because prolonged TLS timeouts almost always indicate blocked or altered outbound traffic rather than an Arc service issue. Ensuring end-to-end reachability, correct DNS, and proxy alignment resolves the majority of these failures and allows the arcappliance deploy hci step to complete successfully.

    I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

    Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

  2. Saravanan Subbaiah 0 Reputation points
    2025-12-05T06:10:46.7366667+00:00

    Thanks Everyone for your support. We worked with Microsoft to resolve this. Here is the summary

    Symptom: Azure Local Cluster Deployment failure at MocArb step.

    Cause: The Default Gateway for the Cluster and its components such as the KVA had routing issues which dint allow internet traffic back into the KVA.

    Resolution: We worked on checking the network setup of the cluster and found VLAN xxx used for KVA while the Physical Node was on VLAN 0. Collected a network trace from the host during a deployment run that failed where we could see retransmits for the msk8s address and hence confirming the core switch gateway dropping the packets.

    Once the routing was fixed along with other identified VLAN mismatch issues identified the deployment was successful and the cluster successfully deployed

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.