vVols User Guide: The FlashArray VASA Provider
The FlashArray VASA Provider
VMware's vSphere APIs for Storage Awareness (VASA) is a VMware interface for out-of-band communication between VMware ESXi and vCenter and storage arrays. The Arrays’ VASA providers are services registered with the vCenter Server. Storage vendors implement providers for their arrays, either as VMs or embedded in the arrays. As of vSphere Version 7.0 U1, VMware has introduced four versions of VASA:
- Version 1 (Introduced in vSphere Version 5.0)
- Provides basic configuration information for storage volumes hosting VMFS datastores, as well as injection of some basic alerts into vCenter
- Version 2 (Introduced in vSphere Version 6.0)
- First version to support vVols
- Version 3 (Introduced in vSphere Version 6.5)
- Added support for array-based replication of vVols and Oracle RAC.
- Version 3.5 (Introduced in vSphere Version 7.0 U1)
- Added additional feature support for improved bitmap operation performance and iSCSI CHAP.
The Pure Storage FlashArray supports VASA Version 3 with Purity//FA 5.0.0 through Purity//FA 6.1.5.
Starting with Purity//FA 6.1.6 and Pure VASA version 1.2.0 support was added for bitmap hint with VASA 3.5.
Because the FlashArray vVol implementation uses VASA Version 3, the VMware environment must be running vSphere Version 6.5 or a newer version in both ESXi hosts and vCenter.
Pure Storage does recommend running vSphere 6.7 U3 p03 or higher for the various fixes and improvements found in this release. Please see the KB that outlines VASA/vVols related fixes by ESXi release found here.
FlashArray vVol support is included in Purity//FA Version 5.0. The Purity//FA upgrade process automatically installs and configures a VASA provider in each controller; there is no separate installation or configuration. To use FlashArray-based vVols, however, an array’s VASA providers must be registered with vCenter. Either the FlashArray Plugin for vSphere Web Client (the Plugin), the vSphere GUI, or API/CLI-based tools may be used to register VASA providers with vCenter.
VASA Provider Certificate Management
The management of VASA Provider certificates is supported by the FlashArray with the release of Purity//FA 5.3 and VASA 1.1.0.
Please see the following KBs that detail the management of the the VASA Provider Certificates:
- Managing VASA Certificates with the purecert command
- How to configure non-linked multi vCenter Support for the FlashArray VASA Provider
Recommendation: Create Local vVol/VASA Admin if the FlashArray is on Purity 5.1+
One of Pure Storage's recommendations is to register the controllers VASA Providers with a local user on the array. This will help in a couple ways:
- Prevent any authentication issues in the event that the AD server is unreachable, the user that the storage providers is deleted/removed, or any other unexpected connectivity issues with the AD server.
- Keep the VASA audit history clear. Best practice is to never use the default array admin, pureuser, with any integration with the FlashArray.
Users are able to create local Array Admin, Storage Admin and Read Only users starting in Purity 5.1.0. The user will want to create a local Array Admin to register the array Storage Providers. Pure Storage found that the storage admin role does not have the full permissions that the VASA Provider requires in order to function correctly.
Here is an example of creating a local array admin to use when registering the storage provider.
From the FlashArray GUI, Navigate to Settings and then Users |
---|
![]() |
Then click on the triple dots in the users box and select "Create User..." |
---|
![]() |
Create a Array Admin user, for example naming it "vvol-admin" and giving it a super secure password. |
---|
![]() |
After the user is created, you will see it show up in the list with it's Role. Now you can use it to register your storage provider. |
---|
![]() |
Registering the FlashArray VASA Provider
There are multiple ways to register the FlashArray VASA Provider.
Registering FlashArray VASA Providers with the Pure Storage vSphere Plugin
Manually Registering the FlashArray VASA Providers with the vCenter UI
Alternatively, VMware administrators can use the vCenter Web Client, PowerCLI, and other CLI and API tools to register VASA providers. This section describes registration of FlashArray providers with the vCenter Web Client and with PowerCLI.
