vSAN 2-node patching

[mutthu]

Spoiler

I usually patch the ESXI host with VUM/ manually, just put the ESXI host n maintenance mode, apply the patches, then give a reboot.
We have a 2-node vSAN ready node from Dell, and I would appreciate t if someone explained how to patch the vSAN without breaking anything.

[stadi13]

Hi @mutthu 

you will find your answer here: https://images.core.vmware.com/sites/default/files/resource/vsan_2-node_cluster_guide_noindex.pdf#pa...

I recommend using vLCM with vSphere 7

“Updates using vLCM
vSphere Lifecycle Manager (vLCM) is a solution for unified software and firmware lifecycle management. vLCM is enhanced with firmware support for Lenovo ReadyNodes, awareness of vSAN stretched cluster, 2 Node cluster, and fault domain configurations, additional hardware compatibility pre-checks, and increased scalability for concurrent cluster operations.
In vSAN 7 Update 3, vLCM supports topologies that use dedicated witness host appliances. Both 2-node and stretched cluster environments can be managed and updated by the vLCM, guaranteeing a consistent, desired state of all hosts participating in a cluster using these topologies. It also performs updates in the recommended order for easy cluster upgrades.“

Regards Daniel

Please mark as resolved when solved 😉

[Tibmeister]

In a nutshell, you will always upgrade your shared witness first, then the nodes, if you are on vSAN 7.0 U1 or above.  The version of vSAN is extremely important (version you are currently on) because that changes the way the upgrade works.

Basically, what I do, being on ESXi/vSAN 7.0 U2c, is I have a second shared witness that will get upgraded/replaced, then I will change the witness for the cluster I am upgrading and then upgrade the hosts.  Once the first 2-node cluster is done, for the remaining 2-node clusters (I have several), I will simply change the witness to the upgraded one and then update the hosts.  At this point, the on-disk format has not been touched, very important.

Once all clusters are updated, I can update the on-disk format of the hosts and the first witness can either be updated/replaced or discarded.  I typically keep two witnesses running at all times, and when everything's upgraded both witnesses are at the same version.

Now, prior to vSAN 7.0 U3, you have to deploy a new witness appliance, whereas newer versions can be upgraded directly from vLCM in-place.  Also, and this is critical, do not update the on-disk versions of any 2-node cluster until all clusters attached to the shared witness have been upgraded, not before.  I cannot stress this enough about the on-disk format.

Here's a great link if you are going from vSAN 7.0 U1 to 7.0 U2.  Since I am already on vSAN 7.0 U2, I already have the shared witness so that parts done.  Otherwise, you will need to deploy a new appliance to become the shared witness, then migrate to it.  The link has details on all that.

Upgrading vSAN 2-node Clusters with a Shared Witness from 7U1 to 7U2 | VMware

[Tibmeister]

Actually slight correction to above, upgrade the witness last, and then after the witness and hosts are all upgraded, upgrade the on-disk format.

[mutthu]

I have a 2-Node vSAN 6.7 clusters. I now have to upgrade to version 7.
Should I upgrade first the ESXi hosts in the cluster, then deploy a version 7 witness and change the witness?

[Tibmeister]

You can deploy a new witness first and have it ready, you don’t have to wait for that. 

[TheBobkin]

Just to add to what @Tibmeister said: if you are just deploying a new Witness of version 7.0 then don't try switching them out until the data-nodes have been updated to 7.0 or it likely won't work (Failed to promote CMMDS issue).

[mutthu]

I will have to use Dell's iso for the ESXi upgrade. The witness version download will be from VMware. I believe the ESXi host and the witness will not be the same build initially, but all will be version 7.0
Does it matter?

[TheBobkin]

@mutthu As long as they are on the same major version (e.g. don't mix 7.0 U1 and 7.0 U2) it should be fine, you can then update it to the exact same build using an ESXi patch image (don't use vendor-specific one, just plain VMware ESXi one).