Kestra vs. VMware Aria Automation: Beyond the vSphere Portal
VMware Aria Automation (formerly vRA/vRO) is the go-to portal for catalog-driven VM provisioning in vSphere environments. But as infrastructure expands to AWS, Azure, GCP, and Kubernetes—and as teams demand Git-native workflows, clear error messages, and modern developer experience—the proprietary JavaScript vRO model breaks down. Kestra replaces vRA/vRO with declarative YAML workflows that work across every cloud, on-prem, and air-gapped environments.
The vRA to Kestra migration guide walks through the move in four stages, from assessing your estate to retiring vRA at renewal, with a payback calculator for your own numbers.
Cloud-Agnostic Orchestration vs. vSphere-First Portal
Multi-Cloud Infrastructure Orchestration
Define every provisioning workflow in YAML. Orchestrate Terraform, Ansible, vSphere, AWS, Azure, and GCP in one flow. Keep your catalog in your existing portal, such as ServiceNow, and call Kestra behind each item, or move it to self-service Apps with dynamic forms and approval gates. Every workflow is Git-native, reviewable, and deployable through CI/CD—no JavaScript, no proprietary APIs, no hidden state.
"How do I provision infrastructure across VMware, AWS, and Azure with one declarative workflow and a clear audit trail?"
VMware-Centric Catalog Portal
VMware Aria Automation provides a polished portal for catalog-driven VM provisioning tightly integrated with vSphere. But orchestration logic lives in vRO—JavaScript with proprietary APIs, ambiguous error messages, and no native Git integration. Expanding beyond VMware infrastructure adds friction.
"Why does debugging a failed vRO workflow take hours? And why can't I version-control these JavaScript workflows properly?"
Replace vRA/vRO with Modern Infrastructure Automation
Unified Infrastructure Automation
Provision VMs, run Terraform, and configure with Ansible in one YAML workflow
Self-service Apps with dynamic forms, approvals, and RBAC per namespace
Full audit trail and evidence logging for compliance
Git-native—every workflow is code, reviewed, and versioned
Multi-cloud: vSphere, AWS, Azure, GCP, Kubernetes from one platform
Legacy VMware Portal
vRO workflows in JavaScript with proprietary APIs—poor DX, hard to debug
Ambiguous error messages make troubleshooting time-consuming
No native Git integration—workflows live in the UI
Deep vSphere coupling creates friction when expanding to multi-cloud
High licensing costs, now priced per core inside VMware Cloud Foundation, with ongoing Broadcom pricing risk
A Fortune 500 manufacturer replaced VMware Aria Automation (vRA/vRO) with Kestra, citing licensing cost, ambiguous logs, and a cyber requirement that no control plane span its OT domains. Kestra provides vSphere-native VM lifecycle management, with Terraform, Ansible, and multi-cloud support added, in a Git-native platform that works in air-gapped, hybrid, and multi-cloud environments.
Time to First Infrastructure Automation Workflow
Kestra starts in minutes with Docker Compose. VMware Aria Automation requires an existing vSphere environment, enterprise licensing, and a multi-step installation wizard that typically takes days and professional services.
# Pick an Infrastructure Automation Blueprint, run it. Done.
Download the Docker Compose file, run it, open the UI, and pick an infrastructure automation Blueprint. Your first provisioning workflow includes a dynamic approval form, Terraform apply, and Ansible configuration—all in readable YAML ready for Git.
Days
to weeks
# VMware Aria Automation
# Prerequisites:
# - Existing vSphere/vCenter infrastructure
# - Broadcom enterprise license
# - Aria Automation appliance deployment
# - vRO configuration and endpoint registration
# - Service catalog setup
# Typical time: 2-5 days + professional services
VMware Aria Automation requires an existing vSphere environment, enterprise licensing, and a multi-step installation wizard. A typical deployment takes days of infrastructure preparation and often requires Broadcom professional services before the first workflow runs.
Declarative YAML vs. JavaScript + Proprietary vRO APIs
Kestra: Readable, reviewable, deployable
id: vm_provision_with_approval
namespace: infra.ops
inputs:
- id: vm_name
type: STRING
- id: environment
type: SELECT
values: [dev, staging, prod]
tasks:
- id: request_approval
type: io.kestra.plugin.core.flow.Pause
onResume:
form:
fields:
- id: approved
type: SELECT
values: [yes, no]
- id: provision
type: io.kestra.plugin.terraform.cli.TerraformCLI
commands:
- terraform apply -auto-approve
env:
TF_VAR_vm_name: "{{ inputs.vm_name }}"
- id: configure
type: io.kestra.plugin.ansible.cli.AnsibleCLI
commands:
- ansible-playbook configure.yml
- id: close_ticket
type: io.kestra.plugin.servicenow.table.Update
table: incident
id: "{{ trigger.body.sys_id }}"
data:
state: resolved
YAML workflows read like documentation. The AI Copilot writes them for you. Every workflow goes through Git and CI/CD—no hidden state in a UI. Approvals, secrets, retries, and ITSM integration are first-class YAML constructs.
vRO: JavaScript, proprietary APIs, poor DX
// VMware vRO workflow (JavaScript + proprietary APIs)
// No native Git, hard to test, ambiguous errors
System.log("Starting VM provisioning...");
var vcPlugin = Server.findForType("VC:SdkConnection")[0];
var datacenter = vcPlugin.getAllDatacenters()[0];
var folder = VcPlugin.getAllVirtualMachineFolder(datacenter)[0];
var resPool = VcPlugin.getAllResourcePool(datacenter)[0];
// Error messages: "Cannot complete login due to an
// incorrect user name or password" (even when it's
// a network timeout, not an auth issue)
VMware vRO workflows are written in JavaScript with proprietary vRO APIs that wrap vSphere objects. They're difficult to version, test, or debug. Error messages are often ambiguous and require vCenter-level access to diagnose. There is no native Git integration—workflows live in the vRO server.
