The sixth generation of vSAN, vSAN 6.6 brings in lot of new features and contribute to Higher Security, Lower Costs and Improved Performance. vSAN storage devices are fully integrated with Photon platform API management. Let’s now go through all the new features in this release.
VSAN now has an optional data-at-rest encryption to improve security. vSAN enryption uses AES 256 cipher and is hardware independent and thus does’nt stop one from using encryption feature on existing hardware and no self encryting devices are needed. However, you would need a Key Management Server(KMS) to enable the encrytion.
A vSAN datastore comprises of both capacity and cache tier, and encryption is performed on the datastore level and thus all the vsan objects are encrypted before they are written to persistent disks and all this awesomeness can be done from web client.
Enabling encrytion can be done on vsanDatastores with or without VMs running, however a rolling reformat is required for this to complete and depending on the amount of data present this may take longer. Disabling encrytion also needs a rolling reformat and takes more time than it took for disabling. Point to keep in mind.
Older versions of vSAN needed a bit of research and calling VMware support sometimes to check the compatibility of hardware with new release and vSphere updates had to be done manually, but now all this can be done using our favourite Update Manager. Health Checks take care of checking the hardware compatibility and also provides suggestions if there are any upgrades available to vSAN. There is no downtime needed and VM’s are migrated off of host and is placed in maintenance mode during the updates.
Health Checks Improvements
Older versions of vSAN required vC and webclient service running to check the Health of the vSAN cluster, now with version 6.6, we can monitor the vSAN health using the native Host Client and any host in the cluster can be used for this.
Health Checks now include verifying the storage device controllers, queue depths and many more, and now Alerting has been enabled for encryption, disk health, network and disk balancing.
vROPS Pack for vSAN
vSAN now seamlessily integrates with vROPS adn hence more insights and recommendations are made by vROPS for the vSAN workloads.
Easy replacing of Witness Host for 2 Node and Stretched Clusters
In case of failure of Witness Host (or host running witness appliance), the amount of time for which the vSAN cluster has to run without a Witness Host is greatly reduced and a new host can be selected using the Change Witness Host option in the Fault Domains section.
vSAN is now included with pre-checks which are very useful when evacuating hosts of removing disk groups. This functionality is included into the maintenance mode operation. This greatly reduces the risk.
Unicast All Over
Multicast dependency has been removed in this version of vSAN, however, when upgrading the current vSAN, multicast is needed untill the cluster is on 6.6 and after that vSAN changes to unicast after the upgrade. If the on disk format is not upgraded to 5 and old version of host is added to cluster, multicast is used. If on disk format is 5 and old version of host is added, the newly added host still uses multicast and is seperated logically
For worloads running on Stretched Clusters and have the built in replication capability, the VM can be configured with Site Affinity reducing the storage used on the other site, this has to be configured using the storage policy
Local Failure Protection
In case of a local failure, we can now configure worloads with storage policy enabling them to have a RAID 1 mirroring or RAID 5/6 coding within a site. The options for this are Primary level of failures to tolerate (across sites) and Secondary level failures to tolerate (within site) and Fault Tolerance methos determines the RAID 1 or RAID 5/6
Intelligent Component Rebuild
In cases where vSAN has to do a copy of data either to create a secondary copy of objects or in case of failure, VSAN network is used for this and can cause throttle, to avoid this in version 6.6, the rebuild waits for an hour to actually copy the data. After 60 minutes, the pre 6.6 versions used to copy the entire data even if the absent components come online . With 6.6 only copy if the components data needs update. Resync operations in prior versions of vSAN is entire controlled my vSAN, this can now be controlled by administrators by adjusting the throughput.
Hope this was informative. Thanks!