[Linux-cluster] Avoiding fencing loops with startup quorum (patch)

[David Teigland]

On Fri, Oct 17, 2008 at 01:27:02PM +0200, Federico Simoncelli wrote:
> Hi all,
>   I am managing a two-node cluster without qdisk and to avoid the
> fencing loop I thought to implement a startup quorum.

Sounds like you want quorum of 2 when nodes are joining, but quorum of 1
after a node fails.  That sounds reasonable.

To do that manually, you *don't* set two_node/expected_votes in
cluster.conf, and then manually run cman_tool expected -e 1 after a node
fails.

Here's another possibility I hadn't thought of before:

. don't set two_node/expteced_votes in cluster.conf
. edit init.d/cman and possibly /etc/sysconfig/cman to do
  cman_tool join -w        (joins cluster and waits to be a member)
  cman_tool wait -q        (waits for quorum, both nodes to be members)
  cman_tool expected -e 1  (change expected votes to 1)

The effects of this will be:

. a node needs to see the other to get quorum and start up
. after both nodes see each other, if one fails, the other will fence
  it and continue
. after both nodes see each other, if they become partitioned, they
  will race to fence each other
. if both nodes are restarted while they are still partitioned, neither
  of them will be able to start

Dave