Finding the FlashArray Controller IP Addresses
Prior to registration, use the FlashArray GUI or CLI to obtain the IP addresses of both controllers’ eth0 management ports.
Click Settings in the GUI navigation pane, and select the Network tab to display the array’s management port IP addresses
![]() |
FlashArray GUI Network Tab - Management IP Addresses |
pureuser@sn1-x70-c05-33> purenetwork list ct0.eth0,ct1.eth0 Name Enabled Subnet Address Mask Gateway MTU MAC Speed Services Subinterfaces ct0.eth0 True - 10.21.149.22 255.255.255.0 10.21.149.1 1500 24:a9:37:01:f2:de 1.00 Gb/s management - ct1.eth0 True - 10.21.149.23 255.255.255.0 10.21.149.1 1500 24:a9:37:02:0b:8e 1.00 Gb/s management - |
FlashArray CLI - Management IP Addresses |
Registering the Storage Provider in vCenter
After the management IPs for the FlashArray are gathered head over to the vCenter UI and run through the following workflow to register the storage providers.
- Navigate to the either the Hosts/Datacenters, VMs, Storage or Network page.
- Select the vCenter Server to register the storage providers with.
- Navigate to the Configure and click Storage Providers under more.
- Click on the Add Button
- Register CT0's storage provider
Name
- A friendly name for the VASA provider. A best practice is to use names that make operational sense (for example, array name concatenated with controller number).
URL
- The URL of the controller’s VASA provider in the form: https://<controllerIP>:8084. HTTPS (not HTTP) is required, the controller’s IP address must be specified, unless a custom cert with a FQDN in the Subjective Alternative Name is used, and port 8084 is required
Credentials
- Credentials for an administrator of the target array. Best practice is to use a local array user and not the default user (pureuser).
The user name entered is associated with VASA operations in future audit logs.
- A friendly name for the VASA provider. A best practice is to use names that make operational sense (for example, array name concatenated with controller number).
- Register CT1's storage provider
Name
- A friendly name for the VASA provider. A best practice is to use names that make operational sense (for example, array name concatenated with controller number).
URL
- The URL of the controller’s VASA provider in the form: https://<controllerIP>:8084. HTTPS (not HTTP) is required, the controller’s IP address must be specified (not its FQDN), and port 8084 is required
Credentials
- Credentials for an administrator of the target array. Best practice is to use a local array user and not the default user (pureuser).
The user name entered is associated with VASA operations in future audit logs.
- A friendly name for the VASA provider. A best practice is to use names that make operational sense (for example, array name concatenated with controller number).
Please ensure that both CT0 and CT1's storage providers are registered.
Manually Registering the FlashArray VASA Providers with PowerShell
When a number of FlashArrays’ VASA providers are to be registered, using a PowerCLI script may be preferable. The VMware PowerCLI cmdlet called New-VasaProvider registers VASA providers with vCenter (vSphereView 6).
New-VasaProvider Cmdlet
New-VasaProvider -Name "MyProvider" -Username "UserName" -Password "Password" -Url "MyUrl" |
New-VasaProvider Cmdlet PowerShell Core Example
PS /Users/alex.carver> $vc_creds = Get-Credential PowerShell credential request Enter your credentials. User: purecloud\alex Password for user purecloud\alex: PS /Users/alex.carver> $vasa_creds = Get-Credential PowerShell credential request Enter your credentials. User: vvol-admin Password for user vvol-admin: PS /Users/alex.carver> connect-viserver -Server 10.21.202.95 -Credential $vc_creds Name Port User ---- ---- ---- 10.21.202.95 443 PURECLOUD\alex PS /Users/alex.carver> New-VasaProvider -Name 'sn1-x70-c05-36-ct0' -Credential $vasa_creds -Url 'https://10.21.149.22:8084' Name Status VasaVersion LastSyncTime Namespace Url ---- ------ ----------- ------------ --------- --- sn1-x70-c05-36-ct0 online 3.0 11/5/2020 1:28:50 PM com.purestorage https://10.21.149.22:8084 PS /Users/alex.carver> New-VasaProvider -Name 'sn1-x70-c05-36-ct1' -Credential $vasa_creds -Url 'https://10.21.149.23:8084' Name Status VasaVersion LastSyncTime Namespace Url ---- ------ ----------- ------------ --------- --- |
The output from registering ct1 is expected as ct1 will be the standby provider. Currently PowerCLI only displays the details on Active Storage Providers and not with standby providers.
