[Pacemaker] Two resource nodes + one quorum node

[Andrew Beekhof]

On 13/06/2013, at 7:33 PM, Lars Marowsky-Bree <lmb at suse.com> wrote:

> On 2013-06-13T07:45:09, Andrew Beekhof <andrew at beekhof.net> wrote:
> 
>> Its certainly possible to build a decent 2-node cluster, but there are several non-obvious steps that are required - preventing fencing loops being one.
> 
> Given that 2-node clusters are probably still the 90%+ majority, I
> wonder if we shouldn't make them easier somehow.
> 
> One of the caveats is that no-quorum-policy defaults to a value that
> doesn't make sense for <=2 nodes; maybe we should change that again?

I would be very reluctant, even with corosync 2's improved 2-node quorum mode.
(You can only obtain quorum when both are up, but you don't loose it when the other side goes down.)

The people that get tripped up by no-quorum-policy are also the people most likely to need to be made aware of the quorum implications of having only two nodes.
Better, IMHO, for that conversation to happen when nothing is running, rather than after a failure just happened.

The same way that stonith-enabled defaults to true and we block resource startup if no devices are configured.

> And maybe we can add generic code to pacemaker/corosync to avoid fence
> loops: don't start automatically after an unclean restart, generic delay
> of the not-yet-DC node if a 2-node cluster splits, etc.

I would not be opposed to something like that.

> 
> What other caveats are there?

After 12 hours at my desk, I don't feel quite qualified to pen the definitive list.