vVols User Guide: The FlashArray VASA Provider

The FlashArray VASA Provider

VMware's vSphere APIs for Storage Awareness (VASA) is a VMware interface for out-of-band communication between VMware ESXi and vCenter and storage arrays. The Arrays’ VASA providers are services registered with the vCenter Server. Storage vendors implement providers for their arrays, either as VMs or embedded in the arrays. As of vSphere Version 7.0 U1, VMware has introduced four versions of VASA:

Version 1 (Introduced in vSphere Version 5.0)
- Provides basic configuration information for storage volumes hosting VMFS datastores, as well as injection of some basic alerts into vCenter
Version 2 (Introduced in vSphere Version 6.0)
- First version to support vVols
Version 3 (Introduced in vSphere Version 6.5)
- Added support for array-based replication of vVols and Oracle RAC.
Version 3.5 (Introduced in vSphere Version 7.0 U1)
- Added additional feature support for improved bitmap operation performance and iSCSI CHAP.

The Pure Storage FlashArray supports VASA Version 3 with Purity//FA 5.0.0 through Purity//FA 6.1.5.

Starting with Purity//FA 6.1.6 and Pure VASA version 1.2.0 support was added for bitmap hint with VASA 3.5.

Because the FlashArray vVol implementation uses VASA Version 3, the VMware environment must be running vSphere Version 6.5 or a newer version in both ESXi hosts and vCenter.

Pure Storage does recommend running vSphere 6.7 U3 p03 or higher for the various fixes and improvements found in this release. Please see the KB that outlines VASA/vVols related fixes by ESXi release found here.

FlashArray vVol support is included in Purity//FA Version 5.0. The Purity//FA upgrade process automatically installs and configures a VASA provider in each controller; there is no separate installation or configuration. To use FlashArray-based vVols, however, an array’s VASA providers must be registered with vCenter. Either the FlashArray Plugin for vSphere Web Client (the Plugin), the vSphere GUI, or API/CLI-based tools may be used to register VASA providers with vCenter.

VASA Provider Certificate Management

The management of VASA Provider certificates is supported by the FlashArray with the release of Purity//FA 5.3 and VASA 1.1.0.

Please see the following KBs that detail the management of the the VASA Provider Certificates:

Recommendation: Create Local vVol/VASA Admin if the FlashArray is on Purity 5.1+

One of Pure Storage's recommendations is to register the controllers VASA Providers with a local user on the array. This will help in a couple ways:

Prevent any authentication issues in the event that the AD server is unreachable, the user that the storage providers is deleted/removed, or any other unexpected connectivity issues with the AD server.
Keep the VASA audit history clear. Best practice is to never use the default array admin, pureuser, with any integration with the FlashArray.

Users are able to create local Array Admin, Storage Admin and Read Only users starting in Purity 5.1.0. The user will want to create a local Array Admin to register the array Storage Providers. Pure Storage found that the storage admin role does not have the full permissions that the VASA Provider requires in order to function correctly.

Here is an example of creating a local array admin to use when registering the storage provider.

From the FlashArray GUI, Navigate to Settings and then Users

Then click on the triple dots in the users box and select "Create User..."

Create a Array Admin user, for example naming it "vvol-admin" and giving it a super secure password.

After the user is created, you will see it show up in the list with it's Role. Now you can use it to register your storage provider.

Registering the FlashArray VASA Provider

There are multiple ways to register the FlashArray VASA Provider.

Registering FlashArray VASA Providers with the Pure Storage vSphere Plugin

A FlashArray will need to be added/registered in the Plugin to register the Storage Provider for the a given FlashArray. Once the FlashArray is registered, Navigate to the main Plugin Page, select the FlashArray and then click on "Register Storage Provider".

The recommended practice is to have a local FlashArray Array Admin user to register the storage providers with. In the example below, there is a local array admin named "vvols-admin" that the Storage Providers will be registered with. In the event that the vCenter is in Enhanced Linked Mode, the option to choose which vCenter to register the storage providers with will be given.

Registering the Storage Provider with a Single vCenter

Registering the Storage Provider with a vCenter in Linked Mode

Once the Storage Provider is successfully registered, navigate to the vCenter Server page, then Config and the Storage Providers tab. Confirm that the storage providers are online and healthy.

