Unable to configure Data-At-Rest encryption on 2-node cluster.

Products

• VMware vSAN

Issue/Introduction

vSAN cluster fails to configure Data-At-Rest encryption on 2-node vSAN cluster with following errors: 

• General vSAN error. Resource check failed - Retry operation after adding new disk group(s) of xxx GB of capacity on each node in the cluster. 
• Resource check failed - Cluster doesn't have enough resource. Sample failed object {failed Object}

Environment

vSAN 7.x

vSAN 8.x

Cause

Not enough resources in order to encrypt vSAN datastore with Data-At-Rest, due to policy and space required for full data evacuation. 

• vSAN Raid-1 policy will require 3 active nodes (2 nodes + witness) to be active in order to maintain a healthy object. 

Resolution

Ensure the: 'Allow reduced redundancy' flag is checked, when enabling Data-At-Rest encryption.

• By checking allow 'Allow reduced redundancy', this will allow a host to go into maintenance mode without a full data migration off the host and instead use a reduced state. 
• This also means, it does not require rebuilding the objects on another node before encrypting the drive [Faster]. 

 

Without this flag, vSAN will fail with this error on a 2-node cluster. This is due to needing '2 hosts + witness' for a healthy vSAN object. Where in a 2-node cluster, it will not achieve full data migration status under normal policy configuration with Raid-1. 

 

Additional Information

vSAN Data-At-Rest encryption tech doc:

• https://techdocs.broadcom.com/us/en/vmware-cis/vsan/vsan/7-0/vsan-adminstration-7-0/using-encryption-in-a-vsan-cluster-1/vsan-data-at-rest-encryption.html