vSAN + vCenter HA + VCSA Backup

1. vSAN Cluster Design — Hybrid vs All-Flash & Sizing

Lựa chọn All-Flash hay Hybrid phụ thuộc workload và ngân sách — All-Flash là xu hướng chính cho production từ 2022.

### vSAN Sizing Ví dụ Thực Tế — 100 VMs Production

Inputs:
  - 100 VMs, avg 200 GB vDisk, 800 IOPS/VM
  - FTT=1 (RAID-5 Erasure Coding) → overhead 1.33×
  - All-Flash cluster, Dedup+Compress ratio ~2.5:1

Capacity calculation:
  Raw needed: 100 VMs × 200 GB = 20 TB
  After FTT RAID-5: 20 TB × 1.33 = 26.6 TB raw
  After dedup: 26.6 TB / 2.5 = 10.7 TB actual raw needed

Hardware config (4 nodes × 2 disk groups):
  Cache:    2× Intel P4510 400GB NVMe per disk group
  Capacity: 4× Samsung 3.84TB SAS SSD per disk group
  Per node: 2 DG × 4 × 3.84TB = 30.72 TB raw
  Cluster:  4 nodes × 30.72 TB = 122.88 TB raw
  Usable after RAID-5 FTT=1: ~82 TB ✓ (target 10.7 TB actual)

Performance:
  4 nodes × (2 DG × ~100K IOPS NVMe cache) = ~800K IOPS
  Target: 100 VMs × 800 IOPS = 80K IOPS → OK

2. Storage Policy Based Management (SPBM) cho vSAN

SPBM là cơ chế tự động đảm bảo mọi VM được lưu trữ đúng theo SLA yêu cầu — không cần admin can thiệp thủ công mỗi khi tạo VM.

### PowerCLI — Tạo vSAN Storage Policies
Connect-VIServer vcsa-01.lab.local

# Policy 1: Gold — FTT=1 RAID-1 Mirror (tốt nhất cho recovery time)
New-SpbmStoragePolicy -Name "vSAN-Gold-RAID1-FTT1" -Description "Production critical, RAID-1" `
    -RuleSet @(New-SpbmRuleSet -AllOfRules @(
        New-SpbmRule -Capability (Get-SpbmCapability "VSAN.hostFailuresToTolerate") -Value 1,
        New-SpbmRule -Capability (Get-SpbmCapability "VSAN.replicationFactor") -Value 2,
        New-SpbmRule -Capability (Get-SpbmCapability "VSAN.forceProvisioning") -Value $false
    ))

# Policy 2: Silver — FTT=1 RAID-5 Erasure Coding (tiết kiệm space hơn)
New-SpbmStoragePolicy -Name "vSAN-Silver-RAID5-FTT1" -Description "Production standard, RAID-5" `
    -RuleSet @(New-SpbmRuleSet -AllOfRules @(
        New-SpbmRule -Capability (Get-SpbmCapability "VSAN.hostFailuresToTolerate") -Value 1,
        New-SpbmRule -Capability (Get-SpbmCapability "VSAN.erasureCodingRedundancy") -Value $true
    ))

# Policy 3: Dev — FTT=0 (không redundancy, tiết kiệm cho dev)
New-SpbmStoragePolicy -Name "vSAN-Dev-FTT0" -Description "Dev only, no redundancy"

# Gán policy cho VM
Set-SpbmEntityConfiguration -StoragePolicy (Get-SpbmStoragePolicy "vSAN-Gold-RAID1-FTT1") `
    -Entity (Get-HardDisk -VM "WINDB-ERP-PRD-01")

3. Disk Group Configuration & Fault Domains

Fault Domains ánh xạ failures domain vật lý (rack, power circuit) vào vSAN — đảm bảo dữ liệu replicas nằm ở các rack khác nhau.

