[Pacemaker] Fencing configuration with pcmk_host_map argument

[Andrew Beekhof]

On Wed, Feb 6, 2013 at 4:42 AM, Thibaut Pouzet
<thibaut.pouzet at lyra-network.com> wrote:
> Le 05/02/2013 16:57, Marek Grac a écrit :
>>
>> Hi,
>>
>> On 02/05/2013 03:24 AM, Andrew Beekhof wrote:
>>>
>>> I cleared the IPMI configuration and kept only the two WTI fencing
>>> Primitives in my configuration to make it as simple as possible :
>>>
>>> primitive wti_fence01 stonith:fence_wti \
>>>          params ipaddr="192.168.0.7" action="reboot" verbose="true"
>>> pcmk_host_check="static-list" pcmk_host_list="fence01.domain"
>>> pcmk_host_map="fence01.domain:1,5" login_timeout="20" shell_timeout="20"
>>> \
>>>          op monitor interval="30s"
>>> primitive wti_fence02 stonith:fence_wti \
>>>          params ipaddr="192.168.0.7" action="reboot" verbose="true"
>>> pcmk_host_check="static-list" pcmk_host_list="fence02.domain"
>>> pcmk_host_map="fence02.domain:2,6"
>>> It is possible that fence_wti doesn't support multiple port values, or
>>> supports them differently.
>>> Marek (CC'd) should be able to comment definitively.
>>>
>> This is right, fence agents (all of them) can be used only with one port
>> value.
>>
>> m,
>>
>> _______________________________________________
>> Pacemaker mailing list: Pacemaker at oss.clusterlabs.org
>> http://oss.clusterlabs.org/mailman/listinfo/pacemaker
>>
>> Project Home: http://www.clusterlabs.org
>> Getting started: http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf
>> Bugs: http://bugs.clusterlabs.org
>>
> Hi Marek, thank you very much for the quick reply.
>
> When I read you (Marek & Andrew), I feel like there is something odd here. I
> have a cluster with two nodes, a redundant ring, two fencing methods
> installed (IPMI, WTI), and each node of this cluster has a dual power
> supply. This configuration should prevent me from a single failure anywhere
> in my system (at least, I hope so).
>
> You are telling me that I cannot use the WTI fence agent to fence one of my
> node because it can only shut one port at a time ?
>
> Maybe I can understant that the fence_agent is only able to shut one port at
> a time. But, what about stonithd's argument "pcmk_host_map" ? I thought that
> it could be the glue I needed here;

No, it requires that the agents support multiple ports.  Clearly this
is not the case for the RHT ones.

What you can do though, is use fencing levels.
Its still not documented unfortunately, but basically you define four
devices (one for each node+port) and then add something like f-p2.1
below for each node.
"devices" refers to your fencing resources.

Not sure how it will work for "reboot" though.

<cib crm_feature_set="3.0.6" validate-with="pacemaker-1.2"
admin_epoch="1" epoch="0" num_updates="0">
  <configuration>
    <crm_config/>
    <nodes/>
    <resources/>
    <constraints/>
    <fencing-topology>
      <!-- try poison-pill and fail back to power -->
      <fencing-level id="f-p1.1" target="pcmk-1" index="1"
devices="poison-pill"/>
      <fencing-level id="f-p1.2" target="pcmk-1" index="2" devices="power"/>

      <!-- try disk and network, and fail back to power -->
      <fencing-level id="f-p2.1" target="pcmk-2" index="1"
devices="disk,network"/>
      <fencing-level id="f-p2.2" target="pcmk-2" index="2" devices="power"/>
    </fencing-topology>
  </configuration>
  <status/>
</cib>


> Let's say I have this :
> pcmk_host_map="fence02.domain:2,6", and this node needs to be fenced. I
> thought that stonithd would do the following (somehow) :
>
> * Shut down (off) port 2 (and make sure the port is actually OFF)
> * Shut down (off) port 6 (and make sure the port is actually OFF)
> * Power up (on) port 2 (..)
> * Power up (on) port 6 (..)
>
> This would be done with four calls to fence_wti. If one "off" action fails,
> stonithd would believe that it could not fence properly the node and try
> another fencing method (i.e. IPMI in my case).
>
> If this is not the purpose of "pcmk_host_map", then I guess I will have to
> rewrite fence_wti to handle my situation properly.
>
>
> Thibaut.
>
> _______________________________________________
> Pacemaker mailing list: Pacemaker at oss.clusterlabs.org
> http://oss.clusterlabs.org/mailman/listinfo/pacemaker
>
> Project Home: http://www.clusterlabs.org
> Getting started: http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf
> Bugs: http://bugs.clusterlabs.org