Modern Orchestration vs. Legacy vSphere Portal
One platform for VM provisioning, Terraform IaC, Ansible configuration, incident response, and ITSM integration. Self-service Apps with dynamic forms, approvals, and full audit trails. Works on-prem, in Kubernetes, and in air-gapped environments.
VMware Aria Automation provides a polished portal for catalog-driven VM and service provisioning with deep vSphere integration. Orchestration logic lives in vRO—JavaScript with proprietary APIs, difficult debugging, and no native Git integration. Expanding beyond VMware infrastructure adds significant friction.
Kestra vs. VMware Aria Automation at a Glance
Primary use case
Full infrastructure lifecycle (provision, configure, remediate, decommission)
Catalog-driven VM provisioning tightly coupled to vSphere
Workflow definition
Declarative YAML (code-first, Git-native)
JavaScript + proprietary vRO APIs (GUI-first, no native Git)
Kestra Is Built for the Full Infrastructure Lifecycle
Replace vRA/vRO With Better DX
Kestra runs VM provisioning with vSphere integration and approval gates, and calls Terraform, Ansible, and your ITSM in the same flow. Your catalog can stay in your existing portal or move to Apps. One set of logs either way, with no JavaScript and no proprietary APIs.
Git-Native from Day One
Every workflow is YAML you can commit, review in a pull request, and deploy through CI/CD. Fortune 500 platform teams manage all their infrastructure provisioning logic as code—versioned, testable, and auditable. No hidden state in a portal, no manual change tracking.
Works Anywhere: Cloud, On-Prem, Air-Gapped
Deploy Kestra on Kubernetes, Docker, or bare metal. Run remote workers close to vSphere targets for hybrid environments. Air-gap deployments supported for regulated industries—no external connectivity required. ITZBund and the Austrian Ministry of Defense run Kestra fully disconnected.
When to Choose Kestra vs. VMware Aria Automation
Choose Kestra When
You need to replace vRA/vRO or extend your VMware automation to multi-cloud.
Your workflows span Terraform, Ansible, PowerShell, and cloud APIs in a single flow.
Audit trails, compliance logging, and air-gapped deployment are requirements.
You want Git-native workflows instead of JavaScript in a proprietary vRO server.
Broadcom's post-acquisition pricing changes make vRA/vRO increasingly expensive.
Consider VMware Aria When
Your infrastructure is exclusively VMware vSphere with no plans to expand.
You need deep vSphere NSX/ALB policy guardrails that vRA provides out of the box.
Your team has significant existing investment in vRO workflows and migration isn't feasible now.
You require specific Aria suite integrations (Aria Operations, Aria Log Insight) in one vendor bundle.
Frequently asked questions
Find answers to your questions right here, and don't hesitate to Contact Us if you couldn't find what you're looking for.
VMware Aria Automation focuses on catalog-driven VM and service provisioning tightly coupled to vSphere infrastructure. Workflows in vRO are JavaScript-based with proprietary APIs, difficult to version, and prone to ambiguous error messages. Kestra replaces vRA/vRO with declarative YAML workflows that work across VMware, AWS, Azure, GCP, and Kubernetes—with proper Git integration, clear logs, and self-service Apps that don't require a proprietary portal. A Fortune 500 manufacturer replaced vRA/vRO with Kestra for better developer experience, clearer logs, and a separate control plane per security zone.
Yes. Kestra has native vSphere plugin support for VM lifecycle management—provisioning, snapshotting, resizing, and decommissioning. Combined with Terraform, Ansible, and PowerShell tasks in the same workflow, Kestra covers the vSphere operations teams script in vRO and extends them to the rest of your stack. You keep deep vSphere integration while gaining multi-cloud flexibility and a modern developer experience.
Kestra Apps provide dynamic, data-backed forms for self-service provisioning. Forms can be populated from APIs, CMDBs, or vCenter data—giving users dropdowns with live infrastructure data (available datastores, network segments, resource pools) rather than static values. Approval gates are inline YAML tasks that pause the workflow for human review before resources are created. Teams use Apps as their catalog, or keep the catalog in their existing portal, such as ServiceNow, and call a Kestra flow behind each item.
The Kestra Migration Assistant for vRA converts the structure of a vRO package (folder hierarchy to namespaces, configuration elements to the KV Store, SecureStrings to secrets) and rewrites the JavaScript as Kestra tasks, which an engineer then reviews and tests. Complex workflows are rewritten by hand. Kestra runs the conversion with your team wave by wave, and for very large estates a systems integrator can do the conversion work. A Fortune 500 manufacturer completed its migration roughly twelve months after the proof of concept began, running vRA and Kestra in parallel until each wave was verified. The vRA to Kestra migration guide covers the full method.
Since Broadcom's acquisition of VMware, many organizations have seen significant licensing cost increases. Kestra Enterprise is licensed by instance, so adding workflows does not change what you pay. Your automation also stops depending on your hypervisor vendor: workflows are YAML files in Git that run on any infrastructure, so you can move workloads to Nutanix, Proxmox, or a public cloud without rebuilding them. Your infrastructure vendor should not own your automation.
Yes. Kestra was designed for compliance-first deployments. It runs fully on-prem with no external dependencies, supports internal Postgres and S3-compatible storage, integrates with AD/OIDC for SSO, and works with enterprise secrets managers like CyberArk and HashiCorp Vault. Government customers like ITZBund and the Austrian Ministry of Defense chose Kestra specifically for its air-gap readiness and audit capabilities.
Getting Started with Modern Infrastructure Orchestration
See how Kestra replaces VMware Aria Automation with declarative YAML workflows across any cloud.