An additional method with PowerShell would be the New-PfaVasaProvider cmdlet from the Pure Storage VMware PowerShell Module. This will require having the Pure Storage PowerShell SDK also installed, but will work with either PowerShell Core or PowerShell. A connection to a vCenter Server and FlashArray will be required to use the New-PfaVasaProvider cmdlet
New-PfaVasaProvider Cmdlet
New-PfaConnection -Endpoint "Management IP" -Credentials (Get-Credential) -DefaultArray -IgnoreCertificate New-PfaVasaProvider -Flasharray $Global:DefaultFlashArray -Credentials (Get-Credential) |
New-VasaProvider Cmdlet PowerShell Core Example
PS /Users/alex.carver> Install-Module -Name PureStoragePowerShellSDK PS /Users/alex.carver> PS /Users/alex.carver> Install-Module -Name PureStorage.FlashArray.VMware PS /Users/alex.carver> PS /Users/alex.carver> New-PfaConnection -Endpoint 10.21.149.21 -Credentials (Get-Credential) -DefaultArray -IgnoreCertificateError PowerShell credential request Enter your credentials. User: vvol-admin Password for user vvol-admin: Disposed : False EndPoint : 10.21.149.21 UserName : vvol-admin ApiVersion : 1.17 Role : ArrayAdmin ApiToken : 18e939a3 PS /Users/alex.carver> connect-viserver -Server 10.21.202.95 -Credential (Get-Credential) PowerShell credential request Enter your credentials. User: purecloud\alex Password for user purecloud\alex: Name Port User ---- ---- ---- 10.21.202.95 443 PURECLOUD\alex PS /Users/alex.carver> New-PfaVasaProvider -Flasharray $Global:DefaultFlashArray -Credentials (Get-Credential) PowerShell credential request Enter your credentials. User: vvol-admin Password for user vvol-admin: Name Status VasaVersion LastSyncTime Namespace Url ---- ------ ----------- ------------ --------- --- sn1-x70-c05-33-CT0 online 3.0 11/5/2020 5:06:10 PM com.purestorage https://10.21.149.22:8084 |
Verifying VASA Provider Registration
To verify that VASA Provider registration succeeded, in the Web Client Host and Clusters:
- Click the target vCenter in the inventory pane
- Select the Configure tab
- Locate the newly-registered providers in Storage Providers
![]() |
On the Storage Providers page there are some useful sections that display the information for the VASA Providers.
- The first column has the Storage Providers names that were used to register the storage providers. Additionally, the storage array that the VASA Provider is managing is listed below it, along with the number of online providers for that storage array.
- The Status column will list if the provider is online and accessible from vCenter.
- vCenter can only have a single Active storage provider for a given storage array. The Active/Standby column will display if the provider is the active or standby provider.
- The Certificate Expiry column displays how many days are left before the certificate expires for that storage provider. At 180 days a yellow warning will be displayed.
- After selecting a Storage Provider there are additional tabs and information that can be selected for that provider. The general tab will display all the basic information for the given storage provider. This is a very useful information tab.
Alternatively, the PowerCLI Get-VasaProvider cmdlet can be used to list registered VASA providers. The results can be filtered to just display the VASA Providers that belong to the Pure Storage namespace. Only the Active Storage providers are returned with this cmdlet.
