What is VMware vSphere HA Admission Control?

Today's post will explain What is VMware vSphere HA Admission Control. This is another article within our Tips category. If you're experienced VMware admin, you'll probably know your way, but this post is destined for folks willing to know the basics and more about Admission control which was redesigned in vSphere 6.5.

The first thing to mention is the fact that this feature is managed through the vCenter server so you'll need an environment with the vCenter server installed. Our post targets the latest vSphere 6.5 release, but HA admission control is not new. It has been enhanced with the 6.5 release, but was here since v 3.5 or even before.

What is VMware vSphere HA Admission Control?

vSphere restricts a certain number of actions in order to guarantee sufficient resources for virtual machine recovery when a host fails. It is basically a possibility to control resources and guarantee restart of VMs in case of hardware failure.

The system can tolerate some cluster hosts failures, up to certain point, a certain percentage (by default). vCenter Server uses admission control to make sure that sufficient resources are available in a cluster to provide failover protection and to ensure that virtual machine resource reservations are respected.

When Admission control enters in action?

• When you Power on a VM
• When you migrate VM
• When you increase CPU or memory reservation of a VM

What's new in the latest version of VMware vSphere and HA Admission Control?

Simplified HA Admission Control Settings

• The new default is Cluster resource Percentage – The configuring workflow for admission control is a little bit simpler. You first define a parameter how many failed hosts you want to tolerate within your cluster, and the system will do the math for you. As default HA cluster admission policy, VMware will use the cluster resource Percentage now. (previously host failures the cluster tolerates policy, was used).
• Override Possible – You can override the default CPU and memory settings if needed. (25% as in previous releases).

Performance degradation Warning message – Previously HA could restart VM, but those would suffer from performance degradation. Now you have a warning message which informs you about it. You’ll be warned if performance degradation would occur after an HA even for particular VM(s).

0% – Raises a warning if there is insufficient failover capacity to guarantee the same performance after VMs restart.
100% – Warning is disabled

Where to configure What is VMware vSphere HA Admission Control?

Connect via vSphere web client > Home > Hosts and clusters > Select your Cluster object > Configure > vSphere Availability > Admission Control > Click the Edit button.

In my lab I have currently 2 hosts within my cluster (vSAN 2-Node cluster and the 3rd host is outside of my cluster, running vSAN Witness as a nested ESXi host), so my cluster can tolerate only 1 host failure (first form field).

Then, you can see just below, the Cluster resource percentage. In my case, I only have 2 hosts so if one host fails, half of my VMs needs to be restarted. The checkbox “Override calculated failover capacity” allows you to, as it says, override the calculated percentage of cluster capacity, which will be reserved for failover.

VMware vSphere HA Admission Control – Percentage based Policy (by Default)

For the % option in Admission control setting, vSphere HA enforces admission control as follows:

• The system calculates the total resource requirements for all powered-on virtual machines in the cluster.
• It calculates total host resources available for virtual machines.
• It takes into account and calculates the current CPU failover capacity and current memory failover capacity for the cluster

If that happens, the admission control blocks the operation.

The values are dynamically re-calculated every time you add (or remove) host from the cluster. The failover capacity percentages will be updated and so a number of resources required on each host will also be updated automatically. No need to disable and re-enable High Availability (HA) for that.

Let's say we have 4 hosts in a cluster. If we raise the Host failures cluster tolerates to two, what happens that it will automatically set CPU and Memory to 50% failover capacity. Same for lowering the value back to one, it will automatically set CPU and Memory to 25% failover capacity. You don't have to manually set the values of failover capacities (except if you want to). You can do that however. You will want to do that via the “Override calculated failover capacity” checkbox.

You don't have to manually set the values of failover capacities (except if you want to). You can do that however. You will want to do that via the “Override calculated failover capacity” checkbox.

VMware vSphere HA Admission Control – Slot Policy

This is the first option from the top, within the drop-down menu. In this case, the default is to “cover all powered-on VMs” and basically, it calculates the slot size based on the maximum CPU/Memory reservation and overhead of all powered-on VMs.

You can also change to the second radio button and use a fixed slot size. In this case, the default what vSphere is proposing (but you can override) is:

This:

When you click the Calculate button, you can then click the View link, which opens a pop-up window showing which VMs are not “guaranteed to have unfragmented failover capacity” …

VMware vSphere HA Admission Control – Dedicated Failover Host (Last option)

This option, where you basically dedicate one of your hosts to be reserved for failover, is very little used. VMware, however, still provides this option. It is not very effective as the host cannot run any VMs (normally), and just wait for failover to happen.

When failover occurs, the VMs which were running on the failed host, are restarted on this dedicated host.

Limitations:

• No VMs can be started on this host
• DRS cannot use this host for rebalancing operations
• No vMotions to this host

Can I disable VMware vSphere HA admission control?

Yes, you can. However, without it, you have no assurance that your VMs which lives within your cluster, can be restarted after a hardware failure. VMware does not recommend to permanently disable admission control.

Admission control is a very useful function to protect your workloads. Without proper understanding, or even disabling admission control your VMs might not restart at all when a failure occurs. By assuring that there are enough resources within your cluster, depending on how many hosts and resources is present, admission control regulates the resources to make sure that there is enough resources available for restarting all VMs.

By assuring that there are enough resources within your cluster, depending on how many hosts and resources is present, admission control regulates the resources to make sure that there is enough resources available for restarting all VMs.

Source: VMware documentation.

More from ESX Virtualization:

• Free Tools
• What is VMware Instant Clone Technology?
• What is VMware Storage DRS (SDRS)?
• What is VMware Cluster?
• VMware vSphere Standard vs Enterprise Plus

Stay tuned through RSS, and social media channels (Twitter, FB, YouTube)