Are multiple Witness appliances on single host supported?

[RockwellM]

I'm working on a design that includes two (8)-node VSAN 6.2 Stretched Clusters and a 2-Node ROBO MGMT cluster.

Assuming it resides in a 3rd site and is sized properly with required number of vNICs, disks, cores, etc., can a single physical ESXi host support the (3) Witness OVA appliances that each cluster will require?  (2 "Normal" and 1 "Tiny")

If so, what are the possible downsides to this design beyond scale?  It's unclear to me what would happen in the event of a host failure in this case.

Many thanks for your assistance.

[perthorn]

This is supported although not a very good design. The witness appliances are just VMs, as long as you have enough resources you can run 3 of them on the same ESXi host. The problem with this design is that all of the sites are dependent on one single host. If that host fails all of the witnesses will go down, which is treated as a lost failure domain in each of the 3 vSAN environments. All of the VM in each of the 3 vSAN clusters will then be vulnerable to failure. As each cluster only has 2 failure domains in addition to the witness appliance, none of the objects can be rebuilt, and will stay vulnerable as long as the witness appliances are down (there won't be another failure domain to rebuild them on). Remember that each of these vSAN clusters in effect only have 2 failure domains plus the witness appliance (they basically work as clusters with 3 hosts). I strongly suggest that you have at least 2 hosts to avoid single points of failure. You could also possibly run the witness appliances on the other vSAN clusters as well.

[RockwellM]

Thank you for your reply.   While your logic is certainly sound, I've never read anything in the "VSAN 6.2 Stretched or ROBO Cluster Guide" that states the Witness needs to be highly available.   It was my original intent to deploy the Witness for any one of the 3 VSAN clusters to either of the other two but was told that this was unsupported.   That being the case and assuming operational feasibility, it does make sense to have a second "spare" ESXi host to take on those Witnesses in the event of a hardware failure.

[perthorn]

I agree, you don't need to make the witness appliance highly available, I assume it will be supported anyway. The question is just to be aware of the implications and risks of the design decision to keep all the witnesses on one ESXi host. For example, if the witness host goes down, all your VMs in all three clusters will stop being protected (as the max protection you can achieve in any of your clusters is FTT=1), and they will stay unprotected until you managed to get the host (and all the witnesses) back up again. If no one were around to fix it or if you needed to order hardware to get the host back up, the VMs might stay unprotected for a long time. If you for instance had any disk failure on any of the hosts in any of the vSAN clusters at this time, some vSAN objects would most likely be unavailable and the VMs would go down. Having a spare host would definitely help mitigate against this problem, as you could possibly manually move the witnesses on this host, but it will obviously require someone to do this. Having the witnesses in an HA cluster would mitigate against the problem of no one being around to do the manual task.

I'm surprised that the witnesses are unsupported on the other ROBO or stretched clusters. These are just critical VMs running in a vSphere cluster, and have nothing to do with the clusters they run in. I would almost think that whoever said it was unsupported assumed that you would run the witness appliance in the same vSAN cluster that the witness is part of (I assume that would be unsupported). I'm not sure about this though and accept that VMware explicitly might have made this unsupported, might be worth double checking though.