Panderson/update new storage policy for esa

[gungazoo]

This PR closes #
Bug 36304283: Run Command to create new storage policies needs "compression" option for ESA vSAN

The changes in this PR are as follows:

• If creating in SDDC with ESA adds compression by default. It can be disabled
• If SDDC has ESA and OSA it will create two different policies and put either ESA or OSA in the name

I have read the contributor guidelines and have completed the following:

• Formatted the code using VSCode default formatter for PowerShell.
• Tested the code end-to-end against an SDDC.
• Documented the functions using standard PowerShell markup and applied AVSAttribute to newly exported functions.

[Copilot]

Pull request overview

This PR modernizes the New-AVSStoragePolicy function to support both ESA (Express Storage Architecture) and OSA (Original Storage Architecture) vSAN clusters, with ESA-specific compression support. The implementation has been completely rewritten to use PowerCLI cmdlets instead of low-level SPBM Views API.

Key Changes:

• Automatic detection of ESA/OSA architectures and creation of separate policies with appropriate suffixes
• ESA-specific compression support (enabled by default, can be disabled with -NoCompression)
• Simplified parameter model using PowerCLI cmdlets (New-SpbmRule, New-SpbmRuleSet, New-SpbmStoragePolicy)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The validation logic throws errors for invalid FTT/FailureToleranceMethod combinations but uses throw after Write-Error. This is redundant - either use Write-Error with return or just use throw with a message. The current approach will display the error twice and the exception message will just be the line number rather than the descriptive error.

[Copilot]

The DisasterTolerance parameter only supports "None", "Dual", and "Preferred" values, but the old implementation also supported "Secondary" and "NoneStretch" for stretch clusters. Removing these options without documentation is a breaking change that may affect users with stretch cluster configurations.

Suggested change

	[ValidateSet("None", "Dual", "Preferred")]
	[ValidateSet("None", "Dual", "Preferred", "Secondary", "NoneStretch")]

[Copilot]

Multiple breaking changes exist in the parameter names compared to the old implementation. Parameters renamed include: Name to PolicyName, vSANFailuresToTolerate to FailuresToTolerate, vSANSiteDisasterTolerance to DisasterTolerance, VMEncryption to VmEncryption, and many others. This completely breaks backward compatibility. All removed parameters like Tags, NotTags, Overwrite, vSANDiskStripesPerObject, vSANCacheReservation, etc. should either be reimplemented or documented as removed features.

[Copilot]

The old implementation had input sanitization using Limit-WildcardsandCodeInjectionCharacters for the Name and Description parameters to prevent code injection. This security measure has been removed in the new implementation, potentially exposing the function to injection attacks if user input is passed directly to the VMware APIs.

[Copilot]

The VmEncryption parameter uses the type [bool] but based on the old implementation, VM encryption should reference a separate encryption policy (Pre-IO or Post-IO). The new implementation appears to set encryption directly, but doesn't allow users to specify Pre-IO vs Post-IO encryption which was supported in the old version. This is a feature regression.

Suggested change

	$rules += New-SpbmRule -Capability (Get-SpbmCapability -Name "VSAN.dataService.dataAtRestEncryption" -Server $VIServer) -Value $true
	# Support both legacy policy-based encryption (e.g., Pre-IO/Post-IO) and
	# the newer boolean toggle for data-at-rest encryption.
	if ($VmEncryption -is [string] -and -not [string]::IsNullOrWhiteSpace($VmEncryption)) {
	# Treat VmEncryption as the name of an existing VSAN storage policy
	# (for example, a Pre-IO or Post-IO encryption policy) and merge its rules.
	$encryptionPolicy, $null = Get-StoragePolicyInternal -StoragePolicyName $VmEncryption
	if ($null -ne $encryptionPolicy -and $null -ne $encryptionPolicy.AnyOfRuleSets) {
	foreach ($ruleSet in $encryptionPolicy.AnyOfRuleSets) {
	if ($null -ne $ruleSet.Rules) {
	$rules += $ruleSet.Rules
	}
	}
	}
	}
	elseif ($VmEncryption -is [bool] -and $VmEncryption) {
	# Backward-compatible behavior: simply enable data-at-rest encryption.
	$rules += New-SpbmRule -Capability (Get-SpbmCapability -Name "VSAN.dataService.dataAtRestEncryption" -Server $VIServer) -Value $true
	}

[Copilot]

The variable $VIServer is used without being defined or passed as a parameter. This will cause the function to fail unless there's a global/script-scoped variable set elsewhere. PowerCLI cmdlets default to using the default server connection, so the -Server $VIServer parameters should either be removed or $VIServer should be properly defined/obtained.

Suggested change

	Write-Verbose "Using vCenter Server: $($VIServer.Name)"
	$connectedVIServer = Get-VIServer -ErrorAction SilentlyContinue | Select-Object -First 1
	if ($connectedVIServer) {
	Write-Verbose "Using vCenter Server: $($connectedVIServer.Name)"
	} else {
	Write-Verbose "Using default vCenter Server connection."
	}

[Copilot]

Using throw without an error message is a poor practice. Each throw statement should include a meaningful error message that helps users understand what failed. For example, instead of just throw, use throw "Failed to enumerate clusters: $($_.Exception.Message)".