The FlashArray will log all subsequent vVol operations from those vCenters under the user used to register the storage providers.

Manually Registering the FlashArray VASA Providers with the vCenter UI

Alternatively, VMware administrators can use the vCenter Web Client, PowerCLI, and other CLI and API tools to register VASA providers. This section describes registration of FlashArray providers with the vCenter Web Client and with PowerCLI.

Finding the FlashArray Controller IP Addresses

Prior to registration, use the FlashArray GUI or CLI to obtain the IP addresses of both controllers’ eth0 management ports.

Click Settings in the GUI navigation pane, and select the Network tab to display the array’s management port IP addresses


*FlashArray GUI Network Tab - Management IP Addresses*

pureuser@sn1-x70-c05-33> purenetwork list ct0.eth0,ct1.eth0
Name      Enabled  Subnet  Address       Mask           Gateway      MTU   MAC                Speed      Services    Subinterfaces
ct0.eth0  True     -       10.21.149.22  255.255.255.0  10.21.149.1  1500  24:a9:37:01:f2:de  1.00 Gb/s  management  -
ct1.eth0  True     -       10.21.149.23  255.255.255.0  10.21.149.1  1500  24:a9:37:02:0b:8e  1.00 Gb/s  management  -

FlashArray CLI - Management IP Addresses

Registering the Storage Provider in vCenter

After the management IPs for the FlashArray are gathered head over to the vCenter UI and run through the following workflow to register the storage providers.

Navigate to the either the Hosts/Datacenters, VMs, Storage or Network page.
Select the vCenter Server to register the storage providers with.
Navigate to the Configure and click Storage Providers under more.
Click on the Add Button

Register CT0's storage provider

Name

A friendly name for the VASA provider. A best practice is to use names that make operational sense (for example, array name concatenated with controller number).

URL

The URL of the controller’s VASA provider in the form: https://<controllerIP>:8084. HTTPS (not HTTP) is required, the controller’s IP address must be specified, unless a custom cert with a FQDN in the Subjective Alternative Name is used, and port 8084 is required

Credentials

Credentials for an administrator of the target array. Best practice is to use a local array user and not the default user (pureuser).
The user name entered is associated with VASA operations in future audit logs.

Register CT1's storage provider

Name

A friendly name for the VASA provider. A best practice is to use names that make operational sense (for example, array name concatenated with controller number).

URL

The URL of the controller’s VASA provider in the form: https://<controllerIP>:8084. HTTPS (not HTTP) is required, the controller’s IP address must be specified (not its FQDN), and port 8084 is required

Credentials

Credentials for an administrator of the target array. Best practice is to use a local array user and not the default user (pureuser).
The user name entered is associated with VASA operations in future audit logs.

Please ensure that both CT0 and CT1's storage providers are registered.

Manually Registering the FlashArray VASA Providers with PowerShell

When a number of FlashArrays’ VASA providers are to be registered, using a PowerCLI script may be preferable. The VMware PowerCLI cmdlet called New-VasaProvider registers VASA providers with vCenter (vSphereView 6).

New-VasaProvider Cmdlet

New-VasaProvider -Name "MyProvider" -Username "UserName" -Password "Password" -Url "MyUrl"

New-VasaProvider Cmdlet PowerShell Core Example

PS /Users/alex.carver> $vc_creds = Get-Credential

PowerShell credential request
Enter your credentials.
User: purecloud\alex
Password for user purecloud\alex: 

PS /Users/alex.carver> $vasa_creds = Get-Credential

PowerShell credential request
Enter your credentials.
User: vvol-admin
Password for user vvol-admin: 

PS /Users/alex.carver> connect-viserver -Server 10.21.202.95 -Credential $vc_creds

Name                           Port  User
----                           ----  ----
10.21.202.95                   443   PURECLOUD\alex

PS /Users/alex.carver> New-VasaProvider -Name 'sn1-x70-c05-36-ct0' -Credential $vasa_creds -Url 'https://10.21.149.22:8084'

