Cluster Configuration Consistency warning on skyline health for Disk Encryption Mismatch - VMware vSAN

Products

• VMware vSAN
• VMware Cloud Foundation
• VMware vSphere ESXi

Issue/Introduction

In the vSAN Skyline Health dashboard, the vSAN Cluster Configuration Consistency health check reports a red status. This article applies to both of the following error messages:

Issue: Disk is not encrypted. but encryption is enabled on cluster

Disk is encrypted, but encryption is disabled on cluster.

• Data-at-Rest encryption is enabled at the cluster level. However, encryption status show disabled on vSAN disks on one or more hosts.

• Data-at-Rest encryption is disabled on the cluster. However, one or more disk/disk groups on hosts may show as encrypted.

• Post enabling or disabling Data-at-Rest encryption on vSAN clusters, the warnings may appear under skyline health.

Environment

• Product: VMware Cloud Foundation 5 (all builds) / VMware vSAN 8.0 (all builds)
• Configuration: vSAN OSA / vSAN ESA

Cause

This inconsistency is caused by a synchronization gap between the cluster and host level settings. May occur in the following situations:

• vSAN data-at-rest encryption task did not complete successfully where the cluster has the encryption enabled. However, the disks were not formatted.

• During the disk group initialization process if a disk group is created on a host before the host has fully synchronized the cluster-wide encryption policy from vCenter, the vSAN management service may format the new disks without encryption.

• After host addition or update where scripted tools or profiles enable or disable the encryption setting.

• This results in a persistent configuration mismatch between the cluster’s required state and the host’s local disk state.

Resolution

To resolve this issue, the host and vCenter settings must match, and any affected disk group must be recreated to force the inheritance of the cluster-level encryption policy.

1. Validate KMS servers are connected on vCenter and trusted.

2. Ensure a valid backup of all virtual machines residing on the vSAN datastore.

3. Verify that the cluster has sufficient slack space to evacuate data from the impacted host.

4. Hosts setting for IgnoreClusterMemberListUpdates should be false. Verify using command esxcfg-advcfg -g /VSAN/IgnoreClusterMemberListUpdates. If the result is '1', change it to '0' using command esxcfg-advcfg -s 0 /VSAN/IgnoreClusterMemberListUpdates

5. From the skyline health warning, click the remediation button to remediate inconsistent encryption configuration. REMEDIATE INCONSISTENT CONFIGURATION