Enforce incompatibility of SPBM

[lucasbernadsky]

Hi, in our Virtual DC environment we have 3 vSAN clusters. One of those is a streched clusters and the other ones are Single Site clusters.

We need to prevent all users to assign storage policies with primary FTT = 0 in streched cluster. As these clusters are in the same vCenter, the policies are availabile on all datastores and clusters.

Is there any way to enforce the incompatibility of the storage policies in vSAN streched datastore, or to add any kind of warning before applying a Single cluster storage policy to a VM in the streched one?

[TheBobkin]

Hello Lucas,

"We need to prevent all users to assign storage policies with primary FTT = 0 in streched cluster."

If you need to prevent users from using a type of Storage Policy then you would need to 1. Not have such policies available for selection and 2. Limit permissions to prevent users from just creating such policies and then using them.

"As these clusters are in the same vCenter, the policies are availabile on all datastores and clusters."

This doesn't mean they will all be usable by all cluster types - if you for instance create a Storage Policy with any of the 'Site Disaster Tolerance' types that say 'Stretched-Cluster' it will show non-stretched vsanDatastores as Incompatible (because they don't have exactly 2 Fault-Domains + a Witness).

Bob

[lucasbernadsky]

Thanks, bob. We need to make sure that the storage policies without site failure tolerance appear as "not compatible" or show a message or doesn't appear as an option for streched clusters.

Do you know a way of achieving this?

[TheBobkin · Accepted solution]

Hello Lucas,

No, there is no way to configure that in the manner you suggest as a FTT=0 Storage Policy only requires a single node for component placement and thus will show as compatible with literally any vSAN cluster (even one with just a single available node).

The only way that I am aware of to prevent users from creating and/or using a FTT=0 Storage Policy is to prevent these actions from being possible by removing the permissions to do so in vCenter.

Bob

[depping]

We don't have the capability as bob said, but I will add it to our ideas portal as I feel it is a valid request for sure.

[lucasbernadsky]

Thanks Duncan. It's really good to be heard and keep seeing how VSAN is growing.

[lucasbernadsky]

Thanks, Bob. That's what I was thinking, it's a shame. Thanks for your answer and let's hope this will be added in newer versions