PS /Users/alex.carver> Get-VasaProvider | Where-Object {$_.Namespace -eq 'com.purestorage'} Name Status VasaVersion LastSyncTime Namespace Url ---- ------ ----------- ------------ --------- --- sn1-x70-c05-33-ct0 online 3.0 11/5/2020 5:06:10 PM com.purestorage https://10.21.149.22:8084 sn1-x70-b05-33-ct0 online 3.0 10/23/2020 11:37:26 AM com.purestorage https://10.21.149.40:8084/version.… sn1-m20r2-c05-36-ct0 online 3.0 10/23/2020 11:37:26 AM com.purestorage https://10.21.149.61:8084/version.… |
Un-registering and Removing the Storage Providers
There are a couple ways to remove a storage provider in the event that the end user needs to remove and re-register a Storage Provider or simply wants to remove the storage providers. This can be done either from the vCenter Server UI or with PowerShell via PowerCLI.
Removing Storage Providers in the vCenter Server UI
Here is the workflow to remove the storage providers in the vCenter Server UI:
- Navigate to the vCenter Server -> Configure -> Storage Provider Page
- Select the Standby Storage Provider that is being removed and select remove and click yes to confirm the removal
- Repeat the steps for the active storage provider
Removing Storage Providers via PowerCLI
Here is the workflow to remove storage providers with PowerShell via PowerCLI:
- After connecting to the vCenter Server, find the storage provider and storage provider ID that needs to be removed and set a provider variable.
PS /Users/alex.carver> Get-VasaProvider | Where-Object {$_.Namespace -eq 'com.purestorage'} | Select-Object Name,Id Name Id ---- -- sn1-x70-b05-33-ct0 VasaProvider-vasaProvider-3 sn1-x70-c05-33-ct0 VasaProvider-vasaProvider-7 sn1-m20r2-c05-36-ct0 VasaProvider-vasaProvider-5 PS /Users/alex.carver> $provider = Get-VasaProvider -Id VasaProvider-vasaProvider-7 PS /Users/alex.carver> $provider Name Status VasaVersion LastSyncTime Namespace Url ---- ------ ----------- ------------ --------- --- sn1-x70-c05-33-ct0 online 3.0 11/5/2020 5:06:10 PM com.purestorage https://10.21.149.22:8084
- Remove the storage provider with Remove-VASAProvider with the provider variable.
PS /Users/alex.carver> Remove-VasaProvider -Provider $provider -confirm:$false PS /Users/alex.carver>
- Remove the same steps with the second storage provider
PS /Users/alex.carver> Get-VasaProvider | Where-Object {$_.Namespace -eq 'com.purestorage'} | Select-Object Name,Id Name Id ---- -- sn1-x70-b05-33-ct0 VasaProvider-vasaProvider-3 sn1-x70-c05-33-ct1 VasaProvider-vasaProvider-8 sn1-m20r2-c05-36-ct0 VasaProvider-vasaProvider-5 PS /Users/alex.carver> $provider = Get-VasaProvider -Id VasaProvider-vasaProvider-8 PS /Users/alex.carver> $provider Name Status VasaVersion LastSyncTime Namespace Url ---- ------ ----------- ------------ --------- --- sn1-x70-c05-33-ct1 online 3.0 11/11/2020 1:19:57 PM com.purestorage https://10.21.149.23:8084 PS /Users/alex.carver> Remove-VasaProvider -Provider $provider -confirm:$false PS /Users/alex.carver> PS /Users/alex.carver> Get-VasaProvider | Where-Object {$_.Namespace -eq 'com.purestorage'} Name Status VasaVersion LastSyncTime Namespace Url ---- ------ ----------- ------------ --------- --- sn1-x70-b05-33-ct0 online 3.0 10/23/2020 11:37:26 AM com.purestorage https://10.21.149.40:8084/version.… sn1-m20r2-c05-36-ct0 online 3.0 10/23/2020 11:37:26 AM com.purestorage https://10.21.149.61:8084/version.…
The main reason that the workflow is using the VASA provider ID is due to inconsistent behavior when using the VASA provider name when trying to remove the second provider. The behavior was much more consistent when using the provider id.