[Pacemaker] question about redundancy / cluster types

[Andrew Beekhof]

On Wed, Jan 16, 2013 at 1:12 AM, Marcin Z <nichuspam at gmail.com> wrote:
> Hi
>
> I'd like to discuss redundancy type in pacemaker
> of course I read this one:
> http://clusterlabs.org/doc/en-US/Pacemaker/1.1-plugin/html/Clusters_from_Scratch/s-intro-redundancy.html
>
> BUT
> i'm wondering if it possible to make such SCENARIO
>
> let's say we have 2 locations (A and B)
> we have 4 servers (2 per location) or 3 servers (2 in A, 1 backup in B)
>
> location A is primary, location B acts as backup - so it should only be
> active ONLY during blackout of A
>
> on location A - we want to have active-active service (lets say it's IP
> address) running on both servers ...
>
> if one server in location A goes down... the service doesn't go to backup
> server in location B - but it remains in location A (so it stays only on 2nd
> server in A)
>
> whole location A goes down - active-active service is migrated to location B
> (in fact it doesn't need to be active-active in B - it's enough if it works
> on one server in B)
>
> i hope my description is clear enough :)
>
> I was trying to play with some options but I couldn't do it as designed....
> i could do active-active (but when one fails - service was active-active on
> 1 server in A and 1 server in B)

Pacemaker can do it easily enough, the hard part is ensuring that the
nodes at location A really are down/dead/not-running-services when
they leave the cluster.
With multiple sites reliable fencing is near impossible and chances
are the other site is fine but the link is down.

You might want to check out booth - https://github.com/ClusterLabs/booth

The Booth cluster ticket manager extends Pacemaker to support
geographically distributed clustering. It does this by managing the
granting and revoking of 'tickets' which authorizes one of the cluster
sites, potentially located in geographically dispersed locations, to
run certain resources.