Upgrading vSAN Witness from 7.0 Update 2 fails with "New ESXi version requires a minimum of 2 processor cores."

Products

• VMware vSAN

Issue/Introduction

To provide upgrade guidance for environments where an affected vSAN Witness Appliance was deployed.

Symptoms:
In vSphere 7.0U2 GA VMware changed the configuration of the Tiny Witness Appliance to 1 vCPU.  Attempting to upgrade a 1vCPU Witness Appliance results in the following error: "New ESXi version requires a minimum of 2 processor cores."

This issue may occur if the following conditions are met:

1. vSAN Witness Appliance was deployed from the official vSphere 7.0 U2 OVF prior to July 9th, 2021
2. The appliance in question was deployed as a 'tiny' size
3. Appliance is upgraded in-place

Unless ALL of the above criteria are met, the problem described will not occur and no further actions are necessary.

Environment

VMware vSAN 7.0.x

Cause

Witness Appliances deployed from the OVA with only 1 vCPU will encounter this error during upgrade.

Resolution

The Appliance download link was updated on July 9th 2021 - appliances deployed from OVA downloaded after this date will not be affected.  For environments with appliances deployed from the affected OVA, see the Workaround section below for next steps.

Workaround:
There are four workarounds for this problem:

Note: While the witness is powered down, the cluster will be in a state of reduced protection; complete the steps expeditiously to minimize the window of exposure.  Take additional steps as appropriate to ensure data protection according to the desired level of risk mitigation.

1. Redeployment
   • The OVA download has been updated.  Affected environments may replace the existing Witness Appliance with one deployed from the new OVA
2. vCenter Server/ESXi UI

   • To modify the CPUs and Socket of the Witness Appliance in the vSphere Web Client:

     • Login to the vCenter or ESXi UI that Witness Appliance residing.

     • Select the Witness Appliance and power off.

     • Edit settings of the Witness Appliance and expand "CPU" menu, set CPU to 2 and "Cores Per Socket" to 2. Then click "OK".

     • Power on Witness Appliance.

3. Python Script

   • Python  

     Attached script: changeNumCpuAndNumCorePerSocket.py

     Synopsis

     The script can run on any vCenter or ESX host which has python installed.

      

     It tries to look for the Witness in the given datacenter path, powers it off and tries to upgrade the CPUs/Sockets.

      

     Once the witness reconfiguration is done it tries to power on the witness and bring it back online(Will not power on if the original state is powered off).

      

     Note: The script can connect to the vCenter managing the witness or the ESX where the witness is currently residing.

      

     Warning: Witness will be powered off when the during the reconfiguration. Any components residing on the Witness will be non-compliant during that period.

     Prerequisites

     • Python - versions 3.6.8 and above
     • Pyvmomi in the environment or path to the pyvpx folder
     • vCenter or ESX from where the script executes should be reachable to the witness residing host/vCenter

   • Sample

     python changeNumCpuAndNumCorePerSocket.py -i <vc/host> -u <username> -p <password> -o <port> -n <witness_name> -d <datacenter_path> -v <pyvpx_dir_path> -l <log_path>
     python changeNumCpuAndNumCorePerSocket.py --help
     
     Inputs to the script: 

     '-i' or '–host'	Required field, it is the vCenter managing the witness or the ESX where the witness is currently residing or localhost
     '-u' or '–user'	Required field which is the vc/host username
     '-p' or '–password'	Required field for logging into the vc/host
     '-o' or '–port'	Optional Field which default to 443, it is the hostd port for connection
     '-n' or '–name'	Required field which is the name of the witness to be upgraded
     -d' or '–datacenter'	Optional Field it is the path to the datacenter where the witness is residing, if provided the witness is searched in that particular datacenter path
     '-v' or '–pyvpxdir'	Optional Field, if provided loads the pyvpx from the path to the pyvpx unzipped folder instead of the environment
     '-l' or '–logfile'	Optional Field and defaults to /tmp/witnessReconfig.log but can be specified to provide log file path for the script logs

4. PowerCLI Script​

   • Attached script: ChangeNumCpuAndNumCorePerSocket.ps1

      

     Synopsis

     The script can run on any machine(virtual/physical) or ESX host which has PowerCLI installed.

      

     It tries to look for the Witness in the given datacenter path, powers it off and tries to upgrade the CPU/Socket.

      

     Once the witness reconfiguration is completed it tries to power on the witness and bring it back online.

      

     Note: The script can connect to the vCenter managing the witness or the ESX where the witness is currently residing.

      

     Warning: Witness will be powered off when the reconfiguration is being be done. Any components residing on the Witness will be non-compliant during that period. 

     Prerequisites

     • PowerCLI Version : PowerCLI 11.4.0 and above

     • PowerShell Core Version : 6.1 and above

   • Note: When trying to connect with PowerCLI to a vCenter Server Appliance, you may encounter Invalid server certificate error.

     Use Set-PowerCLIConfiguration to set the value for the InvalidCertificateAction option to Prompt if you’d like to connect once or to add a permanent exception for this server.

     You may ignore InvalidCertificateAction by running following command before running this script: Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false
      

     Sample

     ChangeNumCpuAndNumCorePerSocket.ps1 usage: ChangeNumCpuAndNumCorePerSocket.ps1 -HostName <hostname> -User <username> -Password <password> -VM <vmname> -Datacenter <datacentername>[optional]
     
     ChangeNumCpuAndNumCorePerSocket.ps1 help: get-help ChangeNumCpuAndNumCorePerSocket.ps1
     
     Inputs to the script:

     -HostName	vCenter managing the witness or the ESXi where the witness is currently residing or localhost
     -User	User name to use when connecting to host/vc
     -Password	User Password to use when connecting to host/vc
     -VM	VM name whose CPU/Socket needs to be changed
     -Datacenter	[optional] Datacenter name where vm could be residing

Additional Information

Impact/Risks:
Upgrading witness appliance will fail.