[Pacemaker] newbie question(s)

[Digimer]

On 05/24/2013 08:26 AM, Florian Crouzat wrote:
> Le 24/05/2013 04:15, Alex Samad - Yieldbroker a écrit :
>>
>>
>>> -----Original Message-----
>>> From: Florian Crouzat [mailto:gentoo at floriancrouzat.net]
>>> Sent: Thursday, 23 May 2013 6:27 PM
>>> To: pacemaker at oss.clusterlabs.org
>>> Subject: Re: [Pacemaker] newbie question(s)
>>>
>> [snip]
>>>
>>> You could also wait for a failover where the VIP or (any resource)
>>> will fail to
>>> properly stop, the cluster doesn't know what do to on stop-failures
>>> (beside
>>> fencing), it freezes in this weird state => you have two slaves on your
>>> network until an admin fixes it.
>>
>> True, what would you use for quorum (it's a 2 node cluster)?
>>
>>
>
> I never used quorum on any 2 nodes cluster, by definition it makes no
> sense, so I always used no-quorum-policy=ignore.
>
> If you really want quorum, you need a third player, either a dedicated
> quorum pseudo-node (don't know much about these) or a third node.
>
> Hope it helps...

I build almost exclusively 2-node clusters, and as Florian said, quorum 
needs to be disabled. This is, itself, safe *if* you have robust fencing 
to ensure that you can't have a split-brain condition.

This works because if a node starts on it's own and can't see it's peer 
within a timeout period, it fences it. Likewise, while in operation if a 
node vanishes (due to internal or network failure), one of the peers 
will be fenced before the other begins recovery.

There are two things to consider;

1. Make sure you use a delay for the fence action against one node. This 
ensures that if the network connection fails and both nodes race to 
fence the other, the one with the delay will always win.

2. Don't set corosync/pacemaker to start on boot. As a general rule, a 
fence occurs when something bad happens. I don't want a node to rejoin 
the cluster until I've looked it over. More important though is that you 
protect against a fence loop. If both nodes are healthy but can't 
contact one another, then the fenced node will boot, fail to reach it's 
peer and fence it. It's peer will come back up, fail to reach the first 
node, fence it. On and on...

hth

digimer

-- 
Digimer
Papers and Projects: https://alteeve.ca/w/
What if the cure for cancer is trapped in the mind of a person without 
access to education?