AND and OR Rules in Storage Policies

I was recently working in an environment where my vCenter server was managing two vSAN clusters, each with its own datastore. I wanted to be able to choose which datastore to provision to via storage policy, but came across some unexpected behaviour. When I configured my vSAN Rule and my Tag Rule, it seems that both datastores would appear as compliant to the policy. I found out the reason, and decided to write it up as I had never known this was how policies AND and OR rules behaved until now.

Setting up Tags

I created a Tags Category called vSAN-TAG.

Next, I created two Tags, one for each datastore, called vSAN-A and vSAN-B respectively.

Finally, I assigned the Tags to each of the datastores:

I was now ready to do some testing with policies.

AND Storage Policies using two Rule Sets

Let’s proceed by building the policy. Again, the idea is to have the same vSAN Rule for both datastores (RAID-1) but use the Tag to select between the different datastores. These are the steps I followed:

Step 1: Provide a Name and Description for the policy

Step 2: Select specific rules for vSAN and Tag based placement

Select both Datastore specific rules as shown below.

Step 3: Configure vSAN Rules

I’m simply leaving these at the defaults.

Step 4: Configure Tag based placement rules

In this rule, I am using tag placement to select vSAN datastore A only using the vSAN-A tag.

Step 5: Check datastore compliance

OK – this is where things were not quite as I expected. Why is this showing both datastore are compatbile when only one of them has the tag vSAN-A?

The reason is because Rule sets have “OR” relation with each other. So both datastores can match either the vSAN rule, or the tag placement rule, or both. So how do I create an “AND” relationship? You have to create the rules within the same Rule set. Rules within a Rule set have “AND” relation with each other.

Go back to step 3, and notice that there is another tab in the vSAN rules for Tags. This is where we should be setting the Tag Placement rule.

New Step 2 – vSAN Rules only

So let’s repeat the process, but this time in step 2, we do not need to select the datastore tag placement rule.

New Step 3 – Add Tag Based Rules to vSAN Rule set

Since this rule is being added to the vSAN Rule set, it is treated as a logical AND, not a logical OR. In other words, all the rules much match before compliance is reached.

New Step 4: Configure Tag based placement rules

Click on the ADD TAG RULE button to add tag based placement rules.

New Step 5: Check datastore compliance

And now, as we can clearly see, only one vSAN datastore is now showing up as compliant.

So now the policy is working as expected. And if I modify this rule to change the tag to vSAN-B, it would be the other vSAN datastore that shows up as compliant. I can now use these policy to determine where my storage should be provisioned in this multi-vSAN cluster environment. This is how you configure logical AND and logical OR placement rules in Storage Policy Based Management.