Attaching edited host profile with VVols configuration might trigger compliance errors

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

The supported way to get a host profile with Virtual Volumes is to configure a reference host and extract its profile. When you manually edit an existing host profile in the vSphere Web Client and then attach the edited profile to a new host, you might trigger compliance errors and other unpredictable problems. These errors might be due to unresolved dependencies between different VVols components in the host profile. The errors might also occur if you incorrectly edit the host profile.

You might encounter the compliance errors under the following circumstances:

• When you remove the storage container from a previously saved host profile

  Consider the following example. The host profile that you extract from the specific host includes two storage containers, VVol-DS1 and VVol-DS2. You edit the extracted host profile and remove one of the storage containers, for example, VVol-DS2 from the profile.

  After you attach the edited host profile to the new ESXi host, the host correctly shows only the remaining VVol-DS1 datastore. However, the compliance check of the host profile returns a Non-Compliant error.

  This problem might occur when a single VASA provider represents two arrays. And the storage containers are configured in such a way that each is mapped to its backing array. If you remove the storage container, the array that is no longer used is also removed from the VASA provider list of arrays. However, the host profile continues to reference both arrays, triggering the compliance error.

  The following example shows the correlation between the VP and the arrays that it manages.

  [root@myesxbox:~] esxcli storage vvol vasaprovider list
  VP1
  VP Name: VP1
  URL: http://10.160.113.182:8080/vasa/version.xml
  Status: online
  Arrays:
  Array Id: com.vmware.vim.sampleprovider:2000000
  Is Active: true
  Priority: 0
  
  Array Id: com.vmware.vim.sampleprovider:1000000
  Is Active: true
  Priority: 0
  

  This example shows how storage arrays and containers correlate.

  [root@myesxbox:~] esxcli storage vvol storagecontainer list
  VVol-DS1
  StorageContainer Name: VVol-DS1
  UUID: vvol:869cad1fb7fd4b30-85f866d796821ef7
  Array: com.vmware.vim.sampleprovider:1000000
  Size(MB): 53246
  Free(MB): 52528
  Accessible: true
  Default Policy:
  
  VVol-DS2
  StorageContainer Name: VVol-DS2
  UUID: vvol:0b3f8f385a1e45bc-9f4c7f59f03114ee
  Array: com.vmware.vim.sampleprovider:2000000
  Size(MB): 53246
  Free(MB): 48461
  Accessible: true
  Default Policy:

  To correct this problem, look at the compliance error and appropriately edit the profiles where the error was shown. This action should make the system compliant with the host profile.

• When you remove the Virtual Volumes configuration from the saved host profile

  Whenever a Virtual Volumes datastore is configured on an ESXi host, a firewall rule is also configured on the host so that the host can access the VP ports. If you remove the Virtual Volumes configuration from the host profile, but leave the firewall profile unchanged, a compliance error might occur when you later apply this host profile to an ESXi host.

  Again, to correct the problem, edit the profile to make the host compliant.
  

• When you add an invalid VASA provider to the saved host profile

  The error can also occur if the provider does not include configured storage containers.

• When you edit the VASA provider information in such a way that it causes conflicts with vCenter Server

  For example, if you change the name of the VASA provider, but keep its existing URL.

  In vSphere 6.5, the VP removal does not result in any real action. Any VP removal happens only if all storage containers for that VP are removed, which results in automatic removal of the VP from the ESXi host.

• In another scenario, even if a remediate or apply action produces an error that appears in the logs, the action might not fail. For example, when an invalid VP is added to the previously saved host profile, an error is generated by the esxcli command. When a subsequent compliance check is run, it might still show that the invalid VP is causing the compliance to fail.

• An apply action is successful and does not generate an error, but the compliance check still might fail. For example, this problem might occur if you add a VP, but no storage containers that are using the VP are configured. ESXi automatically removes the VP and when you later check compliance, the host might show noncompliance.
  

Environment

VMware vSphere ESXi 6.0
VMware vCenter Server 6.0.x

Resolution

When you edit the host profile, make sure that the information you supply is correct. Remove any VVols configuration dependencies, for example:

• If the compliance error appears after you remove the storage container, edit the host profile to delete the reference to the removed array from the VASA provider configuration. If you remove the last storage container associated with a VP, the VP is automatically removed.
• If the compliance error appears after you remove the VVols configuration, edit the host profile to delete the VVols-specific firewall configuration.

Note In certain cases, you might need to edit the host profile fields that are marked as Sorted, do not edit. Make sure to contact VMware Technical Support before editing these fields.