After upgrading vCenter to 8.0U3 (= below version U3e ) -- vSAN Health Service triggers the alert "Cluster Configuration Consistency"

Products

• VMware vSAN
• VMware vCenter Server 8.0

Issue/Introduction

The following Symptoms are observed:

• vSAN Cluster running version 7.x or 8.x
• vSAN Encryption is enabled
• A shallow rekey was performed on the cluster while vCenter was on version 7.x or 8.x below 8.0U3
• There are no active tasks running on vCenter with regards to encryption for the vSAN cluster
• After upgrading vCenter to a 8.0 U3 Build (= any Build below 8.0 U3e),  the vSAN Health Service triggers the alert: "Cluster Configuration Consistency" - "The host (cluster) has completed encryption configuration, but the cluster (host) has not completed."

 

• In vCenter health logs we see the following: 

/var/log/vmware/vsan-health/vmware-vsan-health-service.log reports that the vCenter encryption "changing" flag is "None" but the host encryption "changing" flag is "False":

YYYY-MM-DDTHH:MM:SS.ZZ+##:## WARNING vsan-mgmt[##] [VsanHealthEncUtil::_AggregateEncryptionConfigHealth opID=##] Host: host_name has inconsistent config with cluster, field: changing, vc value: None, host value: False

/var/log/vmware/vsan-health/vmware-vsan-health-summary-result.log:

YYYY-MM-DDTHH:MM:SS.ZZ+##:## INFO vsan-mgmt[##] [VsanHealthSummaryLogUtil::PrintHealthResult opID=##] Cluster vSAN_Cluster_name  Overall Health : red
Test consistentconfig health : red
Issues: Host  Disk  Issue  Recommendation
(Host-##, '', Host(Cluster)HasFinishedEncryptionConfigurationButCluster(Host)HasNot., Click'RemediateInconsistentConfiguration'), (Host-##, '', Host(Cluster)
HasFinishedEncryptionConfigurationButCluster(Host)HasNot., Click'RemediateInconsistentConfiguration'),

• Running esxcli vsan storage list|grep Encrypt

on all ESXi Hosts in the vSAN Cluster shows all disks as encrypted

Environment

• VMware vSAN

• VMware vCenter Server: All Versions below 8.0U3e as listed below:

VMware vCenter Server 8.0U3

VMware vCenter Server 8.0U2

VMware vCenter Server 8.0U1

vCenter Server 8.0 GA

 

 

Cause

In vCenter below 8.0U3, when a Shallow rekey is performed on a vSAN encrypted Cluster,

vCenter records the result value as None and the vSAN Host value is recorded as False

 

Since the Shallow Rekey was performed while vCenter was on a Version below 8.0U3, followed by upgrading it to 8.0U3,

the None value carries over resulting in a false positive. 

Resolution

Clicking on the "Remediate inconsistent configuration" in the vSAN Health Service alert, will NOT resolve this issue nor will upgrading the cluster to 8.0U3.

This issue is resolved in vCenter 8.0U3e Build 24674346. 

It's not advised to suppress the vSAN Health Service alert.

 

Additional Information

vSAN Cluster Configuration Consistency

VMware vCenter Server 8.0 Update 3e Release Notes