Name                 Status       VasaVersion LastSyncTime           Namespace            Url
----                 ------       ----------- ------------           ---------            ---
sn1-x70-c05-36-ct0   online       3.0         11/5/2020 1:28:50 PM   com.purestorage      https://10.21.149.22:8084

PS /Users/alex.carver> New-VasaProvider -Name 'sn1-x70-c05-36-ct1' -Credential $vasa_creds -Url 'https://10.21.149.23:8084'

Name                 Status       VasaVersion LastSyncTime           Namespace            Url
----                 ------       ----------- ------------           ---------            ---

The output from registering ct1 is expected as ct1 will be the standby provider. Currently PowerCLI only displays the details on Active Storage Providers and not with standby providers.

An additional method with PowerShell would be the New-PfaVasaProvider cmdlet from the Pure Storage VMware PowerShell Module. This will require having the Pure Storage PowerShell SDK also installed, but will work with either PowerShell Core or PowerShell. A connection to a vCenter Server and FlashArray will be required to use the New-PfaVasaProvider cmdlet

New-PfaVasaProvider Cmdlet

New-PfaConnection -Endpoint "Management IP" -Credentials (Get-Credential) -DefaultArray -IgnoreCertificate

New-PfaVasaProvider -Flasharray $Global:DefaultFlashArray -Credentials (Get-Credential)

New-VasaProvider Cmdlet PowerShell Core Example

PS /Users/alex.carver> Install-Module -Name PureStoragePowerShellSDK
PS /Users/alex.carver>
PS /Users/alex.carver> Install-Module -Name PureStorage.FlashArray.VMware
PS /Users/alex.carver>
PS /Users/alex.carver> New-PfaConnection -Endpoint 10.21.149.21 -Credentials (Get-Credential) -DefaultArray -IgnoreCertificateError

PowerShell credential request
Enter your credentials.
User: vvol-admin
Password for user vvol-admin: 


Disposed   : False
EndPoint   : 10.21.149.21
UserName   : vvol-admin
ApiVersion : 1.17
Role       : ArrayAdmin
ApiToken   : 18e939a3

PS /Users/alex.carver> connect-viserver -Server 10.21.202.95 -Credential (Get-Credential)

PowerShell credential request
Enter your credentials.
User: purecloud\alex
Password for user purecloud\alex: 


Name                           Port  User
----                           ----  ----
10.21.202.95                   443   PURECLOUD\alex

PS /Users/alex.carver> New-PfaVasaProvider -Flasharray $Global:DefaultFlashArray -Credentials (Get-Credential)

PowerShell credential request
Enter your credentials.
User: vvol-admin
Password for user vvol-admin: 


Name                 Status       VasaVersion LastSyncTime           Namespace            Url
----                 ------       ----------- ------------           ---------            ---
sn1-x70-c05-33-CT0   online       3.0         11/5/2020 5:06:10 PM   com.purestorage      https://10.21.149.22:8084

Verifying VASA Provider Registration

To verify that VASA Provider registration succeeded, in the Web Client Host and Clusters:

Click the target vCenter in the inventory pane
Select the Configure tab
Locate the newly-registered providers in Storage Providers

On the Storage Providers page there are some useful sections that display the information for the VASA Providers.

The first column has the Storage Providers names that were used to register the storage providers. Additionally, the storage array that the VASA Provider is managing is listed below it, along with the number of online providers for that storage array.
The Status column will list if the provider is online and accessible from vCenter.
vCenter can only have a single Active storage provider for a given storage array. The Active/Standby column will display if the provider is the active or standby provider.
The Certificate Expiry column displays how many days are left before the certificate expires for that storage provider. At 180 days a yellow warning will be displayed.
After selecting a Storage Provider there are additional tabs and information that can be selected for that provider. The general tab will display all the basic information for the given storage provider. This is a very useful information tab.

Alternatively, the PowerCLI Get-VasaProvider cmdlet can be used to list registered VASA providers. The results can be filtered to just display the VASA Providers that belong to the Pure Storage namespace. Only the Active Storage providers are returned with this cmdlet.