### vSAN Fault Domain Topology — 2-Rack Design

  RACK A (Fault Domain 1)          RACK B (Fault Domain 2)
  ┌────────────────────────┐        ┌────────────────────────┐
  │  esxi-r01-01  [DG1,DG2]│        │  esxi-r02-01  [DG1,DG2]│
  │  esxi-r01-02  [DG1,DG2]│        │  esxi-r02-02  [DG1,DG2]│
  └────────────────────────┘        └────────────────────────┘
         Power Circuit A                    Power Circuit B

  FTT=1 RAID-1: Component A trên Rack A, Component B trên Rack B
  → Toàn bộ Rack A die → dữ liệu vẫn OK từ Rack B ✓

### Cấu hình Fault Domains via PowerCLI
$cluster = Get-Cluster "CL-HN-Prod-01"
$vsan = $cluster | Get-VsanClusterConfiguration

# Tạo Fault Domain cho 2 racks
$fd1 = New-VsanFaultDomain -Cluster $cluster -Name "Rack-A"
$fd2 = New-VsanFaultDomain -Cluster $cluster -Name "Rack-B"

# Assign hosts vào fault domains
Set-VsanFaultDomain -FaultDomain $fd1 -VMHost @("esxi-hn-r01-01","esxi-hn-r01-02")
Set-VsanFaultDomain -FaultDomain $fd2 -VMHost @("esxi-hn-r02-01","esxi-hn-r02-02")

### Disk Group Best Practices
# All-Flash: 1 NVMe cache disk + 4-7 SSD capacity disks per disk group
# Max 5 disk groups per host
# Cache disk failure → toàn disk group unavailable → quan trọng dùng SSD chất lượng cao
# Monitor: vSphere Client → vSAN → Disk Management → Disk Group Health

4. vSAN Health Service — Proactive Monitoring

vSAN Health Service tự động kiểm tra hàng trăm health checks — chạy định kỳ và phát hiện vấn đề trước khi gây outage.

### esxcli — vSAN Health CLI Commands
SSH vào ESXi host hoặc dùng PowerCLI:

# Kiểm tra vSAN cluster status
esxcli vsan cluster get

# Xem disk health
esxcli vsan storage list

# Kiểm tra vSAN objects non-compliant
python /usr/lib/vmware/vsan/bin/vsan-health-status.py

### PowerCLI — vSAN Health Report
Get-VsanView -VsanObjectType VsanVcClusterHealthSystem |
    ForEach-Object { $_.VsanQueryVcClusterHealthSummary($cluster.ExtensionData.MoRef,
        $null, $null, $true, $null, $null, "defaultView") } |
    Select-Object -ExpandProperty Groups |
    ForEach-Object { "$($_.GroupName): $($_.GroupHealth)" }

5. Deduplication & Compression ROI — Tính Toán Thực Tế

Dedup+Compression chỉ có trên All-Flash vSAN — tiết kiệm không gian đáng kể cho workloads có dữ liệu trùng lặp cao như VDI và clone VMs.

6. Stretched Cluster — Active-Active Multi-DC Design

vSAN Stretched Cluster cho phép 1 cluster trải dài 2 data center — VMs chạy active ở cả 2 site với RPO=0 (synchronous replication).

### vSAN Stretched Cluster Topology

  PREFERRED SITE (DC Hà Nội)         SECONDARY SITE (DC HCM)
  ┌────────────────────────┐          ┌────────────────────────┐
  │  esxi-hn-01 [vSAN]     │          │  esxi-hcm-01 [vSAN]    │
  │  esxi-hn-02 [vSAN]     │◄── sync ►│  esxi-hcm-02 [vSAN]    │
  │  esxi-hn-03 [vSAN]     │ latency  │  esxi-hcm-03 [vSAN]    │
  └────────────────────────┘  <5ms    └────────────────────────┘
              ▲                                    ▲
              │           WITNESS HOST             │
              └──────── esxi-witness (cloud) ──────┘
                        (tiebreaker cho split-brain)

Requirements:
  - Network latency site-to-site: <5 ms RTT (bắt buộc)
  - Bandwidth: minimum 10 Gbps giữa 2 sites
  - Witness host: 3rd location, VM nhỏ, chỉ metadata
  - vSAN Advanced hoặc Enterprise license
  - FTT policy: "Preferred/Secondary" cho PFTT=1

### Cấu hình Stretched Cluster
# 1. Deploy Witness Appliance (OVA) tại 3rd site/cloud
# 2. vSphere Client → Cluster → Configure → vSAN → Fault Domains
# → "Stretched Cluster" → Define Preferred/Secondary site + Witness
# 3. Đặt VM Affinity rules: VMs critical → Preferred site
# 4. DRS anti-affinity: tránh tất cả VMs chạy chỉ ở 1 site