Unable to Create vSAN Data Protection - Protection Group on vSAN Client Cluster running vSAN 8.x

Products

• VMware vSAN

Issue/Introduction

 

In this setup, 
The vSAN ESA cluster comprises 8 hosts operating on ESXi 8.0 U3, providing the vSAN datastore to a client cluster. 
The client cluster includes 2 nodes running on ESXi 8.0 U3, with all the virtual machines stored in the vSAN datastore. 
vSAN Data protection is 9.0.1 version and combined appliance VLR version is 9.0.4. 
Creating vSAN Data Protection—protection group on VMs from the vSAN cluster with 8 nodes succeeds.
Creating vSAN Data Protection—protection group on VMs from a client cluster fails with 'General vSAN error'. 

/var/log/vmware/snap-service.log
{"level":"error","timestamp":"2025-12-17T22:17:56.341Z","C":"vsan/protection.go:785","message":"Task to enable snapshot service config failed","opID":"69414327","taskInfo":null,"error":"ServerFaultCode: General vSAN error.","S":"gitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/server/vsphere/vsan.Vsan.EnableSnapshotServiceConfig\n\t/build/mts/release/bora-24920695/snapservice/pkg/server/vsphere/vsan/protection.go:785\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/vcenter.EnableDpsAndSnapshotService\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/vcenter/configuration.go:51\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/vcenter.EnableProtectionAndSnapshotService\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/vcenter/configuration.go:24\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/vcenter.EnableDpsAndSnapServiceConfigIfRequired\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/vcenter/configuration.go:119\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/clusters.CreateProtectionGroup\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/clusters/protection_groups.go:92\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/controller/clusters.ProtectionGroupsImpl.Create.func1\n\t/build/mts/release/bora-24920695/snapservice/pkg/controller/clusters/ProtectionGroupsImpl.go:87\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/tasks.(*ExecutorImpl).execute\n\t/build/mts/release/bora-24920695/snapservice/pkg/tasks/executor.go:125"}
{"level":"error","timestamp":"2025-12-17T22:17:56.341Z","C":"vcenter/configuration.go:53","message":"Failed to enable snapshot service","cluster":"domain-c#####","error":"ServerFaultCode: General vSAN error.","S":"gitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/vcenter.EnableDpsAndSnapshotService\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/vcenter/configuration.go:53\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/vcenter.EnableProtectionAndSnapshotService\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/vcenter/configuration.go:24\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/vcenter.EnableDpsAndSnapServiceConfigIfRequired\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/vcenter/configuration.go:119\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/clusters.CreateProtectionGroup\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/clusters/protection_groups.go:92\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/controller/clusters.ProtectionGroupsImpl.Create.func1\n\t/build/mts/release/bora-24920695/snapservice/pkg/controller/clusters/ProtectionGroupsImpl.go:87\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/tasks.(*ExecutorImpl).execute\n\t/build/mts/release/bora-24920695/snapservice/pkg/tasks/executor.go:125"}
{"level":"error","timestamp":"2025-12-17T22:17:56.341Z","C":"clusters/protection_groups.go:96","message":"Failed to enable protection or snapshot service","opID":"69414327","error":"com.vmware.vapi.std.errors.error","S":"gitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/service/clusters.CreateProtectionGroup\n\t/build/mts/release/bora-24920695/snapservice/pkg/service/clusters/protection_groups.go:96\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/controller/clusters.ProtectionGroupsImpl.Create.func1\n\t/build/mts/release/bora-24920695/snapservice/pkg/controller/clusters/ProtectionGroupsImpl.go:87\ngitlab.eng.vmware.com/core-build/vsan_snapshot_service/pkg/tasks.(*ExecutorImpl).execute\n\t/build/mts/release/bora-24920695/snapservice/pkg/tasks/executor.go:125"}

 

/var/log/vmware/vsan-health/vmware-vsan-health-service.log indicated the compute cluster is not supported when enabling snapshot service in vsan:
```
2025-12-17T22:17:56.340Z INFO vsan-mgmt[07350] [VsanVcClusterConfigSystemImpl::EagerPreCheck opID=snapservice-69414327-53e5] Operation ConfigureSnapServiceOperation(isCritical=True) is relevant
2025-12-17T22:17:56.340Z ERROR vsan-mgmt[07350] [VsanVcClusterConfigSystemImpl::EagerPreCheck opID=snapservice-69414327-53e5] Operation: ConfigureSnapServiceOperation(isCritical=True) and spec: (vim.vsan.ReconfigSpec) {
  modify = true,
  snapServiceConfig = (vim.vsan.SnapServiceConfig) {
    enabled = true
  }
} are NOT supported when vSAN compute client is enabled or enabling
2025-12-17T22:17:56.340Z ERROR vsan-mgmt[07350] [VsanVcClusterConfigSystemImpl::ReconfigureEx opID=snapservice-69414327-53e5] Cluster reconfig pre check failed: (vim.fault.VsanFault) {
  faultMessage = (vmodl.LocalizableMessage) [
    (vmodl.LocalizableMessage) {
      key = 'com.vmware.vsan.clustermgmt.reconfig.msg.specnotsupportscomputeclient',
      arg = (vmodl.KeyAnyValue) [
        (vmodl.KeyAnyValue) {
          key = 'spec',
          value = '(vim.vsan.ReconfigSpec) {\n  modify = true,\n  snapServiceConfig = (vim.vsan.SnapServiceConfig) {\n    enabled = true\n  }\n}'

Environment

vSAN ESA 8.x
vSAN DP 9.0.x

Cause

vSAN Data Protection 9.0.x does not support this operation on vSAN/vCenter 8.0.3.

Resolution

To configure vSAN Data Protection on a compute cluster, upgrade vSAN/vCenter to 9.0.x version

Additional Information

1. vSAN Data Protection appliance 8.0.3 only supports vSAN ESA cluster.

2. vSAN Data Protection 9.0.3 and later, support compute cluster along with vSAN ESA cluster provided ESXi/VC are version 9.
9.0.4, page 12:  https://techdocs.broadcom.com/content/dam/broadcom/techdocs/us/en/pdf/vmware/live-recovery/vsan-data-protection/vsan-data-protection-9-0-4.pdf
9.0.3 page 13: https://techdocs.broadcom.com/content/dam/broadcom/techdocs/us/en/pdf/vmware/live-recovery/vsan-data-protection/vsan-data-protection-9-0-3.pdf