PS /Users/alex.carver> Get-VasaProvider | Where-Object {$_.Namespace -eq 'com.purestorage'}

Name                 Status       VasaVersion LastSyncTime           Namespace            Url
----                 ------       ----------- ------------           ---------            ---
sn1-x70-c05-33-ct0   online       3.0         11/5/2020 5:06:10 PM   com.purestorage      https://10.21.149.22:8084
sn1-x70-b05-33-ct0   online       3.0         10/23/2020 11:37:26 AM com.purestorage      https://10.21.149.40:8084/version.…
sn1-m20r2-c05-36-ct0 online       3.0         10/23/2020 11:37:26 AM com.purestorage      https://10.21.149.61:8084/version.…

Un-registering and Removing the Storage Providers

There are a couple ways to remove a storage provider in the event that the end user needs to remove and re-register a Storage Provider or simply wants to remove the storage providers. This can be done either from the vCenter Server UI or with PowerShell via PowerCLI.

Removing Storage Providers in the vCenter Server UI

Here is the workflow to remove the storage providers in the vCenter Server UI:

Navigate to the vCenter Server -> Configure -> Storage Provider Page
Select the Standby Storage Provider that is being removed and select remove and click yes to confirm the removal
Repeat the steps for the active storage provider

Removing Storage Providers via PowerCLI

Here is the workflow to remove storage providers with PowerShell via PowerCLI:

After connecting to the vCenter Server, find the storage provider and storage provider ID that needs to be removed and set a provider variable.

PS /Users/alex.carver> Get-VasaProvider | Where-Object {$_.Namespace -eq 'com.purestorage'} | Select-Object Name,Id

Name                 Id
----                 --
sn1-x70-b05-33-ct0   VasaProvider-vasaProvider-3
sn1-x70-c05-33-ct0   VasaProvider-vasaProvider-7
sn1-m20r2-c05-36-ct0 VasaProvider-vasaProvider-5

PS /Users/alex.carver> $provider = Get-VasaProvider -Id VasaProvider-vasaProvider-7
PS /Users/alex.carver> $provider

Name                 Status       VasaVersion LastSyncTime           Namespace            Url
----                 ------       ----------- ------------           ---------            ---
sn1-x70-c05-33-ct0   online       3.0         11/5/2020 5:06:10 PM   com.purestorage      https://10.21.149.22:8084

Remove the storage provider with Remove-VASAProvider with the provider variable.

PS /Users/alex.carver> Remove-VasaProvider -Provider $provider -confirm:$false
PS /Users/alex.carver>

Remove the same steps with the second storage provider

PS /Users/alex.carver> Get-VasaProvider | Where-Object {$_.Namespace -eq 'com.purestorage'} | Select-Object Name,Id

Name                 Id
----                 --
sn1-x70-b05-33-ct0   VasaProvider-vasaProvider-3
sn1-x70-c05-33-ct1   VasaProvider-vasaProvider-8
sn1-m20r2-c05-36-ct0 VasaProvider-vasaProvider-5

PS /Users/alex.carver> $provider = Get-VasaProvider -Id VasaProvider-vasaProvider-8
PS /Users/alex.carver> $provider

Name                 Status       VasaVersion LastSyncTime           Namespace            Url
----                 ------       ----------- ------------           ---------            ---
sn1-x70-c05-33-ct1   online       3.0         11/11/2020 1:19:57 PM  com.purestorage      https://10.21.149.23:8084

PS /Users/alex.carver> Remove-VasaProvider -Provider $provider -confirm:$false
PS /Users/alex.carver>
PS /Users/alex.carver> Get-VasaProvider | Where-Object {$_.Namespace -eq 'com.purestorage'}

Name                 Status       VasaVersion LastSyncTime           Namespace            Url
----                 ------       ----------- ------------           ---------            ---
sn1-x70-b05-33-ct0   online       3.0         10/23/2020 11:37:26 AM com.purestorage      https://10.21.149.40:8084/version.…
sn1-m20r2-c05-36-ct0 online       3.0         10/23/2020 11:37:26 AM com.purestorage      https://10.21.149.61:8084/version.…

The main reason that the workflow is using the VASA provider ID is due to inconsistent behavior when using the VASA provider name when trying to remove the second provider. The behavior was much more consistent when using the provider id.