{"id":4011,"date":"2018-07-05T17:12:41","date_gmt":"2018-07-05T22:12:41","guid":{"rendered":"http:\/\/www.jasemccarty.com\/blog\/?p=4011"},"modified":"2020-02-16T17:13:56","modified_gmt":"2020-02-16T23:13:56","slug":"witness-membership-versioning-hosting","status":"publish","type":"post","link":"https:\/\/www.jasemccarty.com\/blog\/witness-membership-versioning-hosting\/","title":{"rendered":"Understanding the vSAN Witness Appliance \u2013 Cluster Membership, Versioning, and Hosting"},"content":{"rendered":"<p>The vSAN Witness Appliance virtual machine provides a virtualized ESXi host that acts as a tie breaker for vSAN Stretched Cluster and 2 Node configurations. Some common questions come up around not only which version of the vSAN Witness Appliance should be used, but what version the vSAN Witness Appliance should be run on.<\/p>\n<h3>vSAN Witness Appliance<\/h3>\n<p><strong>A few definitions first<br \/>\n<\/strong>With a few different items having &#8220;vSAN Witness&#8221; in their naming, this can get a bit confusing, so let&#8217;s clarify what each of these are, and what their role is.<\/p>\n<ul>\n<li><strong>vSAN Witness Appliance<\/strong> &#8211; A free virtual appliance provided by VMware for use with Stretched Cluster or 2 Node vSAN configurations<\/li>\n<li><strong>vSAN Witness Host<\/strong> &#8211; Either a physical ESXi system, or the vSAN Witness Appliance, being used to store tie-breaker metadata for a Stretched Cluster or 2 Node vSAN configuration<\/li>\n<li><strong>vSAN Witness Component<\/strong> &#8211; A vSAN metadata component that is a used as tie breaker metadata for vSAN data components that reside on different fault domains or hosts.<\/li>\n<\/ul>\n<p>It is important to understand their differences when deploying, configuring, or managing Stretched Cluster or 2 Node vSAN configurations.<\/p>\n<h3>Cluster Membership<\/h3>\n<p>vSAN Stretched Clusters, and 2 Node vSAN, require a <strong>vSAN Witness Host<\/strong> that &#8220;participates&#8221; in the vSAN Cluster. Participates is in quotes, because the <strong>vSAN Witness Host<\/strong> is not a traditional member of the cluster, and is <em>only a vSAN Cluster member, not a vSphere Cluster member<\/em>.<\/p>\n<p><a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WH1-e1530919639490.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12370 size-full\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WH1-e1530919639490.png\" alt=\"Witness Appliance\" width=\"600\" height=\"359\" \/><\/a><\/p>\n<p>The general recommendation is to place the <strong>vSAN Witness Host<\/strong> in a different datacenter, such as Witness-Datacenter shown in the illustration above.<\/p>\n<p>Notice that the <strong>vSAN Witness Host<\/strong> is not a member of the <b>vSphere Cluster <\/b>named Remote-Cluster.<\/p>\n<p>Looking at the disk management UI of the vSAN configuration of Remote-Cluster, the disk group from the <strong>vSAN Witness Host<\/strong> is a contributing vSAN cluster member:<a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WH1A.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12371 size-full\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WH1A-e1530919702866.png\" alt=\"Witness Appliance\" width=\"600\" height=\"298\" \/><\/a><\/p>\n<p><strong>*Very important note: <\/strong><em>Do not attempt to make a cluster out of multiple vSAN Witness Hosts.<\/em> They cannot be members of a vSphere Cluster.<\/p>\n<p>If there is a need to &#8220;organize&#8221; vSAN Witness Hosts, use the Folder capability in the vSphere Client to organize them. <strong>Do not<\/strong> include them in a vSphere Cluster.<br \/>\n<a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITNESS-ORGANIZATION.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-14098\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITNESS-ORGANIZATION-1024x667.png\" alt=\"\" width=\"500\" height=\"325\" srcset=\"https:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITNESS-ORGANIZATION-1024x667.png 1024w, https:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITNESS-ORGANIZATION-220x143.png 220w, https:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITNESS-ORGANIZATION-768x500.png 768w, https:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITNESS-ORGANIZATION-290x190.png 290w, https:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITNESS-ORGANIZATION.png 1083w\" sizes=\"auto, (max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>Notice that vSAN Witness Host &#8220;witness3.demo.local&#8221; is part of a vSphere Cluster. This is not supported.<\/p>\n<p>Adding a vSAN Witness Host to a vSphere Cluster <span style=\"color: #ff0000;\"><em>will require you to redeploy that vSAN Witness Host<\/em><\/span>.