[Pacemaker] Two resource nodes + one quorum node

[Lars Marowsky-Bree]

On 2013-06-12T11:57:05, Digimer <lists at alteeve.ca> wrote:

> I build exclusively two-node clusters, and the biggest draw-back is the
> possibility of a "fence loop". That is, without quorum and with a network
> error, a node can come up on it's own, fail to contact it's peer and fence
> it. When the fenced node boots, it comes up, fails to contact it's peer, and
> fences it. Wash, rinse, repeat.
> 
> To prevent this, I recommend *not* letting your cluster stack start on boot.

FWIW, I've added code to sbd recently that makes this a bit more
fine-grained: don't start automatically if we were fenced by another
node previously.

Not quite perfect yet (we should auto-start if we can contact the other
node; pacemaker should boot into a standby/fenced mode only, unless it
can contact), but a step in the right direction.


(SBD doesn't need to be used with redundant fence methods, I'd actively
recommend not to do that.)


Regards,
    Lars

-- 
Architect Storage/HA
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 21284 (AG Nürnberg)
"Experience is the name everyone gives to their mistakes." -- Oscar Wilde