[Pacemaker] Two node cluster and no hardware device for stonith.

[lists at alteeve.ca]

On 2015-02-05 17:08, Andrea wrote:
> Hi
> 
> I test location constraint with ping resource to stop resource on
> disconnected node, but with stonith active, doesn't works
> 
> I used dummy resource for test
> [ONE]pcs resource create mydummy ocf:pacemaker:Dummy op monitor
> interval=120s  --clone
> 
> Ping resource
> [ONE] pcs resource create ping ocf:pacemaker:ping dampen=5s 
> multiplier=1000
> host_list=pingnode --clone
> 
> Location Constraint
> [ONE]pcs constraint location mydummy rule score=-INFINITY pingd lt 1 or
> not_defined pingd
> 
> 
> If the pingnode became not visible on node2, I will see pingd attribute 
> on
> node2 set to 0 and dummy resources stop on node2.
> If I cut off nentire network on node2, I will see pingd attribute on 
> node2
> set to 0 bud dummy resource never stop.
> During network failure...stonith agent is active and try to fence node 
> 1
> without success.
> Why? Is the failed fence action that block location constraint?
> 
> 
> Andrea

When you disable stonith, pacemaker just assumes that "no contact" == 
"peer dead", so recovery happens. This is a very false sense of security 
though, because most people test by actually crashing a node, so there 
is no risk of a split-brain. The problem is, in the real world, this can 
not be assured. A node can be running just fine, but the connection 
fails. If you disable stonith, you get a split-brain.

So when you enable stonith, and you really must, then pacemaker will 
never make an assumption about the state of the peer. So when the peer 
stops responding, pacemaker blocks and calls a fence. It will then sit 
there and wait for the fence to succeed. If the fence *doesn't* succeed, 
it ends up staying blocked. This is the proper behaviour!

Now, if you enable stonith *and* it is configured properly, then you 
will see that recovery proceeds as expected *after* the fence action 
completes successfully. So, setup stonith! :)