<\/p>\n<h3><strong><br \/>\n<\/strong>Versioning<\/h3>\n<p>Closer inspection of this sample 2 Node cluster shows that the data nodes are the same build, which is a recommended\/supported configuration.<\/p>\n<p><a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/ESXIBUILD1-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12377 size-full\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/ESXIBUILD1-1-e1530919750747.png\" alt=\"Witness Appliance\" width=\"600\" height=\"129\" \/><\/a><\/p>\n<p>Although the <strong>vSAN Witness Host<\/strong> is not part of the vSphere Cluster, it is <em>contributing disks to the vSAN Cluster<\/em>. Because the <strong>vSAN Witness Host<\/strong> is contributing to vSAN, it is <em><strong>strenuously recommended<\/strong><\/em> to be the same build as the vSAN Data Nodes. It is generally <em><strong>required<\/strong><\/em> to be the same release of vSAN.<\/p>\n<p><a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITBUILD.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12378 size-full\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WITBUILD-e1530919779572.png\" alt=\"Witness Appliance\" width=\"600\" height=\"135\" \/><\/a><\/p>\n<p>It is important to remember, that the <strong>vSAN Witness Host<\/strong> is an ESXi instance. Whether it is physical or virtual, <strong><em>it is patched the same as any other ESXi host<\/em><\/strong>.<\/p>\n<p>Repeating that last statement for clarity: &#8220;<span style=\"color: #008000;\"><strong>Whether it is physical or virtual, the vSAN Witness Host is patched the same fashion as any other ESXi host.<\/strong><\/span>&#8221;<\/p>\n<p>The illustrations above have only addressed the context of the <strong>vSAN Witness Host<\/strong> (which could be physical or virtual), and not the <strong>vSAN Witness Appliance<\/strong>.<\/p>\n<p><a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WH2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12383 size-full\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WH2-e1530919812689.png\" alt=\"Witness Appliance\" width=\"600\" height=\"358\" \/><\/a><\/p>\n<p>Notice in the above illustration that the virtual machine <strong>WITNESS67<\/strong> is running on <strong>host0.demo.local<\/strong>. This is the <strong>vSAN Witness Appliance<\/strong> that is provided by VMware for free.<\/p>\n<p>This virtual machine has ESXi installed for use as a tie-breaker for the <strong>Remote-Cluster<\/strong> vSAN Cluster.<\/p>\n<p>Its ESXi Guest OS is configured as <strong>witness.demo.central<\/strong>. The &#8220;virtual ESXi&#8221; is attached to the vCenter server. To vCenter, <strong>witness.demo.local<\/strong> appears (<em>mostly<\/em>) to be like any other ESXi installation.<\/p>\n<p>&nbsp;<\/p>\n<h3>Hosting the vSAN Witness Appliance<\/h3>\n<p>The guidance thus far has been that any vSphere 5.5 host, regardless of licensed edition, may be used for hosting a <strong>vSAN Witness Appliance<\/strong>. This is stated in the <a href=\"https:\/\/storagehub.vmware.com\/t\/vmware-vsan\/vsan-stretched-cluster-2-node-guide\/\" target=\"_blank\" rel=\"noopener noreferrer\">Stretched Cluster and 2 Node Guide<\/a> on <a href=\"https:\/\/storagehub.vmware.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">storageHub.vmware.com<\/a>. This remains true today.<\/p>\n<p>The <strong>vSAN Witness Appliance<\/strong> is generally supported on:<\/p>\n<ul>\n<li>Any on-premises or cloud hosted configuration provided appropriate connectivity is in place*.\n<ul>\n<li>Any licensed edition of vSphere 5.5 or higher<\/li>\n<li>Any Free vSphere Hypervisor 5.5 or higher<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>*Refer to the Stretched Cluster and 2 Node Guide for more information around connectivity requirements.<\/p>\n<p>With the release of vSphere 6.7 there are some new CPU requirements though, as vSphere 6.7 does not support the same list of CPUs as vSphere 5.5, 6.0, or 6.5. The <a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/6.7\/rn\/vsphere-esxi-vcenter-server-67-release-notes.html\" target=\"_blank\" rel=\"noopener noreferrer\">vSphere 6.7 Release Notes<\/a> detail CPUs that are no longer supported in vSphere 6.7.<\/p>\n<p>In cases where the <strong>vSAN Witness Appliance<\/strong> is used for a vSAN 6.7 Stretched Cluster or 2 Node configuration, the vSphere Host&#8217;s CPU must also be supported by vSphere 6.7, regardless of the build of ESXi running on the vSphere Host.<\/p>\n<p>Consider <strong>host3.demo.local<\/strong> which has a CPU that is <span style=\"color: #ff0000;\"><strong>not<\/strong><\/span> supported by vSphere 6.7. This host is running vSphere 6.5. It is still possible to <em>deploy<\/em> a <strong>vSAN Witness Appliance<\/strong> for vSAN 6.7 to a host that <span style=\"color: #ff0000;\"><strong>does not meet the requirements<\/strong><\/span> of vSphere 6.7.<\/p>\n<p><a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/T300.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12391 size-full\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/T300-e1530919861610.png\" alt=\"Witness Appliance\" width=\"600\" height=\"230\" \/><\/a><\/p>\n<p>However, after deploying a new <strong>vSAN Witness Appliance<\/strong> for vSAN 6.7 to this host, and attempting to power it on, it can be seen that it is <strong><span style=\"color: #ff0000;\">not allowed to boot<\/span><\/strong>.<\/p>\n<p><a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WH3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12392 size-full\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/WH3-e1530919889312.png\" alt=\"Witness Appliance\" width=\"600\" height=\"127\" \/><\/a><\/p>\n<p>Also, when attempting to patch\/upgrade a previously deployed <strong>WITNESS65 <\/strong>(witness65.demo.central), which happens to be running on <strong>host3.demo.local<\/strong> it can be seen that it <strong><span style=\"color: #ff0000;\">cannot<\/span><\/strong> be upgraded to vSphere 6.7.<\/p>\n<p><a href=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/VSWA-INCOMPAT.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12393 size-full\" src=\"http:\/\/blogs.vmware.com\/virtualblocks\/files\/2018\/07\/VSWA-INCOMPAT-e1530919922928.png\" alt=\"Witness Appliance\" width=\"600\" height=\"371\" \/><\/a><\/p>\n<p>This is because the host <strong>host3.demo.local<\/strong> does not have a CPU compatible with vSphere 6.7.<\/p>\n<p>To successfully upgrade <strong>witness65.demo.central<\/strong>, the <strong>vSAN Witness Appliance <\/strong>(named <strong>WITNESS65<\/strong>) would have to be moved to a host that is compatible with vSphere 6.7.<\/p>\n<p>&nbsp;<\/p>\n<h3>Summing it all up<\/h3>\n<ul>\n<li>vSAN Stretched Clusters and 2 Node configurations require a <strong>vSAN Witness Host.<\/strong>\n<ul>\n<li>This can be a physical host<\/li>\n<li>This can be the <strong>vSAN Witness Appliance<\/strong>, a virtualized ESXi host, provided by VMware for free.<\/li>\n<\/ul>\n<\/li>\n<li>A <strong>vSAN Witness Host<\/strong> should be the same build as the vSAN Stretched Cluster or 2 Node Configuration it is supporting\n<ul>\n<li>This does not matter whether the <strong>vSAN Witness Host <\/strong>is physical or virtual.<\/li>\n<li>Update the <strong>vSAN Witness Host<\/strong> (physical or virtual) to the same build as the vSAN Data Nodes using VMware Update Manager or other approved method.<\/li>\n<li>If using the <strong>vSAN Witness Appliance<\/strong> (virtual), the location it runs on <strong>does not have to be the same build<\/strong> of ESXi.\n<ul>\n<li>Example: A vSphere Cluster running vSphere 6.0 can run a vSAN Witness Appliance that has ESXi 6.5 installed &#8220;inside it&#8221;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>The <strong>vSAN Witness Host<\/strong> must have a CPU that is supported by the version of vSAN it is supporting\n<ul>\n<li>If using a physical host, the CPU must be supported by the build of vSphere being used<\/li>\n<li>If using a <strong>vSAN Witness Appliance<\/strong>, regardless of the vSphere Host build it is being run on, ensure the vSphere Host CPU meets the requirements of the vSAN build it is supporting.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>This was originally posted on the VMware Virtual Blocks site: https:\/\/blogs.vmware.com\/virtualblocks\/2018\/07\/05\/witness-membership-versioning-hosting\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The vSAN Witness Appliance virtual machine provides a virtualized ESXi host that acts as a tie breaker for vSAN Stretched Cluster and 2 Node configurations. &hellip; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4011","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/posts\/4011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/comments?post=4011"}],"version-history":[{"count":3,"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/posts\/4011\/revisions"}],"predecessor-version":[{"id":4014,"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/posts\/4011\/revisions\/4014"}],"wp:attachment":[{"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/media?parent=4011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/categories?post=4011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jasemccarty.com\/blog\/wp-json\/wp\/v2\/tags